Hazard assessment techniques, namely,  fault tree analysis and safety analysis, have been applied to the  nitration section of a plant producing explosives in the defence sector.  Critical components and operations, the failure of which could lead to  the occurrence of an unwanted event, have been identified and their  effects quantitatively assessed. Some remedial measures have been  suggested to minimise potential hazards and the effect of incorporating  these measures on the system safety has been examined by means of  specific case studies

Jain, A. K.

Rajagopal, C.

English

Defence Science Journal

Defence Science Journal, Vol 44, No 4, October 1994, pp 323-330@ 1994. DES1DOCHazard Assessment of a Nitration Plant using Fault Tree AnalysisC. Rajagopal and Cot A.K. lain .Centre for Environment & Explosives Safety , Delhi-]] 0 054ABSTRACTHazard assessment techniques, namely, fault tree analysis and safety analysis, have been appliedto the nitration section of a plant producing explosives in the defence sector. Critical componentsand operations, the failure of which could lead to the occurrence of an unwanted event, have beenidentified and their effects quantitatively assessed. Some remedial measures have been suggested tomini mise potential hazards and the effect of incorporating these measures on the system safety hasbeen examined by me~ns of specific case studies.critical event itself is a result of the systematic analysisusing FETI (fire, explosion and toxicity index) andHAZOP (hazard and operatibility) studies techniques,A fault tree is a graphical representation of the logicalrelations between an undesired event (fire, explosion,etc.), called the 'top event' and the primary causeevents5. A qualitative analysis systematically maps allpossible combinations of causes for a defined top event.The quantitative analysis may also be performed if dataon the frequencies or failure rates of the various basiccauses are available and thr; risk of occurrence of thetop event is to be evaluated.2. CASE STUDY: NITRATION SECnON OF ACHEMICAL PLANTA small chemical plant, designed to produce lessthan 40 kg of a specific high explosive per day per shift,has been taken up for study. This plant comprisesmixing, nitration, simmering, dissolution andre-crystallization sections.The HAZOP study has identified all possibledeviations from the defined int,- ntion in each section ofthe plant and also listed out various probable causesand consequences of each such deviation. This studyI. INTRODUCTIONRapid growth of large and complex units processingexplosives or flammable or otherwise hazardouschemicals under. extreme temperature and pressureconditions. poses a threat to human life, property andthe environment. Swift technological developments inuntested areas with no opportunity for gradual evolutionand learning by trial and error, as well as ever increasingsophistication in design, tend to make projectsvulnerable to failurel. The failure of such hi-techprojects often leads to catastrophic conditions, and thismakes it imperative to get the design and operatingprocedures right the first time.The need for systematic analysis of the potentialhazards and likely risks from the process plantsproducing sensitiv~ explosives in the defence sector ,thus becomes very critical. Therefore, the quantitativehazard assessment techniques2.3 must be used for everysub-system of the plant being designed, to minimise thecatastrophic accidents resulting from a combination ofprimary .secondary or command failures.This paper describes the quantitative and qualita~iveassessment of a critical event, using a hazard assessmenttechnique. fault tree analysis4. Identification of theReceived 12 August IW3. revised 22 April 1994DEF SCI J. VOL 44. NO 4. ocrOAER 1994has identified the nitration section as one of the mosthazardous sections of this plant.instrumentation/safety features are incorporated in thisassembly:LEGENDCHW (...LED WATER SUPPLYHWS HOT WATER SUPPlYCHWR (tILLED WATER RETURNHWR HOT WATER RETURNliA-LH LEVEL iHOICATOR ALARM LOW HIGHTIC TEMPERATURE INDICATOR CONTROLLERCW COLD WATERSOL 1 SOL-UTION ONESOL 2 SOLUTION TWOSOt. 3 SOlUTION THREEACN ACfTK: ANHYORI!EAT ABSORBER TOWER[=:::]-0 ROTAMETERAOOVc=J AIR OPERATED DIAPHRAGM VALVE~ SOLENOID VALVEt><JFlTTIR!!!ll.1HGLOBE VALVEFLUSH WATER TANKTEMPERATURE IjDICATOR RECOROERNITRATOR 1NITRATOR 2AGEING 1AGEING 2Figure I. P&I diagram for nitrator section.(a)(b)(c)The entry of the reactants to the nitrators ismetered by means of rotameters.High-Ievel alarms are provided in the controlpanel for all the N and A vessels.Temperature of the reaction mixture inside theN and A vessels is maintained at the designtemperature by an ON/OFF temperatureindicator controller (nC).The sensing elementis a thermocouple. The final control element isa solenoid valve in the inlet line of chilled waterto the jackets.The nitration section consists of four vessels: twonitrators and two ageing vessels. Nitration takes placein two stages. In the first stage, nitration of solution Iis carried out by its reaction with solution 2 in thepresence of acetic anhydride and p-formaldehyde. Thisreaction starts in the first nitrator (NI) (Fig. I) andproceeds to completion in the first ageing vessel (AI).The second stage involves reaction with more of solution2 in the second nitrator (N2). This reaction is completedin the second ageing vessel (A2).Being exothermic, the reactions occurring in stagesI and II lead to an increase in the temperature of thereaction mixture. If this rise is not controlled, it couldlead to a runaway reaction. Therefore, jacketed vesselswith chilled water circulation are used for the nitrator(N) and ageing (A) vessels. The following(d) When the temperature reaches the first setpoint, the flow of chilled water supply to thejacket starts to prevent further rise intemperature. In case the chilled water supply324RAJAGOPAL & JAIN: HAZARD ASSESSMENT OF NITRATION PLANT(c) Command failure is also a sub-system failurewhich occurs when a component is functionalbut fails because of incorrect control signals,energy supply, etc. , such as when chilled watersupply fails (67) or temperature control fails(60). Secondary and command failures arefurther developed to basic failures.Following one of the branches of the fault tree, therunaway reaction (52) could occur as a result of anyone of the following three possible causes:(a) Reactants not added in correct proportion (55),(b) Improper reaction conditions (56), and(c) Agitator not functioning (57).The relation among these three causes, therefore,is represented by an OR gate. Considering only thesecond cause, it could occur due to either rise intemperature or increased residence time within thenitrator. The rise in temperature itself could be due tofailure of the solenoid valve (66), chilled water supplyfailure (67) or failure of the temperature control system(68). The temperature control could fail as a result ofeither thermocouple failure or controller failure.Each branch of the tree, in turn, is likewise brokendown into primary or basic failures. The analysis of thistree involves the identification of minimal cut-sets,following common mode failure resolution procedure(Table 1). Common cause failure is an important pointwhich has significant bearing on the top eventprobability. These are basic failures which recur invarious branches of the fault tree meeting at an ANDgate. These failures occur when the components havesome common susceptibility or a common location; twosuch examples are power failure and water supplyfailure. Wherever common cause failures are identified,they are to be eliminated as they greatly reduce thereliability of the system. By this procedure, each eventis repla('",-d by the inputs to its gates; AND gate-inputsbeing placed horizontally and OR gate-inputs insertedvertically in the table.Since the identification of cut-sets and calculationof their probabilities in case of large trees is a laborioustask, use of computers is helpful in obtaining thetop-event probability. A computer program, developedat this Centre, has been used to obtain the minimalcut-sets and the corresponding failure rates.to the jacket fails and the temperature reachesthe second (higher) set point which is set at15 °C higher than the first set point, twoadditional safety features come into play.The first safety feature is the provision of flush waterto N and A vessels from an overhead tank. Inlet of theflush water to the N and A vessels is also controlled bythe same 11C through another solenoid valve fitted inthe inlet line of flush water. Water is used to flush thecontents of the N and A vessels in case of a runawayreaction.The second safety feature provides for the drainageof the contents of nitrator in case of a runaway reaction.An air operated diaphragm valve (AODV) fitted at thedrain takes care of this contingency; the AODV getsactivated by the 11C as soon as the second set point isreached and releases the contents of the nitrator into adrain.3. FAULT TREE: NITRATION SECTIONThe fault tree for 'critical conditions in the nitrator'leading to fire/explosion has been constructed (Fig. 2)Construction of fault tree is a deductive process andinvolves working backwards from effects towardscauses6. The main elements of the tree are eventdefinitions, such as RUNAWAY REAC11ON or NOFLUSH W A TER and logic gates, such as AND andOR, which indicate the inter-relationship betweenvarious failure events. This tree has been analysed tofind the minimal cut-sets, followed by the actualcalculation of the top event probability.As seen from Fig. 2, the top event could occur onlyif runaway reaction occurred in the nitralor withsimultaneous failure of two safety features, viz. , flushwater to nitrator and drainage from nitrator. This isshown by an AND gate linking the top event to thethree sub-events. Each of these contributory causes isthen further broken down into more basic causes. Thecauses of failure may be primary, secondary orcommand.(a) Primary failure is caused by inherent weaknessin a component and is a basic failure such asfaulty rotameter (9) or line fracture (6).(b) Secondary failure is a sub-system failure ~nd iscaused when a component has been loadedbeyond its limits such as when flow rate ofsolutions is more (69) or charge solution isfaulty (65).325DEF SCI J, VOL 44, NO 4, ocrODER 1994Mt~~~..s.='a~,5,j~18"i(,I~"t:(,I..~~-'3.~RAJAGOPAL & JAIN: HAZARD ASSESSMENT OF NffRATION PLANTTable 1. Identification or minimal cut-setsVI VIII II III IV v(36)2CD(36)3CD(36)4CD(36)250(36)2LO(36)2MO(36)2NO(36)200(36)2(28)0(36)2(29)0(36)350(36)3LD(36)3MD(36)3NO(36)300(36)3(28)0(36)3(29)0(36)450(36)4LO(36)4MD(36)4ND(36)400(36)4(28)0(36)4(29)0Contd-.BCD (36)ECD (36)2FD(36)2GD(36)2HD(36)3FD(36)3GD(36)3HD(36)4FD(36)4GD(36)4HDAtFailure to use manual override (36)Air-operated diaphragm valve (AODV) failure (4)Incorrect addition of p-forrnaldehyde (5)Raw material impure (7)Incorrect quantity of raw material added (8)Power supply failure (16)Water supply failure (18)Failure to check water in flush water tank (30)Of these, events (36), (30), (5), (7) and (8) areoperator errors; (36) being the most critical as it occursin every cut-set of the fault tree. Human errors or failurerates are comparatively higher and vary unpredictablyas compared to instrument and other component failurerates. In addition, humans do not fare well in makingrepetitiv'e programmed responses to specific stimuli7.Irwould, therefore, be advisable, wherever possible,to replace operator control by instrumental controls forroutine, programmable but critical actions. Whereverit is not possible, the following actions can be tak'en toaid the operator as well as to decrease the probabilityof failure:The data to this program is input through a file whichaccepts five values in a sequence of main node(number), type of gate connecting it to next event(AND, OR, NOT), numberofsub-nodesin that branch,numbers of these sub-nodes and probability ofoccurrence of the main node. The output is thenconsolidated through a data file.J. be failure rates used in these calculations are basedon the data compiled by UK Atomic Energy Authority,Atomic Energy Commission and Institute of ChemicalEngineers8.From the results of this analysis, minimal cut-setsalong with number of yPars between each failure havebeen listed in Table 2, in the decreasing order ofcriticality (refer Fig. 2). The highest probability ofoccurrence of critical condition in nitrator works out toabout once in 5.2 years.On examination of the list of 360 minimal cut-setsobtained for the fault tree for nitrator, it is evident thatthere are no single or double point failures. Table 2also brings out those basic events which are critical byvirtue of their relation to the top event and their highfailure rates. Some of them are listed below::127DEF ~CI J, VOL 44, NO 4, OCTOBER 1994Table 2. Criticality ranking of occurrence of top eventMinimalcut-sets Years/Fault(36: 4: 16: 30: 18:)(36:4:5:16:)( 36: 4: 7: 16:)(36:4:8: 16:)(36:4:17:16:)(36:2:16:30:18:)(36:2:5:16:)(36:2:7:16:)(36:2:8:16:)(36:2:17:16:)(36:4:5:30:18:)(36:4:7:30:18:)( 36: 4: 8: 30: 18:)( 36: 4: 17: 30: 18:)(36:4:16:)( 36: 4: 18: 16:)(36:4:22: 16:)(36:2:7:30:18:)(36:2:8:30: 18:)(36:2: 17:30: 18:)(36:2:16:)( 36: 2: 18: 16:)(36:2:22:16:)(36:4:9:16:)(36:4:13:16:)(36:2:9:16:)contd5.215.215.215.215.216.256.256.256.256.2510.4210.4210.4210.4210.4210.4211.0812.512.512.512.512.513.2915.3215.3218.38(a)is the logical reverse of a fault tree. Resolution of thistree gives the number of possible ways by which a topunwanted event may be avoided.Safety analysis basically involves the same steps asdoes a fault tree analysis, with the following differences :(a) A safety tree is generally constructed for anevent for which a fault tree already exists. Thetop event of the safety tree is the avoidance ofthe top event of the corresponding fault tree.The structure of safety tree is similar to that ofthe corresponding fault tree, except for thereplacement of the logic gates, AND by ORand OR by AND, respectively.(b) The safety tree is resolved in a similar manneras in the case of a fault tree. The minimalcut-sets obtained give the minimumcombination of basic events required to avoidoccurrence of the top unwanted event. Fromthe cut-sets obtained, the lower order cut-sets,especially the single or one point cut-setsdeserve special attention. They pinpoint thosesingle, critical components and/or safetymeasures whose successful working or inclusionwould ensure non-occurrence of a criticalevent.(c) Basic events recurring in one or more branchesof the safety tree deserve special considerationas the successful working of one suchcomponent would ensure that more than onebranch of the tree is taken care of.Cut-sets of the safety tree for 'critical conditions inthe nitrator' are given in Table 3 in the order ofincreasing number of basic events per cut-set or in thedecreasing order of importance.(b)Table 3. Minimal cut-sets for the safety tree fer nitrator(c)Positioning of the override lever in a prominentlocation and marking it in fluorescent paint foreasy identification, would reduce the responsetime in case of an emergency.Quality as well as quantity of the reactantsadded to the mixing tanks, and p-formaldehydeadded to the nitrator, should be doublechecked.Events (16) and (18), i.e. , power and watersupply failures result in command failures.Therefore an alternative source of powersupply, preferably a generator, could beconsidered. A water storage tank of sufficientcapacity with level indicator and low-level alarmto meet both flush water and chilled waterrequirements could be provided.(36)(2)(3)(4)(30)(32)(33)(34)(35)(31)(32)(33)(34)(35)(5)(6) (23)(24)(26)(27)(5)(6) (23)(25)(26)(27)It is seen that the safety tree for the top event inthe nitrator has six cut-sets, which consist of one singlepoint, one triple point, two five point and two 22 pointSAFETY ANAL YSISA logical fallout of the fault tree analysis is the safetylIysis. This analysis is based on a safety tree, whichRAJAGOPAL & JAIN: HAZARD ASSESSMENT OF NITRATION PLANTcut-sets. The 22 point cut-sets need not be consideredfor safety analysis as it would be practically impossibleto ensure the non-occurrence of 22 eventssimultaneously. The other cut-sets are analysed, andthe required actions to be taken to ensure thenon-occurrence of the top event are suggested asfollows :(a) The only single point cut-set of the safety treeis event number (36), i.e., manuai override todrain the nitrator. Therefore, if the use of themanual override is ascertained, it would alsoensure non-occurrence of critical event in thenitrator .The next cut-set, (2)(3)(4), is of order three.The occurrence of all the three events, viz.uninterrupted air supply, failure-free operationof the diaphragm valve and crack/rupture-freeoperation of the air line, ensures the operationof the AOOV valve and the drainage of thecontents of the nitrator in the event of anemergency.The next two cut-sets are of order five andconsist of the five basic events: (i) water shouldbe available, (ii) solenoid valve should not fail,(iii) power supply to the valve should not fail,(iv) thermocouple should function accurately,and (v) the temperature controller should notfail.Probability of occurrence of top event also reduces to0.096 faults/year or 10.4 years between each fault.Case 2: Effect of Change in Failure RateUse of manual override lever in case of a runawayreaction has been identified by both fault tree and safetyanalysis to be one sure way of preventing occurrenceof top (unwanted) event. If the use of this lever can beensured whe1:1ever required, i.e. , the failure rate for thisevent is reduced from 0.4/year to say O.00l/year, theprobability of occurrence of top event reduces to oncein 208 years. Reduction in the failure rate of this eventwould perhaps involve positioning of an operator withadequate backup, solely for the purpose of operatingthis lever .(b)(c)6. SUMMARYSafe design of a plant involves eliminating potcntialhazards by modifications to design, operation ormaintenance procedures and by inclusion of varioussafety devices. The need for such changes is specificallybrought out by techniques like fault tree and safetyanalysis when applied to particularequipmen tlsub-systems .In this paper, the application of fault tree and safetyanalysis techniques has highlighted the critical eventswhich could lead to the occurrence of top event. Theimprovement in safety standards as a result ofeliminating common cause failures or reducing thefailure rate of an event, has also been quantitativelyassessed through case studies .Steps to obviate failures of sub-systems orcomponents have already been enumerated in thepreceding paragraphs.IMPROVEMENT IN SYSTEM SAFETY -CASESTUDIES5.To assess the improvement of safety standards inthe nitration section due to inclusion of the varioussafety measures recommended in the previous sections,the following cases are considered :Case 1 : Effect of Eliminating Common Cause FailuresI n this case study, effects of eliminating the followingcommon cause failures are considered :Power supply failure (16), andWater supply failure (18).Results of the fault tree analysis obtained by thismodification using the computer program show that thetotal number of cut-sets reduces from 360 to 225.ACKNOWLEDGEMENTSThe authors wish to record their thanks to theDirector, Centre for Environment & Explosives Safety(CEES), Delhi, for his valuable suggestions andpermission to publish the paper .REFERENCES1. Lees, F.P. Loss prevention in the process industries.Butterworths, London, 1986. pp. 1003-10.2. Sayers, B. Safety and risk in a chemical plant (Acase history). Proceedings of the Annual Reliabilityand Maintainability Symposium, 1979, WashingtonDC, USA. pp. 174-80.3. Kletz, T .A. Practical applications of hazardanalysis. Chem. Engg. Progress, October 1978,47-53.329DEF SCI J, VOL 44, NO 4, OcrOBER f9944. 6. Methodologies for risk and safety assessment inchemical process industries a manual.Commonwealth Science Council, London, 1990.Browning, R.L. Use a fault tree to checksafeguards. Proceedings of the Loss PreventionSymposium, Vo114. AIChE. pp. 20-26.Prugh, R. W. Application of fault tree analysis.Proceedings of the Loss Prevention Symposium,Vo114. AIChE. pp. 1-10.Browning, R.L. Human factors in the fault treeCEP, 1976. pp 72-75.7330

Hazard Assessment of a Nitration Plant using Fault Tree Analysis

https://publications.drdo.gov.in/ojs/index.php/dsj/article/download/4187/2445

Hazard Assessment of a Nitration Plant using Fault Tree Analysis

Abstract

Similar works

Full text

Available Versions

Defence Science Journal