Accidents control systems

To enable an accident control system to be developed, it is necessary that all accidents are reported, record, investigated and analysed, so that after remedial action has been decided, plans can be drawn up to prevent a recurrence. The most important question to be asked in any accident investigation is What action has b n taken to prevent a recurrence ... 

Listed below are some process safety practices which can help reduce accidents due to instrumentation and control systems. 

Microprocessor-based control systems are being increasingly used in place of traditional instrumentation. Some accidents that have occurred on these systems are described in Chapter 20. 

A National Transportation Safety Board Railroad Accident Report (1973) describes the accident which occurred in a shunting yard in East St. Louis, Illinois. Arriving cars are classified in the yard, then delivered to outbound carriers. On arrival, cars are inspected. They are then pushed up a mound, uncoupled, and allowed to roll down a descending grade onto one of the classification tracks. This process is called humping. Cars are directed and controlled by a computerized switching and speed-control system. 

Control systems can fail in many ways, and highly energetic reactions like the styrene polymerization in Examples 5.7 and 14.8 raise major safety concerns. The contents of the vessel are similar to napalm. Discuss ways of preventing accidents or of mitigating the effects of accidents. Is there one best method for avoiding a disastrous runaway ... 

Sulphuric acid at 93% was added to p-nitrotoluene. The temperature reached 160°C due to a failure of the thermal control system. The sulphonic acid formed decomposed violently at this temperature. The post-accident investigation showed that the decomposition started between 160 and 190 C. In fourteen minutes the temperature rose to 190-224°C and in one minute and thirty seconds to 224-270°C. A large volume of gas was then released during the eruption. The phenomena caused by the decomposition of nitrated derivatives in the presence of sulphuric acid will be addressed several times. What these incidents have in common is the formation of large carbonised volumes. This phenomenon is common with sulphonic acids. The nitro group role is to destabilise intermediate compounds and final compounds and to generate... 

An inherently safe plant1112 relies on chemistry and physics to prevent accidents rather than on control systems, interlocks, redundancy, and special operating procedures to prevent accidents. Inherently safer plants are tolerant of errors and are often the most cost effective. A process that does not require complex safety interlocks and elaborate procedures is simpler, easier to operate, and more reliable. Smaller equipment, operated at less severe temperatures and pressures, has lower capital and operating costs. 

In general, the safety of a process relies on multiple layers of protection. The first layer of protection is the process design features. Subsequent layers include control systems, interlocks, safety shutdown systems, protective systems, alarms, and emergency response plans. Inherent safety is a part of all layers of protection however, it is especially directed toward process design features. The best approach to prevent accidents is to add process design features to prevent hazardous situations. An inherently safer plant is more tolerant of operator errors and abnormal conditions. 

In this approach accident cases and design recommendations can be analysed level by level. In the database the knowledge of known processes is divided into categories of process, subprocess, system, subsystem, equipment and detail (Fig. 6). Process is an independent processing unit (e.g. hydrogenation unit). Subprocess is an independent part of a process such as reactor or separation section. System is an independent part of a subprocess such as a distillation column with its all auxiliary systems. Subsystem is a functional part of a system such as a reactor heat recovery system or a column overhead system including their control systems. Equipment is an unit operation or an unit process such as a heat exchanger, a reactor or a distillation column. Detail is an item in a pipe or a piece of equipment (e.g. a tray in a column, a control valve in a pipe). 

On July 24,1994, an explosion followed by a number of fires occurred at 13 23 at the Texaco refinery in Milford Haven, Wales, England. Prior to this explosion, around 9 a.m., a severe coastal electrical storm caused plant disturbances that affected the vacuum distillation, alkylation, butamer, and FCC units. The explosion occurred due to a combination of failures in management, equipment, and control systems. Given its calculated TNT equivalent of at least 4 tons, significant portions of the refinery were damaged. That no fatalities occurred is attributed partially to the accident occurring on a Sunday, as well as the fortuitous location of those who were near the explosion. 

