PROCESS SAFETY JOURNEY - TO INHERENTLY SAFER PROCESSES · 2019. 12. 17. · Runaway after stopping...
Transcript of PROCESS SAFETY JOURNEY - TO INHERENTLY SAFER PROCESSES · 2019. 12. 17. · Runaway after stopping...
PROCESS SAFETY JOURNEY - TO INHERENTLY SAFER PROCESSES
Chuck OrellaChemical Eng. R&DIndustrial Green Chemistry WorldMumbai India 17 October 2019
AgendaGoals
o Learn from history and the literature - share ‘the journey’o Statistics & major accidents; root causes
Characterizing Risks for Reactive Hazardso Control of Fire and Explosionso Calorimetry for temperature rise and pressure generation with example
Mitigationo Inherently Safer Processeso Regulation; regulations link back to recurring root causes of accidents
• Process Safety Management, Managing Change
o Hazard, Risk, Consequence Analysis
Why this talk? What’s our role?
Where are We on the Journey to Safety?
0
25
50
75
100
125
0
80
160
240
320
400
1910 1920 1930 1940 1950 1960 1970 1980 1990 2000 2010 2020
Num
ber b
y De
cade
Cum
ulat
ive
Num
ber
Date
Chronology of Major Chemical AccidentsInt. Rev. Chem. Eng., 4, 6, 2012
30% Fire58% Explosion12% Toxic Release
Dust Incident Analyses by US Chemical Safety Board(2006 and 2017 Reports)
0
40
80
120
160
200
0
100
200
300
400
500
1980 1985 1990 1995 2000 2005 2010 2015 2020
Incid
ents
per
Dec
ade
Cum
ulat
ive
Incid
ntS
Date
A Few Examples of Chemical DisastersLocation Accident Description 000’s of kgFlixborough UK 1974
Corrosion/vibration led to failure of cyclohexanone temporary reactor; fire, vapor cloud explosion
>100
Seveso Italy 1976
Runaway after stopping agitation/cooling for weekend- 2,4,5-Trichlorophenol
- 2,3,7,8-Tetrachlorodibenzodioxine (‘dioxin’)60.001
Bhopal India 1984
Toxic Release – Water intrusion into methyl Isocyanate tank leads to runaway with multiple systems inoperative
40
Gnadenhutten OH 2003
Benzoyl peroxide explosion while rotary drying after multiple starts/stops; no internal temperature measure
0.1
Buncefield UK 2005
Gasoline overflowed storage tank ignited and explodedFirefighting foam (800,000); Firefighting water (53 ML)
>1,000
Morgantown NC 2007
Runaway polymerization of butyl acrylate in cyclohexane & toluene from 15% batch size increase
5
Wentworth GA 2008
Settled sugar dust led to explosion in Imperial sugar refining facility
NA
Philadelphia 2019
Fire, explosion in HF-catalyzed alkylation unit following rupture of corroded elbow in feed pipe
Est. 676
Contributing Root Causes from Retrospective Investigations of Many DisastersImproper design
o Wrong materials (corrosion)o Poor construction or designo Lack or wrong instrument (or location)
Operationalo Wrong chemical, wrong order of addition, backflow, contaminationo Lack characterization; plant staff not aware of/don’t understand datao Insufficient/incorrect procedureo Failed or ignored instruments & alarms, equipment
Maintenanceo Failed equipment & alarmso Wrong or no installation &/or calibrationo Corrosion not understood, or less expensive materials knowingly
selected
Force Majeur (Fukishima, Arkema….)
A high fraction of disasters have been during start-up, shut down, and non-routine operations
A Single Failure is Rarely the ProblemTypically, many failures enable a tortuous path
to disastero Challenger space shuttle, Arkema Chemical, etc.
Swiss Cheese Model - several failures aligno Origin from Phil. Trans. R. Soc. Lond. B. 327,
475-484 (1990)
Operational Risk Management Culture and Processes are Not Sufficient*
* 80 Business Unit Executive Directors to CEO’s from oil & gas, chemical/ petrochemical,utilities, metals/mining, manufacturing, building/construction, and transportation https://www.dupont.com/content/dam/dupont/products-and-services/consulting-services-and-process-technologies-redesign/consulting-services-and-process-technologies-landing/documents/Global%20ORM%20Report-20.10.17%20FINAL.pdf
How are Major Hazards Evaluated and Mitigated?
