Retrofitting silo protection on a running plant in Korea

The silo is standing, it takes a delivery every few days, and someone has now asked for protection on it. The trigger is usually external: a group safety audit, an insurer, a corporate standard that changed, a near miss at a sister plant. What lands on your desk is a request to price protection into a Korean plant that has no intention of stopping.

That one condition reorders the job: the scope is set by what is already on the roof, how long the plant will hold still, and who is permitted to open what. Quote it from the original drawing alone and the crew arrives to find the nozzles occupied, the window two days shorter than agreed, and the work pushed to the next low season.

What the retrofit is actually protecting against

A bulk tanker discharges powder by pressurising its own barrel, at up to about 2 bar. The barrel is a certified pressure vessel; the silo it blows into is not. A silo shell is built for the weight of the material inside, and published guidance on over-pressurisation reports damage from as little as 1 psi — around 0.07 bar — which is why protection systems are expected to detect from about 40 mbar. The silo survives deliveries only because the vent filter on the roof passes displaced air out as fast as the tanker pushes it in.

So the failure to design against is not a tanker behaving badly. It is the filter losing its ability to pass air — blinded by material carried up during an overfill, or by a cleaning system that stopped working months earlier — while a delivery is running. The dangerous minutes are the last ones, when little ullage is left and the air has nowhere to go.

That is why a silo protection system is a chain rather than a device: a pressure sensor in the headspace, a high-level sensor, an inlet shut-off valve on the fill line, an alarm the driver can see and hear, and a pressure relief valve as the last line if everything ahead of it fails. Buying the relief valve alone and calling the silo protected is how this retrofit most often goes wrong.

What is already on the silo sets most of the scope

Almost every surprise here was visible in a drawing or maintenance record nobody asked for.

That last row was settled when the silo shipped. The choice between a bolted flat-pack and welded sections decides how a new connection can be made now, and on a bolted shell the answer is often an existing spare flange or nothing.

One item sits outside the mechanical scope. At a Korean ready-mix or precast plant the silo's vent filter is normally part of what the site declared as fugitive-dust control under the Clean Air Conservation Act, and a change to a declared facility is notified before the work, not after. If your scope replaces the filter, the site's environmental officer needs the specification weeks ahead of the lift.

The window belongs to the plant's calendar

Korean ready-mix and precast output falls in midwinter and through the summer rains, and rises hard in spring and autumn. Through the pour season the plant runs hard, but the capital-region ready-mix fleet has taken every Saturday off since March 2021, so the regular gaps are the weekend, the Lunar New Year and Chuseok shutdowns, and the company break in early August. Those gaps are the whole negotiation. A retrofit priced as one three-day mobilisation but executed over two or three separate weekends is a different job, with different costs and a different risk of the plant losing patience.

Whether the silo has to be empty is the second question. Roof-mounted work on a silo that is simply not being filled needs no emptying; anything inside the shell, and any hot work, does — and running a cement silo down to empty is not a switch. It means agreeing the schedule with the cement supplier days ahead and giving up the buffer that lets the plant batch on a busy morning.

Access is the third: a crane or aerial platform has to stand in a yard full of mixer trucks, on a lift plan agreed with the plant, and a windy morning cancels the lift.

Entry is confined-space work under Korean law, and the permit is not yours to sign

Entry into the silo is confined-space work under Korean law. Annex 18 of the Rules on Occupational Safety and Health Standards lists the places that count, and the silos named there are grain and feed stores and mushroom-growing silos — but the list closes with a general item, the interior of a place workers do not occupy and where entry is restricted, and a cement silo at a batching plant sits inside it. The hazards are the ones the rules are written around: air displaced by the stored material, and engulfment in powder that bridges and then collapses. So the atmosphere is measured before entry and again during the work, an attendant stays outside for its duration, and the site issues a permit under its own confined-space programme. Ask the plant for that programme in its current wording — the rules were tightened again in December 2025 and sites are still rewriting these documents.

For a foreign supplier the consequence is that the permit goes to a contractor already registered on that site. A visiting engineer from the equipment side supervises and commissions; the hands inside the vessel are local. It is the same interface that decides who receives and erects a silo on a Korean site.

The design conclusion matters more than the procedure. Most of a protection retrofit needs no entry if the mounting is planned for it: probes, pressure transmitter, filter and relief valve all land on the roof through their own flanges. Entry gets pulled in when the shell needs cleaning, when a backing plate goes on the inside, or when an old probe comes out of a silo with material built up on the wall. Decide which apply at quotation — entry turns a one-day job into a permit sequence with its own approvals.

If it can only be tested from the roof, it stops being tested

Published guidance on silo protection is direct on one point: the system should be functionally testable from ground level, so nobody has to work at height for a routine check. On a running plant that is not a convenience; it decides whether the system still works in year three. A check that needs a platform booking gets deferred through the pour season until it is forgotten.

So ask what a ground-level test proves. A good one drives the level and pressure sensors into alarm, closes the inlet valve, and where the relief valve supports remote exercise, moves it — with the result readable at the panel. A weaker one confirms the wiring is intact and says nothing about a filter that has stopped passing air. Both are sold as self-test.

Name the periodic check in the contract too: interval, record, and who holds it. The plant's maintenance team inherits this system, and a package with no named owner degrades into what you were brought in to replace.

The fill point decides whether the system is used

The person at the coupling usually does not work for the plant. Cement arrives on bulk cement trailers run by the supplier's haulage contractor, and the driver's world is the fill pipe, the gauge and whatever signal is in sight of it — not a lamp in a batching office that is empty on a night or weekend delivery. A beacon and sounder at the fill point, labelled in Korean, with a clear instruction for what to do when it activates, turns the interlock from a diagram into a stopped delivery.

Sequence matters as well. Closing the inlet valve automatically leaves a charged line between the tanker and the valve. If the design gives the driver no way to vent it, the coupling gets broken under pressure — the kind of event the retrofit exists to prevent. Work through what the driver sees and does at each step before fixing the valve location.

The safeguards that make the silo less safe

Three moves, all made with good intent, leave the silo less protected than before.

The first is setting the high-level trip conservatively low. Nobody wants an overfill, so the trip goes in early, and deliveries start stopping with the tanker part-full. The driver takes material away or waits, the plant loses cement it planned to batch with, and after the third time somebody finds the bypass — the silo then runs with the interlock defeated while everyone believes it is protected. The trip point belongs on the commissioning record with the ullage it leaves, agreed with the plant and reviewed after a month of deliveries rather than taken from a catalogue.

The second is raising the relief valve setting because it lifts too often. A valve that lifts is reporting something: the filter is not passing the tanker's air. Raising the setting deletes the report and leaves the shell working closer to its limit with nobody watching.

The third is fitting a larger relief valve instead of repairing the vent path. The valve is the last line, not the route the air is supposed to take. If the filter cannot handle a normal delivery, the silo is using its emergency device as a routine one, and the next blinded filter arrives at a vessel with nothing left in reserve.

The roof general arrangement, plus whatever the site holds on the existing filter and relief valve, is usually enough to separate what needs a shutdown from what does not — and that split is where the delivery plan begins. Send those two documents to us and you get the split back before anything is priced.