The Runaway Scenario

Other simulation examples involving various safety aspects are HMT, THERM, REFRIG1, REFRIG2 and DSC. 

---

It is also important to correct the raw vapour pressure data for any pad gas which was present in the test cell. This can be done by subtracting the partial pressure of any non-condensible pad gas which was present in the test cell, to obtain the vapour pressure (see A2.7.1). Because pressure transducers may not be very accurate at the bottom end of their range, it is advisable to vent the test cell to atmosphere, once it is filledand before sealing it and heating to the initial runaway temperature, so that a reliable initial pad gas pressure is known. (This may not always be compatible with the desire to simulate the runaway scenario within the test.) An alternative is to evacuate both test cell and containment vessel before the reactants are added so that there is no pad gas and no correction is needed,... 

The following questions represent six key points that help to develop the runaway scenario and provide guidance for the determination of data required for the risk assessment ... 

Unwanted reaction Clean and inspect equipment after each use Design with compatible materials contaminants. Maintain integrity of the system Design emergency relief system (ERS) for runaway scenario CCPS G-13 CCPS G-22 CCPS G-23 CCPS G-29... 

After the incident, an investigation team determined that the first operator had not added the initiator when required earlier in the process. When the relief operator added the initiator, the entire monomer mass was in the reactor and the reaction was too energetic for the cooling system to handle. Errors by both operators contributed to the runaway. Both operators were performing many tasks. The initiator should have been added much earlier in the process when much smaller quantities of monomer were present. There was also no procedure to require supervision review if residual monomers were detected. The lesson learned was that operators need thorough training and need to be made aware of significant hazardous scenarios that could develop. 

Consequence Phase 3 Develop Detailed Quantitative Estimate of the impacts of the Accident Scenarios. Sometimes an accident scenario is not understood enough to make risk-based decisions without having a more quantitative estimation of the effects. Quantitative consequence analysis will vary according to the hazards of interest (e.g., toxic, flammable, or reactive materials), specific accident scenarios (e.g., releases, runaway reactions, fires, or explosions), and consequence type of interest (e.g., onsite impacts, offsite impacts, environmental releases). The general technique is to model release rates/quantities, dispersion of released materials, fires, and explosions, and then estimate the effects of these events on employees, the public, the facility, neighboring facilities, and the environment. 

In order to develop the safest process the worst runaway scenario must be worked out. This scenario is a sequence of events that can cause the temperature runaway with the worst possible consequences. Typically, the runaway starts with failure that results in an adiabatic course of exothermic reaction, inducing secondary reactions that proceed with a high thermal effect. Such a. sequence of typical events is shown in Fig. 5.4-55 (after Gygax, 1988-1990 Stoessel, 1993). It starts with, for instance, a cooling failure at time tx when the temperature is at the set level, Tv ,- Then the temperature rises up to the Maximum Temperature for Synthetic Reaction (MTSR) within the time Atn. Assuming adiabatic conditions MTSR = + ATad,R... 

The typical runaway scenario as illustrated in Fig. 5.4-55 shows that the following data are needed to determine what would happen if this scenario materialized (reference is made by numbers in circles in the figure) ... 

If a reliable kinetic model and data on cooling capacity are at hand, runaway scenarios can be examined by computer simulations and only final findings have to be tested experimentally. Such an approach has been presented, e.g. by Zaldivar et al. (1992). However, the detailed reaction mechanism and reaction kinetics are rarely known. Therefore, thermokinetic methods with gross (macro-)kinetics dominate among methods for data... 

On the one side, the traditional core accretion scenario (e.g. [1]) tells us that giant planets are formed as the result of the runaway accretion of gas around a previously formed icy core with about 10-20 times the mass of the Earth. Opposite to this idea, some authors have proposed that giant planets may form by a disk instability process [4]. 

At this stage, a number of credible maloperations will have been defined that can lead to vessel over-pressurisation. In order to cope with all the credible runaway scenarios, the relief system will need to be sized for the "worst case runaway" reaction that can occur, and this is normally the maloperation that will give rise to the highest rate of temperature and/or pressure rise over the relief range. 

Closed system tests, using an unvented test cell (see Figure A2.5) or Dewar flask, can be used for vapour pressure systems. The runaway is initiated in the way that best simulates the worst case relief scenario at plant-scale. The closed system pressure and temperature are measured as a function of time. Most commercial calorimeters include a data analysis package which will present the data in terms of rate of temperature rise, dT/dt, versus reciprocal temperature (-1 / ), and pressure versus reciprocal temperature (see Figure A2.10). However, it is important to correct the temperature data for the effects of thermal inertia. See 2.7.2. 

The same example problem as used in 7.6 will be used. A reactor of volume 3.5 m3 has a design pressure of 14 barg (maximum accumulated pressure 16.41 bara). A worst case relief scenario has been identified in which a gassy decomposition reaction occurs. The mass of reactants in the reactor would be 2500 kg. An open cell test has been performed in a DIERS bench-scale apparatus, in which the volume of the gas space in the apparatus was 3800 ml, and the mass of the sample was 44.8 g. The peak rate of pressure rise was 2263 N/m2s at a temperature of 246°C, and the corresponding rate of temperature rise was 144°C/minute. These have been corrected for thermal inertia. The pressure in the containment vessel corresponding to the peak rate was 20.2 bara. The liquid density at 246°C is estimated as 820 kg/m3. The gas generated by the runaway has a Cp/Cv value of... 

