- Email: [email protected]
Check Cards for Runaway (CCR)
0957–5820/04/$30.00+0.00 # 2004 Institution of Chemical Engineers Trans IChemE, Part B, January 2004 Process Safety and Environmental Protection, 82(B1): 5–11
www.ingentaselect.com=titles=09575820.htm
CHECK CARDS FOR RUNAWAY (CCR) An Operative Tool for the Risk Assessment of Highly Reactive Systems Performed in Small- and Medium-sized Enterprises R. NOMEN, J. SEMPERE*, E. SERRA, A. PEY, J. SALES and V. GHINAGLIA Institut Quı´mic de Sarria`, Universitat Ramon Llull, Barcelona, Spain
T
he Check Cards for Runaway is a simple tool to evaluate quickly the safety level of a chemical plant liable to suffer a runaway reaction. It is obtained by defining all the necessary safety considerations required to design a safe process and predicting systematically all the runaway hazards. Moreover, this tool can be used even when only limited resources are available, as in the case of many small and medium-sized enterprises. The tool resulting from this project is very simple and requires only standard chemical knowledge. Keywords: runaway; hazard; SMEs; risk assessment; critical factor.
INTRODUCTION
of Environmental Sciences, Energy Research and Process Innovation (Apledoorn, The Netherlands), with the financial support of the Generalitat de Catalunya (Barcelona, Spain). The main target of this project is to obtain a simple tool to quickly evaluate the safety level of a chemical plant liable to suffer a runaway reaction. It will try to define all necessary safety considerations required to design a safe process and to systematically predict all runaway hazards. Moreover, it should be useful to SMEs where limited resources are available.
It is well known in the chemical industry that any accident, however small, usually has a negative impact and causes alarm to the surrounding population. In particular, since the Seveso accident (1976), the European Chemical Industry is experiencing an increase in social and environmental pressure (Nomen and Sempere 2001). This situation has resulted in improvements in process practice and, consequently, has raised safety standards in the chemical industry. Nevertheless, accidents still represent dangerous events in the chemical industry because of the severity of their consequences. Considering the environmental impact as well as the possibility of injury of the people involved in such accidents, the highest possible standards of safety need to be achieved. Most large companies use robust hazard assessment methods, including some sophisticated experimental techniques, in order to reduce both the frequency and the severity of potential accidents. However, disseminating this practice (including basic concepts and methodologies) to the huge number of small and medium-sized enterprises (SMEs) in the fine and speciality chemical industry in Europe is difficult. Moreover, the use of the expensive experimental techniques is not possible for many SMEs. Most SMEs make use of existing methods for risk assessment such as check lists, fault trees or HAZOP (Steinbach, 1999). The Check Cards for Runaway are a part of the ART project (Thermal Risk Audit), that is being developed at the Institut Quı´mic de Sarria`—Universitat Ramon Llull (Barcelona, Spain), in collaboration with the TNO Institute
RUNAWAY ASSESSMENT To develop such a tool means creation of a procedure that should allow checking of whether adequate safety measures have been taken to avoid a runaway reaction. Following the purpose of this project, the tool should be as simple as possible and must contain only standard chemical knowledge to be applied by the SMEs when designing, upgrading or running new or existing processes. It is obvious that, if a possible hazard is not detected, no safety measures can be taken. As a first step, a method is needed to easily identify potential hazards in a chemical process. Afterwards it is possible to focus on specific types of hazards, such as runaway reactions, and on how such hazards can be handled to avoid their consequences. Figure 1 presents the main work line by which a hazard can be identified, evaluated and reduced to an acceptable safety level. Early hazard detection in the design process must be one of the objectives of the engineering team. In this process, first all the potential hazards have to be identified, then each potential hazard has to be assessed.
*Correspondence to: Professor J. Sempere, Institut Quı´mic de Sarria`— Universitat Ramon Llull, Via Augusta, 390, E-08017 Barcelona, Spain. E-mail: [email protected]
5
6
NOMEN et al.
Figure 1. Hazard identification process.
Defining which data are required to assess each potential hazard is the next step towards the development of the methodology. Once the data are defined, the necessary tests are selected and run. It must be clear that the selection of the tests to be performed should be directly related to the hazard that must be assessed. Running tests in a systematic way just because it is common practice should be avoided. There must be a reason to run a test, and that reason must be theoretically founded. Until now in this paper, a general idea of hazard management has been presented. Now it is time to go into the anatomy of hazard: to determine a generic hazard structure is an important step towards the development of a tool for
coherent use by SMEs. Having the elements of the hazard well defined allows us to follow the same pattern consistently when assessing a runaway scenario. Figure 2 shows the basic components that can be identified on accidents or near misses. By defining the hazard components, it can be clearly seen where it is necessary to define the safety concepts and which defence level is being analysed. One of the most important characteristics of the tool presented here is to define a coherent and well-defined starting point from which to integrate all the causes that may trigger or provoke a runaway. As shown in Figure 2, it is thought that there are three possible starting points to
Figure 2. Hazard structure.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
7
CCR IN SMES develop the tool: the cause that can generate the hazard, the chemical behaviour of the substances involved in the hazard and the critical factor, defined as a generic hazard that can appear as a consequence of a cause. Each starting point is linked to a different methods or tools to examine them and with the defensive lines that can be associated with them. Figure 2 also shows how the different starting points are related to each other Next, those points, the strategy connected to them and the links established in Figure 2 are explained in more detail: Cause It is an individual and certain event that will trigger the appearance generation of a factor. Causes are defined depending on the process that is being assessed; they are not of general application, but the consequences that arise from them may be common to all the processes. A cause-based strategy can be based on a list of all the operations carried out and all the items in a chemical process. Then they can be analysed to determine all the credible errors or failures arising from those operations and items. Afterwards, the resulting immediate consequences would be analysed and, together with chemical behaviour, it would be possible to find out if a single event is able to evolve and to influence the process in becoming a hazardous process deviation. An important drawback is that this method is thought to be slow because of the huge number of operations and possible failure points that can be found in a process. It is also difficult to develop general safety considerations and assessment lines when the main analysis is done upon certain process items. A cause is usually the starting point on assessments like HAZOP, HAZAN and fault tree analysis. Preventive safety measures will depend on the causes defined. Chemical Behaviour This is the behaviour of the substances involved in the process, considering both process conditions and other credible abnormal conditions that can trigger a runaway. The most interesting chemical properties for a runaway assessment are those related to exothermal activity and reactions with other substances. Chemical behaviour together with critical factors is important to define which are the dangerous conditions for a chemical system. A chemical behaviour-based strategy should be more selective. It must be focused on the tests that have to be made to obtain chemical data. The target should be to detect all possible dangerous chemical behaviour from tests. Afterwards it is necessary to define the hazardous conditions that would trigger dangerous behaviour, and finally to identify the primary causes that may trigger those hazardous conditions. It is thought that, as there is no clear agreement on tests and data analysis, it would be more difficult to obtain this type of tool. It is also thought that tests are a tool to be used after a previous analysis and not as a starting point. This strategy is not so close to process operation; the scope is nearer to the theoretical and laboratory work, and this kind of tool needs to be close to the process but distant enough to be able to contain generic considerations about safety assessment.
