7

AN EXAMPLE:
THESE GUIDELINES APPLIED TO THE
SAFE AUTOMATION OF A BATCH
POLYMERIZATION REACTOR

7.0 INTRODUCTION

This chapter selects a subsystem of an existing process and applies to it the

design philosophy, procedures, techniques, and verification methodology
discussed in the first six chapters of this book. The SIS selection methods
chosen for use in this example illustrate both qualitative and semiquantitative
approaches, that are within the broader spectrum of qualitative and quantita-
tive methods. Each company should have policies and guidelines for selection
of appropriate SIS integrity classification methods.
Because of the amount of detail that is required to achieve a high-integrity, safely
automated design, the example used in this chapter necessarily includes a number of
simplifications, but is presented to show the application and discussion of the prin-
ciples described earlier. Further, the specific desigii choices do not reflect practices tlwt
are part of a particular company's standards, but are representative of good practices.
It certainly does not represent a complete design for a polymerization process.
The process, described in Section 7.1, is the polymerization of vinyl chloride
monomer (VCM),
CH2-CHCl
to make polyvinyl chloride (PVC),
[-CH2-CHCl-In
The example is based on a well-known process scheme and involves a
hazardous reactant, VCM, which is flammable and has toxic combustion
products, as well as being a known carcinogen. The process also illustrates a
larger-scale batch operation that operates in a semicontinuous manner during
an approximately 10-hour period while the polymerization progresses. A
simplified description of the process steps is also provided. In Section 7.2,
hazards are identified; in Section 7.3 the process design strategy is described,
considering some of the design philosophy issues presented in Chapter 2.
Section 7.4 addresses development of the process control system design
strategy. Then, in Section 7.5, a BPCS is designed following the guidelines in
Chapter 4. Section 7.6 reviews the risk assessment and control evaluations
following the techniques covered in Chapter 3. Section 7.7 treats the SIS design
and validation as described in Chapter 5; Section 7.8 covers issues relating to
installation and testing based on material in Chapter 6. Finally, in Section 7.9,
administrative procedures needed to maintain operational integrity are out-
lined, as discussed in Chapter 6.
Although the material in this chapter is based on the design of a new process
unit, in Section 7.10 the differences are contrasted between the approach taken
and the approach that might be necessary if automation were being added to
an existing process unit, designed using older process control approaches.

7.1 PROJECTDEFINITION

7.1.1 Conceptual Planning

Once a business decision is made to consider producing a certain product, in
this example, polyvinyl chloride, the initial project team is assembled. This
team will start by evaluating potential process routes to identify a technology
that will satisfy production needs while meeting responsibilities for health,
safety, and protection of the environment. In the very early stages of process
evaluation and project definition, a process hazards analysis team starts to
interact closely with the designers. For projects handling hazardous materials,
the team will include not only process design engineers but also health and
safety specialists. The team will often need to have access to other specialists
such as chemists, operating personnel, consultants or engineering contractors
with experience with the same or similar processes, process licensors, etc. In
this example, a well-proven process is available as a starting point. Therefore,
we will proceed with the business decision to produce this product, and
concentrate on the aspects of the design process that influence or directly
involve the design of the process control systems and safety interlock systems.
More detailed information on related aspects of the design process can be
found in CCPS Guidelines for Hazard Evaluation Procedures (Ref 7.1), Guidelines
for Chemical Process Quantitative Risk Analysis (Ref 7.2), Guidelines for Safe
Storage and Handling of High Toxic Hazard Material (Ref 7.3), Guidelines for Vapor
Release Mitigation (Ref 7.4) and Guidelines for the Technical Management of
Chemical Process Safety (Ref 7.5).

