Ind. Eng. Chem. Process
Des. Dev. 1985, 24, 893-896
893
REVIEW
Intrinsic Continuous Process Safeguarding Hans 0. Gerrltsen” and Cornells M. van ’t Land Akzo Chemie Nederland bv, Research Centre Deventer, P.O. Box 10, 7400 AA Deventer, The Netherlands
Two principle techniques exist for process safety in the chemical industry; these methods are based on the maintenance of either reaction conditions or chemical/physicalstability in order to provide a safe working environment. From experience gained in the manufacture of organic peroxides, it is concluded that the latter technique (intrinsic continuous process safety), aiming at prevention, is to be preferred. Intrinsic continuous process safety is based on the stability of the reaction system and reaction conditions and minimizes the possibility of dangerous occurrences resulting from human error or equipment failure. Qualitative and quantitative hazard analysis is used to determine conditions for chemicaVphysical stability of a system. A flow calorimeter suitable for evaluation of thermochemical characteristics of the reaction system is described. Process research, process development, and safety research should cooperate closely on process safety aspects from the start of the R & D synthetic work.
1. Introduction Inherent to the large-scale manufacture of certain chemicals is the danger of explosions, evolution of toxic gases, etc. These undesirable phenomena are often caused by a “runaway” reaction. Compared to laboratory scale, control of large plant size reactors is difficult because of the smaller ratio of cooling area to reactor contents (m2/m3); furthermore, the effects are more serious due to the larger masses involved (Berthold et al., 1975). The prevention or control of undesirable reactions in processes will be discussed in this paper. This article deals with processes, which are potentially hazardous, are rather close to the critical area under normal circumstances (narrow margins), and can enter the critical area via different routes. Although the handling and storage of raw materials and products will not be covered, many of the principles elucidated are also relevant to these fields. Product safety data are required to enable product transport, handling, and storage, and, in the past, process safety has often been formulated after a study of product safety. Product safety data were used because it is easier to study the decomposition of a product rather than a reaction under decomposition conditions. However, direct process safety data are required. This paper is based on experience gained from the manufacture of organic peroxides which are extensively 0 196-4305/85/ 1124-0893$0 1.5010
used in the initiation of polymerization reactions. Organic peroxides are “energy-rich”compounds and are often thermally unstable. Incidents are known of peroxides violently decomposing during production, storage, or transport, and this has resulted in personal and material damage. Much data have been accumulated from these incidents, and by careful analysis, it has been possible to extract the important safety factors. Similar incidents can occur during the manufacture of other chemicals (e.g., nitro and Grignard compounds, diazonium salts, epoxides, etc.) (Crewer, 1975), and hence the recommendations given in this paper are also applicable to other fields. 2. Process Safety Intrinsically safe processes are characterized by high chemical and physical stability, i.e., stable raw materials/products and weakly exothermic reactions whose rates are only slightly affected by temperature variation (see, e.g., Kletz, 1978). Whilst it is always desirable to use an intrinsically safe process; for chemical or economic reasons, it is not always possible for the manufacture of certain chemicals. This results in the use of a safeguarded process. Processes can be either intrinsically or extrinsically safeguarded. 2.1. Intrinsic Process Safeguarding. The hazard of potentially dangerous processes is inseparable from the 0 1985 American Chemical Society
894
Ind. Eng. Chem. Process Des. Dev., Val. 24, No. 4, 1985
chemical and physical properties of the reaction system. A counterweight incorporated into the reaction system to overcompensate the influence of these properties can achieve safety. A heavy counterweight confers a stability to the reaction system closely approaching the stability of an intrinsically safe process. Such a process can be termed an intrinsically safeguarded or intrinsically protected process. I t is a safeguarding originating f r o m the core of the process and is consequently directly and completely based on the reaction system and the reaction conditions; the Safeguarding is based o n chemical and physical properties. The safeguarding is anchored in the chemical and physical systems that are present or active during normal safe reactions and is hence under permanent control. The protection is continuously present or active; an activation is not required. The definition of intrinsic safeguarding is extended to include continuously functioning measuring and control equipment, cooling, stirring, pumping, and other systems. Intrinsic process protection results from process safety research. The starting points for this research are as follows: (1)The investigation of the process safety research should concern all reaction parameters. (2) This investigation must yield reaction conditions which are sufficiently far from the critical area or which, when entering this