Safety in Design

Preface

This book emanates from the production of organic peroxides. The Dutch multinational Akzo Nobel, for which I worked as a chemical engineer between 1968 and 2000, manufactures these compounds.

In 1969, a Dutch company named Noury & Van der Lande became part of Akzo Nobel. That company had discovered around 1920 that dibenzoyl peroxide, a solid particulate material, can remove the yellowish color of flour. The finding was patented worldwide, licenses were given, and the industrial production of dibenzoyl peroxide was started. The production of synthetic plastics has increased since the 1940s, resulting in the increasing importance of organic peroxides as initiators of the radical polymerization of vinyl monomers. Noury & Van der Lande also started the production of organic peroxides for this application.

The expression peroxides is short for superoxides. It indicates that the compound contains relatively much oxygen. All or part of this oxygen is active oxygen. The active oxygen causes the desired action at the application of the organic peroxides. For example, the bleaching of flour is caused by the liberation of active oxygen, oxidizing carotene to colorless compounds. A further example, at the manufacture of polymers, is the decomposition of organic peroxides at relatively low temperatures to form free radicals. The free radicals act as initiators for polymerization reactions.

Explosions and fires at the manufacture and the handling of these compounds have happened in the past. Peroxides are characterized by the presence of the peroxo group –O–O–. In organic peroxides, this group is bound to at least one carbon atom, or is bound to a carbon atom via a different atom. The presence of the peroxo group causes the thermal instability of organic peroxides. It also, in many instances, causes the sensitivity to impact, friction, and other chemicals. For example, dry dibenzoyl peroxide is very sensitive to impact, and serious accidents caused by this sensitivity have happened with this material in the past.

In retrospect, the most serious accidents within Noury & Van der Lande and Akzo Nobel occurred between 1935 and 1975. In this period, the production increased from tens to hundreds of metric tpa per product. The majority of serious accidents occurred during the reactions to produce organic peroxides.

My former colleague, the late Hans Gerritsen, proposed a method to improve the protection of the manufacture and handling of organic peroxides significantly. The method is called intrinsic continuous process safeguarding. The safeguarding is based on chemical and physical properties of reaction systems, and an activation of protection systems is not required. The method is also applicable to other chemical production systems. It is discussed in Chapter 1.

Hans Gerritsen also, at Deventer in The Netherlands in 1985, drew my attention to the fact that the methodology can be applied to all types of human activity, and that is what this book is about.

Acknowledgments

I am grateful to Jan de Groot, who read the manuscript and, in doing so, made useful suggestions. Jan is the retired Head of Akzo Nobel's Safety Laboratory.

I am also grateful to retired professor Ad Verkooijen, who read Chapter 10 titled Nuclear Power Stations. His comments enabled me to improve its contents.

Thanks are also due to many people providing information and figures. Their help was invaluable. Most people are open and supportive.

I am greatly indebted to my wife, Annechien, for her constant encouragement and patience.

C.M. van ’t Land

1

Introduction

1.1 Introduction

A concept developed for the chemical industry can also be applied to other fields. This concept is called intrinsic continuous process safeguarding and is discussed in Section 1.2. It is related to the concept of inherently safer design. How the application of the concepts of inherently safer design and intrinsic continuous process safeguarding could have prevented three serious accidents in the chemical industry or mitigated its effects is briefly indicated in Sections 1.3–1.5. Section 1.6 contains concluding remarks.

1.2 Intrinsic Continuous Process Safeguarding

The danger of explosions, evolution of toxic gases, etc., comes with the large‐scale manufacture of certain chemicals. The prevention or control of undesirable reactions in processes is discussed in a paper [1]. The aim of intrinsic continuous process safeguarding is to obtain stable reaction systems that, within very wide limits, are not endangered by human errors or equipment failures. The approach has shown its merits at the manufacture of organic peroxides. It is related to the concept of inherently safer design [2]. Intrinsic continuous process safeguarding is compared to extrinsic process safeguarding in the paper mentioned earlier [1]. The latter safeguarding starts working upon a signal. Extrinsic process safeguarding is appropriate only as complementary and secondary protection: As complementary safeguarding by providing protection in places through which entering the hazardous area is improbable and as secondary protection by drawing up a second line of defense behind the intrinsic protection line.

