Safety

CEP www.cepmagazine.org July 2006 27

S
afety has become an indispensable requirement for
any manufacturer to be granted societys license to
operate. Because a process modules intrinsic safety
is shaped in the predesign stage, safety could be improved if
greater expertise and more attention were dedicated to safe-
ty early in a project. In this respect, preliminary designers
have a profound influence on ultimate plant safety.
Safety in predesign presents a dilemma. Traditional
hazard and operability studies (HAZOPs) require detailed
engineering specifications, such as piping and instrumen-
tation diagrams (P&IDs), that are not available during a
preliminary analysis. Yet, it is too late to gain many of the
benefits of inherent safety once a project has reached the
P&ID stage (1).
HAZOP typically involves a team of six to eight people
who spend from 25 to 50 total person-hours per P&ID.
Considering the cost of professional time, including over-
head, this represents an additional $5,000$10,000 per
evaluation above and beyond the cost of preparing the
P&ID (2). Since most study estimates cannot justify this
time and cost, preliminary designers must have strong
safety instincts. Thus equipped, they can make critical
early decisions geared toward safe design.
Hazard versus risk
The terms hazard and risk are often used interchange-
ably, but there are subtle differences. An appropriate defini-
tion for hazard is a source of danger, whereas risk reflects
the degree of peril that one or more hazards create(s).
Risk is defined generically as the product of the chance
that a particular hazard may actually cause injury or dam-
age (frequency) and the impact of an event if it occurs
(consequence) (3). A hazards risk can be expressed in the
following mathematical equation:
Risk = Frequency Consequences (1)
One can reduce risk by designing so that an occurrence
becomes extremely rare, or so that if it does happen, little
damage would result.
Where do hazards lie?
Wherever there is latent energy of any kind, there is dan-
ger. The greater the energy, the greater the danger. Risk lurks
in each term kinetic energy, potential energy, work, heat,
enthalpy and internal energy of the fundamental energy
balance that chemical engineers use almost every day.
Kinetic energy Although more prominent for its
damage to people traveling in high-speed vehicles, kinetic
energy present in rotating equipment or other machines caus-
es many isolated personal casualties in the chemical industry.
Potential energy More commonly a source of danger
in civil engineering projects, structural failures can release
this form of stored energy with disastrous consequences.
Work Pent-up work, stored in springs, electrical
circuits (sidebar, p. 28) or other devices, powers many
machine accidents and can cause havoc in chemical
process situations.
Heat Strictly defined as energy crossing a bound-
ary, heat from the rapid release of internal or other forms
This article will help you develop strong
safety instincts that will
guide you in making critical decisions
in the preliminary design phase.
Gael D. Ulrich
Palligarnai T. Vasudevan
Univ. of New Hampshire
Predesign With
Safety in Mind
28 www.cepmagazine.org July 2006 CEP
of energy is a factor in many serious incidents that occur
in the process industries, such as runaway reactions and
boiler explosions.
Enthalpy or internal energy This source powers most
chemical reactor runaways and destructive fires. In one such
incident, a runaway reaction blew the inspection cover off a
reactor and spewed a jet of atomized liquid through the third
floor and roof of the building, spattering the adjacent neigh-
borhood. The aerosol plume ignited, forming a fireball with
an explosion that drove the 7,500-L (2-m I.D. by 2.7-m tall)
jacketed vessel from its moorings and against a cement wall.
Nine employees were injured, two seriously with second-
and third-degree burns. (For insight into the drama and trau-
ma of this incident, as well as photos of the scene, see U.S.
Chemical Safety and Hazard Investigation Board Report
1998-06-I-NJ, NTIS Report No. PB2000-107721,
www.csb.gov/index.cfm?folder=completed_investigations
&page=info&INV_ID=18).
Risk hot spots in a plant
Before discussing how to design for safety, it makes
sense to review what, in a plant, causes a disaster.
Piping, including valves, flanges, threaded joints,
drains, traps, strainers and other elements, is the largest
single source of failure (4). Preliminary designers dont
have much to do with piping, except in choosing construc-
tion materials for process equipment, which are almost
always matched in process piping. Responsibility for safe
piping design is ultimately in the hands of final plant
designers. Many piping failures, however, are caused by
corrosion and faulty upkeep. Therefore, predesign manu-
facturing cost estimates should include generous
allowances for maintenance in plants that process haz-
ardous substances.
Storage vessels are the second-riskiest equipment in a
plant. Most storage vessel incidents result from complacen-
cy. Ancillary areas like this dont demand much attention
from operators, so they tend to receive less maintenance
which is not a design problem, but an operations problem.
On the other hand, some storage tank incidents result
from overpressurization. This is especially true of slops
tanks used for waste storage. Fluids with vapor pressures
that unexpectedly exceed design specifications sometimes
accumulate in these vessels. Tanks burst, often causing
explosions or fires.
In some incidents, liquid levels fall below tank heaters,
which subsequently overheat and ignite combustible mix-
tures in the vapor phase. Other events stem from floating
tank roofs that develop leaks, thereby allowing air to enter
and create an explosive mixture. Tanks are sometimes mis-
takenly overfilled. Careless workers or faulty equipment
create hazardous conditions during loading and unloading.
Based on these statistics, most storage risks are the
responsibility of operations, maintenance and final
mechanical design personnel. Preliminary designers, on
the other hand, should specify storage vessels that are
large enough and strong enough for any anticipated need.
