Chemical Engineering Science 142 (2016) 6278

Contents lists available at ScienceDirect

Chemical Engineering Science

journal homepage: www.elsevier.com/locate/ces

Dynamic quantitative operational risk assessment

of chemical processes
Hangzhou Wang, Faisal Khan n, Salim Ahmed, Syed Imtiaz
Safety and Risk Engineering Group, Faculty of Engineering and Applied Science, Memorial University, St. Johns, NL A1B 3X5, Canada

H I G H L I G H T S

Probability of event occurrence is estimated by monitoring multiple key variables.

Probability is continuously updated considering real-time disturbances in variables.

Consequences are estimated by dynamic loss functions with multivariate.

Operational performance is dynamically assessed by quantitative risk value.

art ic l e i nf o a b s t r a c t

Article history: This paper presents a novel dynamic quantitative risk assessment method to analyze the operational
Received 5 March 2015 performance of chemical processes. Unlike traditional methods, the proposed method estimates the
Received in revised form probability of undesirable event occurrence by monitoring multiple key variables in the process. This
27 October 2015
probability is continuously updated considering real-time disturbances in the variables. The con-
Accepted 23 November 2015
Available online 11 December 2015
sequences are estimated using dynamic loss functions developed considering multiple key state vari-
ables. As a result, the process' operational performance is assessed dynamically in the form of quanti-
Keywords: tative risk (dollar) value. The quantitative dynamic risk value helps to make swift operational decisions to
Dynamical risk assessment maintain the process within the safer operating limits, thus preventing untoward incidents/accidents. To
Dynamical loss functions
demonstrate the efcacy of the proposed methodology, it is tested on two case studies, a simple tank
Probability updating
system and the benchmark Tennessee Eastman process.
Multiple variables monitor
Operational performance & 2015 Elsevier Ltd. All rights reserved.

1. Introduction
An important shortcoming of the traditional process safety
management (PSM) system is its isolation and lack of integration
with the rest of the process operation (Garca Herrero et al., 2002).
Process industries rely heavily on failure data to monitor perfor-
mance. As a result, required improvements or changes are only
identied after an incident has occurred (Khan et al., 2010). The
United States Center for Chemical Process Safety (CCPS) suggests
that: Facilities should monitor the real-time performance of
management system activities rather than wait for accidents to
happen. Such performance monitoring allows problems to be
identied and corrective actions to be taken before a serious
incident occurs (CCPS, 2007).
To monitor process safety performance in a timely way, process
safety performance indicators are used to monitor and improve
n
Corresponding author.
E-mail address: khan@mun.ca (F. Khan).
the safety of process plants. One of the most important and
challenging issues for process safety is the early recognition of
deterioration in safety performance caused by operation, main-
tenance, management, organization and safety culture factors
before actual events and/or mishaps occur (Khan et al., 2010).
This paper focuses on dynamic quantitative risk assessment
and its integration with operational performance analysis, to
assess the safety and quality of the process facility.
In order to achieve the highest levels of safety and quality, with
the ultimate goal of fostering a zero-incident and zero-defect
culture, the aim should be to eliminate the main sources of the
losses, i.e. process deviations. For process facilities the causes of
deviations may include process disturbances, feed variability,
mechanical and operational integrity degradation, human errors,
wrong setting and improper methods (Hashemi et al., 2014b). To
analyze the impact of process deviations on safety, Hashemi et al.
(Hashemi et al., 2014a) proposed the application of loss functions
to safety analysis and compared their properties. The method was
further extended by integrating both safety and quality losses
associated with process deviations (Hashemi et al., 2014b).