Critical Factor A critical factor is a generic hazard that may appear in a process as the consequence of a cause. Generic hazards or factors are defined on a theoretical basis. All the factors defined must always be studied to find out which ones are of importance in the process. If the factor is likely to appear in the process causing a hazardous situation, then it is called a critical factor. Critical factors will define which are the parameters that must be tracked in the installation in order to control the process and to set up the alarm conditions and the safety measures. The cause–critical factor link is, in fact, a cause– effect link, the effect being a hazardous process deviation. A factors-based strategy would focus on defining generic situations for hazard assessment. A factor is both near the specific causes and in close interaction with chemical behaviour and the process conditions considered, which are necessary to define whether a factor is critical or not. It is believed that the factors are half-way from plant operations and laboratory tests. They make it easy to define which data is required for their evaluation, and from the data the tests can be specified. Moreover, once the critical ones are detected, it will be clear which errors or failures will trigger them. From the combined assessment of chemical behaviour, process conditions and critical factors, the hazardous process deviation arises. This deviation may develop and constitute an accident or be kept under control with emergency safety measures and become a near miss. Emergency safety measures will be designed using the conditions that can be achieved during those deviations. There will be a point where no more control will be available. At this point only mitigation measures are useful. THE CHECK CARDS FOR RUNAWAY Once all the information about a runaway hazard has been collected and analysed, the next step is to determine how the tool will face the safety assessment. The Tool Strategy A factor-based strategy is the best possible way to define a tool for a hazard assessment: it is good to start the assessment from a point that is half-way between plant operation and laboratory tests. This approach will focus on defining generic situations for hazard assessment. Five factors are defined to assess a runaway event; it is believed that, with these being considered, most of the runaway scenarios are taken into account. The factors are mainly derived from the 10 runaway courses described by Gustin (1992). The chemical process has been split into three areas, which are thought to be essentially different from each other. In this way it is possible to better explain the influence of a factor on a certain process zone. These areas are: (1) Storage—chemicals handled in storage facilities are kept under certain conditions to maintain their chemical properties. There is no intended change of physical or chemical properties. Storage facilities include raw materials, products, by-products or residue holding facilities. (2) Physical processes—chemicals are submitted to physical treatment to change their physical properties; they
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
8
NOMEN et al.
may be heated, cooled, diluted, milled, dried, etc., but no chemical reaction is intended to happen on those processes. There are changes in physical properties but no changes on chemical structure or properties. (3) Reaction—intended changes on both physical and chemical properties are carried out during the reaction stage. It is a special zone of the chemical process and most of the time it is where most safety measures have to be taken. This is why special attention is given to this stage in the process. The factors are now presented explaining their theoretical basis. Mischarging chemicals This factor focuses on scenarios where a chemical mixture showing a violent and exothermic behaviour is achieved by error. As the system has not been designed to handle the reactive behaviour triggered, the heat released may exceed the normal cooling measures, leading the system to runaway conditions. The incompatible chemicals scenario is included by definition in this factor. A typical ‘incompatible chemicals’ scenario appears when two chemical substances that react in a violent and exothermic way with each other come into contact by error. A hazardous situation may also appear while handling the right chemicals. An error on proportions, concentration or mixing order may cause an undesired exothermal behaviour. Even if the intended reaction is taking place, if it is performed too fast heat will be released at a rate that cannot be managed by the cooling system. For these reasons chemicals handled, quantities used and mixing sequences are the key points on which safety measures must focus to prevent this factor appearing. Incorrect mixing must be avoided under any circumstances. Autocatalytic reactions The rate of autocatalytic reactions may increase at constant temperature. Chemicals exhibiting this behaviour must be handled with great care. Even if the reaction mass or bulk in storage vessels is well below a safety temperature, the reaction may lead to a runaway if the handling time is too long at that temperature. Examples of this behaviour are autocatalytic and radical chain polymerization reactions. It is common to find products exhibiting this behaviour mixed with a reaction inhibitor. The inhibitor is a temporary solution to reaction prevention because it is exhausted with time and, as the inhibitor concentration decreases, the reaction rate increases. In order to use an inhibitor as a controlling chemical, its concentration and homogeneity in the bulk must be controlled, as well as the presence of possible impurities that may trigger a reactive behaviour. Segregation The segregation of a phase may be a hazard for different reasons. The most important is that the segregated phase may show unstable exothermic behaviour. In addition, segregation may also affect the composition of the main phase from where the new phase separates, making it unstable. The third way through which segregation may be dangerous is that it may jam measurement devices like level, temperature or pressure probes. Loss of stirring or too low
a temperature are typical causes of segregation. A greater problem occurs when the segregated phase is highly unstable and can have shock-sensitive or detonating properties, or when the two phases can be mixed together again suddenly. The physical and chemical properties of mixtures and chemicals handled must be studied to find out if there is the possibility of segregation. Normal process conditions but also credible conditions under process deviation should be tested. The composition, the thermal behaviour and all possible reactions arising from each phase detected must be studied. Accumulation The accumulation problem arises from a misbalance between reactant consumption and dosing rate. The concentration of the controlling reactant in the bulk will be higher or lower depending on the dosing rate and the temperature. If this concentration reaches too high a value, then the reaction is triggered too fast and high exothermal behaviour appears, which may cause a runaway. As an accumulation scenario is directly related to the problem of dosing a reactant, this factor is only described for the reaction zone, and not defined for storage or process zones. All the parameters that may influence the consumption rate of reactants must be well defined and controlled. Events causing accumulation may be very different: an error on the dosage pump, the presence of an impurity inhibiting the reaction, temperature set too low by bad operation design or by error on temperature sensor, etc. Temperature hazard This kind of hazard may arise from two different situations: too high a system temperature or too high a local temperature or hot spot. A too high system temperature situation may be reached because of an extra heat input to the system by error (heating system valve failure, bad reading from a temperature sensor, human error on setting the process temperature, fire in the surroundings of the installation, etc.) or because of inadequate heat removal (if the cooling system is under an upset condition that reduces the heat removal capacity). In the hot spot scenario, care must be taken with mixtures showing heat sensitive behaviour: a hot spot may initiate an exothermic reaction that can propagate through the whole reaction mass. Hot spots are especially critical on vessels containing substances with detonating, deflagrating or selfigniting properties. This justifies the use of several temperature sensors as important to track the correct temperature profiles of the whole mass. Analysing each factor, the data necessary to perform the assessment of the process can be determined and collected. Therefore, a methodology has to be defined in order to analyse if a factor has to be considered critical and, in this case, if sufficient safety measures are implemented to manage it. The Tool Structure Data Collection Cards A card shape is thought to be the easiest way to organize all the information. Two types of cards are defined, the Data
