jetting; if it has heptane inside the drum, there is not any So, I presume it might be applied; however, we need to

explosion; the fuel comes out as a jet, burns and is very check it.
safe. What we don't want to get is a violent explosion which DICK ILLOMAKI, Allendale Insurance: You mentioned
is determined by the temperature ofthe liquid-vapor inter- that sprinklers were operating in some of the tests and
face. maybe not in others. What were some of the effects of
STAN GROSSEL, Hoffman-LaRoche: You explained that sprinklers in those tests or can you make any conclusions?
you conducted the tests with the drums vertically aligned. Were the drums that ruptured under sprinkler protection?
Would your analysis apply to horizontally aligned drums. MIKLOUCICH: The drums that ruptured were under
MIKLOUCICH: I don't believe so. We haven't looked at sprinkler protection and the drums ruptured before the
that yet. I think it would take a little time on our part to sprinklers operated; in some tests, the sprinklers did not
determine this, unless John has a real fast answer. operate at all. Because of their temperature rating, Kodak
JOHN NORONHA: It seems like the analysis is indepen- has long been an advocate of the lower temperature rated
dent of the geometric dimensions of the freeboard space. sprinkler 165 vs. the 286 which is sometimes used.

Safety Analysis for an Allyl Chloride Plant

Operability analysis in combination with fault-tree quantification assures a
plant arrangement with predetermined reliability.
N. Piccinini, U. Anatra, and G. Malandrino, Istituto di Chimica Industriale del Politecnico di Torino, Italy, and D. Barone,
ANIC S.p.A., S. Donato MiLse, Italy

On the basis of a comparative study of fault-tree quan- -Molten salts are used to cool and recover heat in the
tification, this article concludes that account must be taken boiler B 106.
of the statistical distribution of failure probability and fail-
ure rates.
OPERABILITY ANALYSIS

DESCRIPTION OF PROCESS Operability analysis using guide words (Reference 15)

was performed to identify the potential risks (top events)
The process concerned leads to the production of allyl and related causes.
chloride by high-temperature (300-550') chlorination of Two of these top events are described below:
propylene. The main reaction is: A) Explosion in Jet-mixer J 101. This can occur if the
CH,=CH-CH:, + C1, + CHFCH-CH,Cl+ HC1 propylene: chlorine ratio is within the flammability
limits.
AH,,,, = -26.8 kcal/mol (1) As these are not available in the literature, the flamma-
The other important reaction is the production of 1,2- bility limits of an oxygen-propylene mixture were con-
dichloropropane: sidered (Reference 16).
CHFCH-CH,~ + C1, -+ CH,CI-CHCI-CH,
AH,,,, = -44.1 kcal/mol (2) I a'
Reactions 1 and 2 are promoted by high (>300"C) and
low (<200"C) temperatures respectively (References
7-11).
At approximately 500°C, however, reaction 1 is restricted
by pyrolysis reactions that decrease the conversion factor
and foul the reactor, while much higher temperatures may
result in its thermal collapse.
Since the output is 45,000 t/yr, an isothermal multitube
reactor as opposed to an adiabatic tubular reactor is con-
sidered (References 12-14).
Our allyl chloride and 1,2-dichloropane conversion
rates, and the reaction and molten-salts temperatures as
functions of the length reactor are shown in Figure 1.
Operating conditions and reactor characteristics are il-
!ustrated in Table l , and the plant flow sheet in Figure 2.
This shows that:
-Propylene gas, preheated in the heat exchanger E 104
(2SO'C) and in the heater F 101 (337"C), is sent to the
jet-mixer (J l 0 l A or J 101B) together with chlorine. The
temperature after mixing is 300°C. 0 2 1 6
-Two reactors R l O l A and R l 0 l B are used in turn to R e a c t o r length ( m l
permit maintenance. Figure 1. ollyl chloride and 1.2-dichloropropone 0s
0 ) Conversion Rates to
o function of reactor length
b) Reoction and molten salt temperotures as functions of reactor length

