IChemE SYMPOSIUM SERIES NO.

153 # 2007 IChemE

PLANNING PROTECTION MEASURES AGAINST RUNAWAY REACTIONS

USING CRITICALITY CLASSES

Francis Stoessel
Swiss Institute for the Promotion of Safety & Security, Schwarzwaldallee 215; WRO-1093.3.35, CH-4002 Basel;
e-mail: francis.stoessel@swissi.ch

A systematic approach to the assessment of thermal risks linked with the performance of
exothermal reactions at industrial scale was proposed a long time ago1. The approach consisted
of a runaway scenario starting from a cooling failure and a classification of these scenarios into
criticality classes2. In the mean time these tools became quite popular and many chemical compa-
nies use them. Recently the international standard IEC 615113 prescribed the use of protection
systems with a reliability depending on the risk level. Since the criticality classes were developed
as a tool for the choice of risk reducing measures as a function of the criticality, it seems obvious
that the criticality classes may be used in the context of the standard IEC 61511, which provides a
relation between the risk level and the reliability of protection systems. The objective of the present
work is to show how criticality classes can be used as a tool for the choice of adequate protection
system against runaway reactions.
For this purpose the risk assessment criteria were made more quantitative and more flexible
by using a four level scale for severity and a six level scale for probability of occurrence, as used in
many risk assessment methods. The thermal data of a chemical process are determined as an answer
to six key questions allowing building a cooling failure scenario as a worst case approach. These
results can be summarised in four characteristic temperature levels, i.e. the process temperature
(Tp) the maximum temperature of the synthesis reaction (MTSR), the maximum allowed tempera-
ture for technical reasons (MTT) and the temperature at which the time to maximum rate is equal to
24 hrs (TD24). These temperature together with some technical aspects concerning the industrial
equipment are a sufficient data base for the risk assessment, as well as for the choice and the
reliability assessment of protection systems. Using the criticality class and taking the nature of
the system into account i.e. open or closed and gassy or vapour as well as some technical charac-
teristics of the equipment, the consequences of a potential runaway can be determined. Then using
the estimation of the thermal activity at the relevant temperature level, the probability of loss of
control can be assessed and the required IPL and SIL can be determined. Thus no additional
data are required to accomplish the assessment with recommendations concerning adequate
protection systems.
In a first part the runaway scenario and the criticality classes will be shortly described. Then
the assessment criteria for severity and probability of occurrence of a runaway scenario will be
described together the required data and their interpretation in terms of risk. In a third part, the
assessment procedure is exemplified for the different criticality classes. Finally the design of pro-
tection measures against runaway and the required IPL and SIL are based on the risk assessment
obtained from the criticality classes. This approach allows minimising the required data set for
the safety assessment and for the definition of the protection system designed in order to avoid
the development of the runaway.

KEYWORDS: runaway reaction, risk assessment, safety integrity level

INTRODUCTION consisted of a runaway scenario starting from a cooling

A systematic approach to the assessment of thermal risks
linked with the performance of exothermal reactions at
industrial scale was proposed a long time ago. The approach
1
R. Gygax, Chemical reaction engineering for safety. Chemical Engin-
eering Science, 1988. 43(8): p. 1759–1771.
2
F. Stoessel, What is your thermal risk? Chemical Engineering Pro-
gress, 1993(October): p. 68 –75.
3 the criticality, it seems obvious that the criticality classes
Funktionale Sicherheit - Sicherheitstechnische Systeme für die Prozes-
sindustrie IEC 61511., Nr. IEC 61511, Rev. 2004, DIN VDE.
failure [Gygax, 1988] and a classification of these scenarios
into criticality classes [Stoessel, 1993]. In the mean time
these tools became quite popular and many chemical com-
panies use them [Stoessel, 1995]. Recently the international
standard IEC 61511 [IEC, 2004] prescribes the use of pro-
tection systems with a reliability depending on the risk
level. Since the criticality classes were developed as a tool
for the choice of risk reducing measures as a function of
may be used in the context of the standard IEC 61511,