area, control the progress of the decomposition. The extent of the stability of the system should be such that within very wide limits, the system is not endangered by human errors or failures of instrumentation. Such safeguarding remains effective in the long run. (3) The laboratory-scale reaction conditions should allow proper scaleup. In connection with the foregoing, it is a well-known fact that dangerous processes can sometimes be intrinsically protected in a simple way. An example is the use of strongly diluted systems; the temperature rise caused by the undesired reaction’s heat development is fixed by the heat capacity of the system. The air oxidation of hydrocarbons is another example. The off-gas’s oxygen level controls the air supply in order to stay out of the vapor explosion area. Such simple methods cannot always be found. However, by research, intrinsic protection of a process can nearly always be achieved. 2.2. Extrinsic Process Safeguarding. Extrinsic process safeguarding is protection which is indirectly related to the reaction system. The operation of this protection is discontinuous; the safeguarding does not function during the normal reaction but starts working upon a signal. Extrinsic safeguarding operates by maintenance of safe process conditions by means of intervention by instrumentation or personnel. The simple and consequently universal applicability of this principle is the advantage of this method; however, significant drawbacks exist compared with intrinsic process protection. (1)Extrinsic safeguarding requires more than one stage to achieve safety-either human or instrumental; e.g., the “sounding” of a signal and the subsequent reaction. Its functioning is dependent on the maintenance and checking of the equipment. Proper operation is not continuously apparent. (2) Extrinsic process protection often requires the provisions of complicated process instrumentation and control. Process instrumentation at many points may be
required, and in order to improve the reliability, redundancy is often practiced. For intrinsic process protection the changing of only one process parameter may often suffice. (3) The applicability of extrinsic process safeguarding is limited if the reaction is hazardous because it can get rapidly out of control since the process margins are narrow. Intrinsic process protection is not subject to this limitation. The incorporation in the reaction system of a counterweight based on the chemical and physical properties creates proper protection for a chemical reaction in which the conditions required for synthesis approach those of decomposition. This section is concluded by treating the differences between the two safeguarding methods in some more detail. First, an observation in addition to point 1. Here one of the most difficult aspects of extrinsic process protection becomes apparent, i.e., the dependence on human factors. This is particularly true for processes in which in the long-run serious deviations cannot be permitted even once. It is clear that human behavior (of operators as well as of maintenance personnel) is unpredictable in the very long term. Calculation of this factor is consequently difficult and leads to uncertainty. Second, a remark in addition to point 2. The extension and otherwise complication of extrinsic process protection comes down to symptom fighting; it is not possible to eliminate or reduce the potential hazard of the reaction as is the case with intrinsic safeguarding. For all these reasons, extrinsic safeguarding is appropriate only as complementary and secondary protection: as complementary safeguarding by providing protection in places through which entering the hazardous area is improbable, and as secondary protection by drawing up a second line of defense behind the intrinsic protection line. 2.3. Additional Remarks. Experience gained in the manufacture of organic peroxides confirms the above line of thought. Process control plays a major role in the production of these metastable compounds (the processes are in some respects intrinsically hazardous). Improvement of process safety in former years, especially after incidents, was attempted via upgrading of the extrinsic safeguarding. This appeared not to be the correct approach since one of the links in the chain might fail a t the crucial moment despite checking, training, etc. Maintaining certain conditions for many years and relying on extrinsic protection in the case of deviations are an inadequate safeguarding method. A process with built-in chemical/physical protection is in the proper alternative. There are a number of aspects on which consistent application of this approach depends. (1) Research departments and process development departments operate along different lines. Much effort-despite cooperation in working groups-is required to find an integrated approach to process safeguarding. (2) There is too much confidence in extrinsic safeguarding-often advocated by chemical and mechanical engineers-this attitude does not motivate chemists to design processes with built-in safety. (3) It is sometimes stated that the design of a chemical/physical system for control of the undesired reaction leads to economically unjustified concepts; however, practical experience has taught us otherwise. (4) The view is sometimes held that a chemically unattainable ideal is being sought; however, even violent decompositions as occur during undesired reactions of peroxides can be controlled simply.
