Industrial Explosion Protection How Safe is your Process? Peter E. Moore 1 & Joseph A.

. Senecal 2 Introduction Industrial process operators are required to consider explosion protection measures if there is a prevailing risk of gas or dust explosion occurrences. For all cases where explosion prevention alone is not a sufficient safety measure, practitioners need to review their options and elect a pertinent explosion protection solution sufficient to reduce the risk of an unmitigated explosion occurrence to an acceptable level. Clearly all safety systems have a residual risk that they fail to achieve their mission. This paper considers this challenge, refers to a systematic method to quantify the level of this residual risk as it relates to the whole plant, and shows that the adoption of such a method assists in making more informed and robust overall design decisions. The approach is consistent with high hazard design practices and their application to enhance the resultant safety integrity level of the process. It moves industry practice closer to a robust quantification of explosion protection efficacy and teaches where residual risk needs to be accepted. Explosion Protection The Design Challenge NFPA codes (1, 2) and the supporting body of technical literature provide guidance on design and on the performance efficacy of measures such as explosion venting, explosion suppression and explosion isolation. These codes essentially define a best practice for design of the explosion protection measure. Such protection is based on the assumption of a near worse case ignition/explosion occurrence within the protected vessel - leading to a mitigated explosion where the expected reduced (vented or suppressed) explosion pressure, PRED, is lower than the plant component pressure shock resistance, PS. It is a requirement of efficacious design that the inequality PRED PS is achieved. In practice, these design guides rely on an estimation of expected worse case values of Pred. Determinations are supported by a substantial body of systematic closed vessel explosion test results. The presumption here is that the expected worse case explosion is no more severe than that determined by a measurement of the resultant explosibility parameters of the combustible material according to the prescribed experimental methods set out in recognized standards such as ASTM E1226 (3) and ISO 6184 (4). These standards usually use central ignition of a homogeneous and turbulent representative sample of the product at the most explosible concentration. In practice the explosion threat is characterized by reference to these explosibility parameters 3 : PMAX - the maximum explosion pressure (bar) KMAX - the explosibility rate constant (bar.m.s-1)

Dr P E Moore: VP Engineering, UTC Fire & Security, Colnbrook, UK. (peter.moore@fs.utc.com) Dr J A Senecal: Senior Fellow, Kidde-Fenwal Inc, Combustion Research Center, Ashland, USA. (joseph.senecal@ fs.utc.com) 3 The maximum explosion pressure Pmax, is essentially independent of volume. The explosibility rate constant (Kmax) permits an estimate of the maximum rate of pressure rise (dP/dt)max in a process vessel where Kmax=(dP/dt)max.V1/3.
2

Industrial Explosion Protection How Safe is your Process? Thus, the determination of Pred in each plant component is dependent on the product explosibility parameters. The basis of such an explosion protection measure design is strictly only valid provided that ignition occurs within the confines of the protected vessel (point ignition source assumption) and the obligation of the practitioner is to ensure that this safety system design premise is valid. Consider the case of a process plant component protected by explosion relief venting. In this case the vent area will most likely have been based on the design requirements of NFPA 68 such that the PRED PS criterion is met. In practice this vented component is likely to be connected to one or more adjacent plant components. Best practice would require each of these interconnected vessels to be also fitted with explosion protection, again such that the PRED PS inequality is satisfied. In this example, the installation of appropriate explosion vent panels on the interconnected vessel(s) is arguably NOT a sufficient safety solution. This is simply because there is a substantial risk that the occurrence of an explosion in one vessel, albeit fully mitigated by the explosion protection measure, will propagate a combustion wave down the interconnection which results in a more intense explosion event in the connected vessel. Lunn et al (5, 6) has shown that an interconnected explosion can cause a flame jet ignition in the connected vessels which can impact the resultant explosion intensity in these vessels, and that the extent of any explosion enhancement is dependent on the prevailing geometry. The enhanced explosion severity from flame jet ignition scenarios stems from several factors, the most significant being the size and energy of the ignition in relation to a point source used to determine the single vessel case. Given this scenario the design engineer has two options:

1. The overall explosion protection design needs to incorporate explosion isolation on the interconnection(s) sufficient to prevent a more intense connected vessel explosion occurrence via flame jet ignition, or; 2. The explosion protection design needs to recognise that more intense explosions are probable as a consequence of flame propagation between the connected vessels, and design the installed explosion protection measures with the capacity to mitigate these more intense explosions. It is clearly the case that good explosion protection design practice requires consideration not only of the vessels to be protected, but also the viability and efficacy of any explosion isolation measures on the interconnections. In the above example the major contributor to any determination of the residual risk that the installed protection would fail to mitigate (PRED > PS) will be the risk of an interconnected explosion that results in a downstream explosion incident that is more intense than that envisioned by electing the NFPA codes as a basis to specify the installed explosion venting provisions. Connected Vessel Explosions Figure 1 shows an arrangement of a connected vessel experiment. Flame sensors are located at regular intervals along the duct to allow flame velocities to be determined. Pressure transducers are fitted to both vessels. Vessel V1, having a volume of 9.6 m3, is fitted with a 0.5 m2 explosion vent panel. The vessel is connected by a 30 m x 300 mm diameter straight duct to vessel V2 having a volume of 4.4m3. V2 is fitted with a 0.26 m2 vent panel. An explosible concentration of a starch is deployed into both vessels and swept into the duct by a downstream fan at a nominal velocity of 16 m/s. The vent areas selected are in accordance

Industrial Explosion Protection How Safe is your Process? with the guidance of NFPA 68 for protection of a KMAX ~160 bar-m/s explosion incident such that the expected PRED < 0.6 bar.

Vent Area=0.5m2 Vent Area=0.26m2 Air in Air out

V1=9.6m3

V2=4.4m3

Figure 1. Arrangement for a connected vessel experiment. The volume of the primary vessel, V1, is 9.6 m3 and is connected via a 30 m long DN300 duct to the secondary vessel, V2, which has a volume of 4.4 m3. A blower generates an air flow of approximately 16 m/s in the duct between the two vessels. Ignition in V1 is by a 5 kJ pyrotechnic igniter. Figure 2 contrasts the measured explosion pressure history in V1 and V2 for an ignition set in the geometric centre of vessel V1. Here we observe a substantially more intense connected explosion in vessel V2 and note that the resultant reduced explosion pressure is some 5 times higher (PRED ~ 3 bar) than would be the case for a point source ignition in V2. Thus, in practice, for conditions of a low pressure shock resistance of V2 there would be a risk of explosive rupture dependent on the occurring ignition and explosion scenario.

3.5 3.0

Flame Entry into Duct

Flame Exit from Duct

V1

2.5

V2

Pressure / bar(g)

2.0 1.5 1.0 0.5 0.0 0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

Time / s

Figure 2. Pressure time profiles for V1 and V2 following an ignition in V1 which results in flame propagation along the connecting duct and generating a flame jet ignition occurrence in V2. Flame entry and exit times from the connecting duct are also shown.

Industrial Explosion Protection How Safe is your Process? Efficacy of Explosion Isolation

The design premise of an explosion isolation barrier installed on an interconnecting duct between two vessels is to prevent, or at least to minimize the risk of a combustion wave propagating through the duct. Thus, the explosion barrier, either a triggered fast-acting valve or a suppressant barrier, must be deployed before the flame arrives at the position of the barrier. The design inequality tb td needs to be satisfied (where tb is the barrier establishment time and td is the time of arrival of the flame front at the intended barrier location, d). The time of flame arrival at the barrier location, td, is complex to calculate and is critically dependent on a number of factors: Explosion intensity. The greater the explosion intensity the faster the flame propagates towards the barrier location d. Ignition location. The closer the ignition point in the vessel is to the interconnecting duct, the shorter time td is. Process flow velocity and direction. High flows in the direction of the barrier result in a shorter td value. Explosion detection. Flame detection close to the duct mouth will give a different detection time to that of a pressure detector installed on the vessel and both will be dependent on the exact ignition location. Explosion duration. Suppressant barriers are transitory and thus protect against flame propagation for only a finite period. In the case of timid explosions or some fire scenarios, it is possible for the deployed barrier to be swept out of the interconnecting duct by the explosion pressure - leaving a vulnerability for eventual flame transfer. These interdependencies have been fully reported elsewhere (7) where it is argued that the use of dual detection (flame and pressure in OR logic) maximises barrier efficacy. It is intuitively clear, however, that any barrier design will have limitations, and that 100% viability cannot be assured by explosion isolation. In many explosion protection system designs the purpose of incorporating the isolation barrier is to minimize the risk of flame passage and to ensure that, in the event of any flame propagation beyond the barrier, the consequence does NOT result in a downstream explosion event that cannot be mitigated by the explosion protection measures installed on the downstream vessel. Figure 3 demonstrates that the incorporation of a triggered suppressant barrier between V1 and V2 in our example above prevents explosion propagation and thus any explosion pressure in V2 as a consequence of an ignition in V1. Clearly any ignition in V2 would be vented such that PRED < 0.6 bar (the design criteria) because there will be no explosion enhancement in V2 in this case.

