Batch chemical reactor accident

In the Mars Polar Lander loss, the software requirements did not include information about the potential for the landing leg sensors to generate noise or, alternatively, to ignore any inputs from the sensors while the spacecraft was more than forty meters above the planet surface. In the batch chemical reactor accident, the software engineers were never told to open the water valve before the catalyst valve and apparently thought the ordering was therefore irrelevant. 

In the batch chemical reactor accident described in chapter 2, one safety constraint is a hmitation on the temperature of the contents of the reactor. 

Consider another example of a component interaction accident that occurred in a batch chemical reactor in England [103]. The design of this system is shown in figure 2.1. The computer was responsible for controlling the flow of catalyst into the reactor and also the flow of water into the reflux condenser to cool off the reaction. Additionally, sensor inputs to the computer were supposed to warn of any problems in various parts of the plant. The programmers were told that if a fault occurred in the plant, they were to leave all controlled variables as they were and to sound an alarm. 

Accidents hke the Mars Polar Lander or the British batch chemical reactor losses, where the cause lies in dysfunctional interactions of non-failing, reliable components—i.e., the problem is in the overaU system design—illustrate reliable components in an unsafe system. There can also be safe systems with unreliable components if the system is designed and operated so that component failures do not create hazardous system states. Design techniques to prevent accidents are described in chapter 16 of Safeware. One obvious example is systems that are fail-safe, that is, they are designed to fail into a safe state. 

The new model of accidents introduced in part II of this book incorporates the basic systems theory idea of hierarchical levels, where constraints or lack of constraints at the higher levels control or allow lower-level behavior. Safety is treated as an emergent property at each of these levels. Safety depends on the enforcement of constraints on the behavior of the components in the system, including constraints on their potential interactions. Safety in the batch chemical reactor in the previous chapter, for example, depends on the enforcement of a constraint on the relationship between the state of the catalyst valve and the water valve. 

Most accidents in the chemical and related industries occur in batch processing. Therefore, in Chapter 5 much attention is paid to theoretical analysis and experimental techniques for assessing hazards when scaling up a process. Reaction calorimetry, which has become a routine technique to scale up chemical reactors safely, is discussed in much detail. This technique has been proven to be very successful also in the identification of kinetic models suitable for reactor optimization and scale-up. 

The fine chemicals business is characterized by a small volume of products manufactured. Therefore, batch production predominates and small-scale reactors are used. The need to implement fine chemistry processes into existing multiproduct plants often forces the choice of batch reactors. However, safety considerations may lead to the choice of continuous processing in spite of the small scale of operation. The inventory of hazardous materials must be kept low and this is achieved only in smaller continuous reactors. Thermal mnaways are less probable in continuous equipment as proven by statistics of accidents in the chemical industries. For short reaction times, continuous or semicontinuous operation is preferred. 

Process safety is an important issue for chemical industry in general and for exothermic reactions and reactions involving hazardous chemicals in particular. High hold-up of reactants in conventional batch reactors leads to very high impact in the case of accidents. A common approach to handle fast exothermic... 

---