As with piping, one must be cautious in choosing materi-
als of construction. Inert-gas blanketing should be serious-
ly considered for slops tanks or any vessel that contains
combustible liquids.
Vacuum operations involving any chemical that can
react with air require caution. Air in-leakage is difficult to
detect and may create unexpected explosive mixtures. (At
pressures greater than atmospheric, on the other hand, the
leak is outward, and sight, sound, smell or special instru-
ments can detect it for repair.)
Furnaces are risky by nature, because combustible
mixtures and ignition sources are essential to their func-
tion. A key consideration in furnace design is to avoid
large volumes of reactive mixtures. For example, most fur-
naces employ burners with small mixing chambers of spe-
cial design where intense turbulence, temperature and
geometry assure dependable ignition and flame stability.
Special instrumentation is provided to shut off fuel if a
flame goes out, so that unreacted mixtures do not accumu-
Safety
Work Stored in an Electrical Circuit
Forty years ago, one of the authors was responsible for
the design and construction of a pilot plant. The bag filter
was heated with an external electrical resistance system, but
the filter would not reach its design temperature. (It turned
out that the design calculations were correct, but during plant
shakedown, the newly applied insulation was still damp, and
extra heat was consumed in drying it. )
An electrician who happened to be passing by was asked
to check the electrical connections. He borrowed a test meter
from a nearby bench and opened the circuit box to check the
voltage.
When he touched the probes to the terminals, the box
exploded as though it had been struck by lightning, accom-
panied by thunder. Both men were driven backward. The
electrician suffered third-degree burns on both hands and
arms. Partially shielded by him, the engineer escaped with a
few holes in his clothing and molten spots embedded in his
safety lenses (caused by fiery liquid copper droplets spewn
from the circuit box).
Investigators believe there was a loose strand of wire on
one of the meters probes. It somehow formed a short-circuit
and then vaporized from the intense current driven by the
440-V power supply. This evidently created an arc path that
allowed even more current to flow, melting and vaporizing the
copper wiring in the box, and causing the explosion. The
engineer gained great respect that day for work stored as
electricity.
CEP www.cepmagazine.org July 2006 29
late in the combustion chamber and explode. These safe-
guards are integrated into the purchased equipment pack-
age, so furnace safety requires little of a preliminary
designer other than normal vigilance.
Pump failures are common because pumps are ubiqui-
tous in a chemical process plant. Demands on a pump are
also broad and severe with regard to pressure, temperature,
exposure and other service conditions. Seal failure is by far
the most common defect in operation. As a result, toxic or
reactive mixtures can escape. This is compounded by fric-
tion-induced overheating from a corroded bearing, which
can vaporize and ignite the leaking fluid. Engineers
involved in detailed or mechanical design might specify
magnetically coupled or canned pumps for especially haz-
ardous situations. Mechanics and operators must provide
proper maintenance and effective inspections. In prelimi-
nary design for hazardous service, one should be conserva-
tive in choosing the material of construction and pump type.
Heat exchangers do not have the mechanical complica-
tions and moving parts of pumps, nor do they have the
safety protection of furnaces. Normally, safe design
respects the same criteria as for pressure and process ves-
sels. But when heat exchangers operate at extreme temper-
atures or pressures, observance of rules for safe furnace
design may be more appropriate.
Gas movers and compressors exhibit the same mechan-
ical demands as pumps, but these demands are usually
more extreme. Heat generation is larger in gas compres-
sion, and vapors ignite more readily than liquids. Thus,
compressors are intrinsically more hazardous than pumps.
Gas movers fall below pumps in incident frequency
because they are less ubiquitous, but compressor-triggered
damage is often more deadly and catastrophic. Safety
guidelines for all of the items discussed above should be
considered when designing gas movers.
Chemical reactors are the next-most common type of
equipment after storage vessels that initiate chemical
process disasters. This is not surprising, since most com-
mercial reactions are controlled explosions, often involv-
ing poisonous reagents or products.
Runaway batch reactions top the list of violent inci-
dents (13% of all reactor incidents). Specific causes
include loss of utilities (e.g., electricity or cooling water),
flow reversal, carryover in feed or product streams, incor-
rect reagent charging procedures, plugging and fouling of
heat exchange or instrument surfaces, poor mixing or agi-
tator failure, and external fires. Most of these stem from
careless, poorly trained operators or mechanics, and faulty
control systems. Major engineering errors involve selec-
tion of inappropriate materials of construction, superficial
equipment inspection, failure to anticipate destructive side
reactions, and following risky operating procedures. Back-
up safety systems, such as vents, dump tanks and quench-
es, also fail, and thus serve their intended purpose with
only about 80% reliability.
One guideline for preliminary design is to follow the
furnace strategy: Avoid large batch reactors or large reac-
tor vessels of any type, including continuously stirred tank
reactors (CSTRs), especially if exothermic reactions are
possible (57). This is a severe and often impossible limi-
tation, since exothermic main or side reactions occur with
high-energy feedstocks in most commercial processes,
ranging from foods, plastics, fertilizers and pharmaceuti-
cals to chemicals and fuels. Almost 90% of commercially
important chemical reactions (Table 4-21 of Ref. 8) are
highly exothermic.
As Eq. 1 demonstrates, the greatest risk lies with those
common processes that handle the most volatile and reactive
materials. More than 90% of the process fluids involved in
incidents in one database were petroleum fractions (4).
Liquefied petroeleum gas (LPG) topped the list, followed by
gasoline/naphtha, hydrogen, heavy hydrocarbons, hydrocar-
bon gases, crude oil and diesel fuel. Water, on the other
hand, was involved in the most non-petroleum incidents
(sidebar above), followed by chlorine and ethylene oxide.
Principles of safe design
A popular and successful modern movement toward
greater safety in the chemical processing industries is
known as inherently safer design (ISD). The goal of this
concept is to design production modules so safe that cata-
strophic failure cannot occur. ISD was pioneered by
Trevor Kletz in 1976, who summarized the philosophy in
his famous statement, What you dont have, cant leak
(9). The Bhopal tragedy would not have occurred had this
rule been rigorously applied to that pesticide plant.
Reference 10 (p. 26-5, authored by Kletz) lists a dozen
principles of ISD, although more than half apply to plant
assembly and operation, not design. The following five
Water as a Hazard
As a graduate student, one of the authors was working on
a high-temperature electrochemical experiment. To hurry
things up, he poured molten salt from a tube furnace into a
pail of cold water. The resulting explosion drenched the ceil-
ing of the lab, but, fortunately, caused no harm to himself
other than well-deserved embarrassment. There was no
chemical reaction, but the intense energy transfer generated
steam at a fast enough rate to create a shock wave.
A similar phenomenon is believed to explain the destruc-
tive explosions that were once quite common in Kraft recov-
ery boilers used in paper/pulp plants. Steam tubes rupture
and discharge water into a hot smelt reservoir at the base of
the boiler.
30 www.cepmagazine.org July 2006 CEP
principles (1113) apply to preliminary process design.
1. Use fewer hazardous substances, and smaller quantities
of them (minimize). Methyisocyanate (MIC) was only an inter-
mediate in the production of a less toxic pesticide at Bhopal. If
a continuous reactor had been used, only a small quantity of
MIC would have needed to exist at any point in the process.
Kletz describes how shifting from a batch reactor to a
thousand-fold-smaller continuous one decreased the dangers
of nitroglycerine manufacture by an even greater magnitude.
Added to this dramatic safety gain was a marked reduction in
capital and operating costs with the smaller reactor (10).
2. Use substances that are less hazardous (substitute).
Gupta and Edwards argue that a different reaction scheme
could have been used at the Bhopal MIC plant, one that
substituted a much less toxic intermediate for MIC (9).
3. Use moderate operating conditions (moderate, atten-
uate). As an example of this principle, Gupta and Edwards
point to ammonia production, a source of many chemical
processing disasters (9). With the aid of better catalysts,
reactor conditions have become less severe, from 1,000
atm and 500C in 1920, to 100 atm and 300C today. (The
accompanying 20% gain in equilibrium yield (7) was
undoubtedly the major incentive for this migration.)
As an example of attenuation or weakening a danger,
Kletz points out that it is generally safer to store large
quantities of a hazardous volatile chemical as refrigerated
liquid than as gas under pressure.
4. Use simple plant designs (simplify). Similar to mini-
mizing the amount of hazardous substances, simplifying
equipment often produces a less expensive, more efficient
and safer plant.
5. Design equipment so the effects of an incident are
minimized (limit effects). Similar to attenuation, this prin-
ciple may sometimes go beyond weakening to sidestep-
ping of a danger (see sidebar at left).
Steps for inherently safer predesign
Reference 15 provides an excellent blueprint for identi-
fying and defusing hazards, including an important initial
step hazard identification. Table 1 outlines a framework
for inherently safer predesign (ISPD) analysis based on
Sheppards (15) and Kletzs (13) recommendations. Kletzs
rules for ISD are noted in parentheses in the first column.
Note that the use of safer rather than safe is intention-
al, since no human activity can be made perfectly safe.
1. Identify
A useful tool for hazard identification is the fire trian-
gle (Figure 1), which illustrates that three quantities
fuel, oxidizer and an ignition source are needed to sup-
port combustion and cause a chemical explosion. It might
appear from Figure 1 that these three factors are physically
separate. With many compounds that chemical engineers
encounter (explosives, for example), fuel and oxidant are
combined, and a minor impact can cause ignition.
Reference 10 (p. 26-51) provides a useful list of known
unstable violent compounds.
The identities of fuels and oxidizers will be obvious in
most design situations. Sometimes, the combustibility of a
chemical combination may be uncertain. Several resources
are available to resolve that question.
First, as shown in the third column of Table 1, one can
perform thermodynamic calculations using heats of forma-
tion. Basically, any mixture capable of exothermic reaction
can be dangerous. However, there are composition ranges
that do not support combustion. These are well-defined in
flammability limit charts, which are available for common
combustible mixtures. Figure 2 is a flammability limit
chart for methane/oxygen/nitrogen mixtures.
Even with such a chart, one must be wary, because com-
Safety
Fail-Safe Design
At a safety workshop for chemical engineering faculty (2),
participants worked in teams to identify various safety issues
related to exothermic batch reaction-polymerization. As men-
tioned previously, reactor runaways that occur under these
circumstances are notoriously dangerous for example, a
U.K. Heath and Safety Executive study reported 134 batch-
process accidents (an average of more than five per year)
between 1962 to 1987 (14).
