PROCESS SAFETY JOURNEY - TO INHERENTLY SAFER PROCESSES

Chuck OrellaChemical Eng. R&DIndustrial Green Chemistry WorldMumbai India 17 October 2019

AgendaGoals

o Learn from history and the literature - share ‘the journey’o Statistics & major accidents; root causes

Characterizing Risks for Reactive Hazardso Control of Fire and Explosionso Calorimetry for temperature rise and pressure generation with example

Mitigationo Inherently Safer Processeso Regulation; regulations link back to recurring root causes of accidents

• Process Safety Management, Managing Change

o Hazard, Risk, Consequence Analysis

Why this talk? What’s our role?

Where are We on the Journey to Safety?

0

25

50

75

100

125

0

80

160

240

320

400

1910 1920 1930 1940 1950 1960 1970 1980 1990 2000 2010 2020

Num

ber b

y De

cade

Cum

ulat

ive

Num

ber

Date

Chronology of Major Chemical AccidentsInt. Rev. Chem. Eng., 4, 6, 2012

30% Fire58% Explosion12% Toxic Release

Dust Incident Analyses by US Chemical Safety Board(2006 and 2017 Reports)

0

40

80

120

160

200

0

100

200

300

400

500

1980 1985 1990 1995 2000 2005 2010 2015 2020

Incid

ents

per

Dec

ade

Cum

ulat

ive

Incid

ntS

Date

A Few Examples of Chemical DisastersLocation Accident Description 000’s of kgFlixborough UK 1974

Corrosion/vibration led to failure of cyclohexanone temporary reactor; fire, vapor cloud explosion

>100

Seveso Italy 1976

Runaway after stopping agitation/cooling for weekend- 2,4,5-Trichlorophenol

- 2,3,7,8-Tetrachlorodibenzodioxine (‘dioxin’)60.001

Bhopal India 1984

Toxic Release – Water intrusion into methyl Isocyanate tank leads to runaway with multiple systems inoperative

40

Gnadenhutten OH 2003

Benzoyl peroxide explosion while rotary drying after multiple starts/stops; no internal temperature measure

0.1

Buncefield UK 2005

Gasoline overflowed storage tank ignited and explodedFirefighting foam (800,000); Firefighting water (53 ML)

>1,000

Morgantown NC 2007

Runaway polymerization of butyl acrylate in cyclohexane & toluene from 15% batch size increase

5

Wentworth GA 2008

Settled sugar dust led to explosion in Imperial sugar refining facility

NA

Philadelphia 2019

Fire, explosion in HF-catalyzed alkylation unit following rupture of corroded elbow in feed pipe

Est. 676

Contributing Root Causes from Retrospective Investigations of Many DisastersImproper design

o Wrong materials (corrosion)o Poor construction or designo Lack or wrong instrument (or location)

Operationalo Wrong chemical, wrong order of addition, backflow, contaminationo Lack characterization; plant staff not aware of/don’t understand datao Insufficient/incorrect procedureo Failed or ignored instruments & alarms, equipment

Maintenanceo Failed equipment & alarmso Wrong or no installation &/or calibrationo Corrosion not understood, or less expensive materials knowingly

selected

Force Majeur (Fukishima, Arkema….)

A high fraction of disasters have been during start-up, shut down, and non-routine operations

A Single Failure is Rarely the ProblemTypically, many failures enable a tortuous path

to disastero Challenger space shuttle, Arkema Chemical, etc.

Swiss Cheese Model - several failures aligno Origin from Phil. Trans. R. Soc. Lond. B. 327,

475-484 (1990)

Operational Risk Management Culture and Processes are Not Sufficient*

* 80 Business Unit Executive Directors to CEO’s from oil & gas, chemical/ petrochemical,utilities, metals/mining, manufacturing, building/construction, and transportation https://www.dupont.com/content/dam/dupont/products-and-services/consulting-services-and-process-technologies-redesign/consulting-services-and-process-technologies-landing/documents/Global%20ORM%20Report-20.10.17%20FINAL.pdf

How are Major Hazards Evaluated and Mitigated?