After loss of control of the synthesis reaction, the decomposition reaction will be triggered (MTSR > TD24) and the technical limit will be reached during the runaway of the secondary reaction. In such a case, it is unlikely that the evaporative cooling or the emergency pressure relief can serve as a safety barrier. This is because the heat release rate of the secondary reaction at the temperature level MTT may be too high and result in a critical pressure increase. Thus, it is a critical scenario. 

This chapter describes a runaway scenario. The first section presents a general review of the decomposition reaction characteristics. The second section is devoted to the energy release that defines the consequences of a runaway. The third section deals with triggering conditions of undesired reactions, based on the concept of TMRld. The next section reviews some important aspects for the experimental characterization of decomposition reactions. Finally, the last section gives some examples stemming from industrial practice. 

If the possibility exists of runaway chemical reactions, SRVs should be provided and it is up to the chemical engineers to determine the different scenarios and provide modds that take into account the amount of vapour that can be produced by the chemical runaway reaction. 

Several kinds of failures may compromise safety and productivity of industrial processes. Indeed, faults may affect the efficiency of the process (e.g., lower product quality) or, in the worst scenarios, could lead to fatal accidents (e.g., temperature runaway) with injuries to personnel, environmental pollution, and equipments damage. In the chemical process fault diagnosis area, the term fault is generally defined as a departure from an acceptable range of an observed variable or a parameter. Fault diagnosis (FD) consists of three main tasks fault detection, i.e., the detection of the occurrence of a fault, fault isolation, i.e., the determination of the type and/or the location of the fault, and fault identification, i.e., the determination of the fault profile. After a fault has been detected, controller reconfiguration for the self-correction of the fault effects (fault accommodation) can be achieved in some cases. 

In chemical processes, several kinds of failures may compromise safety and productivity. Indeed, the occurrence of faults may affect efficiency of the process (e.g., lower product quality) or, in the worst scenarios, could lead to fatal accidents (e.g., temperature runaway) with injuries to personnel, environmental pollution, equipments damage. 

Figure 4-86 shows the most important runaway scenarios. As a consequence of the assumed cooling failure, an adiabatic temperature rise will be observed diich is identical to the reacting accumulation potential of the desired reaction. The maximum temperature reached corresponds to the MTSR, which has been discussed in the previous section. 

In common with using prevention as a basis of safety, it is essential that a full evaluation of the hazards of the process is carried out, before the type of protective measure is chosen and designed. The identification and definition of the worst case scenario is particularly important as, in contrast to prevention, any protective measure has to be able to cope with this worst case runaway reaction. In addition, the course of the runaway reaction has to be fully characterized and evaluated using the techniques described in Chapters 3 and 4. 

The conditional statement in equation 1 switches the leaving energy flux based upon a selected time. Since the occurrence of a runaway reaction is indeterminate in reality, the use of the trip time allows for the runaway conditions to be represented. In Abel and Marquardt (2000) a new methodology for capturing uncertainties such as runaway reactions in the model, the so-called scenario-integrated modeling is introduced. At... 

The questions mentioned in this scenario can be answered using the results of calorimetric experiments which can be directly used in the determination of the characteristic temperature levels after a cooling failure they will give us first the temperature due to the runaway of the desired reaction, and then the temperature reached after the runaway of the decomposition reaction... 

These criticality classes are very useful in the decision making process of choosing the protection strategy for a reactor. Depending on the criticality class of the scenario, different measures can be applied to avoid, to control, or to stop the runaway ... 

Fig. 124.1 Schematic of the runaway greenhouse scenario. (1) Various planetary engmeering techniques are used to warm volatile-rich regions on Mars (2) carbon dioxide in the polar caps tmd the regoUth starts to vaporize (3) the thicker atmosphere warms the surface and hence causes a further release of gases. If positive feedback is strong enough, self-sustaining outgassing may occur as a result of a comparatively trivial forcing...

This upset initiates a runaway reaction that can catastrophically rupture the reactor. The impact of this event was judged to be extensive, which, as discussed in Table 6 Note 1, leads to a tolerable frequency of 10 /year for a single scenario. Several failures in the control system could cause this upset, with operating experience indicating that this type of upset occurs about once every 10 years. Protection per Table 5 was the Shortstop addition, but the runaway reaction may be too fast for the operator to respond to an alarm. This protection layer is not included for risk reduction. The area is normally occupied, so it was assumed that personnel could be impacted by the event. The pressure safety valves (PSVs) are only estimated to be 90% effective, since plugging is a common problem in this service. Since the PSVs share a common relief line, they are conservatively considered to be a single Independent Protection Layer. This led to an intermediate event likelihood of a 10 per year. Per the conservative assumptions used in this example, only the PSVs qualified as an IPL. The PHA team reviewed all the process safety risk issues and decided that a SIF was appropriate. As shown in Table 7, this requires a SIL 3 SIF. 

---