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
CCR IN SMES Collection Cards, where all the data necessary to perform the safety evaluation are included, and the Data Analysis Cards, containing all the questions of the methodology. As quite a lot of data are necessary to assess the safety of the process, the simultaneous use of two tables is considered important for this tool: one table will contain physical and chemical properties of each substance involved in the process (including construction materials and wastes), and the other the process and reaction conditions. Properties will be listed for each individual step. In this way, it will be possible for all the necessary data to be found in one site and be used at any moment during the safety analysis. Moreover, the development of a system that associates substance properties to specific process stages, addresses another important issue related to the needs of SMEs: the standardization of the data collection in a way that could make their consultation and further use easier. Some notes have been added at the bottom of each table, explaining what is asked and how to calculate them. The following data are included in each table: Physical and chemical properties table The list of substances and mixtures utilized in the considered process. And for each substance or mixture defined: the chemical composition and CAS number (in order to know exactly what is the substance or mixture considered); the homologation or identification number used inside the enterprise (to be easily identified by the operators); the purity; the phase (solid, liquid or gas); the report on handling conditions (inhibitors, triggering agents, chemical substances able to influence the rate of reaction, etc.); the phase stability vs temperature and pressure (the T or P at which a different phase from the one expected under normal operating conditions appears); the specific heat (for mixtures, in the case of lack of data, it can be calculated using the average of the values of the single substances); the normal boiling point; the thermal activity at the storage temperature (understood as the stability of the substance or the mixture considering the maximum storage period); the deflagration or detonation sensitivity (simply defined as high, medium or low).
9
In the reaction and process conditions table The step considered (specifying to which of the three area it refers). And for each step: temperature and pressure (considering the possible gas production); substances involved (in each step considered); specific heat capacity of the mixture (the experimental value, if known; otherwise the average of the values of the single substances); heat of reaction [from experimental calculations, literature, Internet or simulation programs such as CHETAH (ASTM, 1998)]; MTSR (the maximum temperature reached following the occurrence of the desired chemical reaction under adiabatic conditions, starting from the designed process temperature); kinetic behaviour (specifying if the reaction is an Arrhenius, catalytic-homogeneous or heterogeneous or autocatalytic type); total adiabatic temperature rise (increase of reaction mass temperature, under adiabatic conditions, due to accumulation of the heat released, coming from the synthesis reaction and all the possible secondary reactions involved); thermal activity at the end of the step; MAXTSAFE (see below); influence of hot spot. Figure 3 shows the reactions and process conditions table, in which the required data can be introduced for each step of the process. The maximum safety temperature (MAXTSAFE) will be used to perform the ‘thermal evaluation’ of the process following the five criticality levels developed by Stoessel (1993). Many values can be found in literature references in order to define how to calculate it or, more generally, a limiting temperature above which it is considered that a runaway can occur. In some cases the ADT24 is used for this purpose. The ADT24 can be determined by adiabatic calorimetry as the temperature at which the adiabatic induction time of a possible decomposition reaction falls below 24 h. The problem is that this value is difficult to calculate and adiabatic calorimetry is a technique that is rarely found in SMEs. For this reason, it has been decided to include another way to calculate this maximum
Figure 3. Example of a data collection card for reaction and process conditions.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
10
NOMEN et al.
safety temperature, that requires less knowledge and less complicated techniques. Hence, if adiabatic calorimetry is not available, MAXTSAFE can be obtained by means of a dynamic DSC register of the reaction mass, with a heating rate of 5K min 1 (Serra, 1999), following this detailed procedure: the value of MAXTSAFE can be determined, at a first step, as the temperature at the first exothermal peak less than 70K; this safety reference is more objective than the temperature at which exothermic activity is first detected, Tonset, since the later may depend on the precision of the apparatus; it is necessary to compare this value with the MTSR. If jMTSR 7 (Tpeak 7 70) j > 50, then the approximation of MAXTSAFE ¼ Tpeak 7 70 can be considered correct; if this is not so, it is also necessary to perform an isothermal DSC at MTSR followed by a dynamic register; if MTSR > Tpeak 7 70, the isothermal register does not reveal any significant change of the mass reaction, and the dynamic register is equivalent to the first DSC performed, then it can be concluded that MAXTSAFE > Tpeak 7 70 and therefore MAXTSAFE > MTSR; if MTSR > Tpeak 7 70, the isothermal register does reveal significant change of the mass reaction (low velocity of the exothermal phenomena at the process temperature can be a problem for detection), and the dynamic register is not equivalent to the first DSC performed, then the approximation MAXTSAFE ¼ Tpeak 7 70 can be considered; if MTSR < Tpeak 7 70, the isothermal register does not reveal any significant change of the mass reaction, and the dynamic register is equivalent to the first DSC performed, then the approximation MAXTSAFE ¼ Tpeak 7 70 can be considered; if MTSR < Tpeak 7 70, the isothermal register does reveal significant change of the mass reaction, and the dynamic register is not equivalent to the first DSC performed, then it can be concluded that MAXTSAFE < Tpeak 7 70 and therefore MAXTSAFE < MTSR. When performing an isothermal DSC, it must be considered that a 12 h experiment should be long enough. Besides, low rate of exothermal phenomena at the process temperature can be a problem for detection. It is chosen not to work with another value frequently used in literature that can be estimated by means of a DSC register, the Tonset. The reason is that it strongly depends on the sensitivity of the apparatus, on the behaviour of the considered reaction and on the way the value is calculated, making its reliability unpredictable (Serra, 1999). The amount of required data has been reduced as much as possible and also readily available data used to obtain a tool that requires as few resources as possible, making it effective also when there is no deep knowledge of the process. Therefore, the data that could be easily calculated without the need of complex equipment have been chosen. In order to quickly detect the possible hazards arising from a dangerous mixture, a general compatibility chart and compatibility Chart specific for the considered process are included in the data collection cards. The second one has to be filled in by the SME itself, considering all the substances involved in the process. As seen before, one problem can be the lack of knowledge about the reactive behaviour of all the substances. For this reason, a ‘general’ chart (US EPA, 1980)
