Critical Situations and Prevention of Accidents in Chemico-Technological Systems (Methodological Aspects)

Abstract

The aim of this work is to study the causes of accidents in chemical processes, develop a methodology for accident prevention via control, and illustrat its realization by examples using a variety of strategies. The general concept of critical situations was introduced systematically covering both emergency and pre-emergency situations. In large-scale chemical plants, examples of accidents are presented. Accident causes as a result of disturbances and control faults in technological processes are analyzed. Approaches for preventing accidents are considered. The revealing of critical situations is presented as a problem of pattern recognition, and the subtasks of the recognition are analyzed. An emergency scale based on the assessment of various states of the chemico-technological process is introduced and applied for distinguishing the different levels of accident. The real obstacles in the prevention of accidents via control are shown and analyzed. Matrices of critical situations with corresponding characteristics are given. The main tasks for the prevention and elimination of critical situations are highlighted and characterized, and our methodology for the realization of these tasks is presented. Practical examples of the prevention of accidents in the industrial ammonia synthesis processes (including approaches and strategies) are demonstrated based on the real-time control of autothermal reactors.

1. Introduction

The topicality of accident prevention in chemico-technological systems is obvious. Accidents in the chemical industry occur rather frequently, despite the efficient equipment, modern control instruments, and regular safety measures [1,2,3,4,5,6,7,8]. They take place at the leading chemical enterprises of Europe, America, and Asia. Technical equipment works better and better, but its failures become more and more dramatic [1,4,6,7,9,10,11,12].

The reasons for accidents can be very different: (1) faults in the technological process during control; (2) damage of the technological equipment caused by a variety of factors (corrosion, vibrations, control faults), etc.

In the general literature on the technology, the term “accident” is well known. Typically, the term “accident” is identical to the term “emergency”.

Accidents in the chemical industry are accompanied by huge losses [2,4,6,7,12,13,14,15,16,17,18,19,20,21,22].

Some facts on accidents

The Chernobyl nuclear accident that occurred on 26 April, 1986, was the world’s worst-ever technological disaster.

In chemical industry, the most well-known accidents are described in detail. See [4,7,10,11,15,17,18,19,20,23,24,25]. Apparently, the Bhopal disaster on 3 December 1984 at the Union Carbide Corporation (UCC) was the biggest catastrophe in the history of the industrial chemistry with terrible consequences [23]:

• 8000 people died at once;
• Over the next 20 years, more than 20,000 people died, and hundreds of thousands suffered from complications;
• The Union Carbide Corporation could not regain its original market position.

A well-known accident with fire and explosion occurred on 1 June 1974 at the chemical company NYPRO in Flixborough, United Kingdom [25]:

• 28 people died;
• There was an explosion with a magnitude between 15 and 45 TNT;
• The whole plant was damaged;

In Germany, the explosion catastrophe took place on 28 July 1948 at the company BASF, Ludwigshafen [24]:

• 207 people died, about 3800 people were injured;
• 7350 houses in Ludwigshafen and Mannheim were damaged;
• Property damage was about 80 million German marks.

Also in Germany, there was the big accident on 8 June 1999 at the BAYER company in Wuppertal [10]:

• Over 100 people were injured;
• The estimated property damage exceeded some millions of German marks, including the territory of the factory, surrounding residential buildings, and the whole landscape.

Other examples of accidents at leading enterprises in America and Europe:

• Explosion at Houston Chemical Complex, Phillips 66 (23 October 1989) [17];
• The fire at Allied Colloids Limited, Low Moor, Bradford (21 July 1992) [18];
• Accident in Dormagen, BAYER-Werk (30 June 1997) [15];
• West Fertilizer explosion and fire, West, Texas (17 April 2013) [19];
• Accident with an explosion at the company BASF Ludwigshafen (17 October 2016) [11,20];
• Explosion at Chempark Leverkusen (27 July 2021) [7].

Since 1991, in Germany, all notifiable events in industrial plants are registered by the Central Report and Evaluation Center for accidents and malfunctions in process engineering plants (ZEMA) at Federal Environment Agency (Germany). In 2018 and 2019, 50 accidents and malfunctions in German industrial plants have been registered, mostly in chemical plants. In total, 4 deaths were reported and 75 people were injured. Environmental damage was reported within the operational area for seven events and environmental damage outside of the operational area for one event [4]. Until today, it is not known what caused the accident at BAYER-Werk Dormagen on 30 June 1997.

Prevention of accidents. Approaches and topics

In the analysis of accidents, three statements can be formulated:

• One of main causes of known accidents was human error;
• For some accidents, the real cause cannot be determined;
• For many accidents, the consequences are difficult to predict.

Generally, the prevention of accidents highly depends on the safety culture, and the formation of this culture is Problem 1.

Studies on troubleshooting in chemico-technological processes are subjects of considerable interest.

In the literature, due attention is devoted to solving the problem of emergency prevention: [3,8,12,14,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62].

Different approaches in technical diagnostics and fault detection have been formulated [33,48,49,50,51,52,54,55,56,57] with great attention to equipment diagnostics using nonlinear models. There are various techniques for the risk assessment of enterprises in the chemical industry [8,30,31,32,60,63,64]. In the USA and Germany, risk identification is carried out for both personnel and equipment and performed using the standard techniques of hazard and operability (HAZOP), Fehlermöglichkeits und Einflussanalyse (FMEA), what-if analyses, and checklists [65,66,67].