http://dx.doi.org/10.1016/j.ces.2015.11.034
0009-2509/& 2015 Elsevier Ltd. All rights reserved.
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278
The deviations are frequently caused by disturbances or mea-
surement noises. In this paper we propose a dynamic quantitative
risk assessment method, in which the probability of loss is upda-
ted over time using the measurements of multiple key variables.
At the same time, multivariate key state variables from different
units in the process are monitored to estimate the potential con-
sequences in terms of loss (dollar value). Using probability and
estimated loss, risk is assessed dynamically. The developed risk
assessment method is used as a leading indicator of real time
process performance, so that it can support real time operational
decision-making.
This paper proceeds as follows. The existing methods for risk-
based operational performance analysis are reviewed in Section 2.
The proposed methodology is described in Section 3 followed by
two case studies in Section 4. Finally, the discussions and con-
clusions are presented.
2. An overview of quantitative risk assessment
2.1. Probability assessment and updating
Combining loss models with the probabilities of process
deviations provides a framework to develop a dynamic quantita-
tive risk-based approach to access process performance assess-
ment. As risk includes both the probability of an end process state
and its consequences, a risk-based approach reduces the potential
for assigning an undue amount of resources to manage lower-risk
events, thereby freeing up resources for tasks that address higher-
risk events (CCPS, 2007; Khan et al., 2001).
Abnormal events of varying magnitudes result in incipient
faults, near-misses, incidents, and accidents in chemical plants.
Their detection and diagnosis have been active areas of research
(Venkatasubramanian et al., 2003a, 2003b, 2003c). However,
estimation of the failure probabilities of safety systems to predict
these consequences (end-states), has received little attention in
the chemical process industries (Meel and Seider, 2006). Quanti-
tative risk assessment (QRA) is used as an approach to access and
manage safety of the process system. However, the conventional
QRA methods are unable to update risk on a dynamic basis.
Kalantarnia et al. (Kalantarnia et al., 2009) developed methods
that use Bayesian theory to update the likelihood of event occur-
rence. Using the available accident precursor data, safety system
failure likelihood and the event tree, the end-state probabilities
were revised dynamically in these techniques. As reviewed by
Meel et al. (Meel and Seider, 2008) and Kalantarnia et al. (Kalan-
tarnia et al., 2009), there have been efforts to make risk assess-
ment methods dynamically adaptable with real-time changes
occurring in a process. Kalantarnia et al. (Kalantarnia et al., 2010)
modeled the BP Texas City renery accident using the Bayesian
failure updating mechanism with consequence assessment.
Khakzad et al. (Khakzad et al., 2012) developed a risk analysis
method to update the probability of both causes and consequences
in a dynamic environment; failure probabilities of primary events
and safety barriers were constantly revised over time, and an
updated bowtie was used to estimate the posterior probabilities
of the consequences which in turn results in an updated risk
prole. Pariyani et al. (Pariyani et al., 2012a, 2012b) proposed a
dynamic risk analysis methodology that uses alarm databases to
improve process safety and product quality. The methodology
consists of tracking abnormal events over an extended period of
time. The event-tree and the set-theoretic formulations were used
to compact the abnormal-event data, and Bayesian analyses were
used to calculate the likelihood of the occurrence of incidents.
Millions of abnormal events data were compacted to efciently