is included in the literature, in which a number of substances are grouped attending to reactivity criteria, and the interaction between each group is analysed. This is not intended to be exhaustive and it cannot be assumed that the substances are compatible if they are not classified as hazardous on the chart (the blanks do not necessarily mean that the mixture cannot provoke a hazard). In any case, the general compatibility chart can be used as basic knowledge in case of a lack of other information about the behaviour of the mixture. Following the same principle, a further useful information source is the NFPA (National Fire and Protection Association) index (NFPA, 2001). It is included at the bottom of the compatibility chart specific to the considered process: this identification can help better comprehension of the chemical behaviour of the substance. Furthermore, with the same intent of providing all the necessary information to make the safety analysis, a list of books and Internet sites where literature data and estimation methods can be found is included, defined as ‘Data Sources’. After the collection of all necessary data, they need to be correlated to the considered process area in order to define whether a factor would be critical or not. Data analysis cards As the detection of a critical factor, taking into account all the parts of the process related to each of the three areas (storage, process and reaction) at the same time, can be quite difficult, it has been decided to analyse the process considering the way the chemical companies describe it. They subdivide the process into steps, and then each step is described including operations, conditions and safety measures that need to be considered. The safety analysis is then performed considering one step at a time and referring each step to one of the three areas (storage, process or reaction). As a consequence, this analysis criterion can be easy to understand for SMEs. Furthermore, with such a structure, the detection factor can follow a scheme especially designed for the proper process area. In this way, the analysis can be more complete and easier to carry out, considering all the problems involved with each single step. When a factor is detected as critical, it has to be checked whether sufficient safety measures have been implemented in order to eliminate it. The checklist method is the better tool for the purpose. However, using only this methodology, it is not possible to evaluate the evolution of a hazardous situation and to think about the possible safety measures that needed to be considered. The ‘what-if=checklist’ method (CCPS, 1969) is the best solution for this last aspect. This analysis method combines the creative, brainstorming features of ‘what-if’ analysis with the systematic features of the checklist method. The purpose of such an analysis is to identify hazards, considering the types of accidents that can occur in a process, evaluating in a qualitative manner the consequences of these accidents and determining whether the safety measures appear adequate or not. Combining these two methods emphasizes their main positive features (i.e. the creativity of a ‘what-if’ and the experience-based thoroughness of a checklist), while at the same time compensating for their faults when used separately.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
11
CCR IN SMES
Figure 4. Data analysis card for the segregation factor of a reaction step.
A review of the classical ‘what-if=checklist’ methodology is done and a ‘yes=no tree’ of questions is created, which constitute the data analysis cards. This structure allows consideration of the criticality of each factor due to both its chemical behaviour and the process conditions, and decision on whether or not the safety measures implemented are sufficient. Each step of the process has to be referred to one process area and then the full list of questions has to be followed. For each step, all the critical factors that can come up in each area are considered, and for each factor a list of questions to investigate its criticality is presented. The ‘what if=checklist’ questions are structured in the way that at the end of each ‘tree’ of questions only two possibilities can be achieved: a justification of the non-criticality of the factor considered, due to the chemical behaviour of the substances involved, the process conditions considered or the safety measures used; the intention is to assure that the person that is doing the analysis has considered and deeply analysed the question in all its aspects. ‘review your safety measures’ when the factor is found to be critical and a review of process or safety measures is necessary. Figure 4 shows the checklist for the Segregation factor of a reaction step. After each list of questions for the different areas, a scheme to be used to answer the questions is included, to help understand the path that needs to be followed. During the development of this methodology, it turns out that the reliability of the literature data and the estimated ones cannot be assured. For this reason, although these data are considered, they can be used only to obtain a rough safety analysis of the process and a pointer to the steps that need to be deeply investigated. Only experimental data can be applied in order to detect the possible hazards of a process.
permitting SMEs to perform a safety analysis even if there are few available resources. It has to satisfy two basic requirements: ease of use and comprehensibility. The CCR methodology is not yet operative and feedback from experts and companies is required to make it reliable and useful. For this reason, five Spanish enterprises have been contacted and they have been asked to test the methodology. A number of workshops have been organized in which the tool has been presented and applied to different processes of each enterprise. The feedback received during these meetings is being used to improve the methodology in order to satisfy the SMEs needs. REFERENCES ASTM, 1998, CHETAH 7.2, The ASTM Computer Program for Chemical Thermodynamic and Energy Release Evaluation (American Society for Testing Materials (E27.07), Philadelphia, PA, USA). [Also available as NIST Special Database 16; www.chetah.usouthal.edu= and www.normas.com=ASTM=BOOKS=DS51C.html] CCPS, 1969, Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples (American Institute of Chemical Engineers, New York, USA). Gustin J.L.,1992, Runaway reactions, their courses, and the methods to establish safe process conditions, Risk Anal Int, 12: 475–448. NFPA, 2001, NFPA 704: Standard for the Identification of the Fire Hazards of Materials for Emergency Response, 2001 Edition, National Fire Protection Association, Quincy, MA. [Also see: www.atsdr.cdc.gov= NFPA=nfpa_label.html] Nomen, R. and Sempere, J., 2001, Quimica fina en un nuevo entorno, Ing Quı´m, 384: 75–78. Serra, E., 1999, Metodologies per l’ana`lisi del risc te`rmic de processos quı´mics discontinus, Doctoral Thesis, Institut Quı´mic de Sarria`, Barcelona. Steinbach J., 1999, Safety Assessment for Chemical Processes (Wiley-VCH, Weinheim, Germany). Stoessel F., 1993, What is your thermal risk?, Chem Eng Prog, 89(10): 68–75. US EPA, 1980, A Method for Determining the Compatibility of Chemical Mixtures, EPA-600=2-80-076, US Environmental Protection Agency.
