Process Hazard Analysis Based on Modeling and Simulation Tools

Round 1

Reviewer 1 Report

The present study investigated the use of a computational-based hazard identification method, LIPP-SHAC technology as an example to discuss the development of the model, hazard identification system, and the simulation results comparing with the traditional program based on people. Determine the 38 simulation scenarios, provides the dynamic response of the key process variable, to support the accurate hazard recognition mechanism. The use of model and simulation tools for hazard identification is recommended to encourage the use of these tools for risk analysis. However, there are many problems in this paper, mainly including the following aspects:

1. In the abstract section of the paper, please state the conclusion of the case outcome study. What is the full name of HAZID, please indicate it  in the paper?

2. The chapters of the paper are very disordered and not arranged in order, which brings great trouble to readers. For example, section 3.1.1 is the end of section 2.2, section 3.1.4 is the end of section 3.3.3, and section 3.1.5 is the end of section 3.3.5. Please adjust the order of the article so that readers can understand it easily.

3. In section 3.1.1, this paper proposes three models, namely, Model 1, Model 2 and Model 3. What are the significance and purpose of these three models? It is mentioned in the Result section that the model will appear process malfunctions, so how to solve the process malfunctions?

4. Several times in the passage “Erro! "Fonte de Referencia nao encontrada.” What does it mean? The interpretation of Figure 10 and Figure 11 in this paper does not correspond to the number of figures. “(Slurry mass flowrate...)” appears after the first paragraph of section 3.3.5,  delete it?

5. The work content of the paper is very substantial, but there are many figures in the case analysis of the paper, which make the paper very bloated. Please put the result figures of the case analysis in the supporting materials, and introduce each case in the general summary word in the paper.

Author Response

1. In the abstract section of the paper, please state the conclusion of the case outcome study. What is the full name of HAZID, please indicate it in the paper?

Response 1: Thank you for the recommendation concerning the abstract. We agree that it lacks objective information about the paper outcome. We reviewed the abstract, highlighting the main outcomes of the work. Regarding the full name of HAZID, we included it when we first mentioned the abbreviation in the paper.

2. The chapters of the paper are very disordered and not arranged in order, which brings great trouble to readers. For example, section 3.1.1 is the end of section 2.2, section 3.1.4 is the end of section 3.3.3, and section 3.1.5 is the end of section 3.3.5. Please adjust the order of the article so that readers can understand it easily.

Response 2: We appreciate your comment catching these confusing errors; we corrected them in the new version of the manuscript.

3. In section 3.1.1, this paper proposes three models, namely, Model 1, Model 2 and Model 3. What are the significance and purpose of these three models? It is mentioned in the Result section that the model will appear process malfunctions, so how to solve the process malfunctions?

Response 3: We detailed the purpose and significance of each model during the explanation of model changes from Model 1 to Model 2, and from Model 2 to Model 3 in item 2.2.1. For instance, lines 252 and 253 explain the limitation of Model 1 regarding the TEA/PEEB ratio since, in the regions of TEA low concentrations, this model is not able to capture the known physical behavior of reaction deactivation (represented by adjustment factor approaching to zero). To solve this limitation, Model 2 introduces "a linear approximation up to zero in the region of low ??? concentration since it is known that ??? (co-catalyst) is needed to activate the catalyst [22];". Another example can be given in lines 272 to 274 that explain the purpose of Model 3, which aims to solve Model 2 limitation when simulating scenarios that lead to high reactor temperatures since the assumption of vapor-liquid equilibrium is not valid when exceeding the propene critical temperature. "For this reason, Model 3 was developed to take into account the more precise thermodynamic description of the reaction system."

The term "process malfunctions" refers to the potential equipment that can fail during the process leading to hazardous scenarios. From the potential equipment failures, the simulations were planned. In item 4.1, we mentioned that "preventive and mitigating safety measures must be designed to control the identified hazards." As stated in item 1, "the main objective of the present work is to study how chemical engineering and computational technologies can be combined to enhance hazard identification procedures". The work was not focused on designing safeguards or estimating risks.

4. Several times in the passage "Erro! "Fonte de Referencia nao encontrada.” What does it mean? The interpretation of Figure 10 and Figure 11 in this paper does not correspond to the number of figures. "(Slurry mass flowrate...)" appears after the first paragraph of section 3.3.5, delete it?