Ind. Eng. Chem. Process Des. Dev., Vol. 24, No. 4, 1985
(5) Measurements-entailing certain complications-are required to obtain a stable chemical/physical basis for the reaction system. 2.4. Practical Approach. Achieving a stable chemical/physical basis proceeds via three consecutive steps: (1) Qualitative Analysis of Synthetic Routes. Product and process research, process development, and safety research departments study the various possibilities to synthesize the compound. The control of the isothermal and adiabatic heat development is one of the items to be considered. On the basis of these experiments, a provisional choice is made. (2) Quantitative Analysis of Synthetic Routes. The provisional choice is now being investigated quantitatively to verify its correctness. Experiments are carried out in the critical area. The consequencesfor a plant reactor can be calculated starting from the measured data; e.g., the possibility to dissipate the heat of decomposition (W/kg reactor contents) via indirect cooling can be checked. This investigation combines process research and process safety research. (3) Realization of the Chemical/Physical Basis. Design is based on the previous point. There are two ways to realize protection: choosing the reaction system and the reaction conditions so that the probability of the occurrence of an undesired reaction becomes almost negligible, and choosing the reaction system and the reaction conditions so that a potential undesired reaction can be controlled. It is possible to enter the critical area via a partial failure of the technical facilities (e.g., instrumentation) or via a complete failure. The safeguarding for the former case is often based on the tolerances established by means of isothermal process safety investigations. The safeguarding for the latter case is often based on the limits established by means of the usual adiabatic process safety investigations. The choice is determined by the nature of the hazard. A combination of partial and complete failure protection may be required. Complementary extrinsic and secondary extrinsic safeguarding complete the stable chemical/physical basis.
3. Experimental Section The experimentalprogram involves measurements in the critical area, Le., the area in which the reaction being studied will start to get out of control when operated on plant scale. In order to study the critical area, it was first necessary to design a suitable apparatus. This action was required because standard laboratory equipment (i.e., stirred Dewar flask fitted with a heating/cooling coil) was not sufficiently accurate. Whilst systems are commercially available, they are complicated and expensive (Regenass, 1976; Becker and Magnus, 1955) and whilst they are accurate, serious damage can occur to the equipment when the critical area is examined. This, unfortunately, can inhibit the use of the equipment. A suitable flow calorimeter (Figure 1)was constructed; the system includes a simple replaceable measuring cell and is placed behind a barrier wall. The principle features are as follows: (1) The reactor is a flanged 1.5-L Dewar flask equipped with a stirrer. (2) Cooling is indirect via a stainless steel coil ( L = 2500 mm, o.d./i.d. 5/3 mm). (3) The heat-transfer medium is circulated to and from a 50-L thermostat-controlled water container (*0.05 “C). The container contents are stirred vigorously. (4) A hose pump effects circulation. The flow rate is 20-25 L / h (adjustable *0.5%). (5) The flow meter (range 5-30 L/h) has an accuracy better than 1%. (6) The heating/cooling medium’s AT across the reactor is measured via thermocouples and a recording millivolt meter (range 0-0.2 mV, accuracy better than
895
flow meter
m a r r i
Figure 1. Flow calorimeter.