Major hazards are fire & explosion (overpressure)o Liquids, gases, powders

Characterize a process for hazardso Thermal & pressure risks

• Intended chemistry• Unintended chemistry

Eliminate High Hazard Risks Prior to Scale Upo Inherently safer processes - avoid risks by engineering them

out in R&D• Enzymatic reduction rather than hydrogenation

Put systems in place to control risks that can’t be engineered outo HF, O3, BuLi, HNO3

Characterizing Chemistry Intended or Unintended Scenarios

Pressure initiation temperature?

Vessel pressure rating?

Relief device pressure rating?

Gas generation rate?

Is the vent sufficient for the expected gas?

Is the relief device & piping sufficient for unintended gas?

Additional testing probably not necessary

Thermal initiation temperature?

Can upsets lead to the initiation temperature?

Exothermic Energy Release

What’s the adiabatic temperature increase?

Resid

ual P

ress

ure

Gene

rate

d (A

fter C

oolin

g)

Shock or friction sensitivity for large exotherms?

Capabilities of Various Calorimeters

Calorimeter Type

Sample Size

g

Run Time hr

Lowest Detectable Heat Flow

mW

Sensitivity W/kg

Maximum Temperature

°C

Maximum Pressure

MPa

Differential Scanning

0.005 0.5-5 0.02 4 700 10

Small Reaction

(SuperCRC)

5 5-24 1 0.2 200 3

Large Reaction

(RC1)

100 1-24 50 0.5 300 1

Adiabatic(ARC, VSP)

3 4-72 2 0.7 500 20

Sensitivity greatly impacts the accuracy of the exotherm initiation temperature (EIT). The EIT by adiabatic calorimetry is often 50 oC below that measured by DSC, and can be up to 100 oC less than that from adiabatic calorimetry

Especially Hazardous Operations with PowdersMilling/Delumping with high velocity machinery

o Particle size reduction and even delumping at risk of igniting solids if MIE is below 3 mJ (solvates/solvents)• Low MIE requires partial or full inertion, explosion rated, or

explosion venting• Quadro Comill only approves delumping in air with MIE above 3

mJ

Contained processing can lead to overpressureo Need Kst and Pmax for design of relief device & piping

Hot surfaces; rotating or heated machineryo MIT for cloud/layer

Conveying of powders and solidso NFPA limits on % of MEC & flammable vaporso Constraints on rate based on MIE & volume resistivity

Lack of grounding/earthing o MIE and volume resistivity of solids

Highly PotentControl

Pharma ExposureControl

106

103

100

10-3

10-6

10-9

g/M3

Explosion Range

Settled Dust Layers

Dust Hazards - Recommended TestingReferences

o US National Fire Protection Association: Standard 652o UN Recommendations on Dangerous Goods: Manual of

Tests & Criteria, Part III 33.2.1

Dust Combustibilityo UN Ignition/burn test

Dust Explosibility o 20-L sphere explosion severity test for Kst & Pmax

(ASTM E1226)o Minimum Ignition Temperature (ASTM E1491/E2021)

• As suspended/cloud or in a layer on a surface

o Minimum Explosible Concentration (ASTM E 1515)o Minimum Ignition Energy (ASTM E2019)o Limiting Oxygen Concentration (ASTM E2931)o Volume resistivity (ASTM D257)

Process Safety Assessment: Screening Results Itended Chemistry - no major process safety risks

UNINTENDED Chemistry -400-700 J/g

rapid exotherm initiates

below 180 oC before base is

added

199.29°C

195.39°C476.6J/g

277.95°C616.9J/gPURE DMSO

AFTER BASE

PRE-REACTION

STARTING MATERIAL + DMSO205.07°C689.4J/g

270.81°C434.2J/g

STARTING MATERIAL209.17°C588.0J/g

-5

0

5

10

15

20

25He

at F

low

(W/g

)

50 100 150 200 250 300 350Temperature (°C)

PRE-RXN––––––– DMSO ALONE– – – – STARTING MATERIAL + DMSO––––– · AFTER BASE––– – – STARTING MATERIAL–––––––

Exo Up Universal V4.5A TA

• DSC Results

Case Study - DSC Evaluation of a Reaction in DMSORoth, Megan, Process Safety Progress, 2019e12077, DOI: 10.1002/prs.12077)

R Br

Acid

DMSO

Intermediate

Product

+

0 20 40 60 80 100 120 140 160 180 200 220 240 2600

100

200

300

400

500

Pressure (psia) Temperature (C

Instruments Fail

Catastrophic VesselFailure

TEM

PER

ATU

RE

(C)&

PR

ESSU

RE

(psi

a)

TIME (min)

Onset Temp

Max. Jacket Temp. 170C

Rupture Disc openNoncondensable gas

Adiabatic Accelerating Rate Calorimeter (ARC) Confirms Major Consequence is a Possible Outcome

444.19min

85C iso-age

75C iso-age

65C iso-age

-0.10

-0.05

0.00

0.05

0.10

Heat

Flo

w (W

/g)

0 250 500 750 1000 1250 1500Time (min)Exo Up Universal V4.5A TA I

65 oC75 oC

85 oC

Runaway decomposes DMSO with ΔTad = 420˚C; ARC Onset below 90 oCProposed Reactor Jacket Capable of >160 oC

DSC Isothermal Ages

Isothermal DSC confirms

decomposition at 85 oC

Inherently safer -eliminate DMSO

Inherently Safer ProcessesCharacterize & change chemistry to eliminate risk

o Control or mitigate reactive hazardso Environmental undesirable wastes as solid, liquid, or gaso Eliminate toxic reagents

• ACS GCI Pharmaceutical Roundtable Reagent Guide• Catalytic processes

• Enzymes• Many accidents outside the factory - warehouse, shipping, etc.

o Green Solvents• ACS Solvent Selection Tool

Minimize the PMI & Life Cycle impacto Free to the Public

• ACS Process Mass Intensity Prediction Calculator

o Pharma Roundtable Members only• Process Mass Intensity - Life Cycle Analysis (PMI-LCA) Tool

Hazard, Risk, and Consequence AnalysisIEC 61508/IEC 61511 (Process Industries)

Likelihood Definition Failures/YearFrequent Many times in system lifetime > 10−3

Probable Several times in system lifetime 10−3 to 10−4

Occasional Once in system lifetime 10−4 to 10−5

Remote Unlikely in system lifetime 10−5 to 10−6

Improbable Very unlikely to occur 10−6 to 10−7

Incredible Cannot believe that it will occur < 10−7

Likelihood CatastrophicMultiple Fatalities

CriticalSingle Fatality

MarginalMajor Injuries

NegligibleMinor Injuries

Frequent I I I II

Probable I I II III

Occasional I II III III

Remote II III III IV

Improbable III III IV IV

Incredible IV IV IV IV

Class I: Unacceptable in any circumstances Class II: Undesirable: only if impracticable or if the costs are grossly high;Class III: Tolerable if the cost exceeds the improvement;Class IV: Acceptable as it stands, though it may need to be monitored.

Emergency ResponseActive/Passive

SIS

Layers of Control and ProtectionActive/Passive - Fire

suppression; Pressure ReliefBPCS - Basic Process Control

SystemSIS - (Independent) Safety

Instrumented SystemoMeasuring & control devices are performance rated against failure• SI Level (SIL) - to meet IEC 61511

frequencies

BPCS

Procedures

Process

http://sache.org/beacon/files/2009/07/en/read/2009-07-Beacon-s.pdf

https://www.honeywellprocess.com/library/support/Public/Documents/Safety%20Instrumented%20Systems%20(SIS),%20Safety%20Integrity%20Levels%20(SIL),%20IEC61508,%20and%20Honeywell%20Field%20Instruments.pdf

https://www.emerson.com/en-us/automation/control-and-safety-systems/safety-instrumented-systems-sis

https://iecetech.org/issue/2015-08/Asset-integrity-and-functional-safety

https://webstore.iec.ch/publication/24241

SIL Risk and Consequence Example

Consequence Description

Runaway reaction-overpressure & relief device opens/discharges toxics

Tolerable Frequency 1x10-6

Probability for initiating event (Failed Batch Temperature Probe calls for full jacket heating) 0.1

Fraction of year running reaction 0.1Batch temperature Sensor*/Transmitter* reliability 1x10-2

Jacket valve* fails closed at temperature that cannot initiate runaway 1x10-2

Overall probability 1x10-6

* - Can install redundant devices

What’s our Role as Scientists and Engineers?Engage in and advocate for process safety

o In lab, scale up, and commercial activitieso Seek characterization and understandingo Be ambassadors and champions for inherently safer processes

Use principles of Green Chemistry & EngineeringRecognize that kilo lab, piloting, technology transfer are similar to

start-up and shut down situations - enhanced risks for failuresBe responsible for knowledge management and teaching others

process safety awarenessProcess R&D and operation - aspire to the best, prepare for the

worst

MSD Collaborators on Process Safety

Dan MuzzioMegan RothTom VickeryRalph Zhao

Ed DykeJoe KukuraBarbara Schulze

Questions?Thank you for your participation and energy!

Back up slides

Control of Fires & Explosions No flames, burning, grinding Inert (nonflammable) headspace Grounding (Earthing) to prevent static Electrical designs to prevent sparksoNorth America: Class, Division, Group

• Class I=Gas/Vapor, Class II=Dust, Class III=fibers

o Majority of World: Zone (physical state/likely exposure), Group (source)• Zone 0=Continuous gas/vapor, Zone 1=likely gas/vapor, Zone 2=unlikely

gas/vapor; Zone 20=continuous dust, Zone 21=likely dust, Zone 22=unlikely dust

Flame arrestors Pressure Relief

Oxidant

Public Safety ResourcesUnited Stated Chemical Safety Board - https://www.csb.gov/Center for Chemical Process Safety - https://www.aiche.org/ccpsAm. Chemical Society Division of Chemical Health & Safety -

https://dchas.org/Publications

o https://www.sciencedirect.com/journal/journal-of-loss-prevention-in-the-process-industries

o https://www.icheme.org/knowledge/loss-prevention-bulletin/o https://www.journals.elsevier.com/journal-of-hazardous-materialso https://www.aiche.org/ccps/resources/publications/process-safety-

progresso Brethericks, others

Specialist in Characterizationso Fauske, Dekra (Chilworth),

Regulations & Consortia for Process SafetyMajor regulatory agencies

o OSHA & EPA (US); European Commission (OSH, EEA)o PRC Ministry Ecology & Environment; Administration Workplace Safety

Approaches that address historical failureso Process Safety Management (regulatory)

• Process Safety Information, Process Hazard Analysis, Pre-startup Safety Review• Operating Procedures, Training, & Contractors• Mechanical Integrity, Hot Work• Management of Change; Incident Investigation; Employee Participation• Emergency Planning and Response

Consortiao AIChE Center for Chemical Process Safetyo International Electrotechnical Commissiono International Standards for Automation

Common Tools to Manage Risk & Hazards Layers of Protection CCPS ca. 2000 (Semi-quantitative)

1. Procedures, Maintenance & Basic control system -> Alarms with defined responses

2. -> Safety Instrumented Systems & Safety Integrity Level 3. -> Physical protection - blast walls, pressure relief devices4. -> Emergency Response - Fire systems, Deluge or Mist systemso Integration of Protection layers with SIS & SIL’s

• Frequency, Probability & Impact dictate SIL • Hardware designs (Mean Time to Failure => Probability of a Failing Device)

Failure Mode Effects Analysis - US Army ca. 1950 (Semi-quantitative)o Probability, Detectability, Severity -> Risk Score (Low to Unacceptable)

Bow-Tie Analysis

Flixborough Explosion - 1974Continuous train with 6 x

45,000L reactors at ca 4500 LPM (155 oC, 8.8 bargReactor 5 removed 27-MAR

o Production resumed with bypass (spoolpiece) 1-APR

o Shutdown 29-MAY for leak

o 1-Jun restart, shutdown, restart

O2

155 o

C, 8.8 barg

OOH

H2

Leak and explosion, pressure estimated at 2 barg at epicenter

French Bureau of Analysis Risks Pollution in Industry Venart, Trans. IChemE Proc Saf Env Prot, 82 B2, 105-127, 2004

Seveso Release - 1976

Normal processing: reaction, distillation to remove glycol10 July 1976

o Processing stopped with distillation partially complete at 6 am Saturday• No agitation, jacket isolated

o 12:30 pm rupture disc burst, contamination of 4 nearby townso Public health officer unavailable, report to Carbineri at 20:00 local timeo 15 July - food chain quarantined for high levels of TCDDo 21 July - 2 additional towns quarantined for TCDDo 28 July - 736 residents evacuated; buildings demolished over many years

Root Causeo Shut down with superheated steam on jacket (250-300 oC)o Known isotherm at ~ 220 oC

1

2

3

4

5

6Cl Cl

ClCl

Cl Cl

OHCl

Cl

Cl

O Cl

ClO

NaOH, Glycol

Xylene (Az) 150 oC

HOOH

∆

1,2,4,5-tetrachlorobenzene 2,4,5-trichlorophenol 2,3,7,8-tetrachlorodibenzo[b,e][1,4]dioxine2,3,7,8 TCDD

I Chem E Loss Prevention Bulletin 251, 2016

Bhopal Release - 1984MIC tank

o 1000 kg H2O entered TA E610 containing 40,000 kg MIC

o Rapid heating & release of entire contents of E610 with multiple theories• Water entered through vent header by

mix-up while washing filter (accepted)• Entry through header by mix-up from

from N2 connection• Sabotage• Slow entry over prior weeks & months

o Many Systems Not Working• Refrigeration system shut down 6

months earlier • Flare undergoing maintenance• Scrubber shut down• Water Curtain design/maintenance

I Chem E Loss Prevention Bulletin 240, 2014

Immediate Causes of Example Chemical Disasters

Location Immediate CausesFlixborough UK Mechanical failure of temporary reactor impacted by

corrosion & vibration - > leak, fire; Seveso Italy Processing stopped with no stirring or temperature control;

known decomposition path below jacket temperatureBhopal Water intrusion into MIC tank; multiple protection systems

not maintained including scrubber, chiller, mist showerGnadenhutten OH Extended start/stop drying, jacket temperature ~ SADT, no

internal temperature measurement…Buncefield UK Overfilled tanks, fire suppression pump was the probable

ignition source; failed level indicator, high-high alarm never properly calibrated…..

Morgantown NC 15% larger batch; excess charged at beginning of semi-batch (fed) reaction; undersized condenser allowed solvent loss….

Wentworth GA No housekeeping & newly installed containmentHouston TX TBD…

Explosions-rapid reactions that release energy and gas that seeks to expand

Fast reaction –detonation

Velocity > 350 m/s (770 mph), typically 2000 m/s

Pressures to or above 1 bar

Slow reaction –deflagration

Velocity: 10~100 m/sPressure < 1 bar

Category 5 Hurricane

Velocity> 70 m/sPressure < 0.1

bar (negative)

Control of Fires - Approaches and Regulations

o No flames, burning, grindingo Nitrogen inertion of headspaceo Grounding (Earthing) to prevent statico Electrical designs to prevent sparks

• North America: Class, Division, Group• Class I=Gas/Vapor, Class II=Dust, Class III=fibers• Div 1=Continuous Haz, Div 2=Majority Haz, Div 3=Rare Haz• Group A=C2H2, Group B=H2, C2H4O, Group C=Et2O, C2H4, Group D=CH4, THF,

Toluene……, Group E=metal dust, Group F=coke, C

o Most of World: Zone (physical state/likely exposure), Group (source)• Zone 0=Continuous gas/vapor, Zone 1=likely gas/vapor, Zone 2=unlikely

gas/vapor; Zone 20=continuous dust, Zone 21=likely dust, Zone 22=unlikely dust• Group I=mine gases, Group IIA=C3H8 & equiv, IIB=C2H4 & equiv, IIC=C2H2/H2 &

equiv, Group IIIA=dust flyings, IIB=non-cond dust, Group IIIC=conductive dust

Oxidant

Pressure Relief and Safety DevicesRupture Disc (By Jens Huckauf - Own work, CC BY-SA 3.0,

https://commons.wikimedia.org/w/index.php?curid=7666420)

Safety Integrity Level (SIL)o Risk Frequency

• Prob of Failure on Demand• Risk Reduction Factor

Pressure Relief Valve (By Mbeychok - Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=18559003)

Proportional or fast/fully-opening

Arrestors - Quench Flames before a CatastropheIn-line (pipes) and terminal (vents)

o Flame (deflagration) or detonation (explosion)o Pressure and velocity specific