calculate probability with large alarm databases in real time.
63
Zadakbar et al. (Zadakbar et al., 2012) proposed a methodology to
calculate process risk in combination with a data based fault
detection method; the approach is built upon principal component
analysis (PCA) combined with a quantitative operational risk
assessment model. They later proposed (Zadakbar et al., 2013) the
methodology in which the Kalman lter has been combined with a
risk assessment procedure to detect an abnormal event. Yu et al.
(Yu et al., 2014) developed a self-organizing map based metho-
dology that can deal with abnormal events in processes with
nonlinear and non-Gaussian features.
Most of the above methods may be considered dynamic in
estimating the probabilities of potential events; however, there are
two issues that need to be addressed. (1) It is assumed that a
univariate key process characteristic can be assigned to a system;
(2) the probabilities are calculated mainly based on deviations of
monitored state variable values or data of previously occurring
abnormal events. In practice, typically there is more than one key
variable associated with an abnormal end state. Regarding the
second problem, the probability calculation based on measured
data considers a single target state of the key variable. However,
there may be multiple steady states (Wang et al., 2010a, 2010b,
2010c). Due to strong nonlinear characteristics in chemical pro-
cesses measurement with disturbances there might be unstable
conditions, bifurcations (Wang et al., 2008, 2012a, 2012b, 2011),
even oscillatory phenomena (Wang et al., 2013, 2014b) near the
singularity operating point (Wang et al., 2009, 2014a, 2012c) in
processes.
In this paper, the probability and consequences are estimated
considering multiple key variables. At the same time, the dis-
turbances of manipulated variables are monitored dynamically to
update the loss occurrence and its probability. The effects of pro-
cess deviations on both losses and the probability of occurrence
are considered to estimate the dynamic quantitative risk assess-
ment (DQRA) for process performance analysis.
2.2. Consequence assessment
Quality management and the safety management system are
related; they are two sides of the same coin (Krause, 1993).
Deviations are unavoidable during process operations. The pro-
pagation of these deviations may result in lower quality as well as
losses. In a processing facility, the ability to manage process safety,
and at the same time to maintain product quality is the main
concern for its daily operation.
The benets of integrating safety and quality management
systems have been discussed in the literature (Dumas, 1987; Gar-
ca Herrero et al., 2002). While quality management methods aim
to minimize the variability inherent in product quality, safety
management procedures aim to minimize the chances of occur-
rence of incidents and accidents and their severity (Adams, 1995;
Krause, 1993).
One of the most common methods to integrate safety and
quality is to quantify the two elements. Loss functions are com-
monly used to quantify losses associated with deviations of pro-
cess variables. Traditionally, losses are quantied either as squared
error loss functions or weighted loss functions. Recent develop-
ments consider the use of inverted probability distribution for
quantify losses.
Spiring (Spiring, 1993) used an inverted normal probability
density loss function (INLF) to provide a more reasonable assess-
ment of losses. Sun et al. (Sun et al., 1996) developed a modied
INLF that provided a more moderate loss representation, and
provided a method for tting the modied INLF to reect the
users actual loss. The result was a nonlinear least squares method
for estimating the shape parameter of their modied INLF. And
later, Leung et al. (Leung and Spiring, 2002, 2004) continued to
64 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