7.1.2 Simplified Process Description

The manufacture of PVC from the monomer is relatively straightforward. The
heart of the process is the reactor vessel in which the polymerization takes
place over a period of about ten hours, while the reactor contents are agitated
mechanically and the heat of reaction is removed by the circulation of cooling
water through the reactor jacket. Because the process involves the charging of
a batch to the reactor, process systems are designed with multiple reactor units
in parallel, so that the process can operate on a semicontinuous basis. For
simplicity, this example will focus on one of the units, recognizing that a real
production facility will typically have several parallel units operating in
sequence.
Figure 7.1 is a simplified process flow diagram for a typical PVC manufac-
turing facility. If the reactor vessel has been opened for maintenance after the
last batch was processed and dumped, it must first be evacuated to remove
any residual air (oxygen) in the vapor space, to minimize the oxidation
reaction of monomer which produces HCl and may lead to stress corrosion
damage to the reactor vessel as well as to poor product quality. Otherwise, the
first step is to treat the reactor vessel with antifoulant solution to prevent
polymerization on the reactor walls. This is followed by charging the vessel
with demineralized water and surfactants.
Then the liquid vinyl chloride monomer (VCM) charge is added at its vapor
pressure (about 56 psig at 7O0F).
The reaction initiator is a liquid peroxide that is dissolved in a solvent. Since
it is fairly active, it is stored at cold temperatures in a special bunker. Small

Shortstop Water
Initiator
Surfactants
Fresh VCM

External
Cooling
Water
Reactor
External
Steam Recycle VCM

Gas
VCM Gas
Recovery

Slurry Compressors
Degassing
Section
Recovered
VCM (Recycle)
Slurry Gas
Surge
Drums
Slurry
Stripping
Section Resin
Resin Blender Resin Storage
Dewater/Dry

Figure 7.1 Simplified flow diagram: the PVC Process

quantities are removed for daily use in the process and are kept in a freezer. It
is first introduced into a small charge pot associated with the reactor to assure
that only the correct quantity is added.
After the reaction initiator is introduced, steam-heated water is applied to
the reactor jacket to raise the temperature to about 130 to 14O0F (depending
on the batch recipe for the particular grade of product), where the reaction will
proceed at a satisfactory rate. Agitation is necessary to suspend the VCM in
the water (control particle size), improve heat transfer throughout the batch,
and produce a uniform product. Since the reaction is exothermic, cooling
water is then circulated through the vessel jacket to control the reactor temp-
erature. Reactor conditions are controlled carefully during the approximately
ten hours required for completion of the polymerization.
The reaction is said to be completed when the reactor pressure decreases,
signalling that most of the monomer has reacted. Reacted polymer is dumped
from the reactor and sent to downstream process units for residual VCM
recovery, stripping, dewatering and drying.

7.1.3 Preliminary Design

At this point in the design, scoping and site evaluation are completed. The
first step is to understand the regulatory and corporate policies and con-
straints on the project, based on the potential hazards. In an initial policy
meeting involving the plant manager, the project leader and a representative
of the safety/health/environmental activity, general guidance for the project
is established. Any special local requirements are reviewed, applicable regula-
tions are identified, and general risk guidelines are established. Shortly there-
after, a formal Process Hazards Analysis (PHA) Team is assembled, made up
of design and operating specialists familiar with the technology, an electri-
cal/instrumentation/control expert, a safety/environmental/health risk ex-
pert and a risk assessment specialist. After receiving general guidance from
the initial policy meeting, the PHA team begins systematic identification of
potential hazards. This information is fed back into the process design in a
way that attempts to eliminate or reduce the hazard by a process change or
by sizing and locating process components appropriately. A basic approach
is to minimize hazardous inventories as much as is consistent with sound
operation. This is an example of an improvement towards a more inherently
safe design. Once these inventories are set, then decisions can be updated on
safe separation of components. Similarly, the layout may be modified based
on the considerations given to reducing the potential for significant accidents.
At this stage, more analyses of the BPCS and the system design philosophy
can lead to improvements.
Throughout the design development, there are frequent discussions among
the PHA team members. Different organizations may handle these interac-
tions in different ways, but they all have a common objective: to develop and
implement a reliable and safe design that meets, or improves upon, all relevant
regulatory requirements, company standards and safety criteria.

