I.CHEM.E. SYMPOSIUM SERIES NO. 110

Transcription

1 INTRINSIC CONTINUOUS PROCESS SAFEGUARDING Hans G. Gerritsen and Cornells M. van 't Land Two fundamentally different techniques exist for the introduction of process safety into the chemical industry: - designing a stable chemical/physical basis maintaining reaction conditions by means of personnel and instruments. Experience acquired in the manufacture of organic peroxides has shown that the former technique, aimed at prevention, is preferable. The concept of intrinsic continuous process safeguarding implies the construction of a stable reaction system and reaction conditions and thus minimizes the probability of dangerous occurrences resulting from human error or equipment failure. A failsafe concept for great risks is discussed. INTRODUCTION Inherent in the large-scale manufacture of certain chemicals is the risk of explosion, evolution of toxic gases and other undesirable effects. This paper discusses the prevention or, alternatively, the control of undesired reactions in processes. The storage, transport and handling of chemicals is not covered explicitly. However, the methods discussed also have relevance for those fields. Experience gained from the manufacture of organic peroxides has provided this paper's foundation. These compounds play an essential role in the production and processing of polymers. Organic peroxides are "energy-rich" compounds and are often thermally unstable. There are reports of organic peroxides violently decomposing during manufacture, storage or transport, and this has resulted in personal and material damage. A thorough analysis of these events has led to a coherent theory to obtain maximum process safety. This theory can be applied to the manufacture of other chemicals as well. PROCESS SAFETY High chemical and physical stability characterize intrinsically safe processes. Both the raw materials and the products are stable and the reaction rates are hardly affected by temperature variations. The heat effects involved are quite modest. Not all chemicals can for chemical or economic reasons be produced by means of such a process. The only alternative is using an Akzo Chemie Nederland bv, Research Centre Deventer, Deventer, The Netherlands 107

2 intrinsically safeguarded (protected) process. Intrinsic Process Safeguarding This is a safeguarding originating from the core of the process and is consequently directly and completely based on the reaction system and the reaction conditions; the safeguarding is based on chemical and physical properties. The safeguarding is rooted in the chemical and physical systems that are present or active during normal safe reactions and is hence under permanent control. The protection is continuously present or active; an activation is not required. The definition of intrinsic safeguarding is extended to include continuously functioning measuring and control equipment, cooling, stirring, pumping, and other systems. Process research and process safety research should yield reaction conditions which are sufficiently far from the critical area. The alternative is a set of conditions which, when entering this area, control the progress of the decomposition. The criterion here is the continuous (or intermittently continuous) presence as opposed to a stand-by status. The reaction system is within very wide limits not endangered by human errors or failures of instrumentation. It is postulated that this type of safeguarding is the only one remaining effective in the long term. A careful study of the records regarding incidents that occurred during the production of organic peroxides led to the conclusion that human behaviour (of operators as well as of maintenance personnel) is unpredictable in the very long term. Experiences obtained in the nuclear industry and elsewhere has shown that neither operator education, selection and training (including the use of simulators) nor task analysis, Visual Display Units and ergonomy can prevent human errors. The methodology of intrinsic process protection implies a quest for the critical aspects. Then, the process is safeguarded with regard to these critical aspects. This can be carried out by one of two methods: the reaction proceeds far away from the critical area, or the decomposition proceeds in a controlled way on entering the critical area. It must be possible to scale-up the results of the process research and process safety research. Sometimes the stability of an intrinsically safe process can be easily achieved,e.g.,the use of strongly diluted systems when any temperature rise due to undesired reaction's heat development is limited by the system's heat capacity. Extrinsic Process Safeguarding Extrinsic process safeguarding is protection which is indirectly related to the reaction system. The operation of this protection is discontinuous: the safeguarding does not function during the normal reaction but starts working upon a signal. Instruments and personnel are expected to intervene in order to maintain safe process conditions. Extrinsic process protection comes down to symptom fighting. The drawbacks compared with intrinsic process safeguarding are: More than one stage is required to achieve safety, either human or instrumental; e.g., the "sounding" of a signal and the subsequent 108