Several serious accidents occurred in plants of the chemical industry in the second half of the previous century. Explosions, fires, and the emission of toxic materials were experienced. Three of these accidents will be discussed shortly in the following paragraphs. Kletz formulated the concept of inherently safer design, which encompasses hazard elimination and hazard reduction, for the first time in 1978 [3]. It was concerned with the safeguarding of the manufacture of chemicals. Our paper [1] also concerned the safeguarding of the manufacture of chemicals. The principles of these two related approaches can be used to formulate a generally applicable design strategy for the chemical industry. It is briefly indicated how the concepts of inherently safer design and intrinsic continuous process safeguarding could have either prevented the accidents in the chemical industry, described in the following paragraphs, or could have mitigated its effects.

1.3 The Flixborough Accident in the United Kingdom in 1974

This accident occurred near a small village called Flixborough in a plant having a capacity of 70 000 tons of caprolactam per annum [4]. Caprolactam is an intermediate for the manufacture of Nylon 6 and Nylon 66. The village is in Lincolnshire and located south of Hull at England's east coast. The date of the accident is June 1, 1974. The accident comprised an explosion in the plant followed by fires. The name of the company involved was Nypro. It was jointly owned 55% by Dutch State Mines (DSM) and 45% by the National Coal Board (NCB) of England. Of those working on the site at the time, 28 were killed and 36 suffered injuries. Injuries and damages outside the works were widespread, but no one was killed. Fifty‐three people were recorded outside the works as casualties. The 24‐ha plant was almost completely destroyed. Outside the works, property damage extended over a wide area. The Report of the Court of Inquiry [4] states that the cause of the disaster was the ignition and rapid acceleration of deflagration, possibly to the point of detonation, of a massive vapor cloud formed by the escape of cyclohexane from the air oxidation plant under at least a pressure of 8.8 kg cm−2 and at a temperature of 155 °C. In this plant, cyclohexane was, by means of a continuous process, converted into a mixture of cyclohexanol and cyclohexanone. Cyclohexanone was the intermediate product of the air oxidation plant. The Court estimates that the explosion was of the equivalent force to that of some 15–45 tons TNT. The cyclohexane oxidation plant contained six continuously stirred tank reactors in series. Prior to the accident, a reactor had to be removed for repair and the gap was bridged by a temporary 20‐in. pipe, connected by a bellows at each end and inadequately supported on temporary scaffolding. The pipe collapsed. The escaping cyclohexane was a flashing liquid. At atmospheric pressure, its boiling point is 80.8 °C. Approximately one‐quarter of the escaping cyclohexane, having a temperature of 155 °C, evaporated on escaping. The remaining three quarters thereby cooled down to, in principle, the boiling point at atmospheric pressure, that is, 80.8 °C. Much of the remaining liquid formed a spray. The large cloud formed made the explosion possible. The source of the ignition was probably a hot surface in the hydrogen plant of the caprolactam plant.

Before 1972, cyclohexanone was produced at Flixborough via the liquid‐phase hydrogenation of phenol. The latter process is a safer process than the air oxidation process. The reason is that it proceeds at temperatures below the atmospheric boiling point of the reaction liquids. Specifically, the boiling points at atmospheric pressure of phenol, cyclohexanol, and cyclohexanone are, respectively, 181.75, 161.1, and 156.5 °C. From a safety point of view, the oxidation process introduced a new dimension. Large quantities of cyclohexane had to be circulated through the reactors under a working pressure of 8.8 kg cm−2 and at a temperature of 155 °C. Any escape from the plant was therefore potentially dangerous. As stated above, the temporary 20‐in. pipe in the oxidation plant was inadequately supported. However, a similar error in a liquid‐phase phenol hydrogenation plant would not have had comparable consequences.