Response 4: In the new version of the manuscript, we corrected these errors. We thank you for pointing them.

5. The work content of the paper is very substantial, but there are many figures in the case analysis of the paper, which make the paper very bloated. Please put the result figures of the case analysis in the supporting materials, and introduce each case in the general summary word in the paper.

Response 5: We kindly disagree as we have preferred to keep the figures to favor the reader comprehension about simulations explanation, notably when the different models differ on the hazardous outcome.

Reviewer 2 Report

The authors describe in their contribution the opportunities of simulation-assisted safety analysis compared to conventional a HAZOP study. In general, the paper shows a promising approach to computer-aided safety analysis. The authors describe in very detail how the influence of deviations of process-critical parameters within simulations can be used for safety considerations and compare this with the results from the classical approach of a HAZOP-analysis performed by a team of experts. A main outcome of this study is to adjust the level of detail depending on the use case, as explained by the authors. The authors conclude that a simulation-based safety assessment is very time-consuming and recommend its use especially when simulations help to better understand the influence of safety-critical variables on the process behavior, particularly for dynamic system behavior in critical situations. This should be pointed out in clearer fashion, while lengthy parts from the simulation should be shortened or moved to the Supporting Information. The result section should be shortened, and the result should be emphasized more with regard to the safety consideration. The Conclusion is very lengthy and should focus only on the main results.

There are further issues in detail that should be referred to:

1. At which point in the engineering process should the simulation-based safety assessment be used? For plants which are still in the planning stage, for already existing plants or for both? Please add a section to this topic in the Introduction.
2. The authors explain on page 3 that extrapolation of safety-critical contexts is particularly difficult. Is this a result of the fact that a pure consideration of simulations is not sufficient for a safety consideration, since simulations cover only a small part of the process engineering. Thus, important information such as plant topologies or equipment specifics are fundamentally missing.
3. Page 4, Table 1 give identical failure modes for different key words, e.g. for less or more energy or mass (flow rate?). Please be more specific and give a better description than “disturbance” or “failure”, e.g. broken sensor, blocked valve etc. What means “coupled to mass balance”?
4. Table 2: why is energy related to fouling, not heat flux or temperature control? Beside fouling, corrosion, scaling, or encrustation may happen. Please address these issues in Table 3, too.
5. Page 6, Line 166 Is this a reasonable assumption? Simulations are usually performed for the desired, mostly constant operating ranges, since processes are usually to be run far away from critical ranges, and consequently need to be particularly accurate only in these ranges. Is there an awareness in the process industry for models that converge outside the operating range and provide accurate results? Or is there a need for completely new models?
6. Figure 6. some items are unclear: what is meant with AC? The Level Control is located at very low position at the vessel. If the temperature control of the reactor is performed by the back-pressure regulator at the top, the condensed material must be fed by a pump back into the reactor. The temperature control of the cooling water is not correctly coupled with the condenser and reactor. Both temperature control loops should be connected.
7. Figure 7 How are the boundary conditions given by the plant and used for the evaluation of the simulation, such as design specifications, material characteristics, etc.?
8. Is Figure 8 helpful or can the content be explained in the text?
9. Equation 1 is not correct with subscripts and exponents.
10. Figure 12 gives some valves in orange, which should be mentioned in the title, not only in the text.
11. Chapter 3.3 As already described in Figure 7, the critical variables are changed step by step and the effect of the changes on the safety of the process is simulated. How is it prevented that states are simulated which do not exist in operation because the process is carried out below these ranges? If this is not ensured, it could lead to a fundamental over-dimensioning of components.
12. In general, the results section is very comprehensive. Many examples of very similar cases are given, which makes it difficult for the reader to draw the main conclusion. Please summarize the results with similar conclusions and making the general outcome of the paper clearer. Figs. 13 and 14 can be described in the text. In total 37 figures are a very large amount for this paper.
13. 13 and 14: Where do the design specifics introduced in the results (horizontal lines in the diagrams) come from?
14. After page 13, new page numbers appear, but line numbers continue, very confusing!
15. Page 12, line 530, there is something missing or format error with figure title added to the text.
16. Line 603, what means the sentence ending with “… should be recorded.”? Is the safety or the product quality addressed in this paragraph, too?
17. Line 610, where is the “critical thermodynamic region” located? Be more specific.
18. Line 624, the “hydrodynamic collapse” is mentioned here again, please be more focused.
19. Line 626, what is meant with “online soft sensor”, how should work?
20. Chapter 4.1 in general: How is it prevented that the simulation considers areas as critical, which do not occur in the process due to other operating conditions? How can existing safeguards such as safety valves or functional safety be included in the simulation-based safety assessment? At this point, it should be emphasized once again at which point in the engineering process a simulation-based safety assessment should be carried out.
21. Line 652, what means “stratifies” with relation to a figure? The expression is repeated in the related figure´s title.
22. Line 673 emphasizes that no process simulation is existing for a classical HAZOP study, which is not true. The authors should discuss the case of a classical HAZOP with existing process simulation from the design phase of engineering. What are the benefits and what are the barriers of this case, which is often the usual one.
23. [ref. 38] what is meant with personal communication between Pinto, J.C and J.C. Pinto?

