Document 99Yp5kjQzxeqRnRM27vJMxwMq

/ and %&?Ziieai4- ESCAMBIA PLANT INTEROFFiCS MEMORANDUM AM/ 1-'c,-s v/ to^n To: Distribution From: W. J-. Stueben Dots: 5 October 1977 Copies: Re: PVC process Hazards Review^Summary Attached is your copy of the PVC Process Hazards Review Summary. It is presented in this form by agreement of the committed members. All members of the committee were given an opportunity to review the rough draft. Their comments are reflected in this document. Thii summary, then, represents the views and efforts of the enti e committee. Res^> onse by R. E. Gilbert to the Escambia Plant Safety Daparttne nt is requested by copy of this letter by 4 November 1977. WJS:jsr Distribution R. E. JojIi es R. E. Gi bert G. D. Ha rjrdy rak -- C. V. Hi denbrand L. S. Fo ester A. L. Juhelc \J0 ----- W. J. Stueben M, Langsam W, C. Robb G- Sanderson G.B.H. Speed T. Sreenivasan W. C. Wilde GCT 10 137; J. < AP00030096 PVC PROCESS HAZARDS REVIEW I ntroduction A revi :w was undertaken to reveal the major hazards inherent in the PVC Plant a s it existed after the recent expansion. Hazards were considered to be those t Lings that would cause personal injury, VCM release, or loss of equipment. The co mmittee performing the review, consisted of the following: A. Junek - Maintenance Engineer - Escambia Plant M Langsam - RfcD Chemist - Allentown W . Robb - Process Engineer - Escambia Plant G. Sanderson - Project Engineer - Calvert City Plant G. Speed - PVC Process Supervisor - Calvert City Plant T. Sreenivasan - R8cD Engineer - Allentown W Stueben - Safety Engineer - Escambia Plant w Wilde - PVC Process Engineer - Escambia Plant The re view was done over a period of 11 working days, a little over 600 man-hour s. Time was spent both in the plant observing and in conference. The Method The m sthod of investigation chosen was the "What If" method. As the review prog ressed; however, Failure Mode Analysis was integrated into the method in th e questions. The "Failure Rates For Use In Fault Tree Analysis" document pu slished by DuPont was used extensively to determine probability of occurrence ai id whether or not a recommendation was indicated at this time. The cc mmittee decided that the review would be comprised of the various parts of the PVC manufacturing facility that were actually involved in the conversion < f Vinyl Chloride Monomer to PVC. The drying, warehousing and loading of PVC resi: i were not included because of the time available and apparent lesser degree of ha zard involved. The chemical cleaning unit was not included because many details of Its operation were not firmed up yet. It will be reviewed at a later date. Each 2 eview of a part of the plant was done in three stages. The part or process beit g investigated was first described. The "What If" questions were then asked i i roundtable fashion and the answers written down. When it became a pparent tha t the period of questioning was over, all of the questions asked and their answer s were reviewed and recommendations made. Everything any member of the committ ee thought of was considered and written down. This proved to be an effective sys tem in that on some occasions, a question originally relegated to relative unii nportance, turned out to have much greater significance at a later time. AP00030097 Because of tt is, all of the situations considered credible by members of the committee are included in this report. Although they may not have been considered significant by the memb^ rs of the committee at the time of the review, some of them may prove to be i nportant to someone- else under a different set of circumstances. The re riew of the plant was divided into the following parts: - Vinyl Chloride Monomer Unloading - vinyl Chloride Monomer Storage - Vinyl Chloride Monomer Charging System - Reaction Run - General Purpose Resin - PearL Resin - Short Stop System - Vinyl Chloride Monomer Recovery System - Stripping - Continuous - Batch - Chemical Cleaning A Reactor - initiator Handling SUMMARY C'F RECOMMENDATIONS Vinyl Chlori 3e Monomer Unloading 1. The fo lowing should be provided on a written checklist for the operator to use pr Lor to unloading each VCM railcar: ^ 2. Proper spotting technique (must be within one foot of designated spot). Car has proper identification. Chocks and brakes are set properly. onnection of vapor and liquid lines are satisfactory, rounding wire is connected. Vapor line at loading station should be pressure checked annually to ensure steam jacket integrity. L-uA p&dvl 'l v<-/ /.W fCi A secc nd flow switch should be provided on the VCM pump with the contacts in ser .es so that if the first switch malfunctions, the pump will still shutdown and not overheat, t Aco'oK- fltcL k*. ^Al.1 tnu a Lr&- 4or+u uAtJt A list of vents that lead from the unloading and recovery systems to the gas holder should be provided to facilitate checking in the event that a vent is left op