0.5%). The setup’s accuracy is approximately 5%. A “normal” reaction yields a AT ranging from 1 to 2 O C . Measurements with this equipment and subsequent calculations enable the establishment of the behavior of the technical reactor. The maximum cooling capacity per kilogram of reactor contents of this equipment is many times larger than that of the technical reactor. A good investigation is hence possible. 4. Examples A number of examples concerning the prevention of decomposition during the preparation of organic peroxides are given together with examples from other fields. Cases in the organic peroxides field concern processes in an acid medium mainly. A number of introductory remarks to this subject will aid comprehension. Several classes of peroxides, such as dialkyl peroxides, peroxyketals, and hydroperoxides, are synthesized via acid catalysis, e.g.,
-
RIOOH + R,OH hydro- alcohol peroxide
H+
RlOOR2 + H2O peroxide water
(1)
In these preparations (and also the preparation of esters), the reaction is completed by removing or binding the reaction water. The possibilities are azeotropic water removal, water binding to a large quantity of moderately concentrated strong acid (e.g., sulfuric acid), and water binding to a drying salt (e.g., calcium chloride or magnesium sulfate). Too high an acid concentration in the preparation can result in the initiation of a violent peroxide decomposition. Such a decompositioncan (depending on the dosing order at the batch reaction) occur either at the start or at the end of the reaction. Decomposition may be expressed as follows:
-
+ H+ RlOH + R20+ (2) H+ + decomposition products + heat
RlOORz
R,O+
+ H20
(3) 4.1. The first example concerns the method of binding the reaction water by means of a large quantity of acid (e.g., sulfuric acid 70% by weight). For chemical reasons, it is sometimes necessary to select a process in which the sulfuric acid and a reaction component are added and the other reactant is subsequently dosed. Since the whole quantity of sulfuric acid is available from the start (and the acid concentration is high), the critical stage of this process is at the start of the reaction.
896
Ind. Eng. Chem. Process Des. Dev., Vol. 24, No. 4, 1985
In a process for the manufacture of a peroxide according to this method, it appeared from flow calorimeter experiments that decomposition started at a reaction temperature of 40 "C. Work at 50 "C and calculations based thereon showed that the heat development in the largescale reactor at this temperature could not be controlled. To achieve a safe margin for the reaction temperature of the synthesis of this peroxide, whose decomposition can progress very exothermally in an acid medium, a temperature of 25 "C was prescribed. At this temperature, the influence of the sulfuric acid concentration was subsequently investigated, using the flow calorimeter. It was found that if double the amount of sulfuric acid was used, a spontaneous explosion occurred immediately at the start of the reaction without any warning. Extrinsic protection would not get the time to come into action. This dangerous situation could be avoided by reducing the concentration of the sulfuric acid used in the process; the flow calorimeter indicated that under these circumstances, the reaction is kept out of the critical area at the overdose mentioned. The yield is not affected by this modification. Other solutions are also possible. 4.2. The following two examples relate to cases where the reaction water is bound with the aid of a dehydrating agent (e.g., magnesium sulfate or aluminum sulfate), using a catalytic quantity of acid. 4.2.1. An investigation (Oosterwijk, 1971), carried out by means of a Dewar, showed that such a process was intrinsically protected against temperature increases. The initially fast temperature rise during a planned "runaway" experiment comes to a standstill, the temperature subsequently dropping. This can be explained since at a temperature exceeding the reaction temperature, the salt hydrate releases water, the catalytic quantity of acid is diluted, and the decomposition is consequently blocked. 