7.2 HAZARD IDENTIFICATION

The hazard identification process should have started during the business
decision analysis. It is one of the most important functions of the PHA team
and is ongoing until the process is turned over to plant operations, and
becomes subject to operational safety review and audit programs.

7.2.1 Preliminary Hazard Evaluation

The first step in any process development planning, after general safety
guidelines have been established in an initial policy meeting, is to identify the
broad parameters of the production process, to define safety and environmen-
tal hazards (or hazardous events), and to seek opportunities for making the
process inherently safer. To do this, information is required about the physical
and hazardous properties of all the feedstocks, intermediates, products and
wastes involved in possible alternative processes. For this example, where a
specific polymer is being made from its monomer, there is little choice about
the basic reactant. The available alternative processes vary the polymerization
mediumsolution, suspension or emulsion. The significant properties of
VCM are summarized in Table 7.1. However, the reaction conditions and the
initiator (plus any additives) need to be carefully chosen to assure that the
reaction rate can be safely controlled to prevent runaway reactions, while
producing adequate quality and yield. The selected technology involves
polymerization in water, but does require small quantities of a relatively
dangerous liquid initiator. The hazards associated with the initiator also need
careful attention, but are not included in this simplified example.

7.2.2 Accident History

Next, the potential hazards are identified. In this example, the primary haz-
ards are associated with the f lammability and toxicity of combustion products
from VCM. In actual plant design, personnel exposure and environmental
ambient VCM limits would also be major considerations, but, for simplicity,
these are not covered in this example. As a first step, it is useful to review the
past history of accidents associated with similar operations. One source of
information, which is used for illustrative purposes, is the compilation of
accidents in the chemical industry from 1951 to 1973, prepared by the Manu-
facturing Chemists Association (Ref 7.6):
Table 7.1 Some Physical Properties of Vinyl Chloride
Foraiula: CH2=CHCl
Synonyms: vinyl chloride monomer (VCM)
chloroethylene
chloroethene
vinyl chloride (VCl)

Shipped as compressed liquefied gas; Reid Vap. press. = 75 psia

Gas, colorless, sweet odor; MoI. wt. = 62.5; Sp. Grav. (vap) = 2.16
Normal boiling point = 7.10F; Sp. Gr. (liqNBP) = 0.97; Floats and boils on water
Critical T = 3170F; Critical P = 775 psia; Melting point = -2450F

Heat of Vaporization = 160 Btu/lb; Heat of Combustion = 8136 Btu/lb

Heat of Polymerization = -729 Btu/lb; Normally stable at ambient conditions; polymerizes
in presence of air, sunlight, moisture, heat, or free radical initiators unless stabilized by
inhibitors.
FIRE HAZARDS:
Flammable Limits in Air. 3.6-33%
Flash Point: -1080F (o.c.); Autoignition T = 8820F
Spills flash, boil and produce heavier-than-air gas cloud that may be ignited with flashback.
Poisonous gases (HCl, CO, etc.) produced in fire
May explode if ignited in confined space
External fire exposure to container may result in BLEVE
HEALTH HAZARDS:
Irritating vapor to eyes, nose and throat
If inhaled, causes dizziness, difficult breathing, and may cause serious adverse effects, even
death.
Excessive exposure may cause lung, liver and kidney effects. Human carcinogen, listed by
OSHA, IARC and NTP.
Threshold Limit Value: 5 ppm
OSHA PEL: 1 ppm TWA, 5 ppm excursion limit average over any period not exceeding 15
minutes.
Odor Threshold: 260 ppm
Liquid contact may cause frostbite
WATER POLLUTION:
Limit in process water: 10 ppm
Limit in water discharged offsite: 1 ppm
AIR EMISSIONS:
Limit in process discharge to atmosphere: 10 ppm (local standard)
Limit for annual concentration at plant boundary: 0.2 fig/m VCM in air
RESPONSE TO DISCHARGE:
Issue WarningHigh Flammability, remove ignition sources, ventilate
Stop flow
Evacuate area, allow entry only with proper protective gear
Let large fires burn; extinguish small fires with dry chemical or CO2
Cool exposed containers with water
Prevent entry into sewer systems to avoid potential explosions
 In the case of VCM, we find reference to an accident (#816) in 1961 in a PVC
plant in Japan, in which four lives were lost and ten people were injured. This
accident was due to discharging a batch from the wrong reactor vessel, so that
unpolymerized monomer was released into a room containing the parallel
reactors. VCM vapor was presumably ignited by a spark from electric mach-
ines or by static electricity and the building housing the reactors exploded.
In another accident (#1132), a worker mistakenly opened a manhole cover
on a reactor that was in service, releasing a large quantity of vinyl chloride
that ignited and caused a flash fire resulting in the death of the maintenance
person and two laborers.
Another accident (#1932) involved charging a reactor with 250 gallons of
VCM with the bottom valve of the reactor open. Although a serious hazard
was created by this release, ignition did not occur and no one was injured.
Other incidents are noted, such as one in which an explosion occurred during
maintenance work on a vinyl chloride pump (due to a polyperoxide con-
taminant that was present as a result of three simultaneous, abnormal situa-
tions). VCM was also released from a scrubber in a VCM production plant due
to maintenance problems with a plugged valve during periodic recharging.
Ignition of VCM resulted in one death and several injuries.
There also have been VCM releases and fires associated with transporta-
tion. In 1971, a derailment of 16 cars near Houston led to the escape of VCM
from a 48,000-gallon rail tanker with immediate ignition. After 45 minutes of
exposure to the fire, a second rail car of VCM ruptured violently producing a
large fireball (BLEVE, see Section 7.2.4), killing a fireman and injuring 37 other
people. Large sections of a tank car were found about 400 feet from the
derailment site after the explosion.
There are probably numerous minor incidents for every major accident
reported. These may have cost impacts or cause some small environmental
impact, but are too minor to be noted in the published incident lists, even though
the more likely causes of minor equipment failures or small releases will be known
to those familiar with plant operations and maintenance. Nevertheless, attention
must be paid to the potential for small releases since these may be partial
pathways to major accidents. Particularly with a highly flammable pressurized
material, ignited small releases may cause larger failures if they heat other system
components. Thus, integrity of a VCM system needs to be at a high level.

7.2.3 Preliminary Process Design Safety Considerations

For this example, the desired production rate of PVC is 200 million pounds
per year (90,000 Tonnes/year) or about 23,000 Ib/hr, based on known reaction
kinetics, at a reaction temperature of about 14O0F, the corresponding cycle
time is about 8 hours. In setting the reactor inventory, judgment is usually
used with some awareness of the fact that hazard magnitude for catastrophic
vessel failure is related to the amount of hazardous material. At one extreme,
a single reactor might be used, with a production batch of 180,000 Ib of PVC
in a 40% slurry mixture, requiring a reactor sized for about 50,000 gallons
capacity. This would be unwise, since no redundancy is present and there is
a very large, flammable, high pressure inventory. Also since capacity is not
distributed, production batches would be large, infrequent, and would re-
quire downstream equipment sized for large inventories. Furthermore, this
reactor would require addition of a large quantity of the dangerous initiator
solutiona large enough inventory to raise serious safety concerns.
At the other extreme, a large number, say ten, small reactors, each designed
for a 18,000 Ib production batch (about 5000 gallons), might be used. In the
first extreme, inventories are large; in the second, batches are small, switching
operations are much more frequent, and there are many more interconnecting
lines, valves, and complexities. Tradeoffs would be considered, based on
operational needs, availability of equipment, and cost, as well as safety.
Refinement of such analyses leads to selection of the number of reactors in
parallel and the size of the reactor unit. At this point, it is well to provide for
any potential for future expansion in capacity. In this example, it is decided to
install three parallel reactors, each with a 17,000 gallon capacity. The 5 gallons
of initiator solution required per batch is a manageable quantity for safe
handling. The maximum inventory of VCM in a reactor is estimated to be
60,000 Ib.
Reaction temperature is selected to achieve a desired molecular weight,
which is end-use driven. Proper reactor cooling water temperature control for
stable reactor operation is required to prevent runaway reaction. Stable control
of the polymerization reaction temperature requires a low temperature dif-
ference between the cooling water and the reaction temperature (see Ref .7.7).
For this example, the tempered cooling water supply temperature is high
enough to provide a low temperature difference, versus the 14O0F reaction
temperature, for safe operation.