3 reaction. The efficiency of the activation depends on maintaining and checking the equipment Extrinsic process protection often requires the provision of complicated process instrumentation and control. Process instrumentation at many points may be required, and in order to improve the reliability, redundancy is often practised. For intrinsic process protection the changing of only one process parameter may often suffice. With extrinsic process safeguarding it is not possible to eliminate or reduce the potential hazard of the reaction as is the case with intrinsic safeguarding. Fundamentally, the protection is not instantaneous and this fact may cause a reaction to rapidly go out of control. It is our conviction that extrinsic safeguarding is adequate only as complementary protection in places where the entrance of the critical area is improbable or when used as a secondary protection behind the intrinsic protection line. Fig. 1 depicts the lines of defense for a hazardous process. Additional Remarks The consistent search for an intrinsically safeguarded process requires the close cooperation of process research, process safety research and process development. Furthermore, the approach must overcome hindrances: Engineers have too much confidence in extrinsic safeguarding and there is hence too little pressure on chemists to design processes with built-in safety. It is sometimes held against the method that an economically unjustifiable concept would result, however, experience in the field of the organic peroxides does not support this conclusion. It is sometimes felt that a chemically unattainable ideal is being sought; however, even violent decompositions as occur during undesired reactions of peroxides can be controlled simply. Design of an Intrinsically Safeguarded Process Process research, process development and safety research should cooperate closely from the start of R&D synthetic work. The first phase is a screening of possible synthetic routes. Both the control of the isothermal and the adiabatic heat development are studied. The second phase is to investigate the selected process thoroughly. Experiments are carried out in the critical area. The final stage involves the assessment of the reaction system and the reaction conditions. Extrinsic safeguarding completes the stable chemical/physical basis. Summing-up: the recommended methodology comprises a systematic search for critical items in process safety. The identifications are followed by, so to speak, a thorough lock on the door. The probability of a reaction going out of control has thus become almost negligible. Sometimes attempts are made to calculate the probability of a reaction going out of control, e.g., the nuclear industry is active in this area. It is our conviction that, because of the unpredictability of human behaviour, such assignments are meaningless. In Great Britain, Her Majesty's Nuclear 109

4 Installations Inspectorate (Nil) considers that comprehensive quantification of human reliability is not feasible at present (1). Failures of instrumentation often fall within the category of human errors as well: improper design inadequate manufacture unsatisfactory maintenance and checking. The remarks regarding the behaviour of human beings and the performance of instrumentation point to the necessity to look for processes that are for almost all practical purposes resistant to human errors and failures of instrumentation. Fig. 2 depicts the way the Dutch lowlands are protected from the rivers: a system of three dykes, called the watcher, the sleeper and the dreamer. The analogy will become clearer later. LABORATORY INVESTIGATIONS Gerritsen and Van 't Land (2) describe an experimental set-up to measure the isothermal heat development on deliberately entering the critical area of a hazardous reaction. The equipment discussed essentially is a flow calorimeter. The special feature is that the reactor is located in a concrete cell and the measuring device in front of a barrier wall. The measuring cell is replaceable and serious damage cannot occur to the system on investigating the critical area. Thus, the use of the equipment is not inhibited. However, the flow calorimeter is only one of the research tools. A further example is a Dewar vessel to check the behaviour of reaction mixtures under adiabatic conditions, other simulators are small-scale reactor-ovens. These pieces of equipment are mainly used to investigate a reaction system's behaviour in the critical area. Also the explosive range can be researched. EXAMPLES The paper quoted earlier (2) gives three examples concerning the prevention of decomposition at the preparation of organic peroxides. A further set of three examples describes the applicability of the line of thought in other fields. Only one of the examples in the field of the organic peroxides will be rediscussed in this Section. Furthermore, the issue of dealing with great risks will be dealt with. Organic Peroxides The example chosen concerns the reaction between a liquid organic compound and an oxygen donor. The reaction also produces water and this water is bound by a large quantity of concentrated sulfuric acid. For chemical reasons a process is selected in which the sulfuric acid and a reaction component are charged and the other reactant is subsequently dosed. However, if the acid is too concentrated or the temperature too high the peroxide decomposes vigorously. The critical stage of this process is at the start of the reaction because during the course of the reaction the acid is diluted. Flow calorimeter investigations proved that, with the usual stoichiometry, decomposition started at 40 C. A temperature of 25 C was prescribed. However, 110