A Nomenclature for symbols and abbreviations would be very helpful for the understanding of the simulation. Some indices are not written as subscripts, some capital letters are not used correctly, some references in the text to figures or similar are broken, please check and correct.

Author Response

In this letter, we are sending you a list of responses to the comments of the manuscript entitled "Process hazard analysis based on modeling and simulation tools", by Julia Pinto Athanázio de Azevedo, Maurício B. de Souza Jr., and José Carlos Pinto, which we have submitted for Processes and was recommended reconsideration following major revision. The newly uploaded manuscript is marked in blue to highlight the modifications.

The reviewer's comments are formatted with bold font and our responses with the non-bold font to provide better visualization.

To conclude, we would like to sincerely thank the reviewers for taking their time to go deeply through our text and for the relevant comments that improved the quality of the paper.

1. At which point in the engineering process should the simulation-based safety assessment be used? For plants which are still in the planning stage, for already existing plants or for both? Please add a section to this topic in the Introduction.

Due to the required level of detail, the simulation-based tool, complementing a traditional hazard analysis as HAZOP, for instance, should be applied to the Detailed Engineering Routine Operation phases. Techniques for hazard analysis and associated plant lifecycle phase are available in CENTER FOR CHEMICAL PROCESS SAFETY (1992) [Ref. 5]. We appreciate your comment and have added this topic to the Introduction and item 2.1.

2. The authors explain on page 3 that extrapolation of safety-critical contexts is particularly difficult. Is this a result of the fact that a pure consideration of simulations is not sufficient for a safety consideration, since simulations cover only a small part of the process engineering. Thus, important information such as plant topologies or equipment specifics are fundamentally missing.

The referred difficulty is related to the simulation environment since "when simulating the model over a wide range of operation conditions, the validity of model parameters and numerical convergence may be jeopardized. Therefore, model results must be checked regarding consistency". The proposed Hazard Identification Method, as discussed in section 2.1, states that "after simulating all device malfunctions and building the Simulation Result Table, a heuristic Hazard Analysis must be performed". The complementary heuristic analysis should consider other relevant information and involve the necessary expertise to interpret the simulations results and achieve the safety analysis goal, which can vary according to the application purpose. We agree that this topic is relevant to the paper's objective. Thus we detailed the meaning of heuristic analysis after simulation results aiming to alert for this limitation of the computational-based tool.

3. Page 4, Table 1 give identical failure modes for different key words, e.g. for less or more energy or mass (flow rate?). Please be more specific and give a better description than "disturbance" or "failure", e.g. broken sensor, blocked valve etc. What means "coupled to mass balance"?

The general examples of failure mode aim to embrace all kinds of processes. A control loop failure can be caused by any of its elements (sensors, controller, or actuator). Depending on the process and loop architecture, it can fail on the direction of increasing or reducing mass and energy. For instance, an opening failure valve that is part of a level control loop of a storage tank can lead to mass drainage of the tank if the valve is located in the tank outlet but can lead to the addition of mass if the valve is located on the tank inlet. Nevertheless, to improve reading comprehension, we have added a note in Table 1.

By "coupled to mass balance" we meant that failure modes related to adding or removing mass of a process node can impact the energy balance. We agree that the expression was not clear, and we have also added a note to explain its meaning in Table 1.

4. Table 2: why is energy related to fouling, not heat flux or temperature control? Beside fouling, corrosion, scaling, or encrustation may happen. Please address these issues in Table 3, too.