1.4 The Seveso Emission in Italy in 1976

This accident occurred near a small village called Meda near Seveso, a town of about 17 000 inhabitants some 15 miles from Milan in Italy [5]. The accident happened on July 10, 1976. It comprised the emission of a white cloud drifting from the works from which materials settled out downwind. Among the substances deposited was a very small amount of 2,3,7,8‐tetrachlorodibenzo‐p‐dioxin (TCCD), which is also known as dioxin, although there are more dioxins. This specific dioxin is one of the most toxic substances known. The process that gave rise to the accident was the production of 2,4,5‐trichlorophenol (TCP) in a batch reactor. TCP is used for herbicides and antiseptics. The name of the company involved was ICMESA. It used a process developed by Givaudan, which was itself owned by Hoffmann La Roche. These last two companies are Swiss companies, whereas the former one is Italian.

People fell ill and animals died in the contaminated area over the days following July 7, 1976. People were evacuated from the area affected. There were no deaths of humans directly attributable to TCCD.

The reactor from which the emission took place was a 13 875‐l vessel equipped with a stirrer and with a steam jacket supplied with steam at 12 bara. The boiling point of water at 12 bara is 188 °C.

The reactions to produce TCP had been started at 16.00 h on July 9, 1976. This date was a Friday. At 05.00 h on July 10, 1976, the batch was interrupted. The background was the closure of the plant for the weekend. At that point in time, the first chemical reaction had been completed. A distillation step followed the first chemical reaction; it comprised the removal of part of ethylene glycol (a solvent) from the reactor. The latter step had been started but had not been completed. The heat required for this distillation was supplied via a jacket. Steam entering the jacket came from a turbine. Because of the approaching weekend, the steam turbine was on reduced load and, although the steam pressure was 8 bara, its temperature had risen to about 300 °C. The interruption of the batch comprised the stopping of the heating and the stirring. At 05.00 h on July 10, 1976, the batch temperature was 158 °C. The upper section of the reactor wall, not wetted by the reactor contents, had, at that time, a temperature higher than 158 °C. The latter temperature was caused by the relatively high steam temperature. Based on this fact, Theofanous [6] proposed a sequence for the reaction runaway. The residual heat in the upper reactor section raised the temperature of the top layer of the liquid to 200–220 °C by radiation, a temperature high enough to initiate a runaway reaction leading to decomposition. Such a hot spot could develop because the stirring had been stopped. At 12.37 h on July 10, 1976, the bursting disk on the reactor ruptured and the emission took place.

The high temperature of the heating medium is, safetywise, an aspect. Noticeable decomposition reactions of the reaction mixture concerned already start at 185 °C. Limiting the temperature of the heating medium to, e.g. 165 °C, would have been appropriate. As to the manufacturing of TCP, it would have been better to bring the batch to completion. However, with a reduced heating medium temperature, the process would probably not have been endangered by human error.

1.5 The Bhopal Emission in India in 1984

This accident occurred at Bhopal in India in a plant manufacturing carbamate pesticides [7, 8]. It is by far the worst accident that has ever occurred in the chemical industry. Bhopal is located in Central India in the state of Madhya Pradesh. At the time of the emission, the town had 800 000 inhabitants. The plant was located at the outskirts of Bhopal. The date of the accident is December 3, 1984. The name of the company concerned was Union Carbide India Ltd (UCIL). The emission comprised the release of gaseous methyl isocyanate (MIC) through a nonfunctioning vent gas scrubber having a height of 30 m onto housing adjoining the site. The chemical is extremely toxic. MIC was an intermediate at the manufacture of Sevin, an insecticide. MIC could escape because it became inadvertently or deliberately contaminated with water in a storage tank. An exothermic reaction between MIC and water occurred. The reaction heat caused the evaporation of the compound. An aspect is that MIC's boiling point at atmospheric pressure is 38 °C. The rising pressure in the storage tank caused a relief valve to open. The inadvertent contamination with water due to a flushing (washing) operation is generally considered more probable than the deliberate contamination.

