PLANNING PROTECTION MEASURES AGAINST RUNAWAY REACTIONS USING CRITICALITY CLASSES

Transcription

1 PLANNING PROTECTION MEASURES AGAINST RUNAWAY REACTIONS USING CRITICALITY CLASSES Francis Stoessel Swiss Institute for the Promotion of Safety & Security, Schwarzwaldallee 215; WRO , CH-4002 Basel; A systematic approach to the assessment of thermal risks linked with the performance of exothermal reactions at industrial scale was proposed a long time ago 1. The approach consisted of a runaway scenario starting from a cooling failure and a classification of these scenarios into criticality classes 2. In the mean time these tools became quite popular and many chemical companies use them. Recently the international standard IEC prescribed the use of protection systems with a reliability depending on the risk level. Since the criticality classes were developed as a tool for the choice of risk reducing measures as a function of the criticality, it seems obvious that the criticality classes may be used in the context of the standard IEC 61511, which provides a relation between the risk level and the reliability of protection systems. The objective of the present work is to show how criticality classes can be used as a tool for the choice of adequate protection system against runaway reactions. For this purpose the risk assessment criteria were made more quantitative and more flexible by using a four level scale for severity and a six level scale for probability of occurrence, as used in many risk assessment methods. The thermal data of a chemical process are determined as an answer to six key questions allowing building a cooling failure scenario as a worst case approach. These results can be summarised in four characteristic temperature levels, i.e. the process temperature (T p ) the maximum temperature of the synthesis reaction (), the maximum allowed temperature for technical reasons () and the temperature at which the time to maximum rate is equal to 24 hrs (T D24 ). These temperature together with some technical aspects concerning the industrial equipment are a sufficient data base for the risk assessment, as well as for the choice and the reliability assessment of protection systems. Using the criticality class and taking the nature of the system into account i.e. open or closed and gassy or vapour as well as some technical characteristics of the equipment, the consequences of a potential runaway can be determined. Then using the estimation of the thermal activity at the relevant temperature level, the probability of loss of control can be assessed and the required IPL and SIL can be determined. Thus no additional data are required to accomplish the assessment with recommendations concerning adequate protection systems. In a first part the runaway scenario and the criticality classes will be shortly described. Then the assessment criteria for severity and probability of occurrence of a runaway scenario will be described together the required data and their interpretation in terms of risk. In a third part, the assessment procedure is exemplified for the different criticality classes. Finally the design of protection measures against runaway and the required IPL and SIL are based on the risk assessment obtained from the criticality classes. This approach allows minimising the required data set for the safety assessment and for the definition of the protection system designed in order to avoid the development of the runaway. KEYWORDS: runaway reaction, risk assessment, safety integrity level INTRODUCTION A systematic approach to the assessment of thermal risks linked with the performance of exothermal reactions at industrial scale was proposed a long time ago. The approach 1 R. Gygax, Chemical reaction engineering for safety. Chemical Engineering Science, (8): p F. Stoessel, What is your thermal risk? Chemical Engineering Progress, 1993(October): p Funktionale Sicherheit - Sicherheitstechnische Systeme für die Prozessindustrie IEC , Nr. IEC 61511, Rev. 2004, DIN VDE. consisted of a runaway scenario starting from a cooling failure [Gygax, 1988] and a classification of these scenarios into criticality classes [Stoessel, 1993]. In the mean time these tools became quite popular and many chemical companies use them [Stoessel, 1995]. Recently the international standard IEC [IEC, 2004] prescribes the use of protection systems with a reliability depending on the risk level. Since the criticality classes were developed as a tool for the choice of risk reducing measures as a function of the criticality, it seems obvious that the criticality classes may be used in the context of the standard IEC 61511, 1