en. (If a vent from unloading is left open, the gas holder will fill and thsn the recovery system will load up resulting In the inability to recovc r Vinyl Chloride from the rest of the plant. ) YulI AP00030098 .5 The Chicksan joints on the loading arms should be Inspected thoroughly at the beginning of each loading period. They should be replaced or repaired at any indication of excessive wear or malfunction, r i re 6. All dra ins and bleed valves' in the system should be checked on the current leak pa trol to pick up any that are leaking and are resulting in emissions, Leaker s should be carefully checked by Maintenance to determine if failure U likely. j,, Pro.4^ 7. A rupttkre disc should be added to the compressor relief valve to ensure that it meets EPA regulations and to minimize malfunction due to plugging. Vinyl Chloride Monomer Storage 1. Sight g asses on the monomer storage tanks should be checked for the presen :e of ball check valves. If not present, they should be installed, If pres snt, their ability to function should be checked. The ball check valves minimize any release in the event a sight glass breaks.. At the time of the review, the committee could not find anyone who knew if they were ti ere. or working. C Code a ad insurance requirements should be checked for the use of excess flow val ves or other automatic shut-off.devices in lines coming from the storage tanks. The concern here is that if a line ever ruptured or was broken by an outside source (lift truck, carrydeck crane, etc. ) the entire con tenl s of the storage tanks could spill onto the ground. VCM Charging Systern 1. . The fo lowing recommendations were arrived at to minimize the chance of a majo r overcharge of vinyl chloride to a reactor. he charge meters should be zeroed no less than once per week, b) The computer should be programmed to check weigh tank loss versus harge meter indication. Consideration should be given to installing level indicators on each eactor. o) and (c) also apply to charging meter failure. .2 The lirh.it switch that tells the computer the charge pot lid is down and locked should be checked daily to make sure it is set properly. This could easily be done by the Operator on the first charge of the day. An unlocked lid, indicat.ng that it L^J^could result in a considerable Vinyl Chloride emission. 3. The au ;horizatlon of equipment func tion overrides in the computer programs should be limited to certain personnel. The overrides in current use should -3 - AP00030099 be maintained in a log and a daily override check should be made of the computer. The concern here was-that the use of overrides, although essential in a computerized plant, could become a hazard itself if proper controls are not established and maintained. 4. To kee^> an Operator from putting initiator in the wrong charge pot, it is recom n ended that the sequence of operations be changed so that a vacuum is main) tained on the charge pots except when adding initiator. This procedure would al so aid in addressing other concerns the committee had: a) L etection of a vacuum breaker leak. b) L etection of a. leak through one of the monomer charge valves, c) L etection of a leak in the steam jet valve. d) L etection of a leak through the bottom valve of the charge pot. 5. A computer check, that enough vinyl chloride is available for a charge/ currenily begins after initiator is put in the charge pot. It is recommended that this check by the computer be done before the initiator is put in to mini mize tie time the initiator is in the charge pot* (Only one reactor can be charged at a time. If the vinyl charging system is in use on another reactor , the initiator has to wait in a possibly warm charge pot to be dumped into the reactor. ) .6 A reci culating line should be installed on the fresh vinyl charge pumps to elimina te the chance of overheating in the event the automatic system design* d to shut it off does not work and the pump deadheads. 7. Althoug h the detection of a problem of overheating is`less with the recovered vinyl cHarge pump because of its more frequent use and the fact that its filters have relief back to the pump suction, another problem came up when review ng the pump's specifications. The monomer filter relief is currently set at 190 PSIG. This setting should be lowered to 110 PSIG based on availahU e pump pressure. (Differential pressure should be used as the setting not absolute as was done. ) Ccyj/jmxc ^ 4 w- If the bottom charge pot valve plugs as vinyl chloride monomer is introduced into the charge pot, a rapidly accelerating reaction and possible explosion could result from the reaction of the vinyl chloride and initiator already there. (Buildups of PYC around the bottom charge pot valve have been observed at the Calvert City Plant. ) The recommendation is that the computer be programmed to "go into emergency" if the amount of vinyl chloride that should have'registered on the meter in a set time period, has not registered.