7.2.4 Process Hazard Identification

The major acute hazards associated with VCM release are fire and explosion,
with generation of toxic combustion products. These types of hazard include
the following:

Jet fires: A leak from a pressurized system ignites and forms a burning jet that
might impinge on other equipment and cause damage. (In rough terms,
jet length is about 150 times the jet orifice diametera jet from a 2-in. hole
could produce a burning jet about 30 feet long.)
Flash fires: A pressurized liquid release flashes producing flammable vapor
that travels to an ignition source. Upon ignition, the flame travels back
 through the flammable vapor cloud. (The flammable plume in this case
can be substantially larger than the flame jet.)
Pool fires: Residual liquid from a flashing release forms a pool which may
ignite and burn with a flame height that is two or three times the width
of the pool.
BLEVEs (Boiling Liquid Expanding Vapor Explosions): A pressurized tank of
VCM or associated piping exposed to an external fire may fail due to
metallurgical weakening. Such failure may result in a catastrophic tank
failure, a fireball and the potential for rocketing fragments. Relief valve
overpressure protection will not prevent a BLEVE,
Explosions: Leakage of flammable gas into a confined space with subsequent
ignition may lead to explosions or detonations with substantial overpres-
sures.
Hydraulic Failure: Overfilling of a tank with subsequent liquid expansion
through heating may lead to collapse of any vapor space and rapid
pressurization. Sudden tank failure may ensue.
Stress Corrosion Failure: Air (oxygen) in the system may increase the presence
of chloride ions and may lead to loss of metallurgical integrity.
Toxic Combustion Products: The combustion products of VCM include phos-
gene, hydrogen chloride and carbon monoxide along with other toxics.
(These will be present in the aftermath of a fire, particularly if the fire is
within a confined space).
Runaway Polymerization Reaction: VCM polymerization has the potential
to rupture the reactor, releasing the VCM with major damage possible.