Industrial Explosion Protection How Safe is your Process?

3.5 3.0 2.5

Flame Entry into Duct

V1 V2

Pressure / bar(g)

2.0 1.5 1.0 0.5 0.0 0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

Time / s

Figure 3. Pressure time profiles for V1 and V2 following an ignition in V1 similar to that shown in Figure 2, except that in this experiment a triggered suppressant barrier was employed on the adjoining duct work at a position that satisfied the inequality tb td. The flame entry time is also shown, however due to the suppressant barrier, flame did not exit the duct.

Residual Risk The design of efficacious explosion protection for a whole process is inevitably complex. It relies on a number of the interdependencies of the type elucidated above, and the trade-offs between protection options are not always intuitively obvious. What is required is a systematic means of quantifying the residual risk that the envisioned explosion protection measures fail to fulfil their mission. A failure to mitigate an explosion may arise because of: Failure of a piece of explosion protection hardware; Ineffective explosion protection of any vessel giving rise to PRED > PS because either PRED is understated and/or PS is overstated; Ineffective explosion isolation in any connection giving rise to tb > td because either tb is understated or td is overstated. The authors recommend use of a systematic calculation tool, which is described in detail elsewhere (8-11), to calculate the probability of an unmitigated explosion occurring in any ONE of the vessels of a process plant or plant segment from the premise that there will be one ignition occurrence within a defined unit of time. It assigns the relative probability of ignition occurring in each of the process segment vessels by reference to the vessel duty cycle. The probabilities of failure used for the chosen explosion protection hardware are deemed to be representative and can be derived from mean-time-between-failure data. The methodology uses the observed probability of flame propagation down interconnections that give rise to flame jet ignition to quantify the interdependencies detailed above. Thus, for any reasonable set of installed protection assumptions it is possible to quantify a residual risk that the protection system will fail to mitigate an explosion occurrence, and to interrogate the information such that the component or interconnection which is most at risk of a failure is highlighted. By focussing on improving the protection measure on the highlighted component

Industrial Explosion Protection How Safe is your Process? or interconnection, design change can lead to a substantial reduction in the overall risk of failure. This is a risk model that identifies all scenarios leading to conditions where the design inequalities PRED PS and tb td are NOT met. Many of these failures would be of little consequence (e.g. some plant component distortion), but of course some would be catastrophic. The calculation of residual risk and the interrogation of these theoretical risks has value in providing a quantitative means of comparing and contrasting protection systems options. It provides a valuable design support tool to assist in design decision. Practical Example

The value of a systematic determination of the prevailing residual risk of an unmitigated explosion is demonstrated by the example of two interconnected vented vessels used in Figure 1. In this example the two vented vessels each have a pressure shock resistance of PS = 0.6 bar and are interconnected via a single 30 m long duct with a process flow of 16m/s from the larger vessel, V1, into the smaller vessel V2. There are no other explosion protection provisions on this plant segment. Application of the calculation method permits a determination of the prevailing residual risk for an explosible dust with a KMAX ~ 160 bar-m/s as follows: System Element Vessel V1 Vessel V2 Overall Residual Risk 8.7 x 10-2 1.1 x 10-1 1.97 x10-1

The overall residual risk of a failed mitigation is the arithmetic sum of the individual risks of a failure for both vessels V1 and V2. Using the calculation method we can see that there is a high risk of failure for this simple process segment arrangement, and that the component most at risk of failure is the smaller component V2. This teaches that for all ignition scenarios in this process segment there is a likelihood of about 1 in 5 that explosion damage will be sustained. And as we know from the test result described above, the inclusion of a suppressant barrier triggered from a pressure detector on the connecting vessel (see Figure 4) substantially reduces this exposure. The residual risk for this configuration with the additional protection included is: System Element Vessel V1 Vessel V2 Overall Residual Risk 1.4 x 10-3 1.2 x 10-3 2.6 x 10-3

Indeed we see a significant reduction in risk as expected, such that there is now a likelihood of about 1 in 384 that explosion damage will be sustained.