The failure mode fouling, and additionally, as suggested, scaling and encrustation can affect the energy exchange in the boundaries of the process node. We agree that "Less Energy" associated with fouling confuses the reading about the failure mode, thus we kept just fouling, scaling, and encrustation. Corrosion can be particularly relevant for the function of "containing mass" so we also included it in table 2.

5. Page 6, Line 166 Is this a reasonable assumption? Simulations are usually performed for the desired, mostly constant operating ranges, since processes are usually to be run far away from critical ranges, and consequently need to be particularly accurate only in these ranges. Is there an awareness in the process industry for models that converge outside the operating range and provide accurate results? Or is there a need for completely new models?

This topic is a core subject of interest for our paper. For most process industry applications, the model application range is narrow, and simplification assumptions are made. The paper aims to explore how typical process models and simulation tools can sum to heuristic analysis to obtain a complete and assertive understating of the process hazards. As mentioned in item 4.2, "This is an important observation, taking into account the effort needed to develop a robust model capable of describing all simulation conditions, as discussed in Malfunction Simulation. Assuming that human-based reasoning can identify a significant part of the existing hazards, the application of the simulation should be perhaps directed to the complex scenarios". Our experience during the research showed that starting from a typical process model followed by some model improvements to cover a wider range as for the safety analysis, "the simulations can indeed enhance the understanding of mechanisms of hazardous scenarios, avoid conservative decision making and avoid overlooking device failures that can pose a severe hazard to the process".

6. Figure 6. some items are unclear: what is meant with AC? The Level Control is located at very low position at the vessel. If the temperature control of the reactor is performed by the back-pressure regulator at the top, the condensed material must be fed by a pump back into the reactor. The temperature control of the cooling water is not correctly coupled with the condenser and reactor. Both temperature control loops should be connected.

According to ISA (International Society of Automation), AC represents a controller of all types of process stream composition and physical property analysis. In this case, the concentration of monomer as explained in the text. The process flow chart doesn't consider the vessel's geometry or the actual position of instruments. The control architecture and equipment setup were based on the industrial polypropylene reactor studied by [17,18,20].

7. Figure 7 How are the boundary conditions given by the plant and used for the evaluation of the simulation, such as design specifications, material characteristics, etc.?

The strategy proposed for model development is based on a human validation of the results' consistency. Thus, design specifications, material characteristics, etc., can be included as the evaluation of results requires an increase of the model level of detail.

8. Is Figure 8 helpful, or can the content be explained in the text?

The figure helps the reader better understand the concept before the details are presented in the text.

9. Equation 1 is not correct with subscripts and exponents.

We appreciate your comment catching these confusing errors, which we corrected in the new version.

10. Figure 12 gives some valves in orange, which should be mentioned in the title, not only in the text.

Figure 12 shows all possible device malfunctions, not only valves.

11. Chapter 3.3 As already described in Figure 7, the critical variables are changed step by step and the effect of the changes on the safety of the process is simulated. How is it prevented that states are simulated which do not exist in operation because the process is carried out below these ranges? If this is not ensured, it could lead to a fundamental over-dimensioning of components.

The heuristic analysis after simulation should discard any spurious simulation results.

12. In general, the results section is very comprehensive. Many examples of very similar cases are given, which makes it difficult for the reader to draw the main conclusion. Please summarize the results with similar conclusions and making the general outcome of the paper clearer. Figs. 13 and 14 can be described in the text. In total 37 figures are a very large amount for this paper.

We appreciate the comment and agree that some figures can be described during the text. We have reduced the number of figures in the new version to 31.

13. 13 and 14: Where do the design specifics introduced in the results (horizontal lines in the diagrams) come from?

The normal process condition was based on the industrial polypropylene reactor studied by [17,18,20].

14. After page 13, new page numbers appear, but line numbers continue, very confusing!

We appreciate your comment catching these confusing errors, which we corrected in the new version.

15. Page 12, line 530, there is something missing or format error with figure title added to the text.

We again appreciate your comment catching these confusing errors, which we corrected in the new version.

16. Line 603, what means the sentence ending with "… should be recorded."? Is the safety or the product quality addressed in this paragraph, too?

We meant that the heuristic analysis is a complementary step after the simulations and should be registered and attached to the simulation results. We have complemented the sentence to improve the reader's comprehension.

