It's Never Too Late for

Inherent Safety


G. W. Carrithers

Rohm and Haas Kentucky, Inc.

Louisville, KY

A. M. Dowell, III, P.E.

Rohm and Haas Texas Incorporated

Deer Park, TX

D. C. Hendershot

Rohm and Haas Company

Bristol, PA

INTRODUCTION

The importance of considering inherently safer design early in the life cycle of a chemical process has been strongly emphasized in the literature on inherent safety. However, most of the chemical process industry consists of existing plants, some of which have been operating for many years. Are inherently safer design considerations relevant to those facilities? The answer to this question is, absolutely YES. We acknowledge that, early in the process development, the designer has the greatest opportunities to change fundamentally the process chemistry and unit operations, and that these basic changes offer the best opportunities to make the greatest improvement in inherent process safety. However, it is never too late to improve the inherent safety of a chemical processing facility.

Existing facilities may present opportunities for enhancing inherent safety for many reasons. For example:

• Inherent safety considerations may not have been a priority for the original designers of the plant. The chemical industry has become much more attuned to inherent safety concepts in the last 20 years.

• Improvements in technology may make inherently safer designs more feasible than when the plant was first built. For example, improved process control technology may allow major reductions in intermediate storage. That storage may have been required in the past, due to unreliability of process control systems, or the need to stockpile and analyze intermediates prior to further processing.

• New, more efficient process equipment with reduced inventory of hazardous material may have been developed since the original plant was built.

• Existing plants have often been modified over the years, and the changes may not have been reviewed with a view toward incorporating inherently safer design concepts.

In this paper, we will review several examples of inherent safety improvements which have been incorporated into existing facilities. In all cases, the improvements were implemented at an affordable cost without disrupting the operation of the existing plant. (The examples are for purposes of illustration; the details may be different for an actual facility.)

AN EXOTHERMIC BATCH REACTION

An existing semi-batch process is used to carry out an exothermic reaction:

In addition to the highly exothermic nature of this reaction, there is an additional hazard. If reactant B is significantly overcharged (double charge or more), a side reaction can occur which will generate by-products which are thermally unstable, and a runaway reaction can result.

A simplified version of the process equipment is shown in Figure 1. Reactant A is dissolved in Solvent S in Weigh Tank A, and the solution is then fed to the reactor. Catalyst C is added to the reactor, and cooling is started to the reactor cooling coils. Reactant B, the limiting reagent, is then gradually fed to the reactor by gravity addition from Weigh Tank B, which has been pre-charged with the proper amount of Reactant B. The feed rate of Reactant B is controlled by the batch temperature. If the batch temperature gets too high, there is a potential for a thermal runaway due to undesired side reactions. The process has a number of safety interlocks to confirm that the reactor agitator is on, cooling is on, reactor pressure is normal, and reactor temperature does not exceed a specified limit. As an example, the high temperature interlock is shown in Figure 1. All of the interlocks stop the feed of the limiting reagent, Reactant B, by closing the feed flow control valve and an independent remote control valve.

This reactor system was operated safely for many years. As a part of the normal process safety review cycle, a Process Hazard Analysis (PHA) of the reactor system was done on this system. The PHA identified a number of potential hazards, and the PHA team developed recommendations which improved the inherent safety of the process. Some of the concerns identified by the PHA team included:

1. The limiting reagent, Reactant B, was charged to the reactor by gravity, which is always present as a motive force for the transfer. The safety interlocks rely on the proper closing of the flow control valve and the remote control valve in the Reactant B feed line to stop the feed. If either of these valves leak (which may be likely for the flow control valve, which was not designed as a shutoff valve) or gets stuck in the open position, the flow of Reactant B will continue.

2. The maximum flow rate of Reactant B, if the flow control valve was in the full open position, was high enough that the heat generation rate significantly exceeded the heat removal capacity of the reactor cooling coils. As long as the flow control system is working, this is not a problem, and the high temperature alarms and interlocks should stop the feed of Reactant B in case of high temperature, but these are active control systems.

3. The Reactant B feed tank was capable of holding a charge of material several times larger than the desired charge. Furthermore, it was possible to feed Reactant B into the feed tank while it was being discharged to the reactor, if several valves were in the wrong position. Thus, it was possible to overcharge Reactant B, with the potential side reaction hazard.

As a result of the PHA, the system was modified as shown in Figure 2. The modified system includes several inherent safety features, which were implemented in this existing plant with a relatively small investment:

1. The Reactant B feed tank has been moved to the floor below the reactor level, and the feed is now by a metering pump. In case of high temperature, the metering pump is turned off, and a remote control valve is also closed by the reactor high temperature interlock. It is unlikely (although possible) that the metering pump will fail to shut off, so the proper operation of the remote control shutoff valve is less critical. This compares to the gravity feed in the original system, where the driving force for the Reactant B flow is always present.