Major hazards are fire & explosion (overpressure)o Liquids, gases, powders
Characterize a process for hazardso Thermal & pressure risks
• Intended chemistry• Unintended chemistry
Eliminate High Hazard Risks Prior to Scale Upo Inherently safer processes - avoid risks by engineering them
out in R&D• Enzymatic reduction rather than hydrogenation
Put systems in place to control risks that can’t be engineered outo HF, O3, BuLi, HNO3
Characterizing Chemistry Intended or Unintended Scenarios
Pressure initiation temperature?
Vessel pressure rating?
Relief device pressure rating?
Gas generation rate?
Is the vent sufficient for the expected gas?
Is the relief device & piping sufficient for unintended gas?
Additional testing probably not necessary
Thermal initiation temperature?
Can upsets lead to the initiation temperature?
Exothermic Energy Release
What’s the adiabatic temperature increase?
Resid
ual P
ress
ure
Gene
rate
d (A
fter C
oolin
g)
Shock or friction sensitivity for large exotherms?
Capabilities of Various Calorimeters
Calorimeter Type
Sample Size
g
Run Time hr
Lowest Detectable Heat Flow
mW
Sensitivity W/kg
Maximum Temperature
°C
Maximum Pressure
MPa
Differential Scanning
0.005 0.5-5 0.02 4 700 10
Small Reaction
(SuperCRC)
5 5-24 1 0.2 200 3
Large Reaction
(RC1)
100 1-24 50 0.5 300 1
Adiabatic(ARC, VSP)
3 4-72 2 0.7 500 20
Sensitivity greatly impacts the accuracy of the exotherm initiation temperature (EIT). The EIT by adiabatic calorimetry is often 50 oC below that measured by DSC, and can be up to 100 oC less than that from adiabatic calorimetry
Especially Hazardous Operations with PowdersMilling/Delumping with high velocity machinery
o Particle size reduction and even delumping at risk of igniting solids if MIE is below 3 mJ (solvates/solvents)• Low MIE requires partial or full inertion, explosion rated, or
explosion venting• Quadro Comill only approves delumping in air with MIE above 3
mJ
Contained processing can lead to overpressureo Need Kst and Pmax for design of relief device & piping
Hot surfaces; rotating or heated machineryo MIT for cloud/layer
Conveying of powders and solidso NFPA limits on % of MEC & flammable vaporso Constraints on rate based on MIE & volume resistivity
Lack of grounding/earthing o MIE and volume resistivity of solids
Highly PotentControl
Pharma ExposureControl
106
103
100
10-3
10-6
10-9
g/M3
Explosion Range
Settled Dust Layers
Dust Hazards - Recommended TestingReferences
o US National Fire Protection Association: Standard 652o UN Recommendations on Dangerous Goods: Manual of
Tests & Criteria, Part III 33.2.1
Dust Combustibilityo UN Ignition/burn test
Dust Explosibility o 20-L sphere explosion severity test for Kst & Pmax
(ASTM E1226)o Minimum Ignition Temperature (ASTM E1491/E2021)
• As suspended/cloud or in a layer on a surface
o Minimum Explosible Concentration (ASTM E 1515)o Minimum Ignition Energy (ASTM E2019)o Limiting Oxygen Concentration (ASTM E2931)o Volume resistivity (ASTM D257)
Process Safety Assessment: Screening Results Itended Chemistry - no major process safety risks
UNINTENDED Chemistry -400-700 J/g
rapid exotherm initiates
below 180 oC before base is
added
199.29°C
195.39°C476.6J/g
277.95°C616.9J/gPURE DMSO
AFTER BASE
PRE-REACTION
STARTING MATERIAL + DMSO205.07°C689.4J/g
270.81°C434.2J/g
STARTING MATERIAL209.17°C588.0J/g
-5
0
5
10
15
20
25He
at F
low
(W/g
)
50 100 150 200 250 300 350Temperature (°C)
PRE-RXN––––––– DMSO ALONE– – – – STARTING MATERIAL + DMSO––––– · AFTER BASE––– – – STARTING MATERIAL–––––––
Exo Up Universal V4.5A TA
• DSC Results
Case Study - DSC Evaluation of a Reaction in DMSORoth, Megan, Process Safety Progress, 2019e12077, DOI: 10.1002/prs.12077)
R Br
Acid
DMSO
Intermediate
Product
+
0 20 40 60 80 100 120 140 160 180 200 220 240 2600
100
200
300
400
500
Pressure (psia) Temperature (C
Instruments Fail
Catastrophic VesselFailure
TEM
PER
ATU
RE
(C)&
PR
ESSU
RE
(psi
a)
TIME (min)
Onset Temp
Max. Jacket Temp. 170C
Rupture Disc openNoncondensable gas