Plant/Operations Progress (Vol. 1, No. 1) January, 1982 69

 TABLE1. OPERATING
CONDITIONS

Ally1 chloride conversion rate (% reacted

chlbrine) 73 %
Chlorine conversion rate (70reacted chlorine) 90 Yo
Reactants ratio (mol propylene/mol chlorine) 2.5 i
Pressure 3.2 kg/cm2

Reactants inlet temperature 300 "C

Cooling molten salts inlet temperature 270 "C
Maximum reactor temperature 503 "C
Reactants outlet temperature 498 "C
Cooling molten salts outlet temperature 300 "C

Flowrates
Chlorine inlet 7560 kg/h
Propylene inlet 11190 kg/h
Ally1 chloride production 6000 kg/h Figure 3. Control loops and shutdown system
1,2-dichloropropane outlet 2000 kg/h
Chlorine outlet 730 kg/h

Propylene outlet 7150 kgih The first two are dangerous, while the third is safe; thus,
Hydrochloric acid outlet 2860 kg/h the hazard can only be evaluated by calculation. In this
Total outlet flow 18740 kg/h particular case, the temperature profiles inside the reactor
Cooling molten salts 11250 kg/h showed that a dangerous situation could arise. Changes in
the temperature as a function ofthe percentage decrease in
Reactor Characteristics propylene feed are given in Figure 4.
Internal diameter 0.99 m Reaction-temperature deviations T ,(,, - T,,,) related
Number of tubes 625 n to various percentage changes in the operating conditions
Tube diameter 0.0125 m
5.10 m due to instrument failures are shown in Table 2, together
Tube length
with the dangerous situations which they generated.

B) Thermal collapse of reactor R 101. This can occur FAULT-TREE QUANTIFICATION USING POINT VALUES OR
when the chlorination reaction takes place outside of FAILURE RATES
the project specifications, as in the following situa-
tions: To estimate the frequency of the two top events, the
1) Reduction in propylene feed failure rates and primary-event probabilities shown in
2) Increase in reaction pressure Table 3 were used.
3 ) Increase in cooling system inlet temperature These values are taken from industrial experience, as
4) Reduction of propylene: chlorine ratio well as from the literature (References 17-20).
5 ) Increase in reactant inlet temperatures In this paper, the target frequency A was fixed at 1x
6) Adiabatic operation of reactor (failure of molten-salt (occiyr) (occasions/year).
circulation). This frequency refers to the relatively small amounts of
To ensure accurate evaluation of these events, some toxic and flammable substances present in the plant.
parts of the operability analysis were developed quan- With the first arrangement of the pIant, the frequencies
titatively. of the two top events were:
In some cases, indeed, it is difficult to evaluate the A, = 4 x lo-' occlyr
hazard resulting from instrument failures without a
quantitative analysis. (thermal collapse of reactor R 101)
Some instrument failures may alter several parameters A, = 8 . 8 ~ occ/yr
in different directions (safety or danger).
For exam le, when valve FRC-1V closes (flow transmit- (explosion in jet-mixer J 101)
K
ter fails wit high signal output, see Figure 3 ) , the operat-
ing conditions are changed as follows:
a) decrease in propylene feed
b) decrease in propy1ene:chlorine ratio
c) decrease in reactor inlet temperature.

1111

200 4 4
0 2 4 6
Reactor l e n p t h ( m l

-
WATLR L - - - -- - - - - _-
OUlPUT
Fig. 4. Reaction temperature pattern when valve FRC IV closes owing to a
fault (transmitter signal too high). The parameter is provided by the
Figure 2. Flow sheet of ollyl-chloride process percentage drop in propylene flow rate

70 January, 1982 Plant/Operations Progress (Vol. 1, No. 1)

 TABLE2. CHANGES IN REACTION TEMPERATURE FOR EACH TABLE4. EFFECTO F CHANGES I N PLANT CONFIGURATION ON
CHANGE IN THE PROCESS CONDITIONS - T,,,=). TOP-EVENT FREQUENCY A, (REACTORR 101 THERMAL
The numbers in bold type indicate danger state. COLLAPSE) AND A , (JET-MIXER J 101 EXPLOSION)

Percentage variations A, A,
Instrument failures 15% 30% 45% 60% Configuration occlyr occlyr
---- --
FRC-2 Controller fails to open Initial lo-’
4 8.8
control valve 30 70 100 140 Addition of high-temperature
rRC-1 Ratio controller fails to shut-down system hTS-2 5 10-2 1.4 10-4
open 40 100 176 57 Addition of solenoid valve SV-2 on chlorine
FRC-1T Flow transmitter fails to line and device for entry of nitrogen
close control valve 70 150 230 310 into mixer J 101 1.3 10-3 5.7 10-7
FRC-1V Control valve fails to Reduction of time interval between
close 20 45 60 80 control tests of shut-down system 1.6 7.2 10P
TRC-1 Temperature control
loop fails to open control
valve 70 140 185 250 The fault tree for explosion in the jet-mixer J 101 is
developed in Figure 5 with its primary events.
FRC-3 Controller fails to open The fault trees for both top events reduced to their min-
control valve 70 140 185 250 imal cut sets are shown in Figure 6.
FRC-2 Controller fails to close
control valve -48 -85 -120 -140
rRC-2 Ratio controller fails to FAULT-TREE QUANTIFICATION USING STATISTICAL
close -45 -70 -85 -100 DISTRIBUTION OF FAILURE RATES
FRC-1T Flow transmitter fails to
open control valve -60 -100 -125 -140 Failure probabilities and failure rates used to quantify
fault trees are subject to various kinds of uncertainty, due,
for example, to different working conditions, component
The frequency of the “thermal collapse” top event was and material differences, and to lack of homogeneity of the
higher than the target. Some plant modifications designed few experimental data.
to reduce this frequency (Table 4)were then considered. It Top-event frequency 1,s obviously affected in the same
will be noted that these changes were cumulative. way, and its fault-tree quantification can thus employ a
With the final plant arrangement the top event frequen- probabilistic approach (Reference 5). In this case, how-
cies were: ever, it is necessary to know the statistical distribution of
the reliability data, and these are rare.
A, = 1.6 X 10-4(occ/yr) I n this paper, a log-normal distribution for failure rates
A, = 7.2 x 10-8(occ/yr) was assumed, in line with known experimental data (Ref-
erences 5, 6).
These frequencies do riot take common failure modes The log-normal is an analog of the normal distribution
into account. At very low frequency and probability levels, and is used when factors characterize the variation. If x
these limit the real values to the order of A = - represents a quantity which can vary by factors in its error,
occ/yr (Reference 21). for example, having a possible range between X J F and X , .
The process and instrument diagram of the part of the F , where X,, is some midpoint reference value and F a n
plant concerned in the two top events in its final form is error factor; then, a log-normal is the natural distribution.
shown in Figure 3. If log x is normal (p,u)the frequency function Ax) of x is:

TABLE3. FAILURERATES AND FAILUREPROBABILITIES

USED IN THE FAULTTREE.

A
Symbol Event description occlyr P P
-
A FRC-3 Controller fails to open control valve 0.44 -0.82
B TRC-2 Nitrogen control loop fails to close
control valve - 1.5.10-2 -4.20
hTS-2 High temperature trip (thermocouple
trip amplifer) fails on demand - 1.10-1 -2.30
hTS-1 High temperature trip (thermocouple
trip amplifer) fails on demand - 1.10-1 -2.30
TRC-1 Temperature control loop fails to open
control valve 0.49 -0.71
FRC-2 Controller fails to open control valve
(cutting on valve) 0.44 - -0.82
G 1rS-1 Low ratio trip fails on demand - 1.5.10-2 -4.20
H FRC-2V Control valve fails to open 0.13 - -2.04
I rRC-1 Ratio controller fails to open 0.11 - -2.21
L FRC-IT Flow transmitter fails to close
control valve 0.32 - -1.14
M Spark in mixer J l O l - 1.10-2 -4.60
N sv-2 Fails on demand - 7.5.10-3 -4.89
0 sv-3 Fails on demand - 7.5.10-3 -4.89
P FRC-2V Fails to close shut-down system - 1.6.10-4 -8.74
sv-4 Fails on demand - 7.5.10-3 -4.89
Q -
R FRC3V Fails to close shut-down system 1.6.10-4 -8.74
S sv-1 Fails on demand - 7.5.10-3 -4.89
T FRC-1V Fails to close shut-down system - 1.6.10-4 -8.74

PlantlOperotions Progress (Vol. 1, No. 1) January, 1982 71

 we get:
1nF
q=-=-- In - 0.84
Z,, 1.65
, &, , This value for u is valid for all event distributions. The
single values, calculated for p in accordance with Eq. (5),
are shown in Table 3.

SENSITIVITY ANALYSIS
C l O f 1 1 O f
The Monte Carlo method was applied to determine the
Figure 5. Fault tree for the primary events leading up to explosion in the jet statistical distribution of the top events from those of the
mixer J 101 primary events.
The corresponding block diagram is shown in Figure 7.
A computer producing random numbers z related to a
normal distribution with p = 0 and (T = 1 was used to
obtain random values from the statistical distribution of
the primary events. Random numbers x of a log-normal
distribution with p and u were obtained using the expres-
sion:
x = exp (uz+ IL) (9)
were x = normal distribution random values.
The calculation procedure is repeated for every primary
event, and for the number of items ( N ) . It is illustrated in
Figure 8, which shows how to obtain another random
number of a long-normal distribution ( X = 0.86) from a
random number of a normal distribution (Z = 0.8).
As the number of trials increases (e.g., N = lOOO), The
distribution satisfactorily approaches the distribution ob-
tained with N + m (Reference 5).

&&A
With this procedure, the top-event fre uency (related to
the reactor thermal collapse case in the l n a l arrangement
of the plant) has the histogram shown in Figure 9b (F = 4
and 90% confidence limits). Its shape was investigated by

INPUT 1:
STATISTICAL DISTRIBUTION
n i c a i c e L I C
FOR EACH 0 A S I C F A U L T EVENT

.
lor m i MCD ttico f i c t + nice + lice +LICE
+ - i.idiot/lt

Figure 6. Fault trees reduced to minimal cut sets

a) Explosion in the jet mixer J 101
b) Collapse of reactor R 101

1 (1% x - PI2
jw =
6 ux
. exp -
2u2 (3)

The range of the random variable is defined by the

confidence limits. It is assumed that the percentage of the
INPUT 2:
R E L A T I O N S H I P BETWEEN B A S I C
F A U L T E V E N T AND TOP EVENT
- CALCULATE VALUE OF TOP
E V E N T FROM VALUES O B T A I N E D
I N THE P R E V I O U S STEP
ratio value lying within a 4: 1 factor is 90% (Reference 6):

(+I 5%
e x =s(4&,5)*5% (4) t OUTPUT:
A confidence limit of 90% permits an acceptable esti- SUMMARIZE AND PLOT
mate, since a small variation(0-5%)in the confidence range V A L U E S O F TOP EVENT

would have a negligible effect on the accuracy of the result

(Reference 5 ) . Figure 7. Calculation procedure using the Monte Carlo method
With log-normal distribution point values at 5%, SO%,
and 95% probabilities, it is possible to calculate the pa-
rameters u and p, using the following expressions:
CL = 1nXo.s (5)

u = lnXo.95 - P (6)
Z"
where: 111.11 11,111,11111 *.I..I I,,.. ,1,1, ...
I,I,.IIl 1.l1.1.11 Illtrl~,fl" ".
111 0.111

2, = normalized variable value at 95" percentile = 1.65. Figure 8. Example of procedure used to determine a random value for the
XO.,,= upper confidence limit of log-normal. log-normal distribution (X = 0.86) from a normal distribution value (2 =
Taking into account the following relation: 0.8). The hatched area represents the 90% confidence limit.

72 January, 1982 Plant/OperationsProgress (Vol. 1, No. 1)

 TABLE5. SENSITIVITY IiNALYSIS: CHANGES IN TOP-EVENT
FREQUENCY IN FUNCTION OF ERROR FACTOR(F)
AND
CONFIIIENCE LIMITS( C L )

CL XR X I
a % F Z u occlyr occlyr
- - - -
90 3 1.65 0.66 2.0 7.0
96.5 4 2.11 0.66 2.0 7.0
*90 *4 *1.65 *0.84 *2.0 *6.8
96.5 5.9 2.11 0.84 2.0 6.8
90 16 1.65 1.68 1.5 2.5
96.5 34.6 2.11 1.68 1.5 2.5

A a s p o i n t value (kJ1.6 N7.2

* Reference example (see text)

failure probabilities. When these data have a high error

factor or uncertainty, th:is,sophisticated method yields use-
ful information.

ACKNOWLEDGEMENT

2o i i.11
The authors wish to thank Prof. L. Montrucchio, Istituto
Mateniatico del Politecnico di Torino, for his help in the
sensitivity-analysis calculations.

REFERENCES
1. Pilz, V., “ F a u l t T r e e .4nalysis: How Useful?” Hydrocarbon
Proc., 59, (5), 275 (1980).
2. Pilz, V., “Risikoermittlung und Sicherheitsanalysen in d e r
c h e m i s c h e n T e c h n i k , ” Chern. Ing. Tech., 52, 703 (1980).
Tip E r ~ n t(occ/yrl
Figure 9. Frequency distribution for top event: Reactor R 101 thermal N. Piccinini, is Associate Professor of Industrial
collapse Chemistry Technology at the Politecnico di To-
rino, ,where he teaches and carries out research
activities from 1966 to date. He mostly devoted his
considerin two illustrative cases: F = 3 and F = 16 with research work to kinetics study of some reaction of
dg
90% confi ence limits (Figures 9 a and 9c).
Inorganic Chemistry, safety in the chemical indus-
try and fluidynamic aspects of spounted bed fluidi-
The median values of the top-event frequenc ( X R ) zation. On this topic he cooperates with the De-
shown in the histograms are close to those obtainedVwith partment of Chemical Engineering of the Univer-
point-value quantification. sity of British Columbia, Vancouver, from 1976.
With reference to Figure 9a, it may be pointed out that
frequencies different from the median values have a low
probability density. For example, with A = Jx) =
24%, and with A = A x ) = 1.3%.
The histogram of Figure 9a shows a trace of bimodal U.Anatm, was a chemical engineering graduate at
Politecnico di Torino in 1980. H e spent the 1980
distribution, that depends on the numerical values of w. year as a fellow at Politecnico di Torino working on
As the error factor F increases (Figure 9c) the histogram problems associated with safety in the chemical
become flatter and multiniodal. Even so, the median val- industry. At present he is working at IBM.
uses X are close to the point values A, as also shown in
Table 5. In this table, it may be pointed out that, as a result
of expression (8), the parameter (+ is constant with com-
bined variations in the error factor and confidence limits,
and hence the corresponding A value is unchanged.
G. Malandrino, is completing his academic cur-
CONCLUSIONS riculum in chemical engineering at Politecnico di
Torinu. H e is very interested in problems of safety
The study shows how a plant arrangement with prede- in the chemical industry. His thesis work relates to
termined reliability can be obtained using: this subject.
a) operability analysis, with accurate calculations
where different risk factors are present;
b) fault-tree quantification, using point values for fail-
ure rates and failure probabilities.
The latter method proved effective in identifying the
most critical parts of the plant and the improvements re-
quired. It also permits an acceptably accurate estimate to D. Barone, electrical engineering graduate at
Politecnico di Milano is responsible for reliability
be made of the to -event frequency.
g
This accuracy o viously increases as a function of the
accuracy and reliability of the failure rate and probability
assessments in ANIC, Milan. His prior experience
includes design, installation and maintenance of
petrochemical plants instrumentation.
data used in the calculation, as was shown b a sensitivity
i‘
analysis using statistical distributions of fai ure rates and

Plant/Opemtionr Progress (Vol. 1, No. 1) Jonuory, 1982 73

 3. Bjordal, E. N., “Are ‘risk analyses’ obsolete?,” 3rd Int. Symp. 12. Nissan Chemical, “A Gas-Phase Reactor for Propane Chlori-
on Loss Prevention and Safety Promotion in the Process In- nation,” Belgian Patent 657,267 (1965).
dustries, Bade (September 15-19, 1980). 13. Eisenlohr, D. H., et al. (Columbia-South Chemical), ‘‘Ally1
4. Pilz, V., “What is Wrong with Risk Analysis? The Benefits and Chloride,” British Patent 901,080 (1962).
Drawbacks of Risk Analysis,” 3rd Int. Synip. on Loss Preven- 14. Samples, R. H., et al. (Union Carbide), “Allyl Chloride Pro-
tion and Safety Promotion in the Process Industries, Basle cess and Reactor,” US Patent 3,054,831 (1962).
(September IS-19, 1980). 15. Lawley, H. G., “Operability Studies arid Hazard Analysis,”
5. U.S. Nuclear Regulatory Commission, “Reactor Safety Chem. Eng. Prog., 70, (4), 45 (1975).
Study,” Wash-1400 (1975). 16. Bartkowiak, A,, and M. G. Zabetakis, “U.S. Bureau of Mines,
6. Snaith E. R., “Can reliability predictions be validated?,” Pro- Report of Investigation 5610,” (1960).
ceedings Second National Reliabilitv Conference. Birmine- 17. Anyakora, S. N., G. F. M. Engel, and F. P. Lees, “Some Data
ham (March, 1979). on the Reliability of Instruments in the Chemical Plant Envi-
7. Croll. H. P. A. and G . Hearne. “Substitution of Chlorine and ronment,” Chem. Engineer, 225, 396 (1971).

1530 (1939).
., -
Bromine into Straight-Chain Olefins,” Znd. Ene. Chem.. 31.I ,
18. Powers, G . J., “Probability Data,” Inst. of Safety and Risk
Assessment in Chemical Plant, Urbino (June 1978).
8. Smith. T. M.. “Chemical Engineering
” Kinetics.” McGraw- 19. Gibson M. R., and G. Knowles, “Design and Maintenance of
Hill 1976. Instrument Trip System,” I.C.I., Rep. NRCA/ll (1977):
9. Fairbairn, A. W., H. A. Cheney, and A. J. Cherniansky, 20. Hauptmanns, U., “Fault-Tree Analysis of a ProDosed
“Commercial-Scale Manuf‘icture of Allyl Alcohol,” Chem. Ethilene Vaporization Unit,” Znd. Eng.’Chem. Fundam., 19,
Eng. Prog., 43, 6, 280 (1947). 300 11980).
10. Porter, L. M., et al., “Pyrolysis of Allyl Chloride,” J . Am. 21. Robinson, B. W., “Factor Influencing the Limitations to Frac-
Chem. SOC., 78,5571 (1956). tional Dead Times That Can be Achieved in Real Protective
11. McBee, E. T., et al., “Recent Progress in Chlorination,”Ind. Systems,” First National Reliability Conference, Notting-
Eng. Chem., 33, 137 (1941). ham, UK, September 21-27 (1977).

74 January, 1982 Plont/Operations Progress (Val. 1, No. 1)