1
IChemE SYMPOSIUM SERIES NO. 153
which provides a relation between the risk level and the
reliability of protection systems. The objective of the
present paper is to show how the criticality classes can be
used as a tool for the choice of adequate protection system
against runaway reactions.
For this purpose the risk assessment criteria were made
more quantitative and more flexible by using a four level scale
for severity and a six level scale for probability of occurrence,
as used in many risk assessment methods. The data used to
build the cooling failure scenario, together with some technical
aspects concerning the industrial equipment are sufficient for
the risk assessment, as well as for the choice and the reliability
assessment of protection systems. Thus no additional data are
required to accomplish the assessment with recommendations
concerning adequate protection systems.
In a first part the runaway scenario and the criticality
classes will be shortly described. Then the assessment
criteria for severity and probability of occurrence of a
runaway scenario will be described together with the
required data and their interpretation in terms of risks. In a
third part, the assessment procedure is exemplified for the
different criticality classes. Finally the design of protection
measures against runaway is based on the risk assessment
obtained form the criticality classes.
RUNAWAY SCENARIO
The cooling failure scenario was developed by R. Gygax
[Gygax, 1988 and 1993] for the systematic assessment of
thermal risks linked with exothermal chemical reactions.
This scenario works as follows (Figure 1): If a cooling
failure occurs while the reactor is at the process temperature
(TP), the temperature increases due to the completion of the
reaction. This temperature increase depends on the amount
of non-reacted material, thus on the process conditions.
It reaches a level called the Maximum Temperature of the
Synthesis Reaction (MTSR). At this temperature, a second-
ary decomposition reaction may be initiated. The heat
produced by this reaction may lead to a further increase in
temperature reaching the final temperature (Tend). The fol-
lowing questions represent six key questions that help to
develop the runaway scenario and provide guidance for
the determination of data required for the risk assessment:
Question 1: Can the process temperature be controlled by
the cooling system ?
Question 2: What temperature can be attained after
runaway of the desired reaction?
Question 3: What temperature can be attained after
runaway of the secondary reaction?
Question 4: At which moment does the cooling failure
have the worst consequences?
Question 5: How fast is the runaway of the desired reac-
tion?
Question 6: How fast is the runaway of the decomposition
starting at MTSR?
The six key questions presented above ensure that the
essential knowledge about the thermal safety of a process is
2
# 2007 IChemE
Tend
T
Desired Secondary
Reaction 3
Reaction
ΔTad
5
MTSR
6
ΔTad 2 TMRad
Tp
Cooling
Failure t
1
4
Normal
Process
Figure 1. Runaway Scenario. The left part of the scheme is
devoted to the desired reaction and the temperature increase
to the MTSR in case of a failure. In the right part, the
temperature increase due to a secondary exothermal reaction
is shown, with its characteristic time to maximum rate. The
numbers represent the six key questions
addressed. In this sense, they represent a systematic way of
analysing the thermal safety of a process and building the
cooling failure scenario. Once the scenario is defined, the
next step is the determination of the criticality class allowing
the actual assessment of the thermal risks.
DETERMINATION OF THE CRITICALITY CLASS
The cooling failure scenario presented above, uses the temp-
erature scale for the assessment of severity and the time
scale for the probability assessment. Starting from the
process temperature (TP), in case of a failure, the tempera-
ture first increases to the maximum temperature of the syn-
thesis reaction (MTSR). At this point, it must be checked if a
further increase due to secondary reactions may occur. For
that purpose, the concept of Time to Maximum Rate
under adiabatic conditions (TMRad) is very useful. Since
TMRad is a function of temperature, it may also be rep-
resented on the temperature scale. If we assume that for a
TMRad longer than 24 hrs, triggering the decomposition
reaction becomes unlikely, the temperature at which
TMRad is 24 hrs (TD24) becomes a relevant threshold
level to be considered. This assumption is only valid for a
reaction and not for storage or transportation.
In addition to the three temperature levels
(TP, MTSR, TD24), there is another important temperature:
the temperature at which technical limits of the equipment
are reached: the Maximum Temperature for Technical
reasons (MTT). This may be governed by the resistance of
construction materials, or by the reactor design parameter
as pressure or temperature etc. In an open reacting system,
i.e. operated at atmospheric pressure, the boiling point is
IChemE SYMPOSIUM SERIES NO. 153
often used. In a closed system, operated under pressure, it
may be the temperature, at which the pressure reaches the
set pressure of the pressure relief system. Therefore, the
MTT is of particular importance, since it may represent
the temperature level at which a runaway can be stopped
by appropriate means.
Thus by considering the temperature scale, and for
reactions presenting a thermal potential, we can consider
the relative position of four temperature levels:
. The process temperature (TP): The initial temperature in
the cooling failure scenario. In case of non isothermal
process, the initial temperature will be taken at the
instant when the cooling failure has the most severe
consequences (worst case)
. Maximum temperature of synthesis reaction (MTSR):
This temperature depends essentially on the degree of
accumulation of non-converted reactants and therefore
it is strongly dependant on the process design
. Temperature at which TMRad is 24 hours (TD24): This
temperature is defined by the thermal stability of the
reaction mixture. It is the highest temperature, at
which the thermal stability of the reaction mass is unpro-
blematic.
. Maximum temperature for technical reasons (MTT). In
an open system, it is the boiling point. For a closed
system, it is the temperature, at which the pressure
reaches the maximum permissible, i.e. the set pressure
of a safety valve or bursting disk.
These four temperature levels allow classifying the
scenarios into five different classes (Figure 2) [Stoessel,
1993]. Depending on the relative order of the different temp-
erature levels described in the previous subsection, different
types of scenarios can be obtained. These differ by their
respective criticality, which allows the classification in
criticality classes. Therefore, the criticality class is a
useful tool not only for the risk assessment, but also for
the choice and the definition of adequate risk reducing
measures. In Classes 1 and 2, the loss of control of the
main reaction does not trigger secondary reactions and the
technical limit is not reached. In Class 3 the technical
limit is reached and may serve as a safety barrier, but the
secondary reactions are not triggered. In Class 4 the
T
MTT
TD24
MTT
MTSR MTSR
Tp
Criticality
Class 1 2
Figure 2. Criticality Classes of Scenario, obtained by combining the four temperature levels: TP, MTSR, TD24 and MTT
3
# 2007 IChemE
secondary reactions could be triggered, but the technical
limit may serve as a barrier. In Class 5 the secondary reac-
tions are triggered and the technical limit is reached as the
runaway is too fast for a safety barrier to be efficient.
CONSEQUENCES OF A RUNAWAY REACTION
A runaway reaction may have multiple consequences: The
high temperature by itself may be critical. The higher the
final temperature, the worse are the consequences of
the runaway. In case of a large temperature increase, some
components of the reaction mixture may be vaporised or
some gaseous or volatile compounds may be produced.
This may lead to further consequences: a pressure increase
in the system and/or release of gases or vapour, which may
cause secondary damages by their toxicity or flammability.
TEMPERATURE
The adiabatic temperature rise, which is proportional to the
reaction energy, represents an easy to use criterion for the
evaluation of the severity of an uncontrolled energy
release as a runaway reaction. The adiabatic temperature
rise can be calculated easily by dividing the energy of
reaction by the specific heat capacity:
Q0
DTad ¼ (1)
c0P
In Classes 1 to 3, the energy to be considered is the reaction
energy only, whereas in Classes 4 and 5 the energy to be con-
sidered is the sum of the reaction and decomposition energies.
The temperature increase may represent a threat by itself, but
in most cases, it will result in a potential pressure increase.
PRESSURE
The pressure increase depends on the nature of the pressure
source, i.e. gas or vapour pressure. Furthermore the charac-
teristics of the system, i.e. if the reactor is closed or open to
the atmosphere will determine the consequences: in an open
system, the gas or the vapour will be released from the
reactor, whereas in a closed system the result of a
MTT
MTSR MTSR
MTT
MTSR
MTT
3 4 5
IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

runaway will be a pressure increase. The resulting pressure
can be compared to the set pressure of the pressure relief
system (Pset) or to the maximum allowed working pressure
(Pmax) or also to the test pressure (Ptest) of the equipment.
OPEN GASSY SYSTEM
In an open system with gas production, the volume of gas
can be obtained from equation (2), and the volume calcu-
lated either for a toxicity limit as the IDLH or from the
lower explosion limit LEL:

RELEASE rffiffiffiffiffiffiffiffiffiffiffiffiffiffi
Vg 3 3  Vtox
In an open system, since the gas or the vapour will be Vhazard ¼ )r¼ (4)
released from the reactor, the consequences depend on the Limit 2
extension of the release and on the properties of the gas or
vapour (e.g. toxicity or flammability). The extension can In this equation, the extension is calculated as the radius of a
be assessed by using the volume of the toxic cloud by half sphere. The assessment is performed by comparing the
calculating its dilution to a critical limit. For toxicity, the extension to characteristic dimensions, e.g. of the equip-
limit may be taken as the IDLH or other limits defined ment, plant and site.
by law (e.g. EPRG-2. . ..). In case the gas or vapour is flam-
mable, the lower explosion limit (LEL) is the critical limit.
Since it is easier to have a good representation of a distance
than of a volume, it is proposed to use the radius of a half OPEN TEMPERED SYSTEM
sphere to describe the extension of the gas or vapour An open tempered system is a system in which the latent
cloud. Such a simple approach has nothing to do with heat of evaporation can be used to halt the temperature
dispersion calculation using complex models and meteoro- increase, i.e. to temper the system. This can be achieved
logical information, but is useful for the purpose of asses- at atmospheric pressure by reaching the boiling point or at
sing the risks due to a runaway. a higher pressure by applying a controlled pressure relief.
Thus we have to consider four different cases: The first step is to calculate the mass of vapour that may
be relieved form the latent heat of evaporation and the
. Closed gassy system: gas release in a closed reactor, characteristic temperatures:
. Closed tempered system: vapour pressure in a closed
system, ðTmax  MTT Þ  c0p  Mr
. Open gassy system: gas release from an open system, Mv ¼ (5)
DHv0
. Open tempered system: vapour release from an open system.
The maximum temperature can be the MTSR for
CLOSED GASSY SYSTEM Class 3 or Tend for Classes 4 and 5. This mass is converted
The volume of gas potentially released by a reaction (includ- into a volume by using the vapour density that may be esti-
ing secondary reactions in criticality Classes 4 and 5) can be mated as an ideal gas and the extension is calculated in a
known from the chemistry or measured experimentally by similar way as for open gassy systems bay using either a
appropriate calorimetric methods as e.g. Calvet calorimetry, toxicity limit or the lower explosion limit:
mini-autoclave, Radex or Reaction Calorimetry (as V’g at
Tmes). It must be corrected for the temperature to be rffiffiffiffiffiffiffiffiffiffiffiffiffiffi
Mv 3 3  Vtox
considered, MTSR (Class 2), MTT (Class 3 or 4) or Tf Vhazard ¼ )r¼ (6)
rv  Limit 2
(Class 5). In case the gas stems from the main reaction,
only the accumulated fraction (X) may be released:
The assessment can be performed using the criteria
TðK Þ summarised in Table 1. In cases where more than one cri-
Vg ¼ Mr  Vg0  X  (2) terion applies, the highest rating is taken (worst case) to
TmesðK Þ
assess the severity.
This volume can be converted in a pressure increase by
taking the available free volume in the reactor (Vr,g)
Table 1. Assessment criteria for the severity using the energy
P Vg
¼ (3) (DTad), the pressure for closed systems and the extension for
P0 Vr,g open systems

Extension
CLOSED VAPOUR SYSTEM
Severity DTad P (r)
In this case the pressure increase is due to the vapour
pressure of volatile compounds. Since often the volatile Catastrophic .400 K .Ptest .Site
compound can be considered to be the solvent, its vapour Critical 200– 400 K Pmax – Ptest Site
pressure can be obtained form a Clausius-Clapeyron Low 50 – 200 K Pset – Pmax Plant
equation or by an Antoine equation. For complex systems Negligeable ,50 K ,Pset Equipment
it may be obtained from a a phase diagram P ¼ f(T,x).

4
IChemE SYMPOSIUM SERIES NO. 153
PROBABILITY OF LOSS OF CONTROL
DURING RUNAWAY
For the probability assessment no quantitative failure rates
will be used, a semi-quantitative approach based on the
probability of loss of control will be used instead. The prin-
ciple is that the thermal activity at a given temperature as
MTT for example, will be estimated with the aim of predict-
ing the behaviour of the reacting mixture at this temperature
level. A low activity means that the temperature course is
easy to control, whereas a high activity rends it difficult. It
is assumed that the same reaction that releases heat
also causes the gas release and obviously the evaporation
of volatiles. The heat release can directly be compared to
the cooling capacity of an emergency cooling system. The
control of gas or vapour release is assessed using the
maximum gas or vapour velocity in the equipment.
ACTIVITY OF THE MAIN REACTION
Starting from process temperature (Tp), the reaction is accel-
erated by the temperature increasing to MTT and slowed
down by the reactant depletion. This may be expressed as
a function of the temperature levels assuming a first order
kinetics:
  
E 1 1 MTSR  MTT
qðMTT Þ ¼ qrx  exp  
R Tp MTT MTSR  T
|fflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl} |fflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflpffl}
increases reaction rate decreases reaction rate
The heat release rate of the reaction at process temp-
erature is known from an experiment in a reaction calori-
meter. If it is unknown, as worst case assumption, the
cooling capacity of the reactor can be used instead, since
for an isothermal process the neat heat release rate of the
reaction is certainly inferior to the cooling capacity.
ACTIVITY OF SECONDARY REACTION
For cases where the secondary reaction plays a role
(Class 5), or if the gas release rate must be checked
(Classes 2 or 4), the heat release rate can be calculated
from the thermal stability tests. Secondary reactions
are often characterised using the concept of Time to
Maximum Rate under adiabatic conditions (TMRad)
[Townsend, 1980]:
c0p  R  T 2
TMRad ¼
q(T)  E
A long time to maximum rate means that the time available
to take risk reducing measures is sufficient. At the opposite a
short time means that the runaway may not be halted at
the given temperature. The heat release rate at the tempera-
ture at which TMRad is equal to 24 hours (TD24) may be
calculated from following equation:
2
c0p  R  TD24
q0ðTD24 Þ ¼
24  3600  Edc
This heat release rate may serve as a reference for the
# 2007 IChemE
extrapolation:
  
Edc 1 1
q0ðT Þ ¼ q0ðTD24 Þ  exp  (10)
R TD24 T
This allows extrapolating the heat release rate for cal-
culating the time to maximum rate at different temperatures
by using equation (8).
THERMAL ACTIVITY
The dynamics of the secondary reaction plays an important
role in the determination of the probability of an incident.
The probability can be evaluated using the time scale:
If, after the cooling failure, there is enough time left to
take measures before the runaway becomes too fast, the
probability of the runaway will remain low. For chemical
reactions on an industrial scale (not for storage or transpor-
tation), we can consider the probability to be low if the
time to maximum rate of a runaway reaction under adiabatic
conditions is longer than one day. The probability becomes
high if the time to maximum rate becomes less than eight
hours (one shift). These time scales are only orders of mag-
nitude and are dependent on many factors, among them the
degree of automation, the training of the operators, the fre-
quency of electrical power failures, size of the reactor, etc.
(7) This scaling of probabilities is only valid if something is
done to cope with the known severity (planned emergency
measures).
GAS RELEASE RATE
If we consider that thermal effects are the driving force of a
runaway, we may assume that the gas release is due to the
same reaction. Thus the gas release rate can be calculated
from:
q0(MTT)
v_ g ¼ Vg0  Mr  (11)
Q0
Here the heat release rate and the energy represents the sum
of all active reactions. It may be only the main reaction
(Class 3 and 4) or both main and secondary reactions
(Class 5). This allows calculating the gas velocity in the
equipment using the narrowest tube section. The capacity
of a scrubber may also be used as an assessment criterion.
(8)
VAPOUR RELEASE RATE
The vapour mass flow rate is proportional to the heat release
rate and can be calculated from:
q0(MTT)  Mr
_v ¼
m (12)
DHv
It can be converted to a volume flow rate by using the
(9) vapour density and to a velocity, by using the section of
the vapour tube. The assessment of the equipment vapour
flow capacity should also take the cooling capacity of the
5
IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

Table 2. Assessment criteria for the probability of loss of 61511 standard [3]. It was adapted to the assessment of
control during a runaway reaction runaway reactions with the criteria as defined above. In
such a risk matrix, the different fields corresponding to
TMRad accepted (white), non accepted risks (dark grey or black)
(h) From q’ (W/kg) q’ (W/kg) can be identified. The black field corresponds to risks that
Criteria MTT Stirred Unstirred u m/s cannot be reduced by a safety instrumented system (SIS)
alone. The intermediate field (light grey) is used correspond-
Frequent ,1 .100 .10 .20
ing to risk that should be reduced as far as the costs are in
Probable 1–8 50 – 100 5 –10 10 – 20
relation with the risk reduction, following the ALARP prin-
Occasional 8 – 24 10 – 50 1–5 5 – 10
ciple (as low as reasonably possible). Quantitative failure
Low 24 – 50 5 – 10 0.5– 1 2–5
frequency data are difficult to obtain for multipurpose
Remote 50 – 100 1–5 0.1– 0.5 1–2
batch plants as they are often used in the fine chemicals
Not credible .100 ,1 ,0.1 ,1
and pharmaceutical industries. Moreover, a quantitative
assessment requires a detailed knowledge of the control
instruments, which may not be available during process
condenser into account. Further the swelling of the reaction
development. Therefore a semi-quantitative approach is
mass due to the presence of bubbles may also become criti-
proposed, that provides the required reliability for future
cal for high degrees of filling of the reactor [Wiss, 1993]. If
plant equipment.
both vapour and gas are released, obviously the sum of both
velocities must be used for the assessment. A proposal for
the assessment criteria based on time, on heat release rate DETERMINATION OF THE REQUIRED
and on gas or vapour velocities is summarised in Table 2.
RELIABILITY FOR SAFETY INSTRUMENTED
SYSTEMS
The probability considered here, is the probability that a
PROTECTION SYSTEM DESIGN BASED runaway may not be stopped at the level MTT, and as
ON RISK ASSESSMENT explained above, this probability increases with the
Obviously not all the parameters described above must be thermal activity at this temperature. The criticality classes
evaluated for each scenario. In this context, the criticality were used to describe the behaviour of the reaction mass
classes are a useful tool in the sense that they help in select- at this temperature and to determine the appropriate type
ing the required data for the assessment of severity and prob- of measure that should be implemented. Such a measure
ability (Table 3). The criticality classes also give a back like for example quenching a reaction mass will be triggered
bone for a systematic design procedure. Once the severity by an alarm (e.g. temperature) that opens a valve allowing
and the probability corresponding to a scenario were esti- the quenching medium to be flushed into the reactor. Such
mated, they can be used for the risk assessment and follow- a device comprising a sensor, a logical unit (alarm) and an
ing for the determination of the required reliability of the actuator (the valve) is called a safety instrumented system
protection system. (SIS). Such a system provides one independent protection
layer (IPL). For a high risk, more than one IPL may be

RISK ASSESSMENT
The four severity levels and the six probability levels Frequent 1:2 1:3 + 1:1 2:2 + 1:3 2:3
described above can be arranged in a risk diagram, some- 2:2 3:1 + 1:2 3:2
times also called risk matrix. The matrix presented here Probable 1:1 1.2 + 1:1 1:3 + 1:1 2:2 + 1:3
3:1 2:2 3:1 + 1:2
(Figure 3) is derived from an example given in the IEC
Occasional 1:2 1.2 + 1:1 1:3 + 1:1
2:1 3:1 2:2

Table 3. Required data set for the different criticality classes Low 1:1 1:2 1.2 + 1:1
2:1 3:1
(1)
Data Class 1 2 3 4 5 Remote 1:1 1:2
2:1
Gas main reaction V’(2)
g,rx þ þ þ þ þ Not credible 1:1 1:1
Gas sec. reaction V’(2)
g,dc (þ) (þ) þ þ
Vapour (Pv) (2) þ þ þ Negligible Low Critical Catastrophic
Power main reaction q’rx þ þ (þ)
Power sec. reaction q’dc (þ) þ
(1) The determination of the class requires the knowledge of four temp- Figure 3. Risk matrix adapted from IEC 61511 standard
erature levels: Tp, MTSR (i.e. Xac), MTT and TD24. indicating the accepted, non accepted risks as well as an
(2) Beside the volume or vapour pressure the toxicity limit or the Lower intermediate field. The numbers represent the number of
Explosion Limit (LEL) must be known. The calculation of the velocities required Independent Protection Levels together with the
also requires information about the diameter of the piping system. required safety Integrity level (IPL:SIL)

6
IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

required. Moreover the reliability of the SIS is defined by for the Promotion of Safety & Security for fruitful dis-
the standard IEC 61511 as the safety integrity level (SIL). cussions and suggestions during the elaboration of the tool
The design of a protection system against runaway com- presented here.
prises the definition of the nature of the system as well as
its reliability. Let us consider that the probability decreases
by one order of magnitude, from each level to the level
below, e.g. “probable” means a ten times higher probability NOTATIONS
than “occasional” and so forth. Then a risk that should be
reduced from “frequent” to “remote” corresponds to a
reduction by a factor 1024 and requires for example two Symbol Name Unit
IPLs with an SIL 2, coded 2:2 or 1 SIL 3 and 1 SIL 1 cP ’ Specific Heat capacity kJ.kg21.K21
coded 1:3 þ 1:1 in Figure 3. When more than one IPL is E Activation energy J.mol21
required one of them may be a non instrumented system DH’v Spec. latent heat of evaporatiom J.kg21
requiring human intervention as procedural measures do. m_ Mass flow rate kg.s21
The assessment scales given in the matrix as well as Mr Reaction mass kg
the required IPL and SIL are given as an example in order P Pressure bar
to show how thermal data may lead to a systematic q’ Specific heat release rate W.kg21
definition of the protection systems and the corresponding Q’ Specific energy kJ.kg21
SIL levels to be used. They should be defined according r Radius m
to a company’s own safety policy. R Universal gas constant J.mol21.K21
For a high risk, emergency measures as pressure relief T Temperature 8C or K
or containment must be taken to mitigate the consequences Tmes Temperature of gas measurement 8C or K
of a runaway that cannot be anymore avoided. Nevertheless, DTad Adiabatic temperature rise 8C
by far a better measure is to redesign the process in order u Linear velocity m.s21
to reduce the accumulation to an acceptable level, i.e. v_ Volume flow rate m3.s21
MTSR to a level below TD24. This may be achieved e.g. V Volume m3
by using a semi-batch reactor instead of a batch reactor Vr,g Available volume for gas m3
and ensuring that the feed rate is properly limited and inter- Vg’ Specific gas volume m3.kg21
locked with the temperature and the. A lower concentration X Conversion –
could achieve the same result, but on cost of the process
economy. Of course other process changes should be
considered, as continuous reactors, other synthesis route
avoiding instable reaction masses (increase TD24) etc.
SUBSCRIPTS

CONCLUSION
In this work a systematic procedure was shown allowing Subscript Meaning
defining the thermal data required for an assessment. The
0 Initial value
six key questions shown in the cooling failure scenario
ac accumulation
serve as a guide in this task. Once the data are determined,
dc decomposition
the next step is positioning the four characteristic tempera-
end end
ture levels (Tp, MTSR, MTT and TD24) in order to deter-
g gas
mine the criticality class. Using the criticality class and
max maximum
taking the nature of the system into account i.e. open/
p process
closed and gassy or vapour as well as some technical
r reaction mass
characteristics, the consequences of a potential runaway
rx reaction
can be determined. Then using the estimation of the
test test
thermal activity at the relevant temperature level, the prob-
tox toxic
ability of loss of control can be assessed and the required
v vapour
IPL and SIL can be determined. This approach allows
minimising the required data set for the safety assessment
and for the definition of the protection system designed
in order to avoid the development of the runaway.
REFERENCES
Gygax, R., 1988, Chemical reaction engineering for safety.
ACKNOWLEDGMENT Chem Eng Sci, 43(8): p. 1759– 1771.
The author wants to acknowledge his colleagues Hans Fierz, IEC, 2004 Funktionale Sicherheit – Sicherheitstechnische
Pablo Lerena and Georg Suter from the Swiss Institute Systeme für die Prozessindustrie, Nr. IEC 61511, DIN VDE

7
IChemE SYMPOSIUM SERIES NO. 153
Gygax, R., 1993, Thermal Process Safety, Data Assessment, cri-
teria, measures, ed. ESCIS. Vol. 8, Lucerne: ESCIS.
Stoessel, F., 1993, What is your thermal risk? Chem Eng Prog,
10: 68 – 75.
Stoessel, F., Steinbach, J. et al., 1995, Plant and process safety,
exothermic and pressure inducing chemical reactions, Ull-
mann’s encyclopedia of industrial chemistry, E. Weise.
Weinheim, VCH, B8: 343– 354.
# 2007 IChemE
Townsend, D.I. and Tou, J.C., 1980, Thermal Hazard evalu-
ation by an accelerating rate calorimeter. Thermochimica
Acta, 37: 1 – 30.
Wiss, J., Stoessel, F. and Killé, G., 1993, A systematic pro-
cedure for the assessment of thermal safety and for the
design of chemical processes at the boiling point, Chimia,
47(11): p. 417– 423.