5 if, at this temperature, double the amount of sulfuric acid was used, a spontaneous explosion occurred immediately at the start of the reaction without any warning. Extrinsic process protection would not get the time required to take action. The reaction appeared to be resistant to double the amount of less concentrated acid. Both the yield and the cycle time were not affected by the use of less concentrated acid. So, there is now, on taking acid of a reduced concentration, a double lock on the door: both the temperature and the acid addition must be substantially wrong in order to be able to enter the critical area. Additional remark regarding great risks The methodology of intrinsic continuous process safeguarding is, in our opinion, also suitable for chemical or physical processes that present potential hazards to large numbers of people. Due to company restrictions on divulging confidental chemical information we have chosen a physical process to illustrate this point. The Three Mile Island incident (a well-documented event, (3)) is chosen to illustrate that intrinsic protection systems are being mentioned as alternatives to the extrinsic safeguarding of the secondary circuit present in Actual choices and evaluations are not made as this is possible only for a team of experts. Intrinsic process protection appears to be flexible, more than one solution is possible. See Fig. 3. Four big pumps. The two big feed pumps could be replaced by two sets of two big feed pumps. Each set of two pumps can cope with the full load. See Fig. 4. All four pumps are running continuously under normal circumstances. 50% of the pumps' output is recycled by flow control. The power supply is independent for each set of two pumps. If two big pumps fail the remaining two fully take over: the flow control valve is throttled. The protection is continuously present. This alternative implies an extra energy consumption (approximately 6% of the station's output) and is hence less attractive than the next option. Further thinking leads to an improved solution utilizing the same principle. Four small pumps. The two big feed pumps could be replaced by four smaller pumps in parallel. See Fig. 5. Each pump has 25% of the nominal capacity and all pumps are powered independently. There is no recycle of water here. The safeguarding is again continuously present because the failure of one pump can be accomodated by the three remaining pumps. This system is being applied in practice. Periodic activation of spare feed pumps. The spare feed pumps are started daily by means of a computer programme and the pumps' activation is being checked. Subsequently, the pumps are shut down by the computer programme. This type of safeguarding is not permanently but intermittently present. Miscellaneous solutions. The experts will be able to find different solutions and to compare them economically. It is customary to choose a combination of solutions resulting in more than one main protection. The checking of the main process safety systems can now be attempted. 111

6 Relevant questions here are: are the four big pumps running or are the four smaller pumps active or is it possible to start-up the spare pumps. A return to the issue of the chemical plants is made via this argumentation; there, too, main process safety systems can be noticed. Our thesis: a plant that can, physically or chemically, threaten many people cannot do without main process safety protection for any length of time. A plant that is intrinsically very unsafe must have a counterweight incorporated into the process to overcompensate the potential hazard to achieve safety. It is proposed to provide these plants with a process computer programme that checks the main safety provisions. If the status of one provision is found to be not ready-for-use the plant is automatically after some time shut down (fail-safe concept). This can be illustrated for a nuclear power plant: A computer programme initiates the lowering of the moderation bars into the core daily. However, the rate of progress is such that the power output does not decrease for the first four hours. Right at the start of the lowering of the bars the computer starts checking the main safety systems. If the reports are positive the bars come to a standstill and subsequently move up again. If all the checks are not positive the operator has four hours to improve the situation. If he is not successful it is not possible for him to prevent automatic shutdown. The computer does not interfere with the plant's availability, if it is possible to run a plant safely for a long time it is also possible to run the above-mentioned computer-aided production for any length of time. Operators are highly motivated to keep a plant running and the plant now runs in a safe mode only. The main goal of continuous intrinsic process safeguarding is apparent now: owing to its design a potentially very hazardous plant is its own watchkeeper. REFERENCES 1. Whitfield, D., 1987, "Human Reliability from a Nuclear Regulatory Viewpoint" in "Contemporary Ergonomics", Editor E.D. Megaw, Taylor & Francis, London, Great Britain. 2. Gerritsen, H.G., and van 't Land, CM., 1985, I&EC Proc. Pes. & Devt VDI-Gesellschaft Energietechnik, 1979, "Der Storfall Harrisburg", VDI- Verlag, Dusseldorf, Federal German Republic. 112

7 Fig. 2 Protection of the Dutch lowlands 113

8 Fig. 3 TMI power station Fig. 4 Four big pumps in the secondary circuit provide 200% of the required output together 114

9 Fig. 5 Four smaller pumps in the secondary circuit 115