CONCLUSIONS
ACKNOWLEDGEMENT
A runaway is a complex reactive scenario that may have a high number of possible causes and lots of parameters influencing its probability and severity. The Check Cards for Runaway have been developed with the intention of
The authors recognize the support received from the Direccio´ General de Consum I Seguretat Industrial of the Generalitat de Catalunya. The manuscript was received 1 May 2003 and accepted for publication after revision 18 August 2003.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
www.ingentaselect.com=titles=09575820.htm
CHECK CARDS FOR RUNAWAY (CCR) An Operative Tool for the Risk Assessment of Highly Reactive Systems Performed in Small- and Medium-sized Enterprises R. NOMEN, J. SEMPERE*, E. SERRA, A. PEY, J. SALES and V. GHINAGLIA Institut Quı´mic de Sarria`, Universitat Ramon Llull, Barcelona, Spain
T
he Check Cards for Runaway is a simple tool to evaluate quickly the safety level of a chemical plant liable to suffer a runaway reaction. It is obtained by defining all the necessary safety considerations required to design a safe process and predicting systematically all the runaway hazards. Moreover, this tool can be used even when only limited resources are available, as in the case of many small and medium-sized enterprises. The tool resulting from this project is very simple and requires only standard chemical knowledge. Keywords: runaway; hazard; SMEs; risk assessment; critical factor.
INTRODUCTION
of Environmental Sciences, Energy Research and Process Innovation (Apledoorn, The Netherlands), with the financial support of the Generalitat de Catalunya (Barcelona, Spain). The main target of this project is to obtain a simple tool to quickly evaluate the safety level of a chemical plant liable to suffer a runaway reaction. It will try to define all necessary safety considerations required to design a safe process and to systematically predict all runaway hazards. Moreover, it should be useful to SMEs where limited resources are available.
It is well known in the chemical industry that any accident, however small, usually has a negative impact and causes alarm to the surrounding population. In particular, since the Seveso accident (1976), the European Chemical Industry is experiencing an increase in social and environmental pressure (Nomen and Sempere 2001). This situation has resulted in improvements in process practice and, consequently, has raised safety standards in the chemical industry. Nevertheless, accidents still represent dangerous events in the chemical industry because of the severity of their consequences. Considering the environmental impact as well as the possibility of injury of the people involved in such accidents, the highest possible standards of safety need to be achieved. Most large companies use robust hazard assessment methods, including some sophisticated experimental techniques, in order to reduce both the frequency and the severity of potential accidents. However, disseminating this practice (including basic concepts and methodologies) to the huge number of small and medium-sized enterprises (SMEs) in the fine and speciality chemical industry in Europe is difficult. Moreover, the use of the expensive experimental techniques is not possible for many SMEs. Most SMEs make use of existing methods for risk assessment such as check lists, fault trees or HAZOP (Steinbach, 1999). The Check Cards for Runaway are a part of the ART project (Thermal Risk Audit), that is being developed at the Institut Quı´mic de Sarria`—Universitat Ramon Llull (Barcelona, Spain), in collaboration with the TNO Institute
RUNAWAY ASSESSMENT To develop such a tool means creation of a procedure that should allow checking of whether adequate safety measures have been taken to avoid a runaway reaction. Following the purpose of this project, the tool should be as simple as possible and must contain only standard chemical knowledge to be applied by the SMEs when designing, upgrading or running new or existing processes. It is obvious that, if a possible hazard is not detected, no safety measures can be taken. As a first step, a method is needed to easily identify potential hazards in a chemical process. Afterwards it is possible to focus on specific types of hazards, such as runaway reactions, and on how such hazards can be handled to avoid their consequences. Figure 1 presents the main work line by which a hazard can be identified, evaluated and reduced to an acceptable safety level. Early hazard detection in the design process must be one of the objectives of the engineering team. In this process, first all the potential hazards have to be identified, then each potential hazard has to be assessed.
*Correspondence to: Professor J. Sempere, Institut Quı´mic de Sarria`— Universitat Ramon Llull, Via Augusta, 390, E-08017 Barcelona, Spain. E-mail: [email protected]
5
6
NOMEN et al.
Figure 1. Hazard identification process.
Defining which data are required to assess each potential hazard is the next step towards the development of the methodology. Once the data are defined, the necessary tests are selected and run. It must be clear that the selection of the tests to be performed should be directly related to the hazard that must be assessed. Running tests in a systematic way just because it is common practice should be avoided. There must be a reason to run a test, and that reason must be theoretically founded. Until now in this paper, a general idea of hazard management has been presented. Now it is time to go into the anatomy of hazard: to determine a generic hazard structure is an important step towards the development of a tool for
coherent use by SMEs. Having the elements of the hazard well defined allows us to follow the same pattern consistently when assessing a runaway scenario. Figure 2 shows the basic components that can be identified on accidents or near misses. By defining the hazard components, it can be clearly seen where it is necessary to define the safety concepts and which defence level is being analysed. One of the most important characteristics of the tool presented here is to define a coherent and well-defined starting point from which to integrate all the causes that may trigger or provoke a runaway. As shown in Figure 2, it is thought that there are three possible starting points to
Figure 2. Hazard structure.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
7
CCR IN SMES develop the tool: the cause that can generate the hazard, the chemical behaviour of the substances involved in the hazard and the critical factor, defined as a generic hazard that can appear as a consequence of a cause. Each starting point is linked to a different methods or tools to examine them and with the defensive lines that can be associated with them. Figure 2 also shows how the different starting points are related to each other Next, those points, the strategy connected to them and the links established in Figure 2 are explained in more detail: Cause It is an individual and certain event that will trigger the appearance generation of a factor. Causes are defined depending on the process that is being assessed; they are not of general application, but the consequences that arise from them may be common to all the processes. A cause-based strategy can be based on a list of all the operations carried out and all the items in a chemical process. Then they can be analysed to determine all the credible errors or failures arising from those operations and items. Afterwards, the resulting immediate consequences would be analysed and, together with chemical behaviour, it would be possible to find out if a single event is able to evolve and to influence the process in becoming a hazardous process deviation. An important drawback is that this method is thought to be slow because of the huge number of operations and possible failure points that can be found in a process. It is also difficult to develop general safety considerations and assessment lines when the main analysis is done upon certain process items. A cause is usually the starting point on assessments like HAZOP, HAZAN and fault tree analysis. Preventive safety measures will depend on the causes defined. Chemical Behaviour This is the behaviour of the substances involved in the process, considering both process conditions and other credible abnormal conditions that can trigger a runaway. The most interesting chemical properties for a runaway assessment are those related to exothermal activity and reactions with other substances. Chemical behaviour together with critical factors is important to define which are the dangerous conditions for a chemical system. A chemical behaviour-based strategy should be more selective. It must be focused on the tests that have to be made to obtain chemical data. The target should be to detect all possible dangerous chemical behaviour from tests. Afterwards it is necessary to define the hazardous conditions that would trigger dangerous behaviour, and finally to identify the primary causes that may trigger those hazardous conditions. It is thought that, as there is no clear agreement on tests and data analysis, it would be more difficult to obtain this type of tool. It is also thought that tests are a tool to be used after a previous analysis and not as a starting point. This strategy is not so close to process operation; the scope is nearer to the theoretical and laboratory work, and this kind of tool needs to be close to the process but distant enough to be able to contain generic considerations about safety assessment.