develop the inverted Beta loss function (IBLF) and compared it to
other types of loss functions. Hashemi et al. (Hashemi et al., 2014a)
reviewed several different types of loss functions, and found the
modied inverted normal loss function (MINLF) and the inverted
Beta loss function (IBLF) were more adaptable to depict system
safety losses associated with process variations. Most of these
proposed loss functions are focused on a single variable system. In
chemical processes, it is hard to describe any unit with a single
variable; typically there are multiple variables associated with
safety and quality losses.

Chemical process

Identify the key state

variables of system

Construct the loss

function for system

Measure all state values in

real time

Predict the remaining

times for key variables

Select the minimum

remaining time scenario

Calculate the probability

of the scenario

Trigger safety protection Calculate the loss of the

mechanism scenario

Risk acceptable Calculate the risk

Safety protection
N mechanism triggered Turn off the safety
protection mechanism

Risk acceptable Y

Activate emergency
shutdown system

Stop

Fig. 1. Dynamic quantitative risk assessment method.

 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278
In this paper, multivariate loss functions are used to estimate
operational losses in complex chemical processes. The potential
consequences are scenario dependent, and these results are used
to quantify dynamic risk.
3. The proposed methodology
Risk is assessed by combining the probability that the loss
would happen and the potential loss due to an abnormal condi-
tion. The proposed methodology is shown in Fig. 1.
3.1. Probability assessment and updating
We propose a model to monitor multiple variables at the same
time as the loss occurrence probabilities are updated.
3.1.1. Multivariate monitoring
Usually in chemical processes, when only one key variable is
selected to calculate the probability, this variable is expected to be
the most sensitive one in the system. Being most sensitive, it
triggers an alarm earlier compares to other variables when the
system encounters a disturbance. This simplication leads to two
disadvantages: (1) when the selected variable is designed to
operate in a very narrow range, there would be a ooding of
alarms; (2) one variable alone may not be able to capture infor-
mation about all disturbances and deviations. As a result, mon-
itoring multiple variables is required to capture the real situation
of a process and to take desired actions.
An incident/accident can take place when a variable exceeds it
upper or lower boundary. Fig. 2 presents a set of monitored vari-
ables with their set points and upper and lower boundaries.
Usually, the actual values are located between the lower boundary
and upper boundary. At every moment, the variables can be
located in this gure. Also we can predict the state of these key
variables in the process system, and the predicted states can also
be located in this gure.
To monitor multiple variables, we introduce the concept of
remaining time. Remaining time is the time that one variable
requires to reach the upper or lower boundary. The remaining
time reects the safety margin. If the remaining time is larger,
there would be more time to respond to an abnormal event
situation. As a result, the remaining time can represent the
safety level.
For every important variable with boundaries, we calculate the
remaining time. Among these remaining times of all key variables,
the minimum remaining time can be used as the systems
1
12 2
11 3
LowerBoundary
SetPointValue
10 4
UpperBoundary
ActualValue
9 5
8 6
7 cess, different types of units are monitored. Different inverted
Fig. 2. Schematic of multiple variables monitor; there are 12 example key variables
being monitored.
65
remaining time. For a strongly dependent system, one unit failure
can stop the entire plant.
In Fig. 3, the abscissa is the calculated remaining time. The
ordinate is the rate of progression of the disturbance for the
variable. The remaining time is an estimated result based on
values in current scenario. The remaining time is calculated on line
and is a function of time. The probability is calculated using the
remaining time. The boundary curve is the upper/lower threshold,
if the estimated remaining time is on the left side of the boundary
that means the deviation is too large to take desired action to
eliminate the danger and bring the system to normal. It may mean
that an accident is unavoidable. When the point is on the right of
the boundary curve and the left of the critical curve, it indicates
that a desired emergency safety action is required to bring the
system back to normal. When the result is on the right side of the
critical curve, it means the disturbance or the deviation is accep-
table because the control system and/or operator intervention can
bring the system to normal. The t is an extra time for operator to
take action to bring the system to normal. The value is estimated.
A larger t will give more action time, t is preferred to be a
larger value.
In a complex process, we could calculate the remaining time for
every selected key variable in real time.
3.1.2. Probability assessment and updating
As stated above, the potential of accident occurrence is mea-
sured in terms of remaining time, which can be used to formulate
the probability functions to describe the accident occurrence.
Among probability distribution functions, the exponential dis-
tribution best describes the time between events; it represents a
process in which events occur continuously and independently at
a constant rate. It is the continuous analog of the geometric dis-
tribution, and it has the key property of being memoryless.
Because of these features of exponential distribution, it is selected
to formulate the function of accident occurrence probability.
The probability density function of remaining time t is descri-
bed in Eq. (1) as follows:
(
e  t t Z 0
Pt; 1
0 t o0
In this formulation, t is the minimum remaining time of all
monitored key variables of the process. is the reciprocal of
expected value, describing minimum remaining time allowed in a
process.
When remaining time t tr, the probability of accident occur-
rence probability is shown in Eq. (2).
Z1
Pt Z t r ; e  t dt e  tr 2
tr
The formulation of occurrence probability reect the char-
acteristic of the process and at the same time it would not exceed
1. In this way, the probability could be updated with the calculated
remaining time dynamically.
3.2. Consequence assessment
In this section, we introduce the loss functions to estimate the
consequence of the process in an end process scenario. In a pro-
probability distribution functions are used to estimate the poten-
tial losses.
66 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

Disturbance rate, %
Boundary Critical
Curve Curve

Dmax
t
8
25
24 7
22 6
5 4
19 7 3
6
15
8
5 2
10 4 1

3
5 2

2 t 1
0
O tC t6t5 t4 t3 t2 t1 t0
Time, s

Fig. 3. Schematic of remaining time of a certain variable under disturbances, the black points describe the schematic of remaining time variations under acceptable
disturbances, and the gray points describe the situation under in the end unacceptable disturbances.