Tweeddale (Tweeddale, 1995) identified two general sorts of deviations, i.e. hard and soft deviations. He identifies hard deviations as malfunctioning equipment, and soft deviations as faults in the system or procedures. In this thesis these definitions are slightly modified to cover all deviations identified in the operational process preceding and directly related with an accident. Hard deviations are defined as the actual loss of containment or demonstrable loss of control, e.g. small leakages, overpressure, override of control systems, etc. Soft deviations refer to indications of possible deviations, but cannot be demonstrated by actual facts, e.g. operator complaints, deficiencies of maintenance activities, or bad housekeeping activities, etc. 

A mismatch between operator procedures and the automatic control system of the reactor (see also Table 17) was the first active failure identified in this scenario. This precursor was still present mainly due to a shortage of people. Literally it was said that the pressure relief valve would open if the wrong value was inserted into the reactor s control system. The second precursor was the failure of the pressure relief valve (see also Table 17), which was not known to the responsible person who decided to ignore the difference between procedures and control system. The pressure relief valve failed, because resins stuck in the valve after it was used for the first time. Consequently the second time the valve was opened it was at a much higher pressure due to the build up of resins in the valve. If this second precursor had not been observed in time by damp on the pipes situated above the pressure relief valve or by the alarms in the control room a possible accident scenario existed. This was especially dangerous as the alarms in the control room are often ignored because of the high incidence of false alarms (see also Table 17), which was the third precursor present. 

Process safety interlocks can be used to prevent ttnd/or mitigate tin upset condition. Salety interlocks consist of outputs from process control systems, such as programmable logic controllers or distributed control systems, which trigger tut action designed to compensate I ot an upset condition and thus avoid an accident even in the e em of human or computer error. An example of a salety interlock would be the introduction of full cooling if the temperature of a reaction exceeded a safe level. 

Following major industrial accidents such as those in Bhopal, Seveso and Mexico City, the ILO has unrfertaken a series of activities for the prevention of such disasters. In addition to the develr Mnent of major hazard control systems in a number of developing countries, the Office published a manual on major hazard control [31] and a Code of Practice on the prevention of major industrial accidents [32]. A new Convention... 

Increased radioactive fallout was first observed by the control system of a nuclear power plant on the east coast of Sweden after the Chernobyl accident. Nonetheless, no increase has later been observed in thyroid cancer incidence among children in that special region, emphasizing the importance of iodine sufficiency. 

In a fourth case (18), ammonia recovery storage tanks were damaged by overpressure due to gas entering their liquid rundown line (Fig. 12.11). The gas backflowed through the upper leg of an absorber pumparound circuit following pump failure at startup. The rundown line branched off the pumparound circuit at an elevated position the accident could possibly have been prevented had this line branched near grade (Fig. 12.11). The absorber piping and control system were modified to prevent recurrence (18). 

The agent is destroyed at 2,700°F. Metal parts are also incinerated. Exhaust gases are passed through extensive pollution-control systems. Munitions are destroyed in small quantities in thick-walled rooms that are designed to withstand detonation. The likelihood of an accident that results in exposure of surrounding off-post areas is extremely remote in day-to-day operations. 

The model condition plays an important role in accidents and safety. In order to create effective control actions, the controller must know the current state of the controlled process and be able to estimate the effect of various control actions on that state. As discussed further in section 4.3, many accidents have been caused by the controller incorrectly assuming the controlled system was in a particular state and imposing a control action (or not providing one) that led to a loss the Mars Polar Lander descent engine controller, for example, assumed that the spacecraft... 

To understand the dynamic aspects of accidents, the process leading to the loss can be viewed as an adaptive feedback function where the safety control system performance degrades over time as the system attempts to meet a complex set of goals and values. Adaptation is critical in understanding accidents, and the adaptive feedback mechanism inherent in the model allows a STAMP analysis to incorporate adaptation as a fundamental system property. 

---