Adiabatic Accelerating Rate Calorimeter (ARC) Confirms Major Consequence is a Possible Outcome
444.19min
85C iso-age
75C iso-age
65C iso-age
-0.10
-0.05
0.00
0.05
0.10
Heat
Flo
w (W
/g)
0 250 500 750 1000 1250 1500Time (min)Exo Up Universal V4.5A TA I
65 oC75 oC
85 oC
Runaway decomposes DMSO with ΔTad = 420˚C; ARC Onset below 90 oCProposed Reactor Jacket Capable of >160 oC
DSC Isothermal Ages
Isothermal DSC confirms
decomposition at 85 oC
Inherently safer -eliminate DMSO
Inherently Safer ProcessesCharacterize & change chemistry to eliminate risk
o Control or mitigate reactive hazardso Environmental undesirable wastes as solid, liquid, or gaso Eliminate toxic reagents
• ACS GCI Pharmaceutical Roundtable Reagent Guide• Catalytic processes
• Enzymes• Many accidents outside the factory - warehouse, shipping, etc.
o Green Solvents• ACS Solvent Selection Tool
Minimize the PMI & Life Cycle impacto Free to the Public
• ACS Process Mass Intensity Prediction Calculator
o Pharma Roundtable Members only• Process Mass Intensity - Life Cycle Analysis (PMI-LCA) Tool
Hazard, Risk, and Consequence AnalysisIEC 61508/IEC 61511 (Process Industries)
Likelihood Definition Failures/YearFrequent Many times in system lifetime > 10−3
Probable Several times in system lifetime 10−3 to 10−4
Occasional Once in system lifetime 10−4 to 10−5
Remote Unlikely in system lifetime 10−5 to 10−6
Improbable Very unlikely to occur 10−6 to 10−7
Incredible Cannot believe that it will occur < 10−7
Likelihood CatastrophicMultiple Fatalities
CriticalSingle Fatality
MarginalMajor Injuries
NegligibleMinor Injuries
Frequent I I I II
Probable I I II III
Occasional I II III III
Remote II III III IV
Improbable III III IV IV
Incredible IV IV IV IV
Class I: Unacceptable in any circumstances Class II: Undesirable: only if impracticable or if the costs are grossly high;Class III: Tolerable if the cost exceeds the improvement;Class IV: Acceptable as it stands, though it may need to be monitored.
Emergency ResponseActive/Passive
SIS
Layers of Control and ProtectionActive/Passive - Fire
suppression; Pressure ReliefBPCS - Basic Process Control
SystemSIS - (Independent) Safety
Instrumented SystemoMeasuring & control devices are performance rated against failure• SI Level (SIL) - to meet IEC 61511
frequencies
BPCS
Procedures
Process
http://sache.org/beacon/files/2009/07/en/read/2009-07-Beacon-s.pdf
https://www.honeywellprocess.com/library/support/Public/Documents/Safety%20Instrumented%20Systems%20(SIS),%20Safety%20Integrity%20Levels%20(SIL),%20IEC61508,%20and%20Honeywell%20Field%20Instruments.pdf
https://www.emerson.com/en-us/automation/control-and-safety-systems/safety-instrumented-systems-sis
https://iecetech.org/issue/2015-08/Asset-integrity-and-functional-safety
https://webstore.iec.ch/publication/24241
SIL Risk and Consequence Example
Consequence Description
Runaway reaction-overpressure & relief device opens/discharges toxics
Tolerable Frequency 1x10-6
Probability for initiating event (Failed Batch Temperature Probe calls for full jacket heating) 0.1
Fraction of year running reaction 0.1Batch temperature Sensor*/Transmitter* reliability 1x10-2
Jacket valve* fails closed at temperature that cannot initiate runaway 1x10-2
Overall probability 1x10-6
* - Can install redundant devices
What’s our Role as Scientists and Engineers?Engage in and advocate for process safety
o In lab, scale up, and commercial activitieso Seek characterization and understandingo Be ambassadors and champions for inherently safer processes
Use principles of Green Chemistry & EngineeringRecognize that kilo lab, piloting, technology transfer are similar to
start-up and shut down situations - enhanced risks for failuresBe responsible for knowledge management and teaching others
process safety awarenessProcess R&D and operation - aspire to the best, prepare for the
worst
MSD Collaborators on Process Safety
Dan MuzzioMegan RothTom VickeryRalph Zhao
Ed DykeJoe KukuraBarbara Schulze
Questions?Thank you for your participation and energy!
Back up slides
Control of Fires & Explosions No flames, burning, grinding Inert (nonflammable) headspace Grounding (Earthing) to prevent static Electrical designs to prevent sparksoNorth America: Class, Division, Group
• Class I=Gas/Vapor, Class II=Dust, Class III=fibers
o Majority of World: Zone (physical state/likely exposure), Group (source)• Zone 0=Continuous gas/vapor, Zone 1=likely gas/vapor, Zone 2=unlikely
gas/vapor; Zone 20=continuous dust, Zone 21=likely dust, Zone 22=unlikely dust
Flame arrestors Pressure Relief
Oxidant
Public Safety ResourcesUnited Stated Chemical Safety Board - https://www.csb.gov/Center for Chemical Process Safety - https://www.aiche.org/ccpsAm. Chemical Society Division of Chemical Health & Safety -
https://dchas.org/Publications
o https://www.sciencedirect.com/journal/journal-of-loss-prevention-in-the-process-industries
o https://www.icheme.org/knowledge/loss-prevention-bulletin/o https://www.journals.elsevier.com/journal-of-hazardous-materialso https://www.aiche.org/ccps/resources/publications/process-safety-
progresso Brethericks, others
Specialist in Characterizationso Fauske, Dekra (Chilworth),
Regulations & Consortia for Process SafetyMajor regulatory agencies
o OSHA & EPA (US); European Commission (OSH, EEA)o PRC Ministry Ecology & Environment; Administration Workplace Safety
Approaches that address historical failureso Process Safety Management (regulatory)
• Process Safety Information, Process Hazard Analysis, Pre-startup Safety Review• Operating Procedures, Training, & Contractors• Mechanical Integrity, Hot Work• Management of Change; Incident Investigation; Employee Participation• Emergency Planning and Response
Consortiao AIChE Center for Chemical Process Safetyo International Electrotechnical Commissiono International Standards for Automation
Common Tools to Manage Risk & Hazards Layers of Protection CCPS ca. 2000 (Semi-quantitative)
1. Procedures, Maintenance & Basic control system -> Alarms with defined responses
2. -> Safety Instrumented Systems & Safety Integrity Level 3. -> Physical protection - blast walls, pressure relief devices4. -> Emergency Response - Fire systems, Deluge or Mist systemso Integration of Protection layers with SIS & SIL’s
• Frequency, Probability & Impact dictate SIL • Hardware designs (Mean Time to Failure => Probability of a Failing Device)
Failure Mode Effects Analysis - US Army ca. 1950 (Semi-quantitative)o Probability, Detectability, Severity -> Risk Score (Low to Unacceptable)
Bow-Tie Analysis
Flixborough Explosion - 1974Continuous train with 6 x
45,000L reactors at ca 4500 LPM (155 oC, 8.8 bargReactor 5 removed 27-MAR
o Production resumed with bypass (spoolpiece) 1-APR
o Shutdown 29-MAY for leak
o 1-Jun restart, shutdown, restart
O2
155 o
C, 8.8 barg
OOH
H2
Leak and explosion, pressure estimated at 2 barg at epicenter
French Bureau of Analysis Risks Pollution in Industry Venart, Trans. IChemE Proc Saf Env Prot, 82 B2, 105-127, 2004
Seveso Release - 1976
Normal processing: reaction, distillation to remove glycol10 July 1976
o Processing stopped with distillation partially complete at 6 am Saturday• No agitation, jacket isolated
o 12:30 pm rupture disc burst, contamination of 4 nearby townso Public health officer unavailable, report to Carbineri at 20:00 local timeo 15 July - food chain quarantined for high levels of TCDDo 21 July - 2 additional towns quarantined for TCDDo 28 July - 736 residents evacuated; buildings demolished over many years
Root Causeo Shut down with superheated steam on jacket (250-300 oC)o Known isotherm at ~ 220 oC
1
2
3
4
5
6Cl Cl
ClCl
Cl Cl
OHCl
Cl
Cl
O Cl
ClO
NaOH, Glycol
Xylene (Az) 150 oC
HOOH
∆
1,2,4,5-tetrachlorobenzene 2,4,5-trichlorophenol 2,3,7,8-tetrachlorodibenzo[b,e][1,4]dioxine2,3,7,8 TCDD
I Chem E Loss Prevention Bulletin 251, 2016
Bhopal Release - 1984MIC tank
o 1000 kg H2O entered TA E610 containing 40,000 kg MIC
o Rapid heating & release of entire contents of E610 with multiple theories• Water entered through vent header by
mix-up while washing filter (accepted)• Entry through header by mix-up from
from N2 connection• Sabotage• Slow entry over prior weeks & months
o Many Systems Not Working• Refrigeration system shut down 6
months earlier • Flare undergoing maintenance• Scrubber shut down• Water Curtain design/maintenance
I Chem E Loss Prevention Bulletin 240, 2014
Immediate Causes of Example Chemical Disasters
Location Immediate CausesFlixborough UK Mechanical failure of temporary reactor impacted by
corrosion & vibration - > leak, fire; Seveso Italy Processing stopped with no stirring or temperature control;
known decomposition path below jacket temperatureBhopal Water intrusion into MIC tank; multiple protection systems
not maintained including scrubber, chiller, mist showerGnadenhutten OH Extended start/stop drying, jacket temperature ~ SADT, no
internal temperature measurement…Buncefield UK Overfilled tanks, fire suppression pump was the probable
ignition source; failed level indicator, high-high alarm never properly calibrated…..
Morgantown NC 15% larger batch; excess charged at beginning of semi-batch (fed) reaction; undersized condenser allowed solvent loss….
Wentworth GA No housekeeping & newly installed containmentHouston TX TBD…
Explosions-rapid reactions that release energy and gas that seeks to expand
Fast reaction –detonation
Velocity > 350 m/s (770 mph), typically 2000 m/s
Pressures to or above 1 bar
Slow reaction –deflagration
Velocity: 10~100 m/sPressure < 1 bar
Category 5 Hurricane
Velocity> 70 m/sPressure < 0.1
bar (negative)
Control of Fires - Approaches and Regulations
o No flames, burning, grindingo Nitrogen inertion of headspaceo Grounding (Earthing) to prevent statico Electrical designs to prevent sparks
• North America: Class, Division, Group• Class I=Gas/Vapor, Class II=Dust, Class III=fibers• Div 1=Continuous Haz, Div 2=Majority Haz, Div 3=Rare Haz• Group A=C2H2, Group B=H2, C2H4O, Group C=Et2O, C2H4, Group D=CH4, THF,
Toluene……, Group E=metal dust, Group F=coke, C
o Most of World: Zone (physical state/likely exposure), Group (source)• Zone 0=Continuous gas/vapor, Zone 1=likely gas/vapor, Zone 2=unlikely
gas/vapor; Zone 20=continuous dust, Zone 21=likely dust, Zone 22=unlikely dust• Group I=mine gases, Group IIA=C3H8 & equiv, IIB=C2H4 & equiv, IIC=C2H2/H2 &
equiv, Group IIIA=dust flyings, IIB=non-cond dust, Group IIIC=conductive dust
Oxidant
Pressure Relief and Safety DevicesRupture Disc (By Jens Huckauf - Own work, CC BY-SA 3.0,
https://commons.wikimedia.org/w/index.php?curid=7666420)
Safety Integrity Level (SIL)o Risk Frequency
• Prob of Failure on Demand• Risk Reduction Factor
Pressure Relief Valve (By Mbeychok - Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=18559003)
Proportional or fast/fully-opening
Arrestors - Quench Flames before a CatastropheIn-line (pipes) and terminal (vents)
o Flame (deflagration) or detonation (explosion)o Pressure and velocity specific