Industrial Explosion Protection How Safe is your Process?

Control Panel
Vent Area=0.5m2 Vent Area=0.26m2

V1=9.6m3

V2=4.4m3

Figure 4. Schematic representation of a 9.6 m3 connected via a 30 m long DN300 duct to a secondary vessel V2 (4.4 m3) whereby pressure detectors are employed to trigger a suppressant barrier on the connecting duct work. We can reduce this risk further still by considering the proximity between the expected PRED of ~ 0.6 bar and the pressure shock resistance of the components, Ps = 0.6 bar. Increasing the vent areas on V1 and V2 such that PRED ~ 0.4 bar has a profound impact on the calculated residual risk compare the above result with the projections below: System Element Vessel V1 Vessel V2 Overall Residual Risk 2.0x10-4 1.4x10-5 2.1x10-4

The improvement of the safety factor within the PRED PS design criterion for both vessels significantly reduces the overall risk of a failure in this case from 1 in 384 to 1 in 4684. Clearly there are other viable design scenarios for example we could consider a design whereby V2 is protected by explosion suppression and detection is incorporated on V1 such that any ignition within this component triggers the suppressors on V2. This advanced inerting option (see Figure 5) mitigates risk of an interconnected explosion and provides an alternative safety solution that does not require explosion isolation between the connected vessels. The calculated residual risk for this configuration is: System Element Vessel V1 Vessel V2 Overall Residual Risk 9.8x10-3 1.17x10-2 2.15x10-2

This calculation assumes once again that the expected PRED in both V1 and V2 is 0.6 bar and so these risk values are to be compared with those earlier whereby only explosion isolation was employed. This teaches us that this protection option has a somewhat higher residual risk than the vent with isolation option discussed above.

Industrial Explosion Protection How Safe is your Process?

Control Panel
Vent Area=0.5m2
Pressure / bar(g)

3.5 3.0

Flame Entry into Duct

Flame Exit from Duct

V1

2.5 2.0 1.5 1.0 0.5

V2

V1=9.6m3

V2=4.4m3
0.0 0.00 0.10 0.20 0.30 0.40 0.50 0.60 0.70

Time / s

(a)

(b)

Figure 5 (a). Schematic representation of a 9.6 m3 connected via a 30 m long 300 mm duct to a secondary vessel V2 (4.4 m3) whereby pressure detectors are employed on both vessels such that an ignition in V1 triggers the suppressors on V2, (b) The corresponding pressure time profiles for V1 and V2 following an ignition in V1 for the configuration shown in (a). These considerations for a simple two component plant segment demonstrate the flexibility and contribution of risk modelling in ascribing efficacious explosion protection. The model is fully tractable for more complex scenarios. Date et al (9) have detailed the application and mathematical interpretation of such a tool, and have demonstrated its applicability for a spray drying process plant shown schematically in Figure 6 and with calculated residual risks shown in Table 1.
CLEAN AIR LIQUID FAN AIR & DUST HOT AIR SPRAY DRIER CYCLONE 1 Vent CYCLONE 2 Vent

D1

ZONE 1
PRODUCT

AIR & DUST D2 D2 FLUID BED DRIER 1 FLUID BED DRIER 2 PRODUCT Isolation Valve

ZONE 2
HOT AIR

ZONE 3

Figure 6. Schematic representation of an example spray drying process. The arrows represent material flow through the plant . D1 and D2 represent two different types of pressure detectors.

Industrial Explosion Protection How Safe is your Process?

Despite the complexity of the chosen explosion protection measures and the selection of discrete explosion protection zones, a deterministic value of the residual risk is fully calculable based on the implicit assumptions of the tool. It should be noted that while the election of logical explosion protection zones substantially reduces the inconvenience and the cost of system activation, it de facto, adversely impacts the resultant residual risk of a failed mitigation. In this example the configuration of all of the protection as a single zone would reduce the overall residual risk from 1.67 x 10-2 to 2.51 x 10-3. Spray drier Cyclone 1 Cyclone 2 Fluid Bed Drier 1 Fluid Bed Drier 2 Overall Residual Risk Residual Risk 1.11 x 10-4 7.95 x 10-3 7.77 x 10-3 4.64 x 10-4 4.64 x 10-4 1.67 x 10-2

Table 1. Calculated residual risk for each plant item shown in Figure 6, together with the overall residual risk for this example process plant. Full details of this calculation and the inherent assumptions are given by Date et al (9). Conclusions The choice of the most effective arrangement of explosion protection measures is complex and is not always intuitive. Explosion isolation is a critical part of any protection system design, but it is often not understood that while attention to explosion isolation will minimise the risk of flame or explosion propagation leading to upstream and downstream explosion exposures, it cannot address all explosion scenarios. Industrial design methods, and established design guidance, provide a high degree of security. But for any practical application, there is a wide spectrum of potential ignition and explosion scenarios that will challenge the safety system design. The use of a credible risk model can assist in making quantitative design decisions, and can ascribe the safety integrity level for a process or a process segment. Moreover it enhances our understanding and our decision processes. The complexity of the safety system design challenge, and the validity (or uncertainty) of the implicit assumptions (11) built into risk models make it difficult to assign an absolute determination of a prevailing residual risk. The method of calculating residual risk, however, presents a valuable means of quantifying the effects of design trade-offs and the benefits delivered by adopting higher safety factors within each protected component than are required by the minimum design criteria set out in established guidance documents. The authors advocate this systematic approach to explosion protection design and also caution that any determination of risk quantifies exposure and not consequence of a failed mitigation outcome. Acknowledgements The authors would like to thank Professor Gautam Mitra and Dr Paresh Date from the Center for the Analysis of Risk and Optimisation Modelling Applications, Brunel University, UK for their work in devising the mathematical methodology employed for the computation of residual

Industrial Explosion Protection How Safe is your Process?

10

risk, and Dr Rob Lade from Kidde Products Ltd. and Dr Albrecht Vogl from FSA (Germany) for their substantial contributions. References 1. NFPA 68, Standard on Explosion Protection by Deflagration Venting, National Fire Protection Association, Quincy, MA. 2. NFPA 69, Standard on Explosion Prevention Systems, National Fire Protection Association, Quincy, MA. 3. ASTM E1226, Standard Test Method for Pressure and Rate of Pressure Rise for Combustible Dusts, ASTM International, Conchehocken, PA. 4. ISO 6184, Explosion Protection Systems - Part 1: Determination of Explosion Indices of Combustible Dusts in Air, International Standards Organization. 5. Holbrow, P., Andrews, S. and Lunn, G. A., Dust Explosions in Interconnected Vented Vessels, J Loss Prevention Process Industries, 9(1): 91-103 (1996). 6. Lunn, G. A., Holbrow, P., Andrews, S., and Gummer, J., Dust Explosions in Totally Enclosed Interconnected Vessel Systems, J Loss Prevention Process Industries, 9(1): 4558 (1996). 7. Moore, P.E. and Spring, D.J., Design of Explosion Isolation Barriers, Trans IChemE, Part B, Process Safety and Environmental Protection, 83(B2): 161-170 (2005). 8. Ganguly, T., Date, P., Mitra, G., Lade, R. J. and Moore, P. E., 2007, A method for computing the residual risk of safety system failure, Proceedings of 12th International Symposium on Loss Prevention and Safety Promotion in the Process Industries. 9. Date, P., Lade, R. J., Moore, P. E. and Mitra, G., Modeling the Residual Risk of Safety System Failure, submitted to Journal of Loss Prevention (2008). 10. Lade, R. and Moore, P., A methodology to guide industrial explosion safety system design, Hazard XX: Process Safety and Environment Protection' IChemE No 154 (2008). 11. Moore, P.E. and Lade, R.J., Quantifying the Effectiveness of Explosion Protection Measures, Proc. 11th Process Plant Safety Symposium, Tampa, April 26-30 (2009).