Common worst-case scenarios for reactor runaways
include (3):
loss of cooling water
agitator failure
heat-exchange-surface fouling
unexpected phase separation
unexpected energetic side reactions
unexpected introduction of reagent/catalyst or depletion
of inhibitor.
One workshop team was asked to envision an electric
power failure, formulate a response to this emergency, and
report its conclusions to the larger audience. The discussion
became intense as the group presented and defended its
findings before the body. When asked to define the ultimate
danger, the group replied, runaway reaction. The question-
er, who had helped design the actual reactor, then explained
that it was a fail-safe system, and that if any or all of the
worst-case conditions were to occur, operators could simply
walk away and the reactor would shut itself down safely.
A reaction cant run away unless it can get out of the
reactor. Reagent feed limits, interlocking controls, integrated
heat balances, and other precautions keep an inherently safer
reactor in check. (Reference 3 explains fail-safe design for
exothermic reactions.) Combined with redundant back-up pro-
visions (e.g., purges, vents, dump tanks and quenches), regu-
lar inspections and rigorous operator training, risk though it
can never be reduced to zero becomes infinitesimal.
CEP www.cepmagazine.org July 2006 31
bustibility limits change with temperature, pressure, the
presence of impurities, and other factors. And, in real
processes, incomplete mixing can create pockets that will
burn even when a chart developed from carefully controlled
laboratory experiments says the uniform mixture will not.
Many new and interesting projects involve propri-
etary reactions for which there are few published data.
Most corporations that deal with hazardous exothermic
reactions have their own laboratory with sophisticated
calorimetric test equipment. To define danger zones,
Table 1. Inherently Safer Predesign (ISPD) involves four basic steps.
Experimental and Literature
Step/Rule Tools Analytical Resources References
1. Identify Fire triangle Thermodynamic calculations Perrys Handbook (10)
Flammability-limit chart Reactor design equations Table 26-10 and
Chemical reactivity chart Calorimetry associated pages
Safety compatibility chart Flammability charts Lees (16)
Safety stream chart Crowl and Louvar (17)
Toxicity ratings Urban and Bretherick (18)
Pohanish and Sittig (19)
2. Eradicate Inert-gas blanketing Shanley and Melhem (20)
(ISD Rule 2) Failsafe design Kirk-Othmer
Encyclopedia (21)
3. Minimize Control and eliminate ignition sources Sound chemical engineering Merck Index
Simplify, Keep reactive volumes small analytical and computational skills Material Safety Data
Moderate, Safety equipment and instruments Sheets (MSDSs)
Attenuate fall within this category, but these Chemical engineering
(ISD Rules 1, 3, 5) items are not usually defined in textbooks and
preliminary design monographs
4. Isolate Segregate hazardous operations Sound chemical engineering
(ISD Rule 4) Encase in an impenetrable structure judgment and common sense
Sources: (13, 15).
Ignition Source
F
u
e
l

S
o
u
r
c
e
O
x
i
d
i
z
i
n
g

A
g
e
n
t
N
2
O
2

100
90
80
70
60
50
40
30
20
10
90
80
70
60
50
40
30
20
10
100 90 80 70 60 50 40 30 20 10
0
0
V V V V V V V V V
V
V
V
V
V
V
V
V
V
V
V
V
V
V
V
V
V
V
Flammable
Mixtures
HEL
LEL
Oxygen, vol.%
F
u
e
l
,

v
o
l
.
%
N
i
t
r
o
g
e
n
,

v
o
l
.
%
Fuel
HEL = Higher Explosion Limit
LEL = Lower Explosion Limit
(relatively independent of O
2
concentration)
Min O
2
= Limiting Oxygen Concentration (about 12% here)
A
i
r
M
i
n

O
2
I (Left) Figure 1. The fire triangle illustrates the three elements needed
to support combustion.
I (Above) Figure 2. Flammability diagram for methane/oxygen/nitrogen
mixtures. (Courtesy R. French, Exxon Corp., SACHE, Safety and
Chemical Engineering Education Workshop for Faculty on Safety and
Process Design, Baton Rouge, LA (Sept. 24, 2003).)
32 www.cepmagazine.org July 2006 CEP
researchers can measure the reactivity of various feed mix-
tures over all probable composition, temperature and pres-
sure ranges. If your organization has such a resource, you
should exploit it to the maximum extent possible. (For
more information on calorimetry, see Refs. 3, 14 and 15.)
Thermochemistry is an important area of ISPD diagno-
sis. One-fourth of batch reactor runaway incidents stem
from ignorance in this area, rivaling human-caused operat-
ing errors in importance (14). Remember that most chemi-
cals can ultimately go to their most extreme oxidation
states (hydrocarbons to CO
2
and H
2
O, for example). And,
one must not overlook the potential for dust to self-com-
bust and produce an explosive mixture (10).
Another tool for identifying hazards is the chemical
reactivity chart, such as the one for the production of
acrylonitrile from propylene, air and ammonia illustrated
in Table 2. The chemical reactivity chart provides useful
insight into some consequences, expected and unexpected,
of mixing these reagents.
A good place for a novice designer to begin is the
chemical process hazard analysis matrix (Table 3),
which includes other critical risk factors. Components
are listed in one column and in the top row. Interactions
among the various chemicals are rated according to a
National Fire Protection Association (NFPA) code. A
more-detailed version of this interaction checklist (22)
can be constructed with columns and rows for steam,
people, dirt, grease and other hazards, using chemical
compatibility information (such as from Ref. 18). This
type of matrix serves as the basis for a chemical hazard
analysis (CHA) review similar to the HAZOP conducted
during later project stages. As more information
becomes available during construction and operation,
the hazard analysis matrix matures into a permanent
plant safety document.
Tables 2 and 3 are decision charts that make a process
designers thinking public and transparent. With these
diagnostic tools, we move through the next steps of ISPD.
2. Eradicate
One might look at the fire triangle and conclude that
eradicating risk is easy merely prevent ignition. If it
were that simple, many lives and billions of dollars would
not have been wasted. The references in Table 1 (and oth-
ers) enumerate the many sources of reaction initiation. Most
destructive fires, reactions and explosions are initiated by:
auto- or spontaneous ignition caused by heating
friction, e.g., heat from
a failed bearing on pump
or compressor
static electricity
repair activities, such as
arc welding, cutting, grinding
and impact, that could gener-
ate sparks
open flames, which are
often unavoidable around
furnaces, reactors and heaters
unprotected or faulty
electrical fixtures or switches
lightning and other
natural causes.
Safety
Table 2. Chemical reactivity chart for
acrylonitrile production.
Reaction Expected Endothermic
Type Reactants Reaction or Exothermic?
Main Propylene Partial Exothermic
Oxygen Combustion
Ammonia
Side Propylene Polymerization Exothermic
Side Oxygen None
Side Ammonia None
Side Propylene Combustion Exothermic
Oxygen
Side Oxygen Combustion Exothermic
Ammonia
Side Propylene None
Ammonia
Side Propylene Combustion Exothermic
Oxygen
Ammonia
Source: (15).
Table 3. Chemical process hazard analysis matrix for acrylonitrile production
based on NFPA ratings.
Health Fire Reactivity Component Propylene Ammonia Oxygen Acrylonitrile
1 4 1 Propylene P
3 1 0 Ammonia 0 0
0 0 0 Oxygen 4 1 0
? ? ? Acrylonitrile P ? 4 P
National Fire Protection Association (NFPA) Ratings:
0 = No hazard 1 = Minimal hazard 2 = Caution 3 = Danger 4 = Extreme danger
P = Polymerization ? = Yet to be determined
Source: (15).
CEP www.cepmagazine.org July 2006 33
Given the widespread presence of so many
ignition sources, it is impossible for them to be
eradicated.
To eliminate risk and ensure a safe design
approach, avoid flammable mixtures. This can be
done, for example, by blanketing storage tanks with
nitrogen, carbon dioxide or some other appropriate
inert gas. Reactors, where possible, should be
designed as fail-safe vessels, as described earlier.
3. Minimize
When reactive mixtures cannot be avoided,
keep volumes small. If reaction is the goal, igni-
tion must be reliable and certain to assure that
complete combustion occurs (see the previous dis-
cussion of furnaces).
4. Isolate
As a final line of defense, limit the effects of an
incident by segregation. In the U.S., for instance,
solid rocket facilities were placed in a Utah desert,
miles from civilization, and a nuclear reactor test
site was built in a remote area of Idaho.
The risk can also be confined. Reactor contain-
ment vessels in nuclear power plants represent this
type of quarantine.
Putting ISPD into practice
Starting with the safety documents introduced
by Sheppard (15), a preliminary flow diagram for
acrylonitrile production will be developed using
ISPD concepts.
The raw materials propylene, air and ammo-
nia are well known to most chemical plant
designers. Acrylonitrile is less familiar, but a great
deal about its properties can be surmised from its
molecular formula, C
3
H
3
N, and its structure:
This simple information raises several red flags:
double- and triple-bonded carbon atoms indicate pent-
up energy
C=N denotes membership in the deadly cyanide family
the highly unsaturated structure almost guarantees the
potential for spontaneous exothermic polymerization
hydrocarbon character assures combustibility
small molecular size indicates a gas at ambient condi-
tions or a highly volatile liquid
the cyano group suggests water-solubility.
All these factors point to a highly dangerous
process. Indeed, nitroalkanes, and c-nitro and polyni-
troaryl compounds tend to undergo violent or explosive
decomposition (10).
The table of thermodynamic data in Perrys Handbook
(Table 2-221 in Ref. 10) does not include acrylonitrile;
however, enthalpies of formation for its siblings, acetoni-
trile (C
2
H
3
N) and propionitrile (C
3
H
5
N), are both positive,
denoting the potential for spontaneous exothermic decom-
position. Acrylonitrile is related to TNT and nitroglycer-
ine, although its lack of molecular oxygen makes it less
hazardous than the latter two.
C C C N

H
H
H
Table 4. Key chemical and physical properties of acrylonitrile.
Property Data Comments
Formula C
3
H
3
N Clear, colorless liquid at room
Molecular Weight MW = 53 temperature with a faintly
Boiling Point 77.3C pungent odor
Freezing Point 83.5C
Density @ 20C 806 kg/m
3
Vapor Pressure 0.115 bara Dangerously high vapor pressure
@ 20C at room temperature
Vapor Density 1.8 Unlike hydrogen, vapors will not
(Air = 1) dissipate in air; leaked gas may
accumulate in low spots
Solubility in 6.07.5wt.% Severe potential for pollution; all
Water @ 20C wastewater will require treatment
Viscosity 3.4 10
4
Pa-s Viscosity is about one-third that of
@ 25C water; watch for seal leakage
Flash Point 0C Absolutely no sparks or open
flames are permitted near liquid
Autoignition 481C Avoid hot surfaces
Temperature
Flammability Lower: Flammability limits are about the
Limits 3vol.% same as those of methane
in Air @ 25C Higher:
17vol.%
Enthalpy of Gas: Risk of spontaneous
Formation 185 MJ/kgmole: decomposition or
@ 25C Liquid: combustion
150 MJ/kgmole
Heat of 1,762 MJ/kgmole This is about two-thirds the heat
Combustion, of combustion of gasoline and
Liquid @ 25C natural gas
Heat of 32.7 MJ/kgmole This is about one-fourth the latent
Vaporization heat of water
@ 25C
Source: (21) and others.
C N

34 www.cepmagazine.org July 2006 CEP

The Kirk-Othmer Encyclopedia (21) contains more
details and a flow sketch that provide the basis for a
tentative process flow diagram. Facts relevant to this
analysis are:
over 4 million metric tons of acrylonitrile are pro-
duced per year worldwide, more than 90% of which is
made by heterogeneous vapor-phase synthesis from propy-
lene, ammonia and air over a bismuth-molybdate catalyst
according to the reaction:
C
3
H
6
+ NH
3
+ 3/2 O
2
C
3
H
3
N + 3 H
2
O
acrylonitrile is a basic raw material for fibers and tex-
tiles, acrylonitrile-butadiene-styrene (ABS) and styrene-
acrylonitrile (SAN) plastics, nitrile rubber, bottles/packag-
ing, transparent and opaque plastics, and resins for many
specialty applications
it is among the top 50 tonnage chemicals in the U.S.
it is miscible with a wide range of organic solvents
it undergoes spontaneous polymerization in the pres-
ence of light.
The properties of acrylonitrile are listed in Table 4.
Production occurs in a fluid-bed reactor at a temperature
of 400C510C and pressure of 0.52 barg, where con-
versions of up to 98% are achieved in a single pass. A
starting quantity of 1.1 kg of propylene yields about
1.0 kg of acrylonitrile, 0.1 kg of hydrogen cyanide and
0.03 kg of acetonitrile.
A more-detailed hazard evaluation. Further reading
reveals acrylonitrile is highly toxic if ingested, moderately
toxic when inhaled, extremely irritating and corrosive to
skin and eyes, readily absorbed through skin, carcinogenic
and mutagenic. The average allowable 8-h exposure limit
in the U.S. is 2 ppm, with a 10-ppm maximum for no
more than 15 min. Acrylonitrile combustion can produce
HCN, a deadly gas.
Since more than half of North American and Western
European production goes to the export market, it seems
that manufacturers already compromise Kletzs first rule
of ISD, minimize. With large quantities of acrylonitrile
stored and shipped around the world, any tanker accident
would be worse than a conventional oil spill because of
the compounds solubility in water. Ideally, acrylonitrile
production would be integrated with final product manu-
facture, but markets and economics evidently do not
favor this. (To the credit of acrylonitrile makers, only
one of the incidents in Duguids database (4) occurred in
this industry.)
Based on identification (Step 1 of ISPD, Table 1),
eradication (Step 2) is not truly possible with this prod-
Safety
Table 5. Stream hazard chart.
Melting Flash Boiling Liquid Flam- Car-
Molecular Point, Point, Point, Density mabil- Deadly cino- Genetic
Compound Weight C C C kg/m
3
ity Poision? Toxin? genic? Damage? Irritating? Corrosive?
C3H6 42 High Suffocation No No
Hazard
NH3 17 Moderate Yes Strongly Moderately
O2 32 Powerful No Sometimes
Oxidant
N2 28 Non Suffocation No No
Hazard
C3H3N 53 83 0 77 806 High Yes Deadly Yes
HCN 27 14 26 700 Yes Deadly
C2H3N 41 88 5 82 786 High Yes
CO 28 High Yes Deadly No No
CO2 44 Non Suffocation No No
Hazard
H2SO4 98 Powerful Yes Strongly Strongly
Oxidant
(NH4) 2SO4 132
CEP www.cepmagazine.org July 2006 35
uct, unless its manufacture is abandoned altogether.
Therefore, inherently safer predesign must focus prima-
rily on Step 3, minimization. A predesigner might also
recommend that isolation (Step 4) be considered in ulti-
mate plant siting.
In developing the preliminary process design, safety
considerations are formalized by constructing a compre-
hensive stream hazard chart like the abbreviated version
shown in Table 5. This chart includes byproducts and
other chemicals present beyond those in Tables 2 and 3. In
the predesign report, this document would be located,
along with the stream chart ledger, at the bottom of the
process flow diagram (PFD). Space does not allow inclu-
sion of the comprehensive PFD here (a full-scale version
appears on pp. 512518 of Ref. 8 and on the web at
www.ulrichvasudesign.com/ACN.pdf). Table 5 is an
incomplete stream hazard chart presented to illustrate how
a comprehensive one would be constructed; it should not
be cited as an authoritative source.
To illustrate how ISPD principles are applied to equip-
ment selection and design, a section of the reactor module
from the PFD is shown in Figure 3. At first glance, it
looks like any other process flow segment. Closer exami-
nation reveals that several important design concessions
were made for the sake of safety.
A natural opportunity for regenerative heat recovery
is not exploited. Without considering safety, one might
be tempted to preheat the propylene and ammonia with
the reactor effluent. But that is risky, because a broken
heat exchanger seal could create premature combustion
in the feed line.
Instead, reagents are injected into the reactor without
preheating. This is a solid yet simple design strategy for
CSTRs that minimizes the risk of premature feed igni-
tion. Reactor and effluent heat-recovery chores are shift-
ed to steam generation and feed vaporization through
safer heat-transfer fluid intermediaries. The heat-transfer
fluid is circulated between the E-113 heat exchangers
and the vaporizers to avoid direct contact between the
reagents and the hot reactor effluent. At the predesign
stage, the heat-transfer fluid is not yet specified. Water
is an obvious candidate, although a pump failure might
lead to freezing and the formation of ice in the vaporizer
tubing, causing it to burst. Heat-transfer oil is an alter-
native, but it also has drawbacks. Thus, the selection of
a heat-transfer fluid is an issue that might await final
design to be resolved.
In keeping with Kletzs third rule, attenuate, propylene
and ammonia are stored as liquids under refrigeration
rather than as gases or liquids under pressure.
To minimize adverse effects (Rule 3, Table 1), reactants
are fed to the reactor as gases. Propylene and ammonia
could easily be sprayed into the bed as cold liquids to
eliminate vaporizers E-110 and E-115. As liquids, howev-
er, their energy density and potential for causing damage
are a thousand times larger.
On the other hand, the feed system in Figure 3 conflicts
with Kletzs admonition to simplify. Vaporization adds
complexity to the process and increases the risk of failures
due to the extra equipment, not to mention its higher capi-
tal costs. This dilemma of which reactant phase is best
should be revisited in discussions with safety experts and
other designers on the project. Direct liquid injection
might be chosen, in which case special fail-safe instru-
mentation and operating procedures must be in place to
assure that it is done safely.
Reactor R-120, an exothermic CSTR, is a candidate
for disaster. To avoid the risk of an ignition surge,
reactor design and operation must exclude any chance
of classic CSTR multi-stability (see Ref. 7, p. 184 for
details on this phenomenon). The reactor should be as
small as possible. Fortunately, the hot solid catalyst is
a reliable reaction initiator. Start-up procedures must
be designed to heat the bed to a temperature that guar-
antees the immediate ignition of fresh feed when it
enters the reactor.
A more subtle ISPD characteristic of Figure 3 is that
key mechanical devices, like pumps and compressors, are
provided in multiples (equipment numbers followed by
letters A, B, etc.). This is done because most high-risk
incidents, such as device failures, occur during shutdown
and startup activities. With multiple units, a plant can still
be operated, albeit at reduced capacity, when one device
fails. The faulty unit can be isolated, purged, repaired,
GAEL D. ULRICH is professor emeritus of chemical engineering at the Univ.
of New Hampshire (E-mail: gaelulrich@gmail.com), where he has been
a faculty member since 1970. Prior to pursuing a teaching career, he
worked at Atomics International Div. of North American Aviation and
Cabot Corp. For the past 30 years, he has consulted for a number of
corporations and presided over a small contract research firm for ten
years. The material in this article was extracted from Chemical
Engineering Process Design and Economics, a Practical Guide, 2nd
edition, published with coauthor P. T. Vasudevan in 2004. He holds BS
and MS degrees from the Univ. of Utah and an ScD from the
Massachusetts Institute of Technology, all in chemical engineering, and
is a member of The Combustion Institute.
PALLIGARNAI T. VASUDEVAN is a professor of chemical engineering at the
Univ. of New Hampshire (E-mail: ptvasu@gmail.com), where he has
been a faculty member since 1988, and before that he worked in a
major petrochemical company for seven years. His research at UNH
focuses on catalysis and biocatalysis. He is currently collaborating with
researchers in Spain in the areas of hydrodesulfurization and enzyme
catalysis. He holds a BS from Madras, India, an MS from the State Univ.
of New York at Buffalo, and a PhD from Clarkson Univ., all in chemical
engineering, and is a member of AIChE.
36 www.cepmagazine.org July 2006 CEP
inspected, tested, purged again and returned to service,
while its twin continues to operate thereby avoiding a
total plant shutdown.
Kletz recommends the use of non-continuous spares,
i.e., equipment that remains idle until it is needed (13).
One may argue that idle equipment is more likely to dete-
riorate than functioning equipment. For that reason, the
authors favor multiple items that operate continuously
unless one is under repair.
The development of detailed safe startup and shut-
down procedures are reserved for the final design stage
and its hazards and operability analysis. Nonetheless,
Safety
I Figure 3. Portion of the acrylonitrile process flow diagram. (The complete version is available on pp. 512515 of Ref. 8 or at
www.ulrichvasudesign.com/ACN.pdf.)
CEP www.cepmagazine.org July 2006 37
any preliminary designer should be aware of the con-
cerns that HAZOPs will raise.
A major issue with a process like the acrylonitrile plant
is ensuring safety inside lines and vessels when they are
idle. For example, upon cool-down, vapors inside heat
exchangers, condensate drums, vaporizers and other
equipment are prone to condense, thereby creating a vacu-
um; consequently, any leak (from a faulty isolation valve,
for instance) allows atmospheric air to enter and create a
combustible mixture. To prevent this, final designers
should provide fill lines to blanket equipment with either
an inert gas (e.g., nitrogen or carbon dioxide, or, for some
vessels in a process like that shown in Figure 3, a hydro-
carbon gas). Such practices avoid the creation of com-
bustible mixtures at all times.
Unfortunately, history has recorded many deadly exam-
ples of failures in blanketing systems, since even success-
ful inert-gas blanketing has its hazards. For example, cases
have been documented where isolation procedures were
carried out properly to leave a vessel ready for repair,
except that the vessel was full of inert gas. Maintenance
workers, unaware of the need for breathing apparatus, sub-
sequently entered the equipment, only to collapse and die
from suffocation.
By the principles of inherently safer design, vessels
should be strong enough to avoid implosion or collapse
under vacuum and rupture if an explosion occurs inside.
To the predesigner, this generally means small is good.
Guidance for designing inherently safer vessels can be
found in Refs. 15 and 23.
Closing thoughts
Documents like Tables 25 can be woven seamlessly
along with the process flow diagram into a design report.
Upon such integration, safety, like economics and environ-
mental protection, becomes a vital element of the pre-
design package and an issue that cannot be overlooked
or ignored.
Literature Cited
1. Sutton, I., Review of Process Plants: A Handbook for
Inherently Safer Design, Chem. Eng., 106 (6), pp. 910,
(June 1999).
2. SACHE, Safety and Chemical Engineering Education
Workshop for Faculty on Safety and Process Design, spon-
sored by BASF, AIChE Undergraduate Education Committee
of CCPS (Center for Chemical Process Safety), Dow, Merck,
Rohm & Haas, Shell, and U.S. Chemical Safety and Hazard
Investigation Board, D. A. Crowl and J. Wehman, workshop
leaders, Wyandotte, MI (Sept. 1720, 2000).
3. Leggett, D., Runaway Reactions: Ignore the Chemistry at
Your Peril, Chem. Eng., 107 (8), pp. 7885 (Aug. 2000).
4. Duguid, I., Take this Safety Database to Heart, Chem.
Eng., 108 (7), pp. 8084 (July 2001).
5. Fogler, H. S., Elements of Chemical Reaction Engineering,
3rd Ed., Chapter 8, Prentice-Hall, New York (1998).
6. Hill, C. G., An Introduction to Chemical Engineering
Kinetics and Reactor Design, Chapter 10, Wiley, Hoboken,
NJ (1977).
7. Ulrich, G. D., A Guide to Chemical Engineering Reactor
Design and Kinetics, p. 32, Process Publishing (www.ulrich-
vasudesign.com), Lee, NH (1993).
8. Ulrich, G. D., and P. T. Vasudevan, Chemical Engineering
Process Design and Economics, a Practical Guide, 2nd Ed.,
Process Publishing (www.ulrichvasudesign.com), Lee, NH
(2004).
9. Gupta, J. P., and D. Edwards, Inherently Safe Design,
Communication to SACHE 2000 participants (July 23, 2000)
and letter to Chem. Eng., p. 8 (Oct. 2001).
10. Perry, J. H., D. W. Green, and J. O. Maloney, Chemical
Engineers Handbook, 7th Ed., Table 2-221 and Chapter 26,
McGraw-Hill, New York (1997).
11. Kletz, T., What Went Wrong?, Gulf Publishing Co.,
Houston, TX (1998).
12. Kletz, T., HAZOP and HAZAN: Identifying and Assessing
Process Industry Hazards, 3rd Ed., Hemisphere Publishing,
Bristol, PA (1998).
13. Kletz, T., Process Plants A Handbook for Inherently
Safer Design, Taylor & Francis, Philadelphia, PA (1998).
14. Singh, J., Safe Scaleup of Exothermic Reactions, Chem.
Eng., 104 (5), pp. 9295 (May 1997).
15. Sheppard, C. M., Process Safety in the Curriculum, Chem.
Eng. Ed., 32, pp. 270276 (Fall 1998).
16. Lees, F. P., Loss Prevention in the Process Industries;
Hazard Identification, Assessment and Control, Butterworth-
Heineman, New York (1996).
17. Crowl, D. A., and J. F. Louvar, Chemical Process Safety:
Fundamentals with Applications, 2nd Ed., Prentice-Hall,
Englewood Cliffs, NJ (2001).
18. Urben, P. and L. Bretherick, Brethericks Handbook of
Reactive Chemical Hazards, 6th Ed., Vol. 1 and 2,
Butterworths, London (1999).
19. Pohanish, R. P., ed., and M. H. Sittig, SITTIGs Handbook
of Toxic and Hazardous Chemicals and Carcinogens, 4th
Ed., William Andrew Publishing, Norwich, NY (2002).
20. Shanley, R., and G. A. Melhem, On the Estimation of
Hazard Potential for Chemical Substances, International
Symposium on Runaway Reactions and Pressure Relief
Design Proceedings, Boston, MA (1995).
21. Kirk-Othmer, Encyclopedia of Chemical Technology, 4th
Ed., Vol. 1, pp. 352369, Wiley, New York (1991).
22. Mosley, D. W., A. I. Ness, and D. C. Hendershot, Screen
Reactive Chemical Hazards Early in Process Development,
Chem. Eng. Progress, 96 (11), pp. 5163 (Nov. 2000).
23. Welker, J. R., and C. Springer, Safety, Health, and Loss
Prevention in Chemical Processes, AIChE, Center for
Chemical Process Safety, New York, NY (1990).
CEP