Critical Factor A critical factor is a generic hazard that may appear in a process as the consequence of a cause. Generic hazards or factors are defined on a theoretical basis. All the factors defined must always be studied to find out which ones are of importance in the process. If the factor is likely to appear in the process causing a hazardous situation, then it is called a critical factor. Critical factors will define which are the parameters that must be tracked in the installation in order to control the process and to set up the alarm conditions and the safety measures. The cause–critical factor link is, in fact, a cause– effect link, the effect being a hazardous process deviation. A factors-based strategy would focus on defining generic situations for hazard assessment. A factor is both near the specific causes and in close interaction with chemical behaviour and the process conditions considered, which are necessary to define whether a factor is critical or not. It is believed that the factors are half-way from plant operations and laboratory tests. They make it easy to define which data is required for their evaluation, and from the data the tests can be specified. Moreover, once the critical ones are detected, it will be clear which errors or failures will trigger them. From the combined assessment of chemical behaviour, process conditions and critical factors, the hazardous process deviation arises. This deviation may develop and constitute an accident or be kept under control with emergency safety measures and become a near miss. Emergency safety measures will be designed using the conditions that can be achieved during those deviations. There will be a point where no more control will be available. At this point only mitigation measures are useful. THE CHECK CARDS FOR RUNAWAY Once all the information about a runaway hazard has been collected and analysed, the next step is to determine how the tool will face the safety assessment. The Tool Strategy A factor-based strategy is the best possible way to define a tool for a hazard assessment: it is good to start the assessment from a point that is half-way between plant operation and laboratory tests. This approach will focus on defining generic situations for hazard assessment. Five factors are defined to assess a runaway event; it is believed that, with these being considered, most of the runaway scenarios are taken into account. The factors are mainly derived from the 10 runaway courses described by Gustin (1992). The chemical process has been split into three areas, which are thought to be essentially different from each other. In this way it is possible to better explain the influence of a factor on a certain process zone. These areas are: (1) Storage—chemicals handled in storage facilities are kept under certain conditions to maintain their chemical properties. There is no intended change of physical or chemical properties. Storage facilities include raw materials, products, by-products or residue holding facilities. (2) Physical processes—chemicals are submitted to physical treatment to change their physical properties; they
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
8
NOMEN et al.
may be heated, cooled, diluted, milled, dried, etc., but no chemical reaction is intended to happen on those processes. There are changes in physical properties but no changes on chemical structure or properties. (3) Reaction—intended changes on both physical and chemical properties are carried out during the reaction stage. It is a special zone of the chemical process and most of the time it is where most safety measures have to be taken. This is why special attention is given to this stage in the process. The factors are now presented explaining their theoretical basis. Mischarging chemicals This factor focuses on scenarios where a chemical mixture showing a violent and exothermic behaviour is achieved by error. As the system has not been designed to handle the reactive behaviour triggered, the heat released may exceed the normal cooling measures, leading the system to runaway conditions. The incompatible chemicals scenario is included by definition in this factor. A typical ‘incompatible chemicals’ scenario appears when two chemical substances that react in a violent and exothermic way with each other come into contact by error. A hazardous situation may also appear while handling the right chemicals. An error on proportions, concentration or mixing order may cause an undesired exothermal behaviour. Even if the intended reaction is taking place, if it is performed too fast heat will be released at a rate that cannot be managed by the cooling system. For these reasons chemicals handled, quantities used and mixing sequences are the key points on which safety measures must focus to prevent this factor appearing. Incorrect mixing must be avoided under any circumstances. Autocatalytic reactions The rate of autocatalytic reactions may increase at constant temperature. Chemicals exhibiting this behaviour must be handled with great care. Even if the reaction mass or bulk in storage vessels is well below a safety temperature, the reaction may lead to a runaway if the handling time is too long at that temperature. Examples of this behaviour are autocatalytic and radical chain polymerization reactions. It is common to find products exhibiting this behaviour mixed with a reaction inhibitor. The inhibitor is a temporary solution to reaction prevention because it is exhausted with time and, as the inhibitor concentration decreases, the reaction rate increases. In order to use an inhibitor as a controlling chemical, its concentration and homogeneity in the bulk must be controlled, as well as the presence of possible impurities that may trigger a reactive behaviour. Segregation The segregation of a phase may be a hazard for different reasons. The most important is that the segregated phase may show unstable exothermic behaviour. In addition, segregation may also affect the composition of the main phase from where the new phase separates, making it unstable. The third way through which segregation may be dangerous is that it may jam measurement devices like level, temperature or pressure probes. Loss of stirring or too low
a temperature are typical causes of segregation. A greater problem occurs when the segregated phase is highly unstable and can have shock-sensitive or detonating properties, or when the two phases can be mixed together again suddenly. The physical and chemical properties of mixtures and chemicals handled must be studied to find out if there is the possibility of segregation. Normal process conditions but also credible conditions under process deviation should be tested. The composition, the thermal behaviour and all possible reactions arising from each phase detected must be studied. Accumulation The accumulation problem arises from a misbalance between reactant consumption and dosing rate. The concentration of the controlling reactant in the bulk will be higher or lower depending on the dosing rate and the temperature. If this concentration reaches too high a value, then the reaction is triggered too fast and high exothermal behaviour appears, which may cause a runaway. As an accumulation scenario is directly related to the problem of dosing a reactant, this factor is only described for the reaction zone, and not defined for storage or process zones. All the parameters that may influence the consumption rate of reactants must be well defined and controlled. Events causing accumulation may be very different: an error on the dosage pump, the presence of an impurity inhibiting the reaction, temperature set too low by bad operation design or by error on temperature sensor, etc. Temperature hazard This kind of hazard may arise from two different situations: too high a system temperature or too high a local temperature or hot spot. A too high system temperature situation may be reached because of an extra heat input to the system by error (heating system valve failure, bad reading from a temperature sensor, human error on setting the process temperature, fire in the surroundings of the installation, etc.) or because of inadequate heat removal (if the cooling system is under an upset condition that reduces the heat removal capacity). In the hot spot scenario, care must be taken with mixtures showing heat sensitive behaviour: a hot spot may initiate an exothermic reaction that can propagate through the whole reaction mass. Hot spots are especially critical on vessels containing substances with detonating, deflagrating or selfigniting properties. This justifies the use of several temperature sensors as important to track the correct temperature profiles of the whole mass. Analysing each factor, the data necessary to perform the assessment of the process can be determined and collected. Therefore, a methodology has to be defined in order to analyse if a factor has to be considered critical and, in this case, if sufficient safety measures are implemented to manage it. The Tool Structure Data Collection Cards A card shape is thought to be the easiest way to organize all the information. Two types of cards are defined, the Data