The number of people killed is officially 3787 [8] but is in actual fact much higher. Many more were wounded.

For the purpose of our present discussion, it is relevant to remark that a hazard and operability study of the plant might have revealed ways in which MIC could be contaminated by water. It would then be possible to prevent water to come into contact with MIC. Further main points are that a Sevin process route exists at which MIC is not obtained as an intermediate, that the intermediate storage was rather large, that several plant systems were not in working order, that the plant was not maintained properly, and that housing was too close to the plant.

1.6 Concluding Remarks

Intrinsic continuous process safeguarding is a safeguarding originating from the core of the process and is consequently directly and completely based on the reaction system and the reaction conditions; the safeguarding is based on chemical and physical properties [1].

Over time, people have invented and developed intrinsically protected approaches in many types of human activities. Two examples of such approaches will be discussed briefly. The first example concerns collecting mushrooms. The Amanita phalloides (a very toxic mushroom) may be mistaken for the champignon mushroom (edible). The color of both mushrooms tends toward white. An intrinsically protected, or, in other words, an inherently safer way of collecting mushrooms is to collect chanterelles, edible yellow mushrooms. The false chanterelles exist; however, they are edible, just not tasty. The Jack O’Lantern mushroom also appears similar to the chanterelle. The latter poisonous mushroom is usually found in woodland in North America. Although not lethal, consuming the Jack O’Lantern mushroom leads to strong complaints. Still, the collection of chanterelles is safer than the collection of champignon mushrooms.

The second example is given by Mannan [3]. A double‐track railroad, with a dedicated track for each direction of travel, is inherently safer than a single track for both directions of travel.

References

[1] Gerritsen, H.G. and van ’t Land, C.M. (1985). Intrinsic continuous process safeguarding. Industrial & Engineering Chemistry Process Design and Development 24: 893–896.

[2] Mannan, S. (2005). Lees' Loss Prevention in the Process Industries: Hazards Identification, Assessment, and Control, 32/1–32/24. Amsterdam, Boston: Elsevier Butterworth‐Heinemann.

[3] Mannan, S. (2005). Lees' Loss Prevention in the Process Industries: Hazards Identification, Assessment, and Control, 32/2–32/3. Amsterdam, Boston: Elsevier Butterworth‐Heinemann.

[4] Court of Inquiry (1975). The Flixborough Disaster. London: Her Majesty's Stationary Office.

[5] Mannan, S. (2005). Lees' Loss Prevention in the Process Industries: Hazards Identification, Assessment, and Control, Appendix 3/1–3/13. Amsterdam, Boston: Elsevier Butterworth‐Heinemann.

[6] Theofanous, T.G. (1983). The physicochemical origins of the Seveso accident – I. Chemical Engineering Science 38: 1615–1629.

[7] Mannan, S. (2005). Lees' Loss Prevention in the Process Industries: Hazards Identification, Assessment, and Control, Appendix 5/1–5/11. Amsterdam, Boston: Elsevier Butterworth‐Heinemann.

[8] Pietersen, C.M. (2009). After 25 Years: The Two Largest Industrial Disasters Concerning Dangerous Substances, LPG Disaster Mexico‐City and Bhopal Tragedy, 63–91. Nieuwerkerk aan den IJssel, The Netherlands: Gelling Publishing (in Dutch).