10 0 1
Inverted Normal Loss Function y1 T1
B C B T2 C X
B y2 C B C
is small
YB C
B C; T B C; ij nn
is medium @ A @A
is large yn Tn
Estimated Max. Loss2
In this formulation, yi, i 1,2n, denotes the ith quality char-
acteristic, L(Y) is the actual loss at Y, Ti, i1,2n, is the ith target
Estimated Max. Loss1
value, EML is the estimated maximum loss, is the distance from
the target to the point where the maximum loss EML rst occurs,
P
and is the vector of the shape parameter.
Particularly, the bivariate inverted normal loss function is for-
mulated as below. This can be applied in a reactor unit for tightly
coupled temperature and pressure in reaction, as shown in Eq. (5).
0  1
y1  T 1 2 y1  T 1 y2  T 2 y2  T 2 2
 1
 2 U U
1 B 21  2 2 1 2 2 C
0
Max. Negative Deviation TargetValue Max. Positive Deviation LY EML 2
@1  e 1 2
A
Deviations from TargetValue 1e 2

Fig. 4. Inverted normal loss functions. 5

here, , 1 , 2 are the shape parameters. A typical bivariate
3.2.1. The modied inverted normal loss function INLF is shown in Fig. 5.
The univariate modied inverted normal loss function (MINLF)
is formulated in Eq. (3) below. 3.2.2. The inverted Beta loss function
 2
 Based on the Beta probability distribution function, the inver-
1  y  2T
Ly EML 2
1e 2 3 ted Beta loss function is described in Eq. (6).
  
1  e 2 2  
1T 1
 
1T 1
Ly EML 1  T 1  T T y1  y T 6
here, y denotes the process variable, L(y) is the actual loss at y, T
is the target value, EML is the estimated maximum loss, is the In the formulation of IBLF, y denotes the quality characteristic,
distance from the target to the point where the maximum loss L(y) is the actual loss at y, T is the target value, EML is the esti-
EML rst occurs, and is the shape parameter that needs to be mated maximum loss, and are shape parameters and need to
determined from additional process historical information. Fig. 4 be determined from additional process historical information for
shows a typical MINLF. IBLF. The in IBLF is represented by and T; the relationship
In certain situations, there are multiple variables in one unit, between them is described in Eq. (7) below.
and the multivariate loss function is to be used. The n-dimension,  11  T
1 7
modied inverted normal loss function, is described in Eq. (4) as T
below. Fig. 6 shows the loss trajectories for different and values.
 P1  The inverted Beta loss function can be applied to the asymmetrical
1 0
1  e  2YT YT
1
LY EML 2
4 situation where the rate of loss during positive deviations is dif-
 2
1 e ferent from that during negative deviations.
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278 67

Bivariate Inverted Normal Loss Function

MD2 EML4

0.5MD2

Estimated Max. Loss4

TV2
EML3

Estimated Max. Loss3 -0.5MD2

-MD2
-MD1 -0.5MD1 TV1 0.5MD1 MD1
Estimated Max. Loss2
EML2

Estimated Max. Loss1 EML4

EML3
0
Max.Deviation2 EML1
EML2
0.5Max.Deviation2 Max.Deviation1
0.5Max.Deviation1 EML1
TargetValue2
TargetValue1
-0.5Max.Deviation2
-0.5Max.Deviation1
0 0
Deviations from TargetValue2 -Max.Deviation2 -Max.Deviation1 -MD1 -0.5MD1 TV1 0.5MD1 MD1
Deviations from TargetValue1

Fig. 5. Bivariate inverted normal loss functions.

Inverted Beta Loss Function variable, and Lj;k xj;k t  represents the loss of a unit with k
monitored variables.
=10, =4
= 7, =3
= 4, =2
4. Case studies
Estimated Max. Loss
4.1. Tank system case study

This is a simple process to show the proposed concept. The loss

can be estimated by loss functions and the probability would be
calculated by function with the remaining time.

