Failure scenario

Here we see that by losing control of the main reaction (or synthesis reaction), we may trigger a secondary reaction. This distinction between main and secondary reactions simplifies the assessment, since both reactions are virtually separated, allowing them to be studied separately, but may still be connected by the temperature level MTSR. 

The following questions represent six key points that help to develop the runaway scenario and provide guidance for the determination of data required for the risk assessment  

Question 1 Can the process temperature he controlled by the cooling system  

During normal operation, it is essential to ensure sufficient cooling in order to control the temperature of the reactor, hence to control the reaction course. This typical question should be addressed during process development. To ensure the thermal control of the reaction, the power of the cooling system must be sufficient to remove the heat released in the reactor. Special attention must be devoted to possible changes in the viscosity of the reaction mass as for polymerizations, and to possible fouling at the reactor wall (see Chapter 9). An additional condition, which must be fulfilled, is that the reactor is operated in the dynamic stability region, as described in Chapter 5. 

The required data are the heat release rate of the reaction (qrx) and the cooling capacity of the reactor (g ). These can best be obtained from reaction calorimetry. 

---

The American Institute of Chemical Engineers (AICliE) wishes to thank the Center for Chemical Process Safety (CCPS) and those involved in its operation, including its many sponsors whose funding and technical support made this project possible. Particular thanks are due to the members of the Batch Reaction Subcommittee for their enthusiasm, tireless effort and technical contributions. Members of the subcommittee played a major role in the writing of this book by suggesting examples, by offering failure scenarios for the major equipment covered in the book and by suggesting possible solutions to the various Con-cerns/Issues mentioned in the tables. 

A vessel may be subject to more than one condition under different failure scenarios. For example, a low pressure separator may be subject to blocked discharge, gas blowby from the high pressure separator, and fire. Only one of these failures is assumed to happen at any time. The relief valve size needs to be calculated for each pertinent relieving rate... 

The CADET technique can be applied both proactively and retrospectively. In its proactive mode, it can be used to identify potenrial cognitive errors, which can then be factored into CPQRA analyzes to help generate failure scenarios arising from mistakes as well as slips. As discussed in Chapter... 

FIGURE 5.11. Operator Action Tree for ESD Failure Scenario (Kirwan, 1990). 

Usually, experience of the past is used as the basis of failure scenarios, whereas one should look at a process each time again as if all unexpected events could occur. One has to keep in mind that accidents are often due to the highly unlikely coincidence or complex casual chains that seem improbable. It is necessary to examine all failure modes for all possible design alternatives in order to decrease the probability of an incident. 

Technology advances in electronics such as process control instrumentation systems, computer capabilities, programmable logic controllers, and the use of independent PC s (personal computers) at field locations for special dedicated functions present new challenges to incident investigation. Some of the advances are so rapid that the team may not have the internal expertise to determine failure scenarios, sequences, and modes. The suppliers and manufacturers of these high-tech devices are sometimes the only source of credible information on failure modes of these devices. 

If a recommendation asks for a change in the process, the action must undergo a formal process hazard analysis (PHA) study, such as a HAZOP or other methodology, before implementation. This systematic and formal approach identifies and evaluates hazards associated with the proposed revisions. The study may uncover failure scenarios, adverse consequences, and obscure relationships that are not immediately apparent. The CCPS publication Hazard Evaluation Procedures i is an excellent guide to selection and proper application of PHA methodologies. 

Future penetration of the repository by man is one of the several potential failure scenarios which has been calculated. One particular scenario which will be described assumes an open, unplugged borehole penetrates through the repository and connects aquifers above and below the salt. This case is of much greater concern than for a hole which terminates within the salt. In this latter instance, there is no mechanism to continue dissolutioning of salt and the hole will gradually be squeezed closed. Using the hydrologic parameters... 

In this chapter, after introducing some definitions, a systematic assessment procedure, based on the cooling failure scenario, is outlined. This scenario formulates six key questions that comprise the database for the assessment. Relying on the characteristic temperature levels arising from the scenario, criticality classes are defined. They provide a selection of the required risk-reducing... 

The thermal risk linked to a chemical reaction is the risk of loss of control of the reaction and associated consequences (e.g. triggering a runaway reaction). Therefore, it is necessary to understand how a reaction can switch from its normal course to a runaway condition. In order to make this assessment, the theory of thermal explosion (see Chapter 2) needs to be understood, along with the concepts of risk assessment. This implies that an incident scenario was identified and described, with its triggering conditions and the resulting consequences, in order to assess the severity and probability of occurrence. For thermal risks, the worst case will be to lose the cooling of a reactor or in general to consider that the reaction mass or the substance to be assessed is submitted to adiabatic conditions. Hence, we consider a cooling failure scenario. 

Figure 3.2 Cooling Failure Scenario After a cooling failure, the temperature rises from process temperature to the maximum temperature of synthesis reaction. At this temperature, a secondary decomposition reaction may be triggered. The left-hand part of the scheme is devoted to the desired...