2

Procedural, Active, and Passive Safety

2.1 Introduction

How the safety in the chemical industry can be improved by the application of intrinsic continuous process safeguarding was discussed in Chapter 1. The concept was compared with extrinsic process safeguarding, which starts working upon a signal. It is, for other fields in society, useful to distinguish between procedural, active, and passive safety. Their definitions are given in Section 2.2. In Section 2.3, four examples of emergency power units that failed to come into action are dealt with. Three examples concern hospitals and one example a chemical plant. An emergency power unit is an active safety measure, as it starts working upon a signal. The failure of the blowout preventer (BOP) (an active safety measure) during the Gulf Oil accident in 2010 is discussed in Section 2.4. Section 2.5 deals with the safeguarding of Formula One races by means of mainly passive safety measures. Finally, Section 2.6 discusses explosion panels, also called bursting disks. These parts are designed to give in, if, due to a dust explosion, the subsequent pressure in a piece of equipment surpasses a predetermined value. Safeguarding by these components is continuously present.

2.2 Definitions

The definitions in this paragraph are borrowed from Kletz’ and Amyotte’s book [1]. A procedural safety method is a method activated by a human. The extinction of a fire by a fireman is an example. Of course, to avoid fires, preventive measures should be considered first. The use of materials that cannot take fire is an example. Complete cities burned down in the middle ages because the houses were made out of wood. Still, we cannot completely avoid the occurrence of fires, and to cope with the effects by means of a procedure is a possibility. However, the fire brigade may come in too late.

An active safety method is activated by a signal. For instance, in case of a fire, a water spray is turned on automatically by a smoke, flame, or heat detector. However, the equipment may fail or be turned off.

Both procedural safety methods and active safety methods can be compared to the concept of extrinsic process safeguarding used in the chemical industry as described in Chapter 1.

Finally, a passive safety method is immediately available. In case of a fire, fire‐proof insulation is continuously available and does not need activation by humans or equipment. Passive safety methods can be compared to intrinsic continuous process safeguarding as described in Chapter 1.

Generally speaking, passive safety measures are better than active safety measures because they do not need activation. Active safety measures are better than procedural safety measures because they are already present.

2.3 Four Failures of Emergency Power Units

2.3.1 Introduction

Four failures of emergency power units are discussed in Section 2.3. Emergency power units provide active safety as they start working upon a signal. The safeguarding or protection is not continuously present, and an activation is required. The four different failures of emergency power units to come into action have four different causes. The failure of active safety is in hospitals mostly followed up by procedural safety.

2.3.2 Twenteborg Hospital at Almelo in The Netherlands in 2002

On July 30, 2002, the Twenteborg hospital at Almelo in The Netherlands was struck by lightning [2, 3]. The external electric power supply was interrupted. In such a case, the emergency electric power supply should start automatically. Thus, this provision is an active safety measure. However, the diesel engines of the generators of the emergency power supply did not start because lightning had also damaged the circuitry of the emergency power supply. It took half an hour to repair the external electric power supply. Essential equipment was connected manually to a local accumulator in this period.

2.3.3 Westfries Gasthuis (Hospital) at Hoorn in The Netherlands in 2003

The external electric power supply of the Westfries Gasthuis (hospital) at Hoorn in The Netherlands was interrupted at 22.30 h on November 24, 2003 [4]. The emergency electric power supply should take over automatically in such a case. Similar to the previous case, this provision is an active safety measure. However, because of a faulty relay, the generators of the emergency electric power supply did not start. At 23.00 h, the fire brigade had installed emergency power supply generators for critical departments of the hospital. These departments were, e.g. intensive care, cardiology, and incubators. In the meantime, hospital personnel had taken care of the breathing upon of patients manually (procedural safety). Childbirths and operations did not take place at the time of the interruption of the external electric power supply. The external electric power supply had been fully restored at 03.30 h on November 25, 2003.

A notable aspect is that the emergency electric power supply did not work in spite of the fact that it had been successfully tested in October 2003.

2.3.4 ZGT Hengelo Hospital at Hengelo (O) in The Netherlands in 2011

The electric power supply to the ZGT Hengelo hospital at Hengelo (O) in The Netherlands was interrupted at 08.05 h on May 8, 2011 [5]. The cause was short‐circuiting within the equipment controlling the power supply to the hospital. There was no interruption of the external power supply. The circuitry of the emergency power supply could not detect the interruption of the