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
CCR IN SMES Collection Cards, where all the data necessary to perform the safety evaluation are included, and the Data Analysis Cards, containing all the questions of the methodology. As quite a lot of data are necessary to assess the safety of the process, the simultaneous use of two tables is considered important for this tool: one table will contain physical and chemical properties of each substance involved in the process (including construction materials and wastes), and the other the process and reaction conditions. Properties will be listed for each individual step. In this way, it will be possible for all the necessary data to be found in one site and be used at any moment during the safety analysis. Moreover, the development of a system that associates substance properties to specific process stages, addresses another important issue related to the needs of SMEs: the standardization of the data collection in a way that could make their consultation and further use easier. Some notes have been added at the bottom of each table, explaining what is asked and how to calculate them. The following data are included in each table: Physical and chemical properties table The list of substances and mixtures utilized in the considered process. And for each substance or mixture defined: the chemical composition and CAS number (in order to know exactly what is the substance or mixture considered); the homologation or identification number used inside the enterprise (to be easily identified by the operators); the purity; the phase (solid, liquid or gas); the report on handling conditions (inhibitors, triggering agents, chemical substances able to influence the rate of reaction, etc.); the phase stability vs temperature and pressure (the T or P at which a different phase from the one expected under normal operating conditions appears); the specific heat (for mixtures, in the case of lack of data, it can be calculated using the average of the values of the single substances); the normal boiling point; the thermal activity at the storage temperature (understood as the stability of the substance or the mixture considering the maximum storage period); the deflagration or detonation sensitivity (simply defined as high, medium or low).
9
In the reaction and process conditions table The step considered (specifying to which of the three area it refers). And for each step: temperature and pressure (considering the possible gas production); substances involved (in each step considered); specific heat capacity of the mixture (the experimental value, if known; otherwise the average of the values of the single substances); heat of reaction [from experimental calculations, literature, Internet or simulation programs such as CHETAH (ASTM, 1998)]; MTSR (the maximum temperature reached following the occurrence of the desired chemical reaction under adiabatic conditions, starting from the designed process temperature); kinetic behaviour (specifying if the reaction is an Arrhenius, catalytic-homogeneous or heterogeneous or autocatalytic type); total adiabatic temperature rise (increase of reaction mass temperature, under adiabatic conditions, due to accumulation of the heat released, coming from the synthesis reaction and all the possible secondary reactions involved); thermal activity at the end of the step; MAXTSAFE (see below); influence of hot spot. Figure 3 shows the reactions and process conditions table, in which the required data can be introduced for each step of the process. The maximum safety temperature (MAXTSAFE) will be used to perform the ‘thermal evaluation’ of the process following the five criticality levels developed by Stoessel (1993). Many values can be found in literature references in order to define how to calculate it or, more generally, a limiting temperature above which it is considered that a runaway can occur. In some cases the ADT24 is used for this purpose. The ADT24 can be determined by adiabatic calorimetry as the temperature at which the adiabatic induction time of a possible decomposition reaction falls below 24 h. The problem is that this value is difficult to calculate and adiabatic calorimetry is a technique that is rarely found in SMEs. For this reason, it has been decided to include another way to calculate this maximum
Figure 3. Example of a data collection card for reaction and process conditions.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
10
NOMEN et al.
safety temperature, that requires less knowledge and less complicated techniques. Hence, if adiabatic calorimetry is not available, MAXTSAFE can be obtained by means of a dynamic DSC register of the reaction mass, with a heating rate of 5K min 1 (Serra, 1999), following this detailed procedure: the value of MAXTSAFE can be determined, at a first step, as the temperature at the first exothermal peak less than 70K; this safety reference is more objective than the temperature at which exothermic activity is first detected, Tonset, since the later may depend on the precision of the apparatus; it is necessary to compare this value with the MTSR. If jMTSR 7 (Tpeak 7 70) j > 50, then the approximation of MAXTSAFE ¼ Tpeak 7 70 can be considered correct; if this is not so, it is also necessary to perform an isothermal DSC at MTSR followed by a dynamic register; if MTSR > Tpeak 7 70, the isothermal register does not reveal any significant change of the mass reaction, and the dynamic register is equivalent to the first DSC performed, then it can be concluded that MAXTSAFE > Tpeak 7 70 and therefore MAXTSAFE > MTSR; if MTSR > Tpeak 7 70, the isothermal register does reveal significant change of the mass reaction (low velocity of the exothermal phenomena at the process temperature can be a problem for detection), and the dynamic register is not equivalent to the first DSC performed, then the approximation MAXTSAFE ¼ Tpeak 7 70 can be considered; if MTSR < Tpeak 7 70, the isothermal register does not reveal any significant change of the mass reaction, and the dynamic register is equivalent to the first DSC performed, then the approximation MAXTSAFE ¼ Tpeak 7 70 can be considered; if MTSR < Tpeak 7 70, the isothermal register does reveal significant change of the mass reaction, and the dynamic register is not equivalent to the first DSC performed, then it can be concluded that MAXTSAFE < Tpeak 7 70 and therefore MAXTSAFE < MTSR. When performing an isothermal DSC, it must be considered that a 12 h experiment should be long enough. Besides, low rate of exothermal phenomena at the process temperature can be a problem for detection. It is chosen not to work with another value frequently used in literature that can be estimated by means of a DSC register, the Tonset. The reason is that it strongly depends on the sensitivity of the apparatus, on the behaviour of the considered reaction and on the way the value is calculated, making its reliability unpredictable (Serra, 1999). The amount of required data has been reduced as much as possible and also readily available data used to obtain a tool that requires as few resources as possible, making it effective also when there is no deep knowledge of the process. Therefore, the data that could be easily calculated without the need of complex equipment have been chosen. In order to quickly detect the possible hazards arising from a dangerous mixture, a general compatibility chart and compatibility Chart specific for the considered process are included in the data collection cards. The second one has to be filled in by the SME itself, considering all the substances involved in the process. As seen before, one problem can be the lack of knowledge about the reactive behaviour of all the substances. For this reason, a ‘general’ chart (US EPA, 1980)