The six key questions presented above ensure that the essential knowledge about the thermal safety of a process is addressed. In this sense, they represent a systematic way of analysing the thermal safety of a process and building the cooling failure scenario. Once the scenario is defined, the next step is the actual assessment of the thermal risks, which requires assessment criteria. The criteria used for the assessment of severity and probability are presented below. 

The cooling failure scenario presented above uses the temperature scale for the assessment of severity and the time-scale for the probability assessment. Starting from the process temperature (TP), in the case of a failure, the temperature first increases to the maximum temperature of the synthesis reaction (MTSR). At this point, a check must be made to see if a further increase due to secondary reactions could occur. For this purpose, the concept of TMRad is very useful. Since TMRad is a function of temperature (see Section 2.5.5) it may also be represented on the temperature scale. For this, we can consider the variation of TMRad with temperature and look for the temperature at which TMRad reaches a certain value (Figure 3.4), for example, 24 hours or 8 hours, which are the levels in the assessment criteria presented in Sections 3.3.2 and 3.3.3. 

The process temperature (TP) the initial temperature in the cooling failure scenario. In case of non-isothermal processes, the initial temperature will be taken at the instant when the cooling failure has the heaviest consequences (worst case). 

The six key questions described in the cooling failure scenario allow us to identify and assess the thermal risks of a chemical process. The first steps allow building a failure scenario, which is easy to understand and serves as a base for the assessment The proposed procedure (Figure 3.6) is based on the separation of severity and probability, taking into account the economic aspects of data determination in a safety laboratory. In a second step, based on the scenario, the criticality index can be determined to help in the choice and design of risk-reducing measures. 

Figure 6.6 Cooling failure scenario for the substitution reaction performed in an isothermal batch reactor.

Build a cooling failure scenario As worst case the temperature would increase to boiling point and the solvent evaporate. What would the required energy be to evaporate the water from the reaction mass (Latent heat of evaporation of water AH = 2200 kjkg-1). 

Assessing the thermal risks of the process means answering the six questions in the cooling failure scenario (see Section 3.3.1). The overall energy potential of the reaction is calculated from the molar reaction enthalpy of 200 kj moT1. The concentration to be used is that of the final reaction mass (2molkg 1), since the reactant B must be added to allow the reaction ... 

Thus, the temperature can be controlled using cold water as a coolant, but the reaction requires practically the full available cooling capacity of the reactor (Question 1 in the cooling failure scenario Section 3.3.1). 

The MTSR (Question 2 in the cooling failure scenario) can be directly determined using Equation 7.22, by reading the data from the thermogram (Figure 7.7). The accumulation of 25% is reached at the stoichiometric point, that is, after 3.2 hours of feed (Question 4 in the cooling failure scenario) ... 

At 127 °C, the decomposition reaction is critical, that is, the time to maximum rate (Question 6 in the cooling failure scenario) is shorter than 8 hours (see Table 5.4). 

This is clearly a double jeopardy failure two unrelated events occurring at exactly the same time. One has nothing to do with the other. Therefore, you need to calculate the relief capacity for one scenario at a time. For the loss of power to a pump scenario, the relief load would be based on the amount of vapour generated at the normal rate of steam. For the steam control valve failure scenario, the relief capacity would be based on the amount of vapour generated by the heat provided by a wide-open steam valve even accounting for the amount of vapour condensed in this failure, the condenser would still be in operation. So the SRV should be sized for the worst condition. 

The Bunsen reactor failure scenario is depicted in Figure 2. In this scenario the flow out of the Bunsen reactor is shut down. This could be due to several different reasons, such as a pipe break leaving the Bunsen reactor, or an interruption of reactant supply to the Bunsen reactor. However it happens, the initiating event of this accident is a failure of the Bunsen reactor. 

The product flow pipe failure scenarios are depicted in Figures 6 and 7. In these scenarios the product flow coming from either section is prevented from returning to the Bunsen reactor via a pipe break. Thus, these scenarios maybe reduced to the Bunsen reactor failure scenario. 

Fig. 2-4. Schematic presentation of a cooling failure scenario according...

This very plausible and easy to follow approach to an evaluation of a cooling failure scenario for the batch reactor can in numerous ways be transferred to other reactor types as well as the assessment of the consequences of other maloperation scenarios. 

All further assumptions for the design are based on a cooling failure scenario without specifying any of the causes leading to it. Thus it is assumed that at least two independent failures occur simultaneously ... 

If all parameter sets calculated in accordance with the procedure just described are evaluated, it turns out that, due to the principle of corresponding states, they form a net. All reactions characterized by a three-dimensional parameter combination positioned under this net may be performed in this vessel because, in the case of a failure scenario, they will produce mass flows vsdiich are smaller than the maximum allowed mass flow. All reactions with a parameter combination positioned above the net must not be performed in this plant except if the protecting safety concept has been adequately modified. A three-dimensional plot of the columns which carry the net for a set pressure of 6 bars is shown in Figure 7-7 for the example discussed here. 

Failure scenarios can be developed, that is, what can be done later if problems occur or if a unit fails completely ... 

---