In addition, VCM also presents chronic exposure Iwzards, being a known human
carcinogen and is a regulated substance with regard to personnel exposures to
its vapors, having an OSHA PEL (personnel exposure limittime weighted
average) of 1 ppm in air. Further, federal and local regulations limit its
discharge levels from process vents and plant water treatment systems. There
are also stringent limits set on the amount of residual VCM that maybe present
in the PVC product.
There are some lesser short-term hazards involved with inhalation of VCM
vapor and the potential for autorefrigeration of flashing fluid. Personnel
require protection both from inhalation and possible freeze burns.
At this point, scoping hazard zone estimates are made to indicate the
magnitude of major potential accidents. A 60,000-lb release of VCM could
produce a flammable vapor cloud equivalent to a cubic volume that is about
400 feet on a side. Because VCM is a heavy gas and may contain aerosols from
flashing, a major vapor cloud is much more likely to be pancake-shaped, but
still might have a flammable footprint of 1000-1500 feet in diameter. This
indicates that the maximum accident involving a single reactor might have
offsite impacts, and could fill a substantial confined volume with flammable
gas. In terms of the assessment criteria discussed in Chapter 2, this impact
should be considered to be at least "serious," and probably "extensive/'
depending on specific data considerations. To be conservative, the PHA team
considers it to be in the "extensive" impact category. (Note: The bulk storage
of VCM on site is not considered in this limited example. There is likely to be
a bulk storage tank somewhere that is sized to hold operating inventory. That
tank may have a capacity in the range of 50,000 gallons to accommodate
pipeline upsets or the periodic unloading of rail cars. Such an inventory may
be capable of offsite impact and its location and design, as well as those for
the associated transfer facilities, require detailed attention to safety.)
The PHA team has decided, because of a northern site location that weather
protection against freezing is required and that the reactors should be located
inside a building. If freezing were not a problem at the site, it would be
preferable to locate equipment outdoors to avoid the potential for accumula-
tion of hazardous gases indoors, should a leak occur. The building will be
designed for extensive monitoring for leaks and for potential explosion con-
ditions (in terms of active ventilation, blowout panels, and appropriate electri-
cal design). Gas detectors throughout the enclosure will be tied to an alarm
system to provide early warning of leaks. Any process vents will be collected
into a header system that is tied into a properly sized VCM recovery disposal
system.
Moreover, the process will be operated to minimize the need for operating
personnel to be in the vicinity of the equipment. A few manual operations are
still necessary; the most sensitive of these is the charging of the small quantities
of initiator prior to the start of a new batch cycle. Operators will need sound
training in this critical operation, even though hazards are reduced by the
small quantities of materials involved.
There also is a requirement for an extensive leak and fire detection and
protection system as well as the need to provide personnel with positive-pres-
sure, self-contained breathing apparatus in the event of leak detection.
At this point, the PHA team needs to be fully satisfied that the site and
preliminary layout will provide adequate spacing for present and future
operations both to tolerate the impacts of potential major accidents in the unit
and also to protect the unit from impacts initiated elsewhere in adjacent
facilities.

7.3 PROCESS DESIGN STRATEGY

7.3.1 Process Definition

The process design then progresses into a more detailed phase. A plot plan,
process flow diagram and piping and instrumentation drawings (P&IDs) are
developed. Figure 7.2 presents a simplified P&ID for a single reactor unit in
the process.
The full P&ID set would show the full process from the pipeline receipt or
rail unloading facilities, to the bulk storage of reactants, to parallel reactors, to
the plant utility systems, to waste treatment systems, to relief valve collection
and venting systems, to VCM recovery and storage systems, and to down-
stream systems for stripping and drying the PVC product. Since this is a
well-established technology, the designer will draw on past designs and
experience as a guide.
Basic instrumentation required for process control and monitoring will be
incorporated in the design at this point. However, this will be done on a
preliminary basis, since a more comprehensive development of the control
system will be considered later.
The details of the design require definition of the basic operating proce-
dures and maintenance strategies for the facility. The operational steps for the
process are outlined below:

Pre-evacuation of air: If the reactors have been opened for maintenance,

oxygen must be removed from the system for quality and metallurgical
integrity reasons. This is done using steam ejectors to pull a vacuum.
Reactor preparation: The empty reactor is high pressure water rinsed, leak
tested if the hatch has been opened, and treated with antifoulant.
Demineralized water charging: A controlled charge of water is added. An
overcharge might lead to a hydraulic overfill; an undercharge may cause
quality problems and potential runaway reaction. Any surfactants or
other additives are introduced.
VCM charging: An accurate charge of VCM is added to the reactor.
Reactor heatup: The initiator is added from the charge pot to the batch, and
steam is added to the cooling water circulating through the reactor jacket
until the batch is at a temperature where the reaction will proceed (about
1O0F below the steady-state reaction temperature).
Reaction: The steam system is isolated and cooling water is circulated through
the reactor jacket to control temperature by removing the heat of polym-
erization while the reaction progresses.
Termination:When the reactor pressure starts to decrease because most of the
VCM present has been consumed by the polymerization, the batch will
be dumped.
Reactor Discharge: The reactor contents are dumped under pressure to a
downstream holding facility where the system is degassed for subsequent
stripping and drying. To prevent resin settling in the reactor, the agitator
operates during the dumping procedure. Unreacted VCM is recovered
for reuse.
 Emergency
Vent Emergency
Vent