2 which provides a relation between the risk level and the reliability of protection systems. The objective of the present paper is to show how the criticality classes can be used as a tool for the choice of adequate protection system against runaway reactions. For this purpose the risk assessment criteria were made more quantitative and more flexible by using a four level scale for severity and a six level scale for probability of occurrence, as used in many risk assessment methods. The data used to build the cooling failure scenario, together with some technical aspects concerning the industrial equipment are sufficient for the risk assessment, as well as for the choice and the reliability assessment of protection systems. Thus no additional data are required to accomplish the assessment with recommendations concerning adequate protection systems. In a first part the runaway scenario and the criticality classes will be shortly described. Then the assessment criteria for severity and probability of occurrence of a runaway scenario will be described together with the required data and their interpretation in terms of risks. In a third part, the assessment procedure is exemplified for the different criticality classes. Finally the design of protection measures against runaway is based on the risk assessment obtained form the criticality classes. RUNAWAY SCENARIO The cooling failure scenario was developed by R. Gygax [Gygax, 1988 and 1993] for the systematic assessment of thermal risks linked with exothermal chemical reactions. This scenario works as follows (Figure 1): If a cooling failure occurs while the reactor is at the process temperature (T P ), the temperature increases due to the completion of the reaction. This temperature increase depends on the amount of non-reacted material, thus on the process conditions. It reaches a level called the Maximum Temperature of the Synthesis Reaction (). At this temperature, a secondary decomposition reaction may be initiated. The heat produced by this reaction may lead to a further increase in temperature reaching the final temperature (T end ). The following questions represent six key questions that help to develop the runaway scenario and provide guidance for the determination of data required for the risk assessment: Question 1: Can the process temperature be controlled by the cooling system? Question 2: What temperature can be attained after runaway of the desired reaction? Question 3: What temperature can be attained after runaway of the secondary reaction? Question 4: At which moment does the cooling failure have the worst consequences? Question 5: How fast is the runaway of the desired reaction? Question 6: How fast is the runaway of the decomposition starting at? The six key questions presented above ensure that the essential knowledge about the thermal safety of a process is T end T p T Desired Reaction ΔT ad 1 2 Normal Process 4 5 Cooling Failure Secondary Reaction TMR ad addressed. In this sense, they represent a systematic way of analysing the thermal safety of a process and building the cooling failure scenario. Once the scenario is defined, the next step is the determination of the criticality class allowing the actual assessment of the thermal risks. DETERMINATION OF THE CRITICALITY CLASS The cooling failure scenario presented above, uses the temperature scale for the assessment of severity and the time scale for the probability assessment. Starting from the process temperature (T P ), in case of a failure, the temperature first increases to the maximum temperature of the synthesis reaction (). At this point, it must be checked if a further increase due to secondary reactions may occur. For that purpose, the concept of Time to Maximum Rate under adiabatic conditions (TMR ad ) is very useful. Since TMR ad is a function of temperature, it may also be represented on the temperature scale. If we assume that for a TMRad longer than 24 hrs, triggering the decomposition reaction becomes unlikely, the temperature at which TMRad is 24 hrs (T D24 ) becomes a relevant threshold level to be considered. This assumption is only valid for a reaction and not for storage or transportation. In addition to the three temperature levels (T P,, T D24 ), there is another important temperature: the temperature at which technical limits of the equipment are reached: the Maximum Temperature for Technical reasons (). This may be governed by the resistance of construction materials, or by the reactor design parameter as pressure or temperature etc. In an open reacting system, i.e. operated at atmospheric pressure, the boiling point is 6 3 ΔT ad Figure 1. Runaway Scenario. The left part of the scheme is devoted to the desired reaction and the temperature increase to the in case of a failure. In the right part, the temperature increase due to a secondary exothermal reaction is shown, with its characteristic time to maximum rate. The numbers represent the six key questions t 2

3 often used. In a closed system, operated under pressure, it may be the temperature, at which the pressure reaches the set pressure of the pressure relief system. Therefore, the is of particular importance, since it may represent the temperature level at which a runaway can be stopped by appropriate means. Thus by considering the temperature scale, and for reactions presenting a thermal potential, we can consider the relative position of four temperature levels:. The process temperature (T P ): The initial temperature in the cooling failure scenario. In case of non isothermal process, the initial temperature will be taken at the instant when the cooling failure has the most severe consequences (worst case). Maximum temperature of synthesis reaction (): This temperature depends essentially on the degree of accumulation of non-converted reactants and therefore it is strongly dependant on the process design. Temperature at which TMR ad is 24 hours (T D24 ): This temperature is defined by the thermal stability of the reaction mixture. It is the highest temperature, at which the thermal stability of the reaction mass is unproblematic.. Maximum temperature for technical reasons (). In an open system, it is the boiling point. For a closed system, it is the temperature, at which the pressure reaches the maximum permissible, i.e. the set pressure of a safety valve or bursting disk. These four temperature levels allow classifying the scenarios into five different classes (Figure 2) [Stoessel, 1993]. Depending on the relative order of the different temperature levels described in the previous subsection, different types of scenarios can be obtained. These differ by their respective criticality, which allows the classification in criticality classes. Therefore, the criticality class is a useful tool not only for the risk assessment, but also for the choice and the definition of adequate risk reducing measures. In Classes 1 and 2, the loss of control of the main reaction does not trigger secondary reactions and the technical limit is not reached. In Class 3 the technical limit is reached and may serve as a safety barrier, but the secondary reactions are not triggered. In Class 4 the secondary reactions could be triggered, but the technical limit may serve as a barrier. In Class 5 the secondary reactions are triggered and the technical limit is reached as the runaway is too fast for a safety barrier to be efficient. CONSEQUENCES OF A RUNAWAY REACTION A runaway reaction may have multiple consequences: The high temperature by itself may be critical. The higher the final temperature, the worse are the consequences of the runaway. In case of a large temperature increase, some components of the reaction mixture may be vaporised or some gaseous or volatile compounds may be produced. This may lead to further consequences: a pressure increase in the system and/or release of gases or vapour, which may cause secondary damages by their toxicity or flammability. TEMPERATURE The adiabatic temperature rise, which is proportional to the reaction energy, represents an easy to use criterion for the evaluation of the severity of an uncontrolled energy release as a runaway reaction. The adiabatic temperature rise can be calculated easily by dividing the energy of reaction by the specific heat capacity: DT ad ¼ Q0 c 0 P In Classes 1 to 3, the energy to be considered is the reaction energy only, whereas in Classes 4 and 5 the energy to be considered is the sum of the reaction and decomposition energies. The temperature increase may represent a threat by itself, but in most cases, it will result in a potential pressure increase. PRESSURE The pressure increase depends on the nature of the pressure source, i.e. gas or vapour pressure. Furthermore the characteristics of the system, i.e. if the reactor is closed or open to the atmosphere will determine the consequences: in an open system, the gas or the vapour will be released from the reactor, whereas in a closed system the result of a (1) T T D24 T p Criticality Class Figure 2. Criticality Classes of Scenario, obtained by combining the four temperature levels: T P,, T D24 and 3

4 runaway will be a pressure increase. The resulting pressure can be compared to the set pressure of the pressure relief system (P set ) or to the maximum allowed working pressure (P max ) or also to the test pressure (P test ) of the equipment. RELEASE In an open system, since the gas or the vapour will be released from the reactor, the consequences depend on the extension of the release and on the properties of the gas or vapour (e.g. toxicity or flammability). The extension can be assessed by using the volume of the toxic cloud by calculating its dilution to a critical limit. For toxicity, the limit may be taken as the IDLH or other limits defined by law (e.g. EPRG-2...). In case the gas or vapour is flammable, the lower explosion limit (LEL) is the critical limit. Since it is easier to have a good representation of a distance than of a volume, it is proposed to use the radius of a half sphere to describe the extension of the gas or vapour cloud. Such a simple approach has nothing to do with dispersion calculation using complex models and meteorological information, but is useful for the purpose of assessing the risks due to a runaway. Thus we have to consider four different cases:. Closed gassy system: gas release in a closed reactor,. Closed tempered system: vapour pressure in a closed system,. Open gassy system: gas release from an open system,. Open tempered system: vapour release from an open system. CLOSED GASSY SYSTEM The volume of gas potentially released by a reaction (including secondary reactions in criticality Classes 4 and 5) can be known from the chemistry or measured experimentally by appropriate calorimetric methods as e.g. Calvet calorimetry, mini-autoclave, Radex or Reaction Calorimetry (as V g at T mes ). It must be corrected for the temperature to be considered, (Class 2), (Class 3 or 4) or T f (Class 5). In case the gas stems from the main reaction, only the accumulated fraction (X) may be released: V g ¼ M r V 0 g X T ðkþ T mes K ð Þ (2) This volume can be converted in a pressure increase by taking the available free volume in the reactor (V r,g ) P ¼ V g (3) P 0 V r,g CLOSED VAPOUR SYSTEM In this case the pressure increase is due to the vapour pressure of volatile compounds. Since often the volatile compound can be considered to be the solvent, its vapour pressure can be obtained form a Clausius-Clapeyron equation or by an Antoine equation. For complex systems it may be obtained from a a phase diagram P ¼ f(t,x). OPEN GASSY SYSTEM In an open system with gas production, the volume of gas can be obtained from equation (2), and the volume calculated either for a toxicity limit as the IDLH or from the lower explosion limit LEL: V hazard ¼ V g Limit ) r ¼ rffiffiffiffiffiffiffiffiffiffiffiffiffi 3 3 V tox 2 In this equation, the extension is calculated as the radius of a half sphere. The assessment is performed by comparing the extension to characteristic dimensions, e.g. of the equipment, plant and site. OPEN TEMPERED SYSTEM An open tempered system is a system in which the latent heat of evaporation can be used to halt the temperature increase, i.e. to temper the system. This can be achieved at atmospheric pressure by reaching the boiling point or at a higher pressure by applying a controlled pressure relief. The first step is to calculate the mass of vapour that may be relieved form the latent heat of evaporation and the characteristic temperatures: ð M v ¼ T max Þc 0 p M r DHv 0 The maximum temperature can be the for Class 3 or T end for Classes 4 and 5. This mass is converted into a volume by using the vapour density that may be estimated as an ideal gas and the extension is calculated in a similar way as for open gassy systems bay using either a toxicity limit or the lower explosion limit: V hazard ¼ M v r v Limit ) r ¼ rffiffiffiffiffiffiffiffiffiffiffiffiffi 3 3 V tox 2 The assessment can be performed using the criteria summarised in Table 1. In cases where more than one criterion applies, the highest rating is taken (worst case) to assess the severity. Table 1. Assessment criteria for the severity using the energy (DT ad ), the pressure for closed systems and the extension for open systems Severity DT ad P (4) (5) (6) Extension (r) Catastrophic.400 K.P test.site Critical K P max P test Site Low K P set P max Plant Negligeable,50 K,P set Equipment 4

5 PROBABILITY OF LOSS OF CONTROL DURING RUNAWAY For the probability assessment no quantitative failure rates will be used, a semi-quantitative approach based on the probability of loss of control will be used instead. The principle is that the thermal activity at a given temperature as for example, will be estimated with the aim of predicting the behaviour of the reacting mixture at this temperature level. A low activity means that the temperature course is easy to control, whereas a high activity rends it difficult. It is assumed that the same reaction that releases heat also causes the gas release and obviously the evaporation of volatiles. The heat release can directly be compared to the cooling capacity of an emergency cooling system. The control of gas or vapour release is assessed using the maximum gas or vapour velocity in the equipment. ACTIVITY OF THE MAIN REACTION Starting from process temperature (T p ), the reaction is accelerated by the temperature increasing to and slowed down by the reactant depletion. This may be expressed as a function of the temperature levels assuming a first order kinetics: q ð Þ ¼ q rx exp E 1 1 R T p fflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl} increases reaction rate T p fflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflffl} decreases reaction rate The heat release rate of the reaction at process temperature is known from an experiment in a reaction calorimeter. If it is unknown, as worst case assumption, the cooling capacity of the reactor can be used instead, since for an isothermal process the neat heat release rate of the reaction is certainly inferior to the cooling capacity. ACTIVITY OF SECONDARY REACTION For cases where the secondary reaction plays a role (Class 5), or if the gas release rate must be checked (Classes 2 or 4), the heat release rate can be calculated from the thermal stability tests. Secondary reactions are often characterised using the concept of Time to Maximum Rate under adiabatic conditions (TMR ad ) [Townsend, 1980]: TMR ad ¼ c0 p R T2 (8) q (T) E A long time to maximum rate means that the time available to take risk reducing measures is sufficient. At the opposite a short time means that the runaway may not be halted at the given temperature. The heat release rate at the temperature at which TMRad is equal to 24 hours (T D24 ) may be calculated from following equation: (7) q 0 ðt D24 Þ ¼ c0 p R T2 D24 (9) E dc This heat release rate may serve as a reference for the extrapolation: q 0 ðtþ ¼ q0 ðt D24 Þ exp E dc R 1 1 T D24 T (10) This allows extrapolating the heat release rate for calculating the time to maximum rate at different temperatures by using equation (8). THERMAL ACTIVITY The dynamics of the secondary reaction plays an important role in the determination of the probability of an incident. The probability can be evaluated using the time scale: If, after the cooling failure, there is enough time left to take measures before the runaway becomes too fast, the probability of the runaway will remain low. For chemical reactions on an industrial scale (not for storage or transportation), we can consider the probability to be low if the time to maximum rate of a runaway reaction under adiabatic conditions is longer than one day. The probability becomes high if the time to maximum rate becomes less than eight hours (one shift). These time scales are only orders of magnitude and are dependent on many factors, among them the degree of automation, the training of the operators, the frequency of electrical power failures, size of the reactor, etc. This scaling of probabilities is only valid if something is done to cope with the known severity (planned emergency measures). GAS RELEASE RATE If we consider that thermal effects are the driving force of a runaway, we may assume that the gas release is due to the same reaction. Thus the gas release rate can be calculated from: _v g ¼ V 0 g M r q0 () Q 0 (11) Here the heat release rate and the energy represents the sum of all active reactions. It may be only the main reaction (Class 3 and 4) or both main and secondary reactions (Class 5). This allows calculating the gas velocity in the equipment using the narrowest tube section. The capacity of a scrubber may also be used as an assessment criterion. VAPOUR RELEASE RATE The vapour mass flow rate is proportional to the heat release rate and can be calculated from: _m v ¼ q0 () M r DH v (12) It can be converted to a volume flow rate by using the vapour density and to a velocity, by using the section of the vapour tube. The assessment of the equipment vapour flow capacity should also take the cooling capacity of the 5

6 Table 2. Assessment criteria for the probability of loss of control during a runaway reaction Criteria TMRad (h) From q (W/kg) Stirred q (W/kg) Unstirred u m/s Frequent, Probable Occasional Low Remote Not credible.100,1,0.1,1 condenser into account. Further the swelling of the reaction mass due to the presence of bubbles may also become critical for high degrees of filling of the reactor [Wiss, 1993]. If both vapour and gas are released, obviously the sum of both velocities must be used for the assessment. A proposal for the assessment criteria based on time, on heat release rate and on gas or vapour velocities is summarised in Table 2. PROTECTION SYSTEM DESIGN BASED ON RISK ASSESSMENT Obviously not all the parameters described above must be evaluated for each scenario. In this context, the criticality classes are a useful tool in the sense that they help in selecting the required data for the assessment of severity and probability (Table 3). The criticality classes also give a back bone for a systematic design procedure. Once the severity and the probability corresponding to a scenario were estimated, they can be used for the risk assessment and following for the determination of the required reliability of the protection system. RISK ASSESSMENT The four severity levels and the six probability levels described above can be arranged in a risk diagram, sometimes also called risk matrix. The matrix presented here (Figure 3) is derived from an example given in the IEC Table 3. Required data set for the different criticality classes Data Class (1) (2) Gas main reaction V g,rx þ þ þ þ þ (2) Gas sec. reaction V g,dc (þ) (þ) þ þ Vapour (P v ) (2) þ þ þ Power main reaction q rx þ þ (þ) Power sec. reaction q dc (þ) þ (1) The determination of the class requires the knowledge of four temperature levels: T p, (i.e. X ac ), and T D24. (2) Beside the volume or vapour pressure the toxicity limit or the Lower Explosion Limit (LEL) must be known. The calculation of the velocities also requires information about the diameter of the piping system standard [3]. It was adapted to the assessment of runaway reactions with the criteria as defined above. In such a risk matrix, the different fields corresponding to accepted (white), non accepted risks (dark grey or black) can be identified. The black field corresponds to risks that cannot be reduced by a safety instrumented system (SIS) alone. The intermediate field (light grey) is used corresponding to risk that should be reduced as far as the costs are in relation with the risk reduction, following the ALARP principle (as low as reasonably possible). Quantitative failure frequency data are difficult to obtain for multipurpose batch plants as they are often used in the fine chemicals and pharmaceutical industries. Moreover, a quantitative assessment requires a detailed knowledge of the control instruments, which may not be available during process development. Therefore a semi-quantitative approach is proposed, that provides the required reliability for future plant equipment. DETERMINATION OF THE REQUIRED RELIABILITY FOR SAFETY INSTRUMENTED SYSTEMS The probability considered here, is the probability that a runaway may not be stopped at the level, and as explained above, this probability increases with the thermal activity at this temperature. The criticality classes were used to describe the behaviour of the reaction mass at this temperature and to determine the appropriate type of measure that should be implemented. Such a measure like for example quenching a reaction mass will be triggered by an alarm (e.g. temperature) that opens a valve allowing the quenching medium to be flushed into the reactor. Such a device comprising a sensor, a logical unit (alarm) and an actuator (the valve) is called a safety instrumented system (SIS). Such a system provides one independent protection layer (IPL). For a high risk, more than one IPL may be Frequent Probable Occasional Low Remote Not credible 1:2 Negligible 1:3 + 2: :1 1:2 2:1 Low 2:2 + 1:3 3:1 + 1:2 1:3 + 2: :1 1:2 2:1 Critical 2:3 3:2 2:2 + 1:3 3:1 + 1:2 1:3 + 2: :1 1:2 2:1 Catastrophic Figure 3. Risk matrix adapted from IEC standard indicating the accepted, non accepted risks as well as an intermediate field. The numbers represent the number of required Independent Protection Levels together with the required safety Integrity level (IPL:SIL) 6

7 required. Moreover the reliability of the SIS is defined by the standard IEC as the safety integrity level (SIL). The design of a protection system against runaway comprises the definition of the nature of the system as well as its reliability. Let us consider that the probability decreases by one order of magnitude, from each level to the level below, e.g. probable means a ten times higher probability than occasional and so forth. Then a risk that should be reduced from frequent to remote corresponds to a reduction by a factor and requires for example two IPLs with an SIL 2, coded 2:2 or 1 SIL 3 and 1 SIL 1 coded 1:3 þ in Figure 3. When more than one IPL is required one of them may be a non instrumented system requiring human intervention as procedural measures do. The assessment scales given in the matrix as well as the required IPL and SIL are given as an example in order to show how thermal data may lead to a systematic definition of the protection systems and the corresponding SIL levels to be used. They should be defined according to a company s own safety policy. For a high risk, emergency measures as pressure relief or containment must be taken to mitigate the consequences of a runaway that cannot be anymore avoided. Nevertheless, by far a better measure is to redesign the process in order to reduce the accumulation to an acceptable level, i.e. to a level below T D24. This may be achieved e.g. by using a semi-batch reactor instead of a batch reactor and ensuring that the feed rate is properly limited and interlocked with the temperature and the. A lower concentration could achieve the same result, but on cost of the process economy. Of course other process changes should be considered, as continuous reactors, other synthesis route avoiding instable reaction masses (increase T D24 ) etc. CONCLUSION In this work a systematic procedure was shown allowing defining the thermal data required for an assessment. The six key questions shown in the cooling failure scenario serve as a guide in this task. Once the data are determined, the next step is positioning the four characteristic temperature levels (T p,, and T D24 ) in order to determine the criticality class. Using the criticality class and taking the nature of the system into account i.e. open/ closed and gassy or vapour as well as some technical characteristics, the consequences of a potential runaway can be determined. Then using the estimation of the thermal activity at the relevant temperature level, the probability of loss of control can be assessed and the required IPL and SIL can be determined. This approach allows minimising the required data set for the safety assessment and for the definition of the protection system designed in order to avoid the development of the runaway. ACKNOWLEDGMENT The author wants to acknowledge his colleagues Hans Fierz, Pablo Lerena and Georg Suter from the Swiss Institute for the Promotion of Safety & Security for fruitful discussions and suggestions during the elaboration of the tool presented here. NOTATIONS Symbol Name Unit c P Specific Heat capacity kj.kg 21.K 21 E Activation energy J.mol 21 DH v Spec. latent heat of evaporatiom J.kg 21 _m Mass flow rate kg.s 21 M r Reaction mass kg P Pressure bar q Specific heat release rate W.kg 21 Q Specific energy kj.kg 21 r Radius m R Universal gas constant J.mol 21. K 21 T Temperature 8C ork T mes Temperature of gas measurement 8C ork DT ad Adiabatic temperature rise 8C u Linear velocity m.s 21 _v Volume flow rate m 3.s 21 V Volume m 3 V r,g Available volume for gas m 3 V g Specific gas volume m 3.kg 21 X Conversion SUBSCRIPTS Subscript Meaning 0 Initial value ac accumulation dc decomposition end end g gas max maximum p process r reaction mass rx reaction test test tox toxic v vapour REFERENCES Gygax, R., 1988, Chemical reaction engineering for safety. Chem Eng Sci, 43(8): p IEC, 2004 Funktionale Sicherheit Sicherheitstechnische Systeme für die Prozessindustrie, Nr. IEC 61511, DIN VDE 7

8 Gygax, R., 1993, Thermal Process Safety, Data Assessment, criteria, measures, ed. ESCIS. Vol. 8, Lucerne: ESCIS. Stoessel, F., 1993, What is your thermal risk? Chem Eng Prog, 10: Stoessel, F., Steinbach, J. et al., 1995, Plant and process safety, exothermic and pressure inducing chemical reactions, Ullmann s encyclopedia of industrial chemistry, E. Weise. Weinheim, VCH, B8: Townsend, D.I. and Tou, J.C., 1980, Thermal Hazard evaluation by an accelerating rate calorimeter. Thermochimica Acta, 37: Wiss, J., Stoessel, F. and Killé, G., 1993, A systematic procedure for the assessment of thermal safety and for the design of chemical processes at the boiling point, Chimia, 47(11): p