- This time period should be based on the rate of reaction of pure vinyl chloride monomer and initiator and should not be greater than one mihute. Concei n by every member of the committee about the charge pot operation in gene ral, resulted in the recommendation that consideration be given to introd cing vinyl chloride directly into the reactor and washing the initiator into th e reactor with water. -4- AP00030100 Reaction Ran Operation These ecommendations cover the period of time from, the start of the polymerize tic n reaction until the reaction is complete and the PVC slurry is discharged to a stripper. 1. A short discussion was held about the effects of a po-wer failure after the reactloh goes exothermic. It was decided to recommend that power failures in the plant be the subject of a separate "second generation" review using Failure Mode Analysis, This was done because of the amount of time it would take to do the job properly and the time remaining for the committee to complete the review due to other commitments. ____ J'. J.cw Area VGM monitoring points should be installed at thefto^of the cooling tower (!3VC), the cooling tower return sump^and the chiTTed water return /" sump sc that a leak in either the condenser on top of the reactor or a cracked baffle would be detected as soon as possible. 3. Operate r training should emphasize initiator recognition and selection, If the w rong initiator is selected for certain recipes, a batch could overhea t. i. Operate r training should include the possibility that a reaction running hotter 11 an normal could be caused by a plugged gas vent on the condenser QVv. of a lar ;e reactor. This would be particularly true if the reaction in question occurred immediately after an opening of the reactor. 5. The co puter should be programmed to detect simultaneous very low RFM ar d lower than normal amperage on the agitator drive motor and short s top the batch. This would allow the suspension in the reactor to still mix short stop through the entire reactor effectively (without having to boil the batch) in case of a broken agitator shaft or coupling, This re zommendatlon also applies to situations that cause the motor to kickout because of overload or power "dip". 6. Trainin l for the field operator should include the fact that steam hammer in the r factor could be caused by a reactor cooling jacket water pump failure jr a chilled water valve that has failed open. 7. Rapidly rising batch temperature could occur if.the automatic valve controlling the stea m to the reactor jacket failed open. Operator training should include this inf rmation to enable computer operator to diagnose a high temperature situatio 8. On the large reactors and stripper, an agitator shaft Duraseal system failure :ould result in some or all of their contents being spilled onto the ground. Although this would probably happen in stages starting with the failure of the upper seal and could' be detected by a loss of seal fluid from -S- AP00030IOf the res ervoir, the common reservoir, If allowed to empty, would quickly result .n the failure of the seal systems on the two large reactors and the strippe Because of the potential, the following Is recommended: plUcv ' juftV a) b> lOtfV 11 stall a low level alarm on the seal fluid reservoir and flow*" idicators on the individual seal systems, or preferably, I u stall individual .Daraseal systems on the three vessels with bottom erntering agitators with the above alarms, flow indicators and use circulating pumps. The "o d" reactor building vessels, with top entering agitator shafts, have a mixed bag of seal systems. Three reactors and one batch stripper are on a common system while the remaining vessels have individual sys tem s that are operated under nitrogen pressure. While the results of a se tl failure 'on the common system would be slightly different than the ' bottom, entering agitators, more^&aescape (VCM) and less slurry, the recomrnendations are the same. ''^TJje nitrogen pressured systems might fail slo wer, A failure could result in the pressurization system, filling with M - a difficult problem to handle. The recommendations, however, are the same as for the other systems. Minimum action should be low level alarms on the existing reservoirs and flow indicators on each system, Preferubly each vessel should have its own pumped Duraseal system to minimi ze the results of a seal system failure. Flow i:r dicators have another benefit. If a seal system were- blocked in or the *eal fluid pump were not turned on, detection would be much easier It shoul d be noted that the Duraseal systems on #19 reactor at the Calvert City C Plant have interlocks on the agitator motors that do not allow them tc be turned on without the seal fluid pumps operating. 10. 