Shortstop

Degas

Pre-evacuation

Post-vacuatlon

Additive

Water Additive
Hatch
Open
'pressure Switch
Bjsh Water]

CWR Initiator

CWS

Note: Some SIS intertocksi

(e.g.,fire,gas, and manual
U)rotshown for clarity.
Stearrf NMKSMW
fMdbeckto
BPCS LEGEND

SIS Input
Note Detects .
thermoweH failure-

Note: Typical feral on/off

automaicshuiDffvaNes BPCS Input
unteaa ottwrwiae specified.

Note: Instrumentation symbols drawn in accordance with

ANSLOSA - S5.1 - 1964, Instrumentation Symbob and
Identification.' Approved November 5,1986.

Figure 7.2 Example of P&ID for PVC reactor unit.

 There are two additional process systems which are provided for an emer-
gency situation. In the event of an uncontrolled reaction or the potential for
such an event, the polymerization can be stopped rapidly by addition of a
Shortstop chemical (chain stopping agent) to the batch. However, agitation
of the batch is necessary for good distribution of the Shortstop to rapidly
terminate the polymerization. If the agitator has failed, the Shortstop must be
added within a minute or two, to allow mixing before the liquid swirl in the
reactor dissipates. As a back-up, the reactor contents can be mixed by "burp-
ing" the reactordropping pressure to generate rising bubbles within the bulk
liquid mass.
The second emergency system is an automatic depressurization system. In
the event of an uncontrolled reaction, the reaction can be safely limited by
depressurizing the reactor to the vent system. The heat of vaporization of the
boiling reaction mass safely removes heat from the reactor.
At this time, the specific components are also selected and specifications
are set for design conditions, materials, performance, etc.

7.3.2 Preliminary Hazard Assessment

Once the design is developed in some detail, the PHA team subjects the design
to a preliminary hazard assessment. The PHA team will use some systematic
technique, such as a preliminary HAZOP or FMEA (See Chapter 3), to review
the design and the proposed control strategy. From the hazard identification
process and from the past accident history, it seems that the example process
reactor has the potential for "minor" through "extensive" severity events as
defined in Figure 2.4, the Process Risk Ranking Model. In addition, design
integrity must consider the need to meet the strict containment requirements
to prevent emissions of VCM that might endanger worker safety and health.
The results of this hazard review need to be carefully documented, with
particular regard to event sequences that might lead to uncontrolled releases.
In this example, a HAZOP was done by the PHA team for the preliminary
hazards assessment. Based on the HAZOP results, a team of appropriate PHA
process and instrumentation experts prepared a list of accident events for
development of an initial safety interlock functional design.
Table 7.2 is a partial list of accident events and the associated prevention
strategy used to propose interlock strategy and actions to help further identify
or create additional independent layers of protection.
This interlock team proposed the following safety interlock preventive
strategy:

A. To deal with the runaway reaction scenarios where the agitator re-
mains on, items 1,4,5, and 7 in Table 7.2, the team proposed the following
sequence:
Table 7.2 Partial Summary of Preliminary Hazard Assessment Information for
Development of Safety Interlock Strategy
# INITIATING PROCESS PROCESS PREVENTIVE
EVENT UPSET VARIABLES STRATEGY
AFFECTED

1 Cooling water Loss of cooling leading Low C. W. Flow Add Shortstop

control fails to runaway reaction High Reactor Temp. Emergency Cooling
High Reactor Pressure H2O Flow (SIS)
Depressurize Reactor
(SIS)
Pressure Safety Valves
OPL)

2 Agitator Motor Reduced cooling, Low Agitator Motor Add Shortstop and Burp
Drive Fails temperature non- Amperage reactor to stop
uniformity leads to High Reactor runaway.
runaway reaction Temperature Depressurize Reactor
High Reactor Pressure (SIS)
Pressure Safety Valves
(IPL)

3 Area wide loss Loss of agitation leading Agitation Motor off Add Shortstop and Burp
of normal to runaway reaction Low Coolant Flow reactor to stop
electrical power High Reactor Pressure runaway.
(UPS High Reactor Depressurize Reactor
Instrumentation Temperature (SIS)
power remains) Pressure Safety Valves
(IPL)

4 Cooling water Loss of cooling leading Low C. W. Flow Steam Drives on

pumps stop, to runaway reaction High Reactor Temp. Pumps
pump power High Reactor Pressure Add Shortstop
failure Depressurize Reactor
(SIS)
Pressure Safety Valves
(IPL)

5 Batch recipe High initiator High Reactor Temp. Add Shortstop

error; two concentration causes High Reactor Pressure Depressurize Reactor
charges or runaway reaction (SIS)
initiator are used Pressure Safety Valves
(IPL)

6 Control system Reactor becomes liquid High charge level Compare Hi-level &
failure overfills full as the temperature High charge weight weight with recipe (SIS)
reactor increases, possible High Reactor Pressure Depressurize Reactor
hydraulic reactor (SIS)
damage and VCM Pressure Safety Valves
release. (IPL)

7 Temperature High temperature leads High Reactor Pressure Add Shortstop

control failure to runaway reaction. High Reactor Temp. Emergency Cooling
causes H2O Flow (SIS)
overheating Depressurize Reactor
during steam (SIS)
heat-up step Pressure Safety Valves
(IPL)

8 Reactor agitator Seal failure can lead to High pressure in reactor Additional ventilation
seal fails dangerous VCM fume seal around reactor seal
release Fume detection in Depressure reactor on
reaction area high seal pressure
(SIS)
 Next Page

At a "high" temperature or pressure condition, activate the emergency

full rate cooling water flow SIS, and alert the opera tor by alarm.
If the reactor temperature or pressure continue to increase, sufficient
time is available for the operator to remotely add Shortstop.
-Lf neither of these methods stop the runaway, a "high-high" tempera-
ture or pressure SIS will open the emergency depressure vent valves to
safely control the runaway.
B. For runaways that occur because the agitator is not workingitems 2
and 3 of Table 7.2protection is needed in addition to the proposal given
in A above:
Loss of agitation (low amps) will be indicated to the operator by an
alarm, and after adding the Shortstop, "burping" is required to mix the
Shortstop into the reaction mass.
As in Proposal A above the emergency depressure SIS is a backup to
control the runaway.
C. Low or no cooling water flow upsets are controlled by the protection
in Proposal A above. In addition the emergency full cooling water flow
SIS is initiated by a "low-low" cooling water flow signal. If low cooling
water flow was caused by power loss to the water pumps, the operator
is alerted by the low flow alarm to turn on the steam turbine water pump
drive.
D. Overcharging the reactor with water or VCM, can cause overfilling
and possible reactor hydraulic overpressure damage. This upset is
avoided by preventing the batch heat up if the weigh cells or the reactor
level exceed the "high" limit for that batch addition step in the BPCS.
Backup is provided by the "high-high" reactor pressure SIS that activates
the emergency depressure vent valves.
E. Failure of the reactor agitator seal causes dangerous releases of VCM.
To protect against this it is proposed to activate the emergency depressure
SIS for high pressure in the agitator seal.
F. Because the Shortstop system is so important in controlling all runaway
reactions, interlocks to assure Shortstop availability are also proposed by
the team. The interlocks do not allow VCM charging to reactor if the
Shortstop tank level is low, or if the nitrogen pad pressure on this tank is
low.

7.4 SIS INTEGRITY LEVEL SELECTION

Using the proposed interlock list, a PHA team meeting is held to classify the
integrity levels for the SISs. In this section, two methods will be used, the
"risk-based" method and SIS selection as part of a HAZOP.