is included in the literature, in which a number of substances are grouped attending to reactivity criteria, and the interaction between each group is analysed. This is not intended to be exhaustive and it cannot be assumed that the substances are compatible if they are not classified as hazardous on the chart (the blanks do not necessarily mean that the mixture cannot provoke a hazard). In any case, the general compatibility chart can be used as basic knowledge in case of a lack of other information about the behaviour of the mixture. Following the same principle, a further useful information source is the NFPA (National Fire and Protection Association) index (NFPA, 2001). It is included at the bottom of the compatibility chart specific to the considered process: this identification can help better comprehension of the chemical behaviour of the substance. Furthermore, with the same intent of providing all the necessary information to make the safety analysis, a list of books and Internet sites where literature data and estimation methods can be found is included, defined as ‘Data Sources’. After the collection of all necessary data, they need to be correlated to the considered process area in order to define whether a factor would be critical or not. Data analysis cards As the detection of a critical factor, taking into account all the parts of the process related to each of the three areas (storage, process and reaction) at the same time, can be quite difficult, it has been decided to analyse the process considering the way the chemical companies describe it. They subdivide the process into steps, and then each step is described including operations, conditions and safety measures that need to be considered. The safety analysis is then performed considering one step at a time and referring each step to one of the three areas (storage, process or reaction). As a consequence, this analysis criterion can be easy to understand for SMEs. Furthermore, with such a structure, the detection factor can follow a scheme especially designed for the proper process area. In this way, the analysis can be more complete and easier to carry out, considering all the problems involved with each single step. When a factor is detected as critical, it has to be checked whether sufficient safety measures have been implemented in order to eliminate it. The checklist method is the better tool for the purpose. However, using only this methodology, it is not possible to evaluate the evolution of a hazardous situation and to think about the possible safety measures that needed to be considered. The ‘what-if=checklist’ method (CCPS, 1969) is the best solution for this last aspect. This analysis method combines the creative, brainstorming features of ‘what-if’ analysis with the systematic features of the checklist method. The purpose of such an analysis is to identify hazards, considering the types of accidents that can occur in a process, evaluating in a qualitative manner the consequences of these accidents and determining whether the safety measures appear adequate or not. Combining these two methods emphasizes their main positive features (i.e. the creativity of a ‘what-if’ and the experience-based thoroughness of a checklist), while at the same time compensating for their faults when used separately.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11
11
CCR IN SMES
Figure 4. Data analysis card for the segregation factor of a reaction step.
A review of the classical ‘what-if=checklist’ methodology is done and a ‘yes=no tree’ of questions is created, which constitute the data analysis cards. This structure allows consideration of the criticality of each factor due to both its chemical behaviour and the process conditions, and decision on whether or not the safety measures implemented are sufficient. Each step of the process has to be referred to one process area and then the full list of questions has to be followed. For each step, all the critical factors that can come up in each area are considered, and for each factor a list of questions to investigate its criticality is presented. The ‘what if=checklist’ questions are structured in the way that at the end of each ‘tree’ of questions only two possibilities can be achieved: a justification of the non-criticality of the factor considered, due to the chemical behaviour of the substances involved, the process conditions considered or the safety measures used; the intention is to assure that the person that is doing the analysis has considered and deeply analysed the question in all its aspects. ‘review your safety measures’ when the factor is found to be critical and a review of process or safety measures is necessary. Figure 4 shows the checklist for the Segregation factor of a reaction step. After each list of questions for the different areas, a scheme to be used to answer the questions is included, to help understand the path that needs to be followed. During the development of this methodology, it turns out that the reliability of the literature data and the estimated ones cannot be assured. For this reason, although these data are considered, they can be used only to obtain a rough safety analysis of the process and a pointer to the steps that need to be deeply investigated. Only experimental data can be applied in order to detect the possible hazards of a process.
permitting SMEs to perform a safety analysis even if there are few available resources. It has to satisfy two basic requirements: ease of use and comprehensibility. The CCR methodology is not yet operative and feedback from experts and companies is required to make it reliable and useful. For this reason, five Spanish enterprises have been contacted and they have been asked to test the methodology. A number of workshops have been organized in which the tool has been presented and applied to different processes of each enterprise. The feedback received during these meetings is being used to improve the methodology in order to satisfy the SMEs needs. REFERENCES ASTM, 1998, CHETAH 7.2, The ASTM Computer Program for Chemical Thermodynamic and Energy Release Evaluation (American Society for Testing Materials (E27.07), Philadelphia, PA, USA). [Also available as NIST Special Database 16; www.chetah.usouthal.edu= and www.normas.com=ASTM=BOOKS=DS51C.html] CCPS, 1969, Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples (American Institute of Chemical Engineers, New York, USA). Gustin J.L.,1992, Runaway reactions, their courses, and the methods to establish safe process conditions, Risk Anal Int, 12: 475–448. NFPA, 2001, NFPA 704: Standard for the Identification of the Fire Hazards of Materials for Emergency Response, 2001 Edition, National Fire Protection Association, Quincy, MA. [Also see: www.atsdr.cdc.gov= NFPA=nfpa_label.html] Nomen, R. and Sempere, J., 2001, Quimica fina en un nuevo entorno, Ing Quı´m, 384: 75–78. Serra, E., 1999, Metodologies per l’ana`lisi del risc te`rmic de processos quı´mics discontinus, Doctoral Thesis, Institut Quı´mic de Sarria`, Barcelona. Steinbach J., 1999, Safety Assessment for Chemical Processes (Wiley-VCH, Weinheim, Germany). Stoessel F., 1993, What is your thermal risk?, Chem Eng Prog, 89(10): 68–75. US EPA, 1980, A Method for Determining the Compatibility of Chemical Mixtures, EPA-600=2-80-076, US Environmental Protection Agency.
CONCLUSIONS
ACKNOWLEDGEMENT
A runaway is a complex reactive scenario that may have a high number of possible causes and lots of parameters influencing its probability and severity. The Check Cards for Runaway have been developed with the intention of
The authors recognize the support received from the Direccio´ General de Consum I Seguretat Industrial of the Generalitat de Catalunya. The manuscript was received 1 May 2003 and accepted for publication after revision 18 August 2003.
Trans IChemE, Part B, Process Safety and Environmental Protection, 2004, 82(B1): 5–11