4.2.2. In these processes, the raw material used, viz., hydroperoxide, could be considerably more sensitive to acid than the peroxide being prepared. In processes requiring a small catalytic quantity of acid, a low-concentration acid can be used for the synthesis. In view of the sensitivity of the hydroperoxide to acid, only acid of low concentration is admitted to the plant to protect the process. An ample margin for the concentration-backed by experimentsshould be taken into account. This safeguarding is supplemented by measuring and control equipment to ensure that the raw materials are mixed before the acid catalyst is added. During the reaction, water is liberated; the water dilutes the acid, thus preventing decomposition of the hydroperoxide. Examples in Other Fields, The following categories can be distinguished: reactions with thermally unstable compounds, (this may comprise both final and intermediate compounds, such as nitro and diazonium compounds); strongly temperature-dependent reactions, e.g, reactions with epoxides; and irregularly initiated reactions such as Grignard reactions (an example concerning each of these categories will be given). 4.3. Nitro Compounds. Aromatic compounds with substituents such as COOH, S03H,and C1 can be nitrated a t a reasonable rate a t high temperature only. A strong temperature rise from this exothermic reaction may occur at this temperature level due to rapid addition of the H2S04/HN03mixture. A decomposition reaction will then start (Crewer, 1975); nitro compounds can decompose violently at a high temperature, i.e., ca. 200 "C. An adequately low concentration of the reactants to prevent the
attainment of a decomposition temperature is the best way to prevent decomposition in this case. The decomposition temperature can be determined with the aid of the flow calorimeter. Using a solvent to control the reaction temperature is an alternative action. 4.4. Reactions with Epoxides. The large-scale manufacture of these compounds has in practice given rise to incidents, e.g., the reaction between epichlorohydrin and an N-substituted aniline (Schierwater, 1971).
/*\
CH2-CH-CH2CI
R
+
&AH
, - - I
R
According to the literature, this reaction was commercially operated at 60 "C. If however, the temperature rose by about 10 OC, the reaction went completely out of control. This shows that the rate of the reaction strongly increases with the temperature. A different reaction system had to be designed. Two features can be distinguished. A high reaction temperature prevents the accumulation of raw materials; the reaction rate is adequate. Dosing one of the reaction components with a metering pump is a second measure. The limited flow capacity of the pump must control the reaction rate to prevent the system temperature from rising to the point where an uncontrolled reaction can occur. 4.5. Grignard's Syntheses. It is well-known that the classical method-using ether as solvent and iodine as catalyst-cannot be applied in the plant because of the flammability of the solvent and the unpredictable initiation of the reaction. Control of such a reaction can be obtained via equipment. However, a reproducible controlled reaction system is preferred. A possible solution is the use of a solvent to which a minimum amount of ether is added to reduce the ether concentration in the vapor phase. A second measure is to employ an initiator with a more predictable character, e.g., in the case of an intermediate Grignard reaction in the synthesis of tetraalkyltin; a reproducible and consequently controlled start could be achieved using bromine as a catalyst. Acknowledgment We are indebted to the Management of Akzo Chemie R & D for the permission to publish this article. We thank our colleagues of Akzo Chemie R & D for fruitful discussions, in particular Dr. D. J. Buckland and R. van den Berg. Literature Cited Becker, P.; Magnus, A In "Houben-Weyi Methoden der Organischen Chemie", 4th ed.;Verlag Chemie: Stuttgart, Federal Republic of Germany 1955; Vol. 3/1. p 541. Berthold, W.: Heckle, M.; Ludecke, J.; Ziegler, A. Chem .-lng .-Tech. 1975, 4 7 , 368-373. Crewer, T. Chem.-1ng.-Tech. 1975, 4 7 , 230-236. Kietz, T. A. Chem. Ind. (London) 1978, 287-292. Oosterwijk, H. H. J. Internal Laboratory Report, Akzo Chemie Nederland b.v., Location Deventer, The Netherlands, 1971. Regenass, W. Int. Symp. Prev. Occup. Risks Chem. Ind.. R e p . , 3rd 1976, 157-173. Schierwater, F. W. Ind. Chem. Eng. Symp. Ser. 1971, N o . 3 4 , 47-49.
Received for review July 11, 1983 Revised manuscript received February 13, 1985 Accepted March 21, 1985