11. Area monitoring points should be installed at the base of all reactors to detect a leaking drop valve. Significan t leaks have occurred when the drop header valve leaks outside the system after being opened. A vi su al check should be made by an Operator after each batch (through the sig ht glass) to make sure the reactor is completely empty. If enough slurry were left in a reactor after dropping, overpressure could result on the next batch. Although no member of the committee could remember ever hearing of a reactoi rupturing, - the committee recommends that initial acoustic emission testing be done on each vessel and repeated every ten years. The chance of 'rupture is very remote, but the results would be disasterous. The Short Stc p System I. There ure a number of block valves in the short stop system that if closed, AP00030102 would revent the short stopping of a problem batch. It is recommended that these vaIves be carsealed open and the seals checked periodically (at a frequet cy to be determined). 2. A meter is used to register the amount of short stop used and all short stop flows through It. In order to preclude any problems in this area, the following recommendations are made: a) Carsealed bypass valves should be installed around the meter in case i: plugs or jams. b) A| filter should be installed in the line between the short stop pump an d the reservoir to prevent contamination from, plugging or jamming t)h: e meters- J. spare meter should be folioed (not currently done). These recommendations would increase the reliability of die short stop system). 3. If an Oberator tries to manually short stop more than one batch simul taneously, limitations in the system might cause one reactor not to get enough short stop to kill the batch. Operators should be instructed to short si top one batch at a time, the same as if the computer were doing it. 4. A low level alarm should be installed on the short stop fluid reservoir to ensure that enough short stop is always, available. One third of volume is recommended as set point. 5. WvJ'C'.'IN.O4" 6. The sij;ht glass (level indicator) on the short stop reservoir should be checke3 for the presence of ball check valves. A broken sight glass would render the short stop system ineffective. To ensure nitrogen is immediately available for the system, only one gas bottle should be connected at a time and the other retained as a backup (two aie currently connected). The relief valve should be checked for proper size and removed for calibration if it has not been done already. 7. Will W /&**-) Weathejr tight one gallon cans of short stop should be placed in both the new and old reactor buildings, on the top floors (charge pot level). Short stop cculd then be introduced manually through the charge pot in case the automatic charge pot system is inoperative, or a line to a particular reactoi* plugs. 8. w Reservoir supply pump is rated at 34o feet on print. Reservoir to be pumped into is rated 2H0PSI. This discrepancy should be reconciled. 165 Recovery Sy stem 1. The need for urgency in effecting repairs of vacuum pump water leaks should be included in Operator training. A large water leak would at first AP00030103 -2 /j/U cause (|he pump o lose its effectiveness and then, if the pump were allowed to cont nue running, could result in the seal failing and a VCM emission. Operat rs should be alert to loud squealing noises from the pump as an indication of pump problems. .2 If the v acuum pump seal water separator overpressures, the prints call for the pressure to reLieve back into the separator. This relief path should be. che <fcked thoroughly and rerouted or fitted with a rupture disc/relief valve. If the g as holder level control indicates higher than actual, the compressor recycl valve sticks closed, or the three Nash compressors come on and stay or , a vacuum could be pulled on the gas holder. It is recommended that a limit switch be installed at the low level position of the gas holder piston that in tferlocks with, the compressors. The possibility of using liquid seal protec !ion such as a "Midland Conservent" should also be explored. A "Midlah d Conservent" is also capable of overpressure protection. 4. If a tut e in the seal water exchanger of a compressor were to rupture, VCM w ould probably show up in cooling tower water. The recommendation to add i VCM sampling point at the top of the cooling tower also applies here. (Reaction Run #2). (This aTs o applies to a condenser tube rupture. ) o. If the compressor seal water were allowed to freeze, the seals could break or leak through resulting in an emission. Freeze checks should be included for the compressors. 6. The sij;ht glass on the seal water separator should be inspected to make sure that check valves are present so that any emission resulting from a broken sight glass is limited. 