17. Line 610, where is the "critical thermodynamic region" located? Be more specific.

The "critical thermodynamic region" is explained in item 2.2.1 with the part: "Model 3 is an improvement of Model 2 regarding the thermodynamic behavior of propene, motivated by the fact that the operating temperature, ? =343 ? and the propene critical temperature, ? ? =365.57 ? are close [33]. Due to the proximity to the critical temperature, the assumption of liquid-vapor equilibrium during simulations may not be correct in all conditions. Besides, the remaining thermodynamic properties are subject to significant variations in the proximities of the critical point. For this reason, Model 3 was developed to take into account the more precise thermodynamic description of the reaction system". In order to improve the reading comprehension, we have recalled item 2.2.1, when we referred to "critical thermodynamic region" in the abovementioned part.

18. Line 624, the "hydrodynamic collapse" is mentioned here again, please be more focused.

The "hydrodynamic collapse" is explained in item 3.2 in the part: "A critical variable that is particularly important for this case study is the polymer mass fraction inside the reactor. As the polymer is in the solid phase, the polymer must be kept in suspension in the liquid phase. Experience shows that when the polymer mass fraction is higher than 0.5, the hydrodynamic collapse of the suspension can occur. This phenomenon can cause significant damage to the reactor mechanical components and can lead to loss of primary containment, constituting thus a critical variable for safety". To improve the reading comprehension, we have recalled item 3.2, when we referred to "hydrodynamic collapse" in the abovementioned part.

19. Line 626, what is meant with "online soft sensor", how should work?

An online soft sensor is an interesting tool for predicting material physicochemical properties, concentration, and other properties of substances. Hence, it is useful in process safety hazard analysis, as mentioned by (Coimbra et al., 2017).

20. Chapter 4.1 in general: How is it prevented that the simulation considers areas as critical, which do not occur in the process due to other operating conditions? How can existing safeguards such as safety valves or functional safety be included in the simulation-based safety assessment? At this point, it should be emphasized once again at which point in the engineering process a simulation-based safety assessment should be carried out.

To assess potential process hazards and then the raw risk, it is common to extrapolate the process consequence against a process malfunction, disregarding the actuation of process safeguards. This approach was included in the methodology so that the reader can understand why not to include safety valves or functional safety.

21. Line 652, what means "stratifies" with relation to a figure? The expression is repeated in the related figure's title.

We changed "stratifies" for "shows" for better understanding. Thank you.

22. Line 673 emphasizes that no process simulation is existing for a classical HAZOP study, which is not true. The authors should discuss the case of a classical HAZOP with existing process simulation from the design phase of engineering. What are the benefits and what are the barriers of this case, which is often the usual one.

As discussed in comment 5, this topic is a core subject of interest for our paper. For most process industry applications, the model application range is narrower, and simplification assumptions can be made. Our experience during the research showed the limitations of typical process models when applied for hazard identification. This required the development of other models with different levels of detail.

23. .[Ref. 38] what is meant with personal communication between Pinto, J.C and J.C. Pinto?

We appreciate your comment catching these confusing errors, which we corrected in the new version.

24. A Nomenclature for symbols and abbreviations would be very helpful for the understanding of the simulation. Some indices are not written as subscripts, some capital letters are not used correctly, some references in the text to figures or similar are broken, please check and correct.

We appreciate your comment catching these confusing errors, which we corrected in the new version.

Round 2

Reviewer 2 Report

In general, all our comments were answered and implemented in most cases. However, it is still not clear, why the presented simulation-based HAZOP should be more efficient than the heuristic one, if afterwards the heuristics have to be applied to the simulation results (see answer to comment 5). Further comments were not answered correctly or in such detail to understand the meaning of the authors.

comment 9. “Equation 1 is not correct with subscripts and exponents.” Eq. 1 must be m_dot, not with a dot above R

comment 10. Figure 12 gives some valves in orange, which should be mentioned in the title, not only in the text. The title of Fig. 12 should mention that the orange symbols are indicating “malfunction”

comment 11. “Chapter 3.3 As already described in Figure 7, the…” This remark is not answered correctly, as some of the following remarks, too. This makes it hard to follow the possible corrections. The authors should give a more detailed rebuttal file.

comment 13. The normal process conditions should be given in 3.3 with references.

comment 19. Line 626, what is meant with "online soft sensor", how should this work? The expression is not explained to the reader.

Table 3 is newly added, but is only related to Fig. 6. All equations 1-15 are not covered. This has to be added for better understanding of the contribution. In this condition, the contribution is still not ready for publication.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf