Late Initiator, Lost Cooling: Judging Safeguards on a Batch Resin Reactor

Deviation 1 - more initiator / late addition

• Causes: operator holds the batch then adds initiator on the original schedule; addition valve passing; wrong weighment; batch sheet ambiguity.
• Consequences: unreacted monomer and initiator accumulate, then a delayed exotherm; the adiabatic temperature rise is unchanged but it arrives faster and from a higher starting temperature, so the peak pressure rises.
• Safeguards: batch sheet and weighment, supervision, the high-temperature alarm. None of these stops an exotherm once it starts, and the trip only closes the steam valve, which is irrelevant once the reaction is self-heating.

Deviation 2 - less cooling

• Causes: water-main shutdown, pump trip, control valve failure, jacket fouling, blocked strainer.
• Consequences: loss of heat removal, runaway to well above the 6 barg design pressure; the fire-sized relief valve cannot handle the two-phase runaway load.
• Safeguards: fail-closed valve (this is the failure mode, not a safeguard), high-temperature alarm with operator response, high-temperature trip.

Combination. The credible worst case is late addition plus loss of cooling, and the near miss six weeks ago is direct evidence that the human system creates it. A HAZOP must record combined and human-factor deviations, not just single ones.

Judgement. The safeguards are administrative plus one trip that acts on the wrong variable. There is no automatic action that stops the chemistry, and no relief path sized for the real scenario. The batch is not adequately protected at current scale, before considering a 30% increase.

Approach. Fix the consequence (reactor rupture, potential fatalities, major release), pick the site risk criterion for that consequence (commonly in the region of 1×10⁻⁵ per year), and then count credible independent protection layers against the initiating event.

Illustrative arithmetic (substitute site data)

• Initiating event: loss of cooling water, 0.1 per year.
• Basic process control system: not an IPL by definition - credit 1.
• Operator response to the high-temperature alarm: creditable only if the alarm is independent of the failed cooling, the response is written and drilled, the operator has an action that actually stops the reaction, and the response time is well inside the process safety time. Here the runaway time is about 40 minutes and the claimed response is 10 minutes, so the timing works, but the action does not: restoring cooling is not independent of the cooling failure, and there is no shortstop. On that basis, do not credit it.
• High-temperature trip closing the steam valve: independent and testable, but it does not remove heat. Credit only if it initiates a real protective action, for example a shortstop injection or a quench; then assess it as a safety instrumented function with a defined SIL and proof-test interval (SIL 2 gives roughly 1×10⁻² to 1×10⁻³).
• Relief valve: not an IPL for this scenario - it was sized for fire, and a runaway would demand two-phase relief well beyond its capacity.

Result. With only the trip credited at 1×10⁻², the mitigated frequency is about 1×10⁻³ per year, one to two orders above a typical criterion. The gap must be closed by adding protection, not by crediting the operator.

Judgement. LOPA here is a tool for exposing the gap, not a paper exercise to make the numbers pass.

Preferred direction: eliminate the accumulation. Convert the initiator addition to semi-batch (starved feed), so unreacted initiator and monomer cannot build up. This attacks the cause rather than the consequence and is the classic inherently safer answer. It usually costs little more than a dosing pump, a flow meter and a revised batch sheet, though the recipe and product properties must be re-qualified.

Add an active protective layer. An emergency shortstop - a fast-acting injection of a validated inhibitor or quench - interlocked to a high-temperature or high-rate trip, with the mixing time demonstrated so the inhibitor reaches the whole batch before the runaway outruns it. This gives a genuine IPL for the LOPA and is cheap compared with re-rating the vessel.

Reduce the inventory. Hold the batch size at current scale rather than increasing it; a 30% volume increase raises the adiabatic heat load and the relief demand and should not be accepted until the protection is in place.

Why not rely on the relief valve. Re-rating for two-phase runaway relief means a much larger valve, a knock-out drum and flare capacity, and it would still discharge a hot, possibly polymerising mixture. It is a last line, not a fix. A rupture disc alone does not solve the disposal problem.

Package to recommend. Semi-batch addition, shortstop with a SIL-assessed trip, revised batch sheet and operator training on the late-addition scenario, cooling water low-pressure alarm and automatic hold on initiator addition, and a re-run of the relief case with the corrected scenario. Only then consider the volume increase, supported by fresh calorimetry at the new fill level.