E.g., in the HAZOP technique, the conceptual scheme is the following one:

“Engineers/modelliers simulate reactor circuit in two steady states, start-of-run and end-of-run and think through the various operational and safety issues between these two states. They will also look at the startup/shutdown procedure. Operators, design engineers and technology specialists, then, identify hazards, characterize their causes and suggest solutions in terms of measurable process variables like temperature, pressure, level and their control, while also reviewing safety devices such as Pressure Relief Valves.”

FMEA is an engineering method that provides qualitative statements.

All of these techniques are used for the process design and certification of new products or processes, etc. [67].

In [41,42], the development of expert systems for assessing the accident risk is considered. Such systems can be used both for analyzing the state of equipment and for developing the technological processes as well.

In [62], a methodology was described on how to use the data obtained by historians for the verification of safety assumption.

Tasks related to accidents can be divided in two categories:

• Aimed at analyzing and eliminating the consequences of accidents;
• Aimed at the prevention of accidents.

There are different modes of control of technological objects: manual, automatic, and automated.

With manual control of the system, control actions are formed and realized by a person (technologist, operator).

Some causes of accidents are analyzed in [4,12,14,26,68]. It is pointed out that, generally, the insufficiency of manual control is generated due to the high risk of dangerous situations (operating modes) because of the long reaction time of operators.

Automatic control of the system is control without the direct participation of a person in the control loop.

In the case of automated control of the system, the control actions generated by the computer can be realized via the closed loop (automatically) and manually, by the operator.

For technological processes, the development of automated control systems is one of the most efficient ways of preventing accidents.

In the known automated control systems, two approaches are outlined. The first approach is the recognition of arising dangerous technological situations, i.e., technical diagnosis. Then, the process operator must be informed about these situations [53,54,55,56,57,69,70]. The second approach involves the technical diagnosis of the control object and the automatic regulation of key variables with increased reliability [14,36,38,68].

In [14], three main tasks for the avoidance of accidents in control are listed: prevention, diagnosis, and elimination. This work presents a methodology for solving these tasks based on the concretization, development, and generalization of the concept of failure-free control. The tasks are considered and realized as complementary ones. When eliminating dangerous situations, subtasks of decision-making and implementation of corresponding control actions are also solved.

Accident-free operation should be considered as one of the obligatory conditions for the achievement of high economic and ecological efficiency of chemico-technological systems.

In this work, the control of chemico-technological systems in real time will be discussed aiming at the prevention of accidents. It will be illustrated by practical examples of ammonia production which is one of the cornerstones of industrial chemistry. Recently, ammonia has also been viewed as an interesting energy storage candidate. The chemical method for the industrial ammonia synthesis process was developed in 1905–1913 by the chemist Fritz Haber and the chemical engineer Karl Bosch (Germany). The method was already being used in industrial scale operations in 1913 [71,72,73]. The synthesis of ammonia is associated with the realization of many typical processes of chemical technology (heterogeneous catalysis, compression of gases to high pressures, purification and separation of gases, heat processes, combustion, condensation, evaporation).

The ammonia synthesis plant is a complex nonlinear system with different strong feedbacks. In Europe and the USA, the main feedstock for ammonia production isnatural gas as a source of hydrogen [74]. In China, which is the world’s largest producer of ammonia, the feedstock for ammonia synthesis is coke oven gas [74,75,76].

Due to the high pressure in the synthesis system and the high temperature in the reactor, as well as the use of combustible and explosive gases (CH₄, H₂), ammonia synthesis belongs to a class of processes which are potentially hazardous.

2. Background of Analysis

In the literature, the different definitions of accidents have been formulated. Some of them are similar, stressing the “unintended”, “unplanned”, or “sudden” scenarios of accidents.

Table 1. Definitions of accidents.

No	Definition	Source (References)
1	An accident involves the destruction of buildings and (or) technical devices used at a hazardous production facility, uncontrolled explosion, and (or) release of hazardous substances	[2]
2	An accident is an unplanned and uncontrolled event in which the action or reaction of an object, substance, person, or radiation results in personal injury or the probability thereof	[77]
3	An occupational accident shall mean a sudden externally caused event related to the performed work resulting in injury or death of a worker	[78]
4	The workplace accident is understood as a sudden, impossible-to-predict incident which results in injuries, deaths, or damages	[79]
5	An accident is an unintentionally caused event. In most cases, the term is used specifically in reference to unintentionally caused negative events	[80]

shows the examples of accident definitions.

In this paper, the accidents in chemico-technological systems are defined and described as unplanned technological incidents which are characterized by considerable economic and/or ecological losses and/or by the human toll. Concepts of emergency and pre-emergency situations are used.

Sometimes, an emergency situation is identified with an accident. Here, an emergency situation (ES) is defined as a situation which corresponds to dangerous technological breakdowns. The term ”dangerous” means that this situation will be followed by an accident if the appropriate and urgent control measures are not taken.

In emergency situations, signalization systems are, as a rule, activated. Then, protective interlocks and emergency and gate valves start to work. If emergency situations are not eliminated within a limited time, then they are followed by accidents.

Pre-emergency situations (PS) are characterized by breakdowns which can lead to emergency situations in the absence of proper control measures. By analyzing these breakdowns and/or their dynamics, accidents can be predicted.

In many cases, emergency and pre-emergency situations are combined. These two situations can be generalized by the concept of critical situations (CS).

In the exploitation of chemical plants, some planned measures are possible, when economical and/or ecological losses are big, e.g., planned shutdowns aiming at plant maintenance, the repair and replacement of the equipment, reloading of catalysts, and so on. The planned shutdowns are scheduled by a separate technological document.

Some shutdowns are unplanned, and so-called ‘false shutdowns’ may occur as well. Within our methodology, all unplanned shutdowns are considered as accidents.

Both the planned shutdowns and unplanned ones are accompanied by significant economic and ecological losses, especially because of a long-term equipment downtime.

In Figure 1, the categories of the accident losses are presented. Losses can occur both during an accident (e.g., due to a shutdown of the plant, a decrease in the productivity, destruction of equipment and buildings, and environmental pollution as well) and after an accident (production downtime, death of people or damage to their health). Finally, accidents cause irreparable damage to the image of enterprises.

Some losses can be compensated (’reversible’ losses), while others, for example, losses of life, are ‘irreversible’.

The problem of accident prevention is interdisciplinary (Figure 2), and it creates additional obstacles for its solving.

3. Materials and Methods

The efficient prevention of accidents depends to a large extent on the correct recognition of critical situations (CS). Algorithms for eliminating emergency and pre-emergency situations may differ significantly.

In most cases, it is much more difficult to eliminate an emergency situation than the corresponding pre-emergency one. Typically, this is caused by the higher losses which correspond to the emergency situation.

As is known, the behavior of a technological process depends on input variables (including control actions), as well as on external and internal disturbances. In critical situations, many differences in the behavior of the technological process take place. Analyzing these differences, the decision about the presence of certain CS can be made.

We consider the problem of revealing the critical situations as a problem of pattern recognition, consisting of the following subtasks:

• Splitting a set of situations into classes depending on their properties;
• Finding features of recognition under constraints;
• Descriptions of different classes via the language of recognition features.

All of these subtasks are developed for a concrete chemico-technological plant based on technological regulations and practical experience. Also, some subtasks are formed based on a thorough theoretical study of the technological process and its static and dynamic mathematical models. In some cases, methods of artificial intelligence are applied, e.g., automated recognition of patterns and regularities in data [40,81]. Based on the current technological data, it is determined whether the situation which arises belongs to a certain class.

Developing the features of recognition, it is very important to take into consideration not only static but dynamic characteristics of the technological object as well, in particular, the rate of change in variables. In some cases, requirements/for transient processes must be considered, e.g., the absence of oscillations for certain variables. It should be considered as well that:

• The characteristics of nonlinear technological process can depend on input variables and disturbances;
• Measurement errors of technological variables can be significant.

As the features of recognition, the following can be used:

• The output and input variables of the technological process, as well as their derivatives;
• Additional functions of output and input variables including their derivatives.

Some illustrations will be presented below.

The normal technological mode, that is the guidance for the operator, is described by the technological regulation. For the computer, the mode of normal operating is the mode that corresponds to the two conditions, i.e.,

(1)

The requirements of the technological regulation;

(2)

The additional requirements of pattern recognition.

Therefore, the normal mode for the operator is generally not the same as the normal mode for the computer. The operator may not recognize some pre-emergency situations identified by a computer that uses additional calculated features of recognition.

In the literature, different scales for accident characterization are known, e.g., the Heinrich ratio [82], Rohn emergency scale [83]. These scales characterize the losses and damages of accidents, as well as the consequences of accidents. However, these scales do not consider different regimes and states of objects. Also, different scenarios of accidents, especially the pre-emergency situation, which is a subject of this paper, are not considered either.

Our scale is based on the assessment of various states of a chemico-technological object. The state of the object is characterized using a special scale, emergency degree (ED) that includes the following ranges (Figure 3):

(1)

Mode of normal operating (ED = 0); qualitatively, ED = 0 corresponds to requirements of technical regulations and to additional requirements in some cases;

(2)

Mode of pre-emergency breakdowns, i.e., a pre-emergency situation or a combination of pre-emergency situations (ED = 1);

(3)

Mode of emergency breakdowns, i.e., an emergency situation or a combination of critical situations with one emergency situation at least (ED = 2);

(4)

Accidents (ED = 3).

The optimal and nominal modes are different types of Mode 1.

The nominal mode means a special case of the normal mode recommended to the operator by the technologist. The modes of startups and scheduled shutdowns also refer to Range 1. Emergency shutdowns refer to Range 4.

What is a meaning of emergency degree? It can be defined as a reserve in time (T_K), a period, during which an accident can be prevented.

Obviously,

T₁ > T₂ > T₃ > T₄,

k is the number of the range of the emergency scale; k = 1, …, 4, T₄ = 0.

Qualitatively, this dependence is a decay of T_k from infinity (Range 1) to the zeroth value (Range 4).

In Figure 4, the comparative characteristics of losses corresponding to critical situations and accidents are shown (Ranges 2–4 on the emergency scale). The expenditures on the elimination of emergency situations are included into the losses.

4. Results

4.1. General Results

An analysis of control means for the normal operating mode shows that they, generally, do not provide efficient prevention and elimination of CS [14]. This can be explained as follows:

Cause 1. Difference in control strategies for the normal operating mode and critical situations

Control objectives in the normal operating mode and in critical situations can differ significantly [14] (Figure 5).

In critical situations, the “expensive” control actions must be used sometimes, and the “expensive” action is one for which the cost is much higher than the cost of the control in the normal operation.

Thus, in critical situations some inevitable losses must be accepted in order to prevent much bigger losses due to an accident.

Cause 2. Essential nonlinearity

Generally, the characteristics of many chemical processes are nonlinear and even essentially nonlinear [84,85]. As an essential nonlinearity, we mean the nonlinearity that can lead to qualitative changes in the operation mode, first of all to the loss of stability. This kind of nonlinearity occurs in a number of chemical systems containing reactors.

The kinetics of catalytic reactions depends nonlinearly on many factors, i.e., temperature, pressure, concentration of reactants, and catalyst state. In critical situations, the variation in these parameters can provoke dramatic and fast changes in the dynamic characteristics of the control and disturbance channels.

Cause 3. Deficit of control actions in critical situations

The appearance of CS is often associated with a deficit of control actions. A deficit of control actions is understood as a phenomenon in which the number of controlled variables is greater than the number of control actions. Such situations may occur, when final control elements are blocked or are at the limits, i.e., the resources of control actions have been exhausted [14].

Cause 4. Change in characteristics of control objects over time

Typical examples of phenomena that lead to a change in the characteristics of an object over time can be:

• Loss of activity of catalysts in industrial chemical reactors, i.e., catalyst deactivation, as a complex non-steady-state process influenced by many physicochemical factors including chemical “poisoning”, coking, thermal deactivation, sintering, and mechanical degradation [86]. Also, the different primary categories of catalyst deactivation can be distinguished [87,88]:

  ○

  Reversible and irreversible deactivation;

  ○

  Chemical and physical deactivation;

  ○

  ‘Intrinsic’ and ‘extrinsic’ deactivation.

• Change in the heat transfer coefficient due to the formation of scale on the heat-exchange surface.

The change in characteristics over time essentially complicates ensuring accident-free control.

Cause 5. Increasing the sensitivity of objects to disturbances

This cause is one of consequences of the nonlinearity that complicates the task of preventing accidents. In critical situations, the increase in the sensitivity to disturbances is exhibited to the greatest extent when a change in the object characteristics leads to the loss of stability.

When using the control means for working in the normal operating mode, the accidents can still occur in the following cases [14]:

(a)

Errors of process operators.

The percentage of such accidents is quite high. It can be explained by different factors, i.e., the long reaction time of operators, a big number of controlled variables, complexity of the situations, etc. In some critical situations, the process productivity may not be less and even more than in normal operating. One of the dangerous operator errors is the attempt to increase the process efficiency with no attention to the proximity of a critical situation.

(b)

Unreliability of information on object variables;

(c)

Failure of control means in normal operating mode;

(d)

Turning on improperly programmed control systems in critical situations;

(e)

Action of strong disturbances on the control object.

Such disturbances can lead to rapid and essential deviations of the object’s variables, as well as to the fast change in the characteristics of control and disturbance channels.

(f)

Combinations of factors listed above.

In critical situations, switching on some control means oriented on normal operating can aggravate the dangerous situation. Finally, the working recommendation is switching off such means.

As for the presented emergency scale (Figure 3), Ranges 2 and 3 correspond to critical situations. We characterize each situation answering the three questions:

• Are the considered critical situation and the normal operating mode different in the properties of the control object, i.e., stability, the control model, etc.?
• Are the critical situation and the normal operating mode different in control strategies (algorithms)?
• Is the deficit of control actions arising even in the case where all final control elements (actuators and valves) are intact?

In this paper, the answers to Questions 1–3 (“yes” = 1 or “no” = 0) are used for compiling the vector of the characteristics of the situation (VCS). This vector has the structure:

V_r = [g, s, d],

where r is the number of the critical situation; r = 1, …, N; g, s, and d are the answers (“yes”—1 or “no”—0) to Questions 1–3.

Characteristics of critical situations are used for the compilation of the so-called matrix of critical situations (MCS). Some examples of VCS and an example of an MCS will be given for preventing accidents in ammonia synthesis control (P. 4.2.11).

The control strategies in critical situations and in normal operating can be different.

In the general case, the prevention and elimination of critical situations should be ensured by the realization of three complementary tasks (Figure 6):

• Prevention of arising pre-emergency situations (Range 2) while solving control tasks in the normal operating mode;
• Recognition of critical situations of the technological process;
• Elimination of critical situations.

Our methodology for the realization of the three tasks is given below.

For the prevention and elimination of simple critical situations, the analysis of all three tasks is not obligatorily required. However, for complicated critical situations the analysis of all of these tasks is preferrable.

Task 1. Prevention of arising pre-emergency situations in the normal operating mode

When controlling a technological object, this task is especially important. It presents the development of both control strategies and means for preventing the object transition from normal operating to the pre-emergency mode. In this case, real practical difficulties should be considered, i.e., the unreliability of some technological variables, failures of final control elements, errors in realizations of control actions, etc. Within Task 1, these difficulties are overcome using special procedures (see below).

Task 2. Recognition of pre-emergency and emergency situations

This task presents timely recognition of the CS, revealing the causes of their occurrence, and preparing the information for Task 3. Since the algorithm for eliminating the PS can be simpler and more efficient than the algorithm for eliminating the corresponding ES, it is desirable to identify the PS as early as possible. The most difficult situations arise when several breakdowns in the technological process occur simultaneously.

Task 3. Elimination of critical situations

This task consists of decision-making procedures based on the Task 2 information, computing, and realizing the control actions for the transition of the object from the current state (Ranges 2–3 on the scale) to the state of normal operating. When making decisions, mathematical methods of the system analysis are used, e.g., the principle of a guaranteed result [89].

The causes of critical situations are not always identified. In some cases, the elimination of identified causes is impossible. Moreover, eliminating some causes does not always guarantee the prevention of an accident. When eliminating critical situations, the following strategy is employed:

If it is managed to identify the cause of the CS, and if it is possible to prevent the accident by eliminating the cause, then it is removed. Otherwise, the elimination of critical situations is organized via the transition of the system from the current state to the normal operation mode using appropriate control actions. If it is possible and reasonable, then the identified cause of the CS is eliminated as well.

In some cases, it is not managed to determine the pre-emergency situation. Nevertheless, the typical procedures for preventing and eliminating the emergency situations must be considered and performed.

Solving only Task 1 is not enough to ensure accident-free operation. But the renunciation of this task can lead, e.g., to temperature oscillations in the system, which in its turn can often provoke accidents. Below, all three mentioned tasks will be presented for the prevention of accidents in ammonia synthesis control.

4.2. Prevention of Accidents in Ammonia Synthesis Control (Examples, Methodology, and Solutions)

4.2.1. Technological Schemes of Ammonia Production

In this work, the methodology given above will be illustrated by examples taken from the practice of control of the ammonia production from natural and coke oven gases.

A detailed description of typical processes of ammonia synthesis is given, in particular, in [8,35,43,44,45,60,71]. The main difference in the realization of the technological schemes is caused by the different feedstocks.

In Figure 7, Figure 8 and Figure 9, the simplified technological schemes are shown. In ammonia production from natural gas, the hydrogen required for the synthesis is obtained via catalytic reforming of natural gas with water steam. In ammonia production from coke oven gas, the necessary nitrogen is produced by a low-temperature air separation process.

The synthesis of ammonia is carried out in a synthesis column which is a typical catalytic autothermal reactor. There are various types of synthesis columns, i.e., tubular reactors, multiple-shell reactors, and reactors of a combined type.

In this work, we consider the tubular reactor and the reactor of the combined type for ammonia production from the coke oven gas and from the natural gas, respectively.

The control of synthesis columns is determined by the essential physico-chemical properties and technological peculiarities of the process:

• The reaction of the ammonia production from nitrogen and hydrogen occurs with the volume decrease; this reaction is reversible and exothermic. As a consequence, both the equilibrium and optimal temperature will decrease with the conversion [86,90];
• The heat of the reaction is used for heating the input gas mixture;
• A part of the cold reactive mixture is supplied directly into the reaction zone of the column to control the temperature.

The temperature decrease in the reaction zone can be a result of different factors:

• The increase in the ratio between the flows of the cold and heated mixtures;
• The increase in the concentrations of ammonia and/or non-reacting gases at the column inlet;
• Decrease inpressure in the ammonia synthesis loop.

4.2.2. Critical Situations Caused by Breakdowns in the Technological Process during Control

Examples of such situations in the production of ammonia can be:

• Breakdowns in the composition of the nitrogen–hydrogen mixture;
• Loss of thermal stability of the ammonia synthesis reactor (the reaction extinguishing);
• Excessive increase in the pressure in the ammonia synthesis loop;
• Temperature fluctuations in the ammonia synthesis reactor, which lead to the occurrence of thermal stresses in the connecting elements of the apparatus and, as a result, to the decompression of the system. This can cause leaks, fires, and explosions of the gas mixture.

4.2.3. Accidents Caused by the Damage of the Technological Equipment

As an example of such an accident in the production of ammonia from natural gas, the burnout of the reactor tubes or the damage of the connection elements in the tubular methane reformer can be presented. This can lead to an explosion of the reaction mixture.

4.2.4. Differences in Control Strategies of the Ammonia Production in Normal Operating Mode and in Critical Situations

The phenomenon described above can be caused by a significant increase in temperature at the outlet of the methane reformer.

If this temperature rises dangerously, it must be reduced much faster than in normal operating mode, and a possible drop in the plant productivity should be neglected.

4.2.5. Different Strategies for Eliminating Critical Situations Caused by Technological Violations

In coke gas-based ammonia production, the main final control element for the temperature in the ammonia synthesis column is the cold bypass which includes the actuator and the valve of the supply of the gas mixture to the reaction zone without preheating. If the loss of thermal stability of the reactor is monitored, and the cold bypass is closed, the supply of liquid ammonia to the ammonia evaporator is often increased. As a result, the temperature of the mixture after the evaporator (secondary condensation temperature) decreases. Then, the degree of separation of the ammonia condensed increases. This leads to a decrease in the ammonia concentration at the column inlet accompanied by the following changes: a shift in the reaction equilibrium to the right, an increase in the heat generation, an increase in the reaction zone temperature, and, finally, the re-establishing of thermal equilibrium [35].

In a special case where the loss of stability is caused by the breakthrough of liquid ammonia into the reactor, it is not permissible to reduce the temperature of secondary condensation since it would exacerbate the development of a dangerous mode. In such a situation, other measures are used, such as opening the long bypass (diverting gas bypassing the column) for reducing the gas flow rate to the reactor and increasing the system pressure. It is essential to restore the operability of the evaporator by reducing the supply of liquid ammonia to this unit.

4.2.6. “Expensive” Control Actions

In the case of the reaction extinguishing when the cold bypass is closed and the level of liquid ammonia in the evaporator is at the upper limit, it is necessary to open the long bypass. Such a control action is associated with significantly higher costs of ammonia production compared with the control implemented by the cold bypass.

4.2.7. Essential Nonlinearity of Ammonia Synthesis Processes

When the input gas flow, pressure, and mixture composition change in the ammonia synthesis system, characteristics of the control and disturbance channels change as well in a rapid and significant manner. This complicates the prevention and elimination of critical situations [68].

In many cases, there is a significant non-linear change in the characteristics of the control object. As mentioned above, increasing the supply of liquid ammonia to the normally functioning ammonia evaporator leads to a decrease in the ammonia concentration at the reactor inlet and the temperature increase in the reaction zone. However, in the pre-emergency situation caused by the overfilling of the evaporator (Range 2 on the emergency scale), the boiling of liquid ammonia in the apparatus is stopped. As a result, increasing the supply of liquid ammonia does not lead to the following phenomena, i.e., a decrease in the temperature of secondary condensation, a decrease in the ammonia concentration at the reactor inlet, and a temperature increase within the reaction zone.

In the case of small temperature deviations, the ammonia synthesis reactor behaves in normal operation mode as an object with self-balancing (stable object). The control channel of the object can be approximately described by the first-order aperiodic link with variable coefficients and variable delay time [14,68]. After the loss of thermal stability, the reactor characteristics change dramatically. In this case, the control channel of the object must be approximated by the link without self-balancing, i.e., the unstable object [68].

4.2.8. Deficit of Control Actions in Critical Situations

In ammonia production from coke oven gas, the situation is possible when the reaction in the synthesis column starts to “die out”, the cold bypass valve is completely closed, and the level of liquid ammonia in the evaporator is at the upper limit. The situation becomes even more complicated if the long bypass cannot be opened due to the high pressure in the circulation system, as such a control action would lead to an additional pressure increase.

In ammonia production from natural gas, air is used as the nitrogen source for ammonia synthesis. The air flow rate not only affects the ratio of hydrogen to nitrogen but also the temperature of the gas mixture after the second stage of the methane converter.

In the case of a deviation from the hydrogen-to-nitrogen ratio with the dangerous rise of the hydrogen concentration, increasing the air supply for restoring the ratio is sometimes unacceptable. This occurs when the resources of the air compressor are at their limit or when the temperature after the second stage of the methane converter is too high. If the air supply is increased, converter destruction, fire and, finally, explosion can be the consequences.

4.2.9. Change in the Characteristics of the Synthesis Reactors over Time

Characteristics of the ammonia synthesis reactor can change in time. The reason for this is the loss of activity of the catalyst during the catalytic process which occurs as a result of “poisoning” by some substances, thermal deactivation, and mechanical destruction, etc.

As a consequence of chemical, thermal, and mechanical treatments, structural changes in the catalyst (sintering) occur, which result in an increase in the catalyst non-uniformity. The catalyst activity and its non-uniformity can be different in different sections of the apparatus. Due to the noted phenomena, the characteristics of the column change significantly during its operation, which complicates the modeling of this object and its control in real time.

When controlling the column, it is necessary to consider the upper and lower temperature limits in the reaction zone. Compliance with these limits is necessary to ensure the thermal stability of the reactor. Also, accounting for the upper limit aims at the prevention of the catalyst sintering. Changes in the object characteristics necessitate adjustments in the temperature limits in the reaction zone and the optimal temperature as well.

4.2.10. Increase in the Sensitivity of the Control Objects in Critical Situations

If a pre-emergency situation arises due to the loss of the thermal stability of the reactor, even a slight breakdown of the supply or composition of the input gas mixture can considerably accelerate the dangerous temperature drop, and the emergency shutdown of the column can occur.

4.2.11. Matrices of Critical Situations for Ammonia Production

Table 2. Matrix of critical situations for ammonia production (“yes”—1, “no”—0).

Number of CS	Critical Situations	Is the Difference in Object Characteristics?	Is the Difference in Control Strategies?	Is the Deficit of Control Actions Possible?
1	Breakdowns in the ratio between the supply of natural gas and air (the air compressor resources are at the limit)	0	1	1
2	Loss of the thermal stability of the ammonia synthesis reactor (the reaction extinguishing)	1	1	1
3	Overflow of ammonia evaporator (the level of liquid ammonia in the evaporator is at the upper limit)	1	1	0
4	Dangerous rise in the temperature at the outlet of the tube methane reformer	0	1	0
5	Temperature increase in the catalytic zone of the ammonia synthesis reactor above the permissible level	0	0	0

shows an example of matrices of critical situations (MCS) for several pre-emergency situations (Range 2 on the accident scale) that occur in ammonia production.

The MCS is compiled on the basis of characteristics of critical situations which are described by the vector of the characteristics of the situation (P.4.1). Thus, for the second situation V₂ = [1, 1, 1], and for the fifth situation V₅ = [0, 0, 0], respectively.

The MCS represents the visual generalized characteristics of critical situations. It is essential for preventing and eliminating dangerous breakdowns. The analysis of MCS allows the estimation and comparison of the elimination of various critical situations based on their complexity. Thus, in terms of elimination, it is obvious that Situation 5 is noticeably simpler than Situation 3 or Situation 2.

Development and analysis of the MCS creates a foundation for goal-oriented studies for designing control systems focused on the prevention of accidents.

4.2.12. Prevention and Elimination of Critical Situations in Ammonia Synthesis Reactors

As practical examples of the prevention and elimination of a CS, subsystems for the control of autothermal reactors can be considered. These subsystems are parts of the control system for ammonia synthesis units [14,35,36,38,68]. In this section, the prevention of the loss of thermal stability for ammonia synthesis reactors is treated in more detail. It is one of the key tasks for the subsystems. For the control of the thermal regime of reactors, the following tasks are solved:

I.

Optimal control of reactors in normal operating mode (Range 1 on the emergency scale) which consists of two basic sub-tasks, i.e., temperature stabilization in the catalytic reaction zones and determination of the optimal temperature in these zones;

II.

Diagnosis of reactors, i.e., recognition of the loss of the thermal stability of the reactors (Ranges 1–3 on the emergency scale);

III.

Elimination of critical situations which have arisen via the transition of the control object from the unstable current state (Ranges 2–3) to the stable one (Range 1).

Task I is integrated into a set of tasks for the control of the synthesis units in the mode of normal operating. Tasks II and III are integrated into the set of tasks for the diagnosis of technological process, recognition, prevention, and elimination of critical situations for synthesis units. All tasks are realized using the program modules which are implemented into the control system.

While solving Tasks I–III, the prevention of pre-emergency situations is ensured by the realization of the procedures shown in Figure 10.

The logico-technological checks of the process variables in Task I consist of verifying the reliability of information on the technological variables. In this case, constraints are used on possible values of the variables and the rate of their change as well as models. Also, possible relationships between the variables are used [35,39].

When solving Task I, control actions produced by the system are computed considering the principle of the guaranteed result. In this case, the last one consists of the admissibility of the realization of all of the control vector components and any combinations of these components. The object state and the computed control actions are checked at each control step before and after the realization. The autonomous control of autothermal synthesis reactors is also ensured. It additionally increases the control reliability.

For increasing the operation speed of the system and stability of the technological process, the compensation of measured disturbances is realized. For the purpose of the timely detection of critical situations, the values of key variables are predicted and analyzed. While computing the control actions, aperiodic transient processes must be ensured for preventing thermal stresses in the connecting elements of the units.

The system ensures a high adaptation speed of control models. For this purpose, real-time dynamic models have been developed in which parameters are expressed as functions of the input variables [14].

When diagnosing the reactors (Task II), the technological constraints on the temperature in the reaction zone and the prognostic temperature are considered, and the rate of the temperature change as well as the limits of these values. The constraints on the rate and the prognostic temperature are calculated as functions of the input variables.

The detection of critical situations is implemented using artificial intelligence methods, including image and pattern recognition techniques [35,40,81]. During the diagnosis process, the causes that led to the dangerous temperature changes are also identified.

Based on the solution of Task II, Task III is solved, the decision for elimination of a critical situations is made, and an algorithm for eliminating the situation is selected. In case of uncertainty in certain parameters of the system, simplified algorithms are used.

The system also accounts for the possibility of the simultaneous occurrence of multiple critical situations, i.e., complex critical situations (CCS). In this case, a control strategy is implemented in which the elimination of one critical situation does not render the elimination of another critical situation impossible.

The following control actions are used in the elimination of critical situations:

-

Supplying the cooling bypass flows regulated by the cold bypass valves (W_c,ij);

-

Changing the temperature of secondary condensation regulated by the valves (W_a,i) which supply the liquid ammonia to the ammonia evaporators;

-

Using the long bypasses regulated by the valves (W_l,i) which divert the gas bypassing the column.

In the production of ammonia from natural gas, purge gas valves (W_p,i) are also used. In the production of ammonia from coke gas, purge gas valves are rarely used due to the high purity of the incoming nitrogen–hydrogen mixture (NHM).

A dangerous decrease in the temperature at the i-th reactor is eliminated primarily by the valve W_c,ij. If this does not lead to the required results, then the temperature t_2k,i is decreased using the valve W_a,i, if it is possible. Otherwise, control actions for opening the long bypass (valve W_l,i) or the purge gas valve W_p,i are produced.

In relation to the process under consideration, our approach of eliminating the critical situations is the following one.

The more accurate the technical diagnosis performed and the greater the opportunities to select the most suitable control actions, the more effective the elimination of the hazardous situation, and the lower the costs of the elimination. In parallel with the elimination of critical situations, the causes of their occurrence (breakdown in the composition of the input NHM, operator errors, etc.) are removed if it is possible.

In the case of the prevention and elimination of critical situations due to breakdowns in NHM composition, additional software tools are included into the synthesis control system. These tools were developed considering the dominant dead time in the control channel for the composition of NHM [35,36,43,44,45].

Specialized controllers have been developed to stabilize the temperature in the reaction zones, ensuring stability and high operating speed even when the object characteristics change in a wide range. One of the nonlinear controllers for temperature control in the reactors is described in [14]. This controller realizes the strategies used by experienced operators to control the column temperature in the normal operating mode and in critical situations as well. It is termed as the best operator strategy. In [68], the developed controller with a variable structure is presented. With the appropriate modification, it can also be used to solve the discussed problem.

Thus, due to the rapid adaptation of the models and the use of specialized controllers, the system’s operability is ensured with a quick change in the object characteristics in a wide range.

When eliminating critical situations in the case of a deficit of control actions, the principle of selective control is used. For example, the concentration of inert gases, the ratio between nitrogen and hydrogen in the NHM, the pressure in the ammonia synthesis loop, and the temperature in the ammonia synthesis reactor are adjusted using the valve W_p,i, [36].

Automatic diagnosis of the state of the final control elements is also performed.

In any situation, devices of higher and lower priority are distinguished. If the device of higher priority fails, a lower-priority control element is used.

It should be stressed that the program tasks for the recognition, prevention, and elimination of critical situations are initiated in the control system much more frequently than the tasks offinding the optimal temperature in the catalytic reaction zones.

The considered Tasks I, II, and III can be operated autonomously. In the separate realization of Tasks II and III, the additional execution of Procedure 1 from Task I (Figure 10) is organized in them.

As mentioned in the introduction, there are many methods for preventing accidents, and these methods can be categorized in different ways. Within our paper, our approach, which can be termed as the “Rational Control Methodology (RCM)”, is compared with some other methods for preventing accidents via control known from the literature. This is collated in

Table 3. Comparison of accident prevention approaches via control.

Modes of Control	Compared Characteristics
	Reaction Time in Recognition of Complex Critical Situations (CCS)	Reaction Time in Elimination of CCS	Probability of Errors in Recognition of CCS	Probability of Errors in Decision Making for Elimination of CCS	Probability of Errors in Control Actions	Optimal Elimination of CCS
Manual control	long	long	relatively large	relatively large	relatively large	impossible
Manual control with automated diagnosis	short	long	very small	relatively large	relatively large	impossible
Rational Control Methodology (RCM)	short	very short	very small	very small	very small	possible

which includes some compared characteristics based on the chosen concepts and corresponding key terms, i.e., reaction time in recognition of complex critical situations (CCS) and their elimination, respectively; the probability of errors in the recognition of CCS, in decision-making for their elimination, and in control actions, respectively; and the possibility of optimal CCS elimination. Optimal CCS elimination is considered to be an elimination which corresponds to the chosen optimal control law.

5. Discussion

Accident prevention in the industry is carried out through the application of complementary methods and approaches, including various technical and organizational measures, training, and personnel drills. Our solutions complement existing ones.

The area of our work is interdisciplinary. Currently, such concepts as accidents, emergencies, malfunctions, and breakdowns are used differently in different organizations and countries. This is why a lot of attention was paid to definitions. In some cases, emergency situations and accidents are defined identically. In Germany, there are the concepts of Störfall, Notfall, Notfallsituation, which are defined in a different way. For the forced shutdown, it is debated whether it is an accident or not.

According to the meaning of our article, we tried to present its concepts for a wide audience as simply and accessibly as possible.

Accident prevention is a complex scientific and technical problem with a practical orientation. In many cases, the proper prevention of accidents also provides possibilities for increasing the efficiency of the chemico-technological processes in the normal operation mode.

It must be stressed that most industrial chemico-technological processes belong to the class of potentially highly hazardous processes. The modern chemical plant is a complex non-linear control object with uncertainty.

The aim of our article was writing the review on accident prevention combined with our original results. There are the typical difficulties of chemical-technological control objects that should be considered when preventing and eliminating the technological breakdowns. The focus of the article was on the development of the “Rational Control Methodology” for solving the problem considered.

In recent years and decades, enormous strides have been made in the development of computing technology. But, despite this, accidents often occur at the leading chemical companies worldwide.

Our paper is not about hardware or system-wide software. Primarily, it is about specialized solutions in the field of chemical engineering; automatic control, the theory of decision-making under conditions of uncertainty, etc.

Within our methodology (RCM), the prevention of accidents can be solved by implementing the particular complementary practice-oriented tasks.

Both classical and contemporary methods of control, pattern recognition and decision-making are used. In addition to unified problems, it is also necessary to solve problems specific to each chemico-technological control object. The choice of method is determined by the characteristics of the object and the problem formulation. Often, when solving a specific problem, existing methods are modified and/or new methods and approaches are developed.

The main prerequisites for implementing the proposed methodology include the ability to access the required technological parameters (pressure, temperature, chemical compositions, etc.) measured in real time.

When preventing accidents, the following tasks are topical:

• Design of dynamic mathematical models focused on practical applications;
• Tasks of the control of systems with uncertainty;
• Tasks related to the implementation of artificial intelligence.

6. Conclusions

The paper introduces the concept of critical situations as a combination of emergency and pre-emergency situations arising during the operation of chemico-technological objects. Examples of accidents and corresponding losses in the leading chemical plants of Europe, America, and Asia are described.

The methodology of the recognition of critical situations is presented.

It is shown that in the general case, the normal modes of the technological process for the operator and for the computer are different.

Based on the assessment of various states of the chemico-technological object (emergency degree), the emergency scale is developed.

The comparative characteristics of losses corresponding to different emergency degrees are given, and the schematic diagram for preventing accidents is constructed.

The practical control difficulties in preventing accidents are distinguished. It was shown that in the general case, the control means for the normal operating mode do not provide the efficient prevention and elimination of critical situations, and the reasons for this were found.

It was demonstrated that sometimes in critical situations, inevitable losses must be accepted in order to prevent much bigger losses due to an accident.

Matrices of critical situations are presented, visualizing the generalized characteristics of both critical situations and their combinations. These matrices can be used for the prevention and elimination of technological breakdowns.

Three main tasks are highlighted and characterized, aiming at the prevention of accidents via the control of complex chemico-technological objects: (1) prevention of pre-emergency situations while solving control tasks in the normal operating mode; (2) recognition of critical situations in the technological process; (3) elimination of critical situations.

Examples are given from the practice of the control of typical potentially hazardous processes, i.e., industrial ammonia production processes. Subsystems were considered for the control of typical autothermal reactors, which are parts of the control system for ammonia synthesis units.

Within the three main tasks of the automated control of reactors, the complementary measures aimed at preventing and eliminating the critical situations are described. The recognition and elimination of critical situations in the system is fulfilled considering the specific physico-chemical properties and technological peculiarities of the process.

The high operability of the control system with the fast change in the object characteristics in a wide range is ensured by quick adaptation of the special dynamic models and corresponding nonlinear controllers.

The real-time realization of the tasks for the prevention and elimination of critical situations significantly increases the economic and ecological efficiency of the chemico-technological system. The results of the work can be used for both goal-oriented investigation of objects of the chemical process industry and developing the means for the prevention of accidents via control.

7. Future Directions

Currently, we are working on new mathematical models and systems for the prevention and elimination of critical situations, as well as on generalizing the principles and strategies for preventing accidents in the control of complex technological objects. It appears that among the methods of preventing accidents, two categories should be distinguished, i.e., common-sense methods and non-trivial methods in which physico-chemical understanding needs to be developed. This is a subject of our special interest.