2. The maximum flow rate of the metering pump is not capable of generating more heat from reaction than the reactor cooling capacity. Therefore it is not possible to overheat the reactor by feeding Reactant B at a rate which exceeds the reactor's capability to remove heat. Of course, there are other overheating scenarios which still are possible - for example as a result of reduced cooling capacity due to coil fouling, low coolant flow rate, or high coolant temperature.

3. The maximum capacity of the Reactant B feed tank has been reduced to exactly one batch charge. In this case, the same Reactant B feed tank was re-used - it was relocated to the lower floor. To reduce its maximum capacity, an overflow was added to the side of the tank at the desired level, with the overflow piped back to the Reactant B storage tank.

4. Reactant B is charged to the feed tank through a three-way valve to the bottom of the feed tank in the revised system. The three-way valve allows flow either from the storage tank to the Reactant B feed tank, or from the feed tank to the reactor. It is not possible to pump Reactant B directly from the storage tank to the reactor. This system makes it much more difficult to overcharge Reactant B. The operator would have to fill the Reactant B charge tank, charge part of the batch of Reactant B, then re-fill the Reactant B charge tank from the storage tank and begin charging to the reactor again.

These modifications represent significant improvements to the inherent safety of the existing plant. Following the PHA, a quantitative risk analysis (QRA) of this reactor system was completed. The QRA showed a total risk reduction of about a factor of 1000 when comparing the original system to the modified system.

REFRIGERATION OF MONOMETHYLAMINE

Refrigeration can be an effective way of minimizing the effects of a release of a material with a low boiling point (CCPS, 1993). Refrigeration reduces the hazard potential by:

• Reducing the storage pressure, preferably to near ambient, thus reducing the release rate in case of a leak in the system.

• Eliminating or greatly reducing the initial flash of material in case of a leak, because the material is not stored as a superheated liquid above its ambient pressure boiling point

• Eliminating or reducing the atomization of liquid which does not flash. The very small droplets will not "rain out", but instead will travel downwind in the vapor cloud where they will eventually evaporate due to heat absorbed from the surrounding atmosphere

Monomethylamine (H₂NCH₃) is a flammable gas with a strong, ammonia-like odor. Table 1 summarizes some of the important physical properties of monomethylamine.

Table 1: Selected Properties of Monomethylamine (AIHA, 1989)

Monomethylamine was stored in a pressure vessel at ambient temperature. The vapor pressure of monomethylamine is about 3.9 atm absolute (42 psig, 57 psia) at 20 °C. During an hazard analysis study, it was suggested that refrigeration of the monomethylamine be considered to reduce the hazard zone in case of a leak from the system. The potential impact of this change was evaluated using PHAST^®, a release consequence modeling program from DNV-Technica. Table 2 shows the results of the consequence modeling study for one example release scenario, the rupture of a 5.1 cm. (2 inch) line between the liquid monomethylamine storage tank and the transfer pump to the manufacturing process. The ERPG-3 concentration of 500 ppm was selected as a representative concentration to illustrate the reduction in the hazard distance which can be attained by refrigerating the monomethylamine.

Table 2: Effect of Refrigeration on Distance to ERPG-3 Concentration for a 5.1 cm. (2 inch) Monomethylamine Pipe Rupture

Clearly, refrigeration of monomethylamine has a significant impact on the hazard zones. Following the analysis it was decided to modify the storage tank to store monomethylamine at approximately 3 °C, and the cost-benefit of further reducing the temperature will be evaluated. The modified system is also inherently safer because the storage tank is capable of containing the monomethylamine at ambient temperature - it does not rely on the proper operation of the refrigeration system to ensure that the monomethylamine vapor pressure does not exceed the design pressure of the storage tank.

ELIMINATION OF A CHLORINE WATER TREATMENT SYSTEM

Chlorine is often used for water treatment in a chemical manufacturing facility. The chlorine handling facilities are often in the utilities area and may not be recognized as presenting a significant potential hazard.

In one plant, chlorine was used for disinfecting water. One ton cylinders of chlorine were used, with liquid chlorine piped through 1.3 cm. (1/2 inch) pipe to an injection nozzle where it was mixed with the water being treated. Modeling of the consequences of a rupture of the 1.3 cm. (1/2 inch) liquid chlorine pipe indicated that the distance to the ERPG-3 chlorine concentration of 20 ppm (AIHA, 1988) could be as far as about 1.6 km. (1 mile), depending on weather conditions. An alternative chlorination system using a chlorine vaporizer immediately adjacent to the chlorine cylinders was considered. In this system, the long outdoor transfer line from the chlorine cylinder storage feed area to the water treatment area contained chlorine gas instead of chlorine liquid, significantly reducing the inventory in the transfer pipe. This alternative reduced the distance to the ERPG-3 concentration of 20 ppm chlorine to about 0.8 km. (0.5 mile) for the release scenario of rupture of the chlorine transfer line.

For this installation, alternative water disinfecting systems were also investigated. It was found to be feasible to use sodium hypochlorite treatment, and this essentially eliminated the hazard of a chlorine vapor cloud entirely.

REDUCTION OF CHLORINE TRANSFER LINE SIZE

A manufacturing process included a chlorination process using liquid chlorine. The original facility used a 5.1 cm. (2 inch) transfer line from the chlorine storage facility to the manufacturing building. A hazards review questioned the line size, and it was determined that the line size could be reduced to 2.5 cm. (1 inch) without impacting the manufacturing process. Table 3 shows the impact of this reduction in chlorine transfer line size on the hazard zone resulting from the potential failure of the transfer pipe. Several typical weather conditions are considered. For purposes of this example, the hazard zone was defined as the distance to the ERPG-3 concentration for chlorine, 20 ppm. For all weather conditions, the distance to the ERPG-3 concentration was reduced by a factor of two to three.

Table 3: Effect of Reduction of Line Size on Hazard Zone from Potential Failure of a Chlorine Transfer Line

SUBSTITUTION OF AQUEOUS AMMONIA FOR ANHYDROUS AMMONIA

Dilution of a hazardous material is an important strategy for improving the inherent safety of a chemical process or storage facility. Dilution can reduce the storage pressure or vapor pressure of a hazardous material, and reduces the atmospheric concentration of hazardous vapor over a spill.

Approximately 227,000 kg. (500,000 pounds) of anhydrous ammonia was stored in a large pressurized storage tank. The tank was rated for 6.2 atm absolute (75 psig, 90 psia) working pressure, and it had a pressure relief valve set for 6.0 atm absolute (72 psig, 87 psia). This value compares to the vapor pressure of ammonia of about 6.4 atm absolute (93 psig, 108 psia) at 16 °C (60 °F). The ammonia was kept under refrigeration to maintain the storage tank pressure below the tank pressure rating and relief valve set point. Occasionally the refrigeration system would fail, and the storage tank pressure would slowly increase as the ammonia temperature rose due to heat flow into the tank from the surrounding environment. There was a potential to open the relief valve if the refrigeration system could not be returned to service before the relief valve set point was reached.

The system was reviewed, and the team questioned the need for anhydrous ammonia in the manufacturing process. It was determined that 28% aqueous ammonia could be substituted for anhydrous ammonia in all of the processes and products where the anhydrous ammonia was currently being used. There was minimal impact on these manufacturing processes, including economic considerations.

To illustrate the benefit of dilution, the consequences of two ammonia release scenarios were modeled using PHAST^® from DNV-Technica:

• Release of the entire contents of the ammonia storage tank over a 10 minute period. This scenario is equivalent to the "worst-case" scenario which has been proposed by EPA in the draft consequence analysis guidance document for the draft Risk Management Plan (RMP) regulations (EPA, 1996).

• Failure of a 5.1 cm. (2 inch) diameter ammonia transfer pipe between the storage tank and the ammonia transfer pump. This scenario might be considered an appropriate "alternative release scenario" as described in the EPA RMP draft consequence analysis document (EPA, 1996).

The results of this analysis are summarized in Figure 3 for both potential release scenarios. The use of aqueous ammonia greatly reduces the downwind ammonia concentration in the resulting vapor cloud.

The aqueous ammonia system also does not require a refrigeration system, which greatly simplifies the storage facility. The storage tank is now capable of containing the ammonia under all ambient temperature conditions, eliminating the reliance on proper operation of the refrigeration system to maintain a storage tank pressure less than the relief valve set pressure.

This case study also illustrates the importance of periodic review of all facilities, with a search for inherently safer design options as a part of the review. There had, at one time, been a requirement for anhydrous ammonia at this site. It was logical, and safer, to use a single ammonia storage facility for anhydrous ammonia, rather than two separate systems. However, the process which required anhydrous ammonia had been shut down, and it was now possible to convert the other processes to the use of aqueous ammonia, resulting in an inherently safer system.

LIMITATION OF MAGNITUDE OF DEVIATIONS FOR AQUEOUS AMMONIA

The hazard of a substance can be reduced by limiting the possible magnitude of process deviations. The equipment design is made more tolerant of error (or, more robust) to reduce the frequency of a release (CCPS, 1993).

For the reasons listed in the previous example, an aqueous ammonia system was installed to supply ammonia for reaction in a process that could tolerate the water solution. The system was initially installed using an available surplus tank of 1.7 atm absolute (10 psig, 25 psia) design pressure and fitted with a 1.7 atm absolute (10 psig) relief valve. The system injected anhydrous ammonia in ratio with water into an eductor in a circulating heat exchanger loop (Figure 4). For the purpose of this example, the desired concentration was about 30 wt%, and the normal operating temperature was about 38 ºC (100 ºF) or less.

Table 4: Total Vapor Pressure of Aqueous Ammonia
(adapted from Perry, 1984, page 3-73)

Table 4 gives the total vapor pressure of aqueous ammonia for conditions near the design point. The tank design pressure will be exceeded and the relief valve will open if the temperature rises or if the concentration increases, even by small increments, as shown by the shaded area and the black border on the right side of Table 4.

Initiating causes for a pressure surge leading to a release include:

• loss of flow in the circulation loop,

• upset in the ratio control,

• loss of coolant to the heat exchanger

• high temperature of coolant in the heat exchanger, and

• upsets in the ratio control.

During plant operation, several pressure surges from these causes opened the relief valve. The resulting cloud required evacuation of adjacent process units. The emergency response was to use a fire monitor to knock down the cloud while the unit corrected the control or heat transfer problem and waited for the tank pressure to come down. To prevent the releases, it was necessary to add multiple instrumented layers of protection (interlocks) to trip the make-up ammonia on high temperature, high pressure, out of ratio, high level, or trip of the circulating pump. These interlocks needed quick response since the temperature and pressure rose quickly during a upset.

A new tank of 4.4 atm absolute (50 psig, 65 psia) design pressure was installed to make the plant less sensitive to upset. The concentration would have to reach about 34% at a temperature of 60 ºC (140 ºF) to cause a release, shown by the heavy black border in the lower right corner of Table 4. The new tank essentially eliminated releases from the relief valve. The instrumented layers of protection do not have to trip as quickly, and, perhaps, some interlocks could be eliminated.

This example illustrates the fact that the cheapest equipment (if even it is free) may not always give the lowest total cost, especially when the economics of the consequences of releases and the cost of protective instrumentation systems are considered.

A VESSEL ENTRY EXAMPLE

Nitrogen is often piped to process vessels for process reasons, as well as to inert equipment handling flammable materials. One of the concerns, when it is necessary to enter such vessels for inspection or maintenance operations, is ensuring that the nitrogen is properly disconnected or otherwise isolated from the vessel. Figure 5 shows schematically an inherently safer approach for being sure that the nitrogen has been disconnected prior to vessel entry. All nitrogen lines to the vessel are fed through a single pipe, which passes through a hose or removable section of pipe directly across the vessel manway. It is not possible to open the vessel manway without first removing the nitrogen hose or removable pipe section. Figure 6 shows how this has been implemented for two vessels.

Of course, this design does not ensure that the atmosphere inside the vessel is safe for entry, and all permit and vessel entry procedures are still needed. There are many other mechanisms which could result in a hazardous atmosphere inside the vessel - it may contain hazardous materials, the vessel may not have been properly purged prior to entry, and there are other process pipe connections, for example. However, this design does provide an inherently more reliable mechanism for ensuring that one hazard to personnel involved in a vessel entry operation has been eliminated, by making it very difficult to avoid disconnecting the nitrogen supply to the vessel when opening the manway.

SUMMARY

These case studies clearly show that it is never too late to consider inherent safety. We recognize that the greatest opportunities for development of inherently safer process technology occur early in the process and product development cycle. However, the principles of inherently safer design apply at all stages in that process life cycle. Therefore, it is essential that process engineers involved with the development, design, and operation of chemical processes at all phases in the life cycle understand inherent safety, and be aware of the benefits of inherently safer design. Inherent safety and its potential application must become a way of thinking throughout an organization, from product invention and early process development, through to the operation of existing facilities which have been in place for many years.

When is the best time to consider inherent safety? The best answer to this question is "Start early, and never stop."

REFERENCES

• American Industrial Hygiene Association (AIHA) (1988). Emergency Response Planning Guidelines: Chlorine, Akron, OH: American Industrial Hygiene Association (April 20).

• American Industrial Hygiene Association (AIHA) (1989). Emergency Response Planning Guidelines: Monomethylamine, Akron, OH: American Industrial Hygiene Association (November 14).

• Center for Chemical Process Safety (CCPS) (1993). Guidelines for Engineering Design for Process Safety. New York: American Institute of Chemical Engineers.

• Environmental Protection Agency (EPA) (1996). Offsite Consequence Analysis Guidance (Draft). Washington, D. C.: United States Environmental Protection Agency (January 22).

• Perry's Chemical Engineers' Handbook (1984). 6th Edition. Perry, R. H., D. W. Green, and J. O. Maloney, ed., New York: McGraw-Hill, Inc.