7. fvA- uui.4iier^w A pres sure drop indicator should be installed on the scrubber so that pluggin g could be detected. As presently designed, a plugged scrubber could i esult in the gas holder being overpressured. A plug would be difficuIt to detect prior to a gas holder overpressure. .8 A loss of cooling of the condensers would result in additional VCM in the inerts bleed. This could be detected if the flow transmitter were set to alarm (at a set point to be determined). This indicator wo uld also help detect the liquid that would result from a plugged rundown line. 9. 0^ .10 Steam sparging should be installed in the condenser bleed so that ignition because of lightning can be controlled. The VCM concentration could be in excess of 10 percent (EPA problem? ). If the freon level controller on the freon condenser were to indicate lower than actual, liquid could get into the compressor and the seals would fail. Consideration should be given to installing a Knockout pot. 8. - - AP00030104 11. Leaks i n the gas holder seal might not be detected until after personnel ove rex sure has occurred. An area monitoring sample point should be installs d in the upper portion of the gas holder. Stripping A R eactor Formulation No. 1 (Contin lous) Stripper 1. A pressure alarm should be installed on the stripper pressure indicator to Indicate an overpressure problem prior to the relief valve lifting. An overpressure could occur because of the following reasons: Vyt.1^*^) a) b) c) d) V ent flow control sticks shut or shuts in error, T oo much sparging steam is admitted to stripper. A batch was sent to the stripper before completion of polymerization a ad the gas holder is full. Tjh e back pressure control valve falls and does not control. 2. ov. Operators should be instructed to lower the temperature on the stripper to minimize the chance for overpressure when an incompletely polymerized batch is sent to the stripper. 3. NV* High an d low level alarms should be installed on the stripper. A high level al arm would prevent overfilling and possible overpressure because of a fai ed ''bottoms pump" or "bottoms" level controller. A low level alarm. ould help prevent the stripper from plugging because of the contents being " :ooked", by alerting the Operator to the condition. The "bottoms line" of the stripper should be inspected at least quarterly ' ^ after the first six months of operation. The line is made of 304 stainless steel, The 304 stainless steel bottoms line had to be replaced by a 316L stainless steel liriie at Calvert City because of stress corrosion cracking adjacent to the welds Nos, 2 3 {Hatch) Strippers ^ $Tl 1. \JA- w A Bachi rach sensor should be installed above the blend tank that,will alarm, t u t not turn on the sprinkler system in the event a batch is sent to the tank,s without leaving some in the stripper as a water seal. The 15 foot he a d created by- the piping should minimize any release but it was felt that the 20 minute time between area monitor system samplings was insuffic Lent. This sensor would also detect a release caused by a level control er failure that allowed VCM to come from the gas holder through the striipper. .2 The four way valve that VCM flows through to the gas holder has a history of leaking through the stem. Any new valve that is ordered should be watched carefully for similar problems. _o_ AP00030105 3. The rut' ber boots on the oversize line from the wet screen can plug and break, releasing hot slurry on anyone who happens to be underneath, These oots should be checked for integrity on a frequent basis. Chemical Cle aning A Reactor A/fr 2. oK. An ares monitor point should be installed in the vent line from the DMF s to rag e tanks to detect VCM in the DMF that might occur from a valve leaking through. Xf the vacuum breaker leaks through during chemical cleaning, DMF vapors and liquid would be sent to the atmosphere. A leak through of the stem jet valve would allow DMF to collect inthe jet and spray out as hot liquid and vapor during the next use. Both of these valves should be replaced at the f rst sign of any leakage. 3. If the r sflux condenser valve were to leak through or be left open (i. e. , during :he manual drop of a batch) vinyl chloride could leak back into the reactor. It is recommended that a checklist be provided (the computer sequence would do) to aid an Operator in dropping a batch manually. Any condition that indicates that this valve might be leaking should result In the valye being changed. 4. Calvert City has had problems with the agitator .shaft seals leaking through after ch emical cleaning. Run batch recommendation #9 also applies here. 5. Ml. Water ould get into the gas holder if the meter controlling the water fill prior to cleaning was in error. If enough water was allowed to get into the gas holder, problems of overstressing the gas holder could occur, It is re commended that this operation be timed by the computer. All mabway and charge pot O rings should be replaced after every cleaning as DM^1 attacks the material they are currently made of. *4 Jh Initiator Handlin g. 1. )cr^ The stc rage freezer alarm that is currently in the 'third floor fresh air room o : the old reactor building should be moved to the control room, as Opera to rs no longer stay in this room continuously. .2 The thermostats controlling the storage freezers should be converted to explosion-proof models. The chance of VCM being ignited is now much' greatei because of the gas holder and the size of the new reactors. The charge pot and its operation was probably the greatest cause of unanimous cc ncern. To this end, Mike Langsam is currently doing research -10- AP00030106 on the explosion potential of the peroxides and peroxide VCM combinations in the charge pot. If more detail is needed, it can be obtained from a committee member, The rough not iss used to make this summary are also available if requested. WJS:jsr 10/4/77 "W. J. Stueben -i 1 - AP00030107 FAULT TREE INDEX VCM Releases VCM release from monomer storage tanks FA 6131 and 32 VCM release from fresh charge tank VCM rel< ase from recovered monomer tank VCM release from vaporizer VCM release from fugitive emission system vacuum receiver VCM release from blowdown tank. VCM release from 7T 0 slurry stripping column VCM release from gas holder VCM release from gas holder inlet scrubber VCM release from displacement H^O tank VCM release from methyl chloride splitter VCM release from gas separators FC-8341 and 42 VCM release from Nash compressor separator relief VCM release from incinerator feed tank FB-8817 Other Faul<: Trees Blowdown tank rupture Blowdown tank internal fire Strippe:: column rupture Fugitive emissions system internal fire or explosion Fault Tree 100 200 300 400 500 600 700 800 900 1000 1100 1200 1300 1400 2000 3000 4000 5000 AP00030108 v >< t REACTOR RELEASES - RUNAWAY REACTIONS Introdi iction A fault tree describing all the combinations of events which could cause a VCM re ease was not developed for this review because of the complexity of the various runaway reaction demand scenarios. Instead, a different approach was attempted. The stepwise overvlewof this procedure is as followi; Cl) A list of all the individual demands was generated. (2) A list of all the possible levels of protection, including alarms and operator intervention were described. Average unavailabilities were cilculated for each of the individual protective system components. (3) For each particular demand a set of minimum cut sets were developed describing the necessary and sufficient combinations of individual protective system component failures. (4) The total protective system unavailability for each individual demand w<ts calculated. (5) The individual demand rates were then multiplied by their respective protective system unavailabilities to obtain Individual event frequencies. (6) Individual event frequencies were then summed to obtain the total ft equency for reactor release from runaway reaction. AP00030109 Discus ion Table [ contains a listing of the various ways deviatins in normal operation could occur which if undetected and not controlled could lead to runawal/ reactions and reactor releases. Table I DEVIATION DETECTION PROTECTIVE SYSTEM A Wrong type nitiator Jacket T drops 1) Full reflux cooling 2) Control by small additions AMS + venting if required 3) Manual AMS dump B Wrong amount of iniator Jacket T drops Same as A C Excessive fd> uling Jacket T drops Reactor P and T increases Same as A D Loss of coo ing water supply (other than cooling water supply goind dry) "No flow11 signal from flow transmitter 1) Automatic switch to chilled water 2) Control by small additions of AMS + venting if required 3) Manual AMS dump E Chilled water supply fails Reactor P & T increases X) Manual switch back to cooling tower water 2) Full reflux cooling 3) Control by small additions of AMS + venting if required A) Manual AMS dump F Cooling towe r sump goes dry Jacket T drops Reactor P & T increases Computer printout Alarm in CR 1) Automatic switch to chilled water (temporary only) 2) Control by small additions of AMS + venting if required 3) Manual AMS dump G Too much sus pending agent Jacket T drops AMP rise 1) Addition of water same as A H Monomer over charge Review of charge data Jacket T drops AMP rise Same as A I Water under charge Jacket T drops AMP rise Same as G AP00030110 J Agitator fa lure K Power failure L Temperature control system failure M Instrument .ir failure Low AMPS computer and panel alarm Low RPM computer alarm Jacket T drops reactor P & T increases 1) Try to restart 2) Must add AMS within 20 seconds (P=0) 1) Must add AMS within 20 seconds (P=Q) Same as A 1) Automatically fails to cooling tower water and full reflux Table 31 contains a listing of all the various deviations (demands) which could lead to a runaway reaction and calculated frequencies. Table II Demands Leading to a Runaway Reaction A Wrong type of Initiator B Wrong amount of initiator C Excessive fouling D Loss of cooling water (other than CTW sump going dry) E Chilled water system failure F Cooling tower water sump goes dry G Too much suspending agent H Monomer overcharge I Water undercharge J Agitator failure K Power failure L Temperature control system failure/steam valve sticks open M Instrument air failure D yr-1 3 3 250 0.2 0.67 3 1.5 1.5 0.4 0.27 0.33 0.2 The basic assumptions used in deriving the demand rate was that there would be 12 batches per day and a total 3000 batches per year from a .total of four reactors. The derivations for these demand rates are included In the Appendix and are based on plant experience and estimates of human error. The high demand rate for excessive fouling is based on an assumption that AP00030111 the last batch prior to chemical cleaning, in this case the 12th batch, will have sufficient fouling as to be difficult to control. A deta iled representation of the ways in which the protective system can fail is shown in Table III. The first column represents failures in the protec tive system early in the runaway process while the last column repres ents last ditch efforts to stop the batch. In this representation and th e present plant operation there is no automated trip system for shorts top addition. All of the actions taken to stop a runaway require some Operator intervention. Table III PVC PROTECTIVE SYSTEM FAILURE CAUSES WHICH IN COMBINATION COULD LEAD TO A RUNAWAY REACTION AND VCM RELEASE Temperature sensing/transmission fails Pressure sensing/ transmission fails (monitoring) Computer printers fail Computer annunciator fails Operator does not respond to computer annunciator Operator responds but AMS/vent system -ineffective 9 Hardwired temp and pressure alarms fail 10 Operator does not respond to hardwired alarms 11 Manual AMS dump fails or Ineffective Operator does not Respond to computer messages Operator responds but chilled H,,0/reflux cooling failed or ineffective AP00030112 Failures from these various columns in Table III were grouped together to form a collection of minimum cut sets specific for each demand. Not aV demands have the same level of protection and therefore the same winimun cut sets. Included In Appendix Is a listing of minimum cut sets specific for demands A, B, and C in Table III. From failure rate and repair information and plant experience average unavai'abilities were caluclated for each of the items in the protective system. The relevant calculations and a tabulation of this information is shown in Appendix The average unavailability was caluclated for each minimum cut set and for each demand. The average unavailability for a cut set is the product of the average unavailability of the Individual items or components. Pcut set " P1 P2'P3` The avi rage unavailability for the protective system relative to a partic til ar demand is * Protective System ^ ^~Pcut set 1^^ Pcut set 2^ (1'Peut set p Table presents the summary results of potential reactor releases from each o the Individual demands. The event frequency for each demand was obtain nd by the relatinship ~a = da The tab le shows a total potential VCM emergency red case rae of 2.1 per year, Of this total 1.7 or approximately 80% of the potential releases are re ated to decreased heat removal capability requiring close operator attent on. Anothei)* 12% of the total is due to either agitator failure or power failure for which there is really no protective system. AP00030113 Table IV PVC REACTOR RELEASE FREQUENCY FROM RUNAWAY REACTIONS (Without Automatic Shortstop SystenO k D (yr-1) P Total (yr'1) Cut Sets A rfrong type of initiator 3 0.0067 0.020 B ^rong amount of initiator 3 0.0067 0.020 C Excessive fouling 250 0.0067 1. 68 D Loss of cooling water (other than CTW sump going dry) .2 0.0067 0.001 E ('hilled water system failure F CTW sump goes dry 0.67 0.0379 0.025 G "oo much suspending agent 3 0.0067 0.020 H Monomer overcharge 1.5 0.0195 0.029 I i/ater undercharge 1.5 0.0195 0.029 Agitator failure 0.1x4 0.364 0.145 ..K Power failure 0.067x4 0.364 0.098 L Temperature control system failure/steam valve sticks open 0.33 0.0379 0.012 . M Instrument air failure 0.2 0.084 0.017 Total 2.1 AP00030114 T!KV!7r. A P 0 0 0 3 0 I15 FUGITIVE EMISSIONS AB AP00030I16 AP000301f 7 XX T3007* "I GAS HOLDER I GflS HOLDER INLET SCRUBBER I A P 0 0 0 3 0 I19 B TM09I T3 OO02 AP00030I20 METHYL CHLORIDE SPLITTER SHT. I f ncoflj AP0003012 GflS SEPARATORS FC-9341/8342 NASH COMPRESSOR SEPARATOR FC-8312 APOOO 0O4 ho Shi . i Of i rjoo*< t VCX RELEASE FROM INCINERATOR FEED TAWC TV>C AP00030123 rCH ueuase FROM MONOMER STORAGE TAWS FA-ST31 t 32 APO AP00030I25 COHPUTER alarm FAILS APOOO non? OU! Is aiOHDOHH TANKS T3OOT0 I 1 AP00030127 STRIPPER COLUMN RUPTURE 4011 AP00030128 APO BLOWDOWN TANK RUPTURE 7) 2003 04 RUNAWAY REACTION IN REACTOR 2001 'OPERATOR' iROPS 0ATC1rO B/0 TANf N WHOLE Of IN PART A BLOWDOWN TANK INTERNAL FIRE V WATER / DISPLACEMENT \ 5 I 4 AP00030I30