4.1.1. Flowchart of tank system

0
Max. Negative Deviation TargetValue
Deviations from TargetValue
Fig. 6. Inverted Beta loss functions.
3.2.3. The aggregated loss for a scenario
Using the loss functions, total loss of a scenario can be esti-
mated. The losses are estimated continuously, with every state of
deviation from the target value. The aggregated loss is the sum of
all unit losses. In a process operation there are two types of unit
loss: i) unit loss described by a single variable; ii) unit loss
described by multiple variables. In rst type of loss calculation,
single variable deviation from target is used to estimate the loss. In
second type of the loss calculation, integration of maximum of
different variables loss is used to estimate the loss.
After estimating every unit loss, the aggregated loss for a sce-
nario can be calculated.
In a given process system, the key variables are denoted as Xt,
m of these variables individually describe a unit, and the others are
described as the n units left.
The loss function of system will be formulated as Eq. (8):
X
m X
n
LXt  Li xi t  Max Lj;k xj;k t 
i1 j1
k A jtotal
In this formulation, t  denotes a certain moment during process
operation, Xt  denotes all the variable values at that moment.
Li xi t  represents the loss of a unit with only one monitored
The owchart of this process is shown in Fig. 7. In this process,
the tank is fed in through the inlet ow, and the feed out pipeline
Max. Positive Deviation is controlled by an automatic controller, which measures the level
and adjusts the valve to change the outow rate so that the level of
the tank can be maintained at a set value. Usually for a typical
process, when the inlet ow rate is in a reasonable range, the
process would work properly as designed.
However, to ensure safety, more factors have to be considered,
and more critical situations have to be considered to guarantee
safety, lower system risk and prevent device damage. To design a
more safe process, a bypass pipeline is introduced; also a risk
controller is implemented to assess risk and manage the risk. The
safety layers of this process are shown in Fig. 8.
In a normal situation, only the outlet pipeline controller plays a
role to maintain the level of the tank. The risk controller measures
all state values and calculates the potential risk of the system. If
the risk increases to a certain level, the safety layer utility would
be triggered to lower the risk. In this system, the rst triggered
mechanism is the bypass pipeline valve. When the level of the
tank keeps increasing, even if the outlet ow rate reaches its
maximum value, the bypass would be turned on to reduce the
inlet ow rate. Usually this will work to successfully decrease the
feed volume into the tank so that the level can be maintained at
the set value. After a while, when the risk decreased to a certain
8
level, the bypass would be turned off. The system is controlled by
the outlet controller. Due to the nite volume of the buffer tank
this buffer can only function during a limited time. If the inlet ow
rate increases rapidly, even if the bypass pipeline cannot prevent
the increase of level, in this situation, the risk controller would
68 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

Risk Management
System

Original Feed In Feed In

Fio K ES Fi
bypass
Height Level
LC

H
KSL

A
Tank Feed Out
K Fo
Fig. 7. Flowchart of tank system.

Emergency shutdown system

Bypass system

Control system

Tank system

Charges

Investment Maintenance EML1 EML2

Fig. 8. Tank system with safety layer barriers.

capture these features, and calculate the risk of overow. If the Ht 0 H 0

risks continue to increase, the risk controller calculates the risk in
real time, and when the risk increases to a certain value, the nal In this tank, the level of the tank is the key variable of the
emergency shutdown system will be activated. The inlet pipe line process; it is monitored by the risk management system, and the
valve would be turned off so that there would be no volume of inlet ow rate is the manipulated variable, which is measured
feed at all. The system would shut down before the system actually constantly, and the value is used to predict the remaining time.
faces the danger. The normal operation values are listed in Table 1. In this pro-
cess, the maximum bypass rate is 50% of the total original inow
4.1.2. Model of tank system feed, the maximum outlet ow rate Fo is set to 0.1 m3/s, the
In this tank, the level of the tank can be described by the maximum original inlet ow rate is 0.2 m3/s, and we assume
dynamic system model in Eq. (9): disturbance is D; it is a percent, from 1% to 50%. In this tank the
controller gain of K is 0.1 m2/s; this controller adjusts the owrate
dH 1 of feed out.
F  F o
dt A i The loss function of the tank process is as follows. We use the
modied inverted normal loss function. In the process the over-
F o t 1 F o t KH  H set 9 ow is the accident, so the right half space (level height above the
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278 69

Table 1 20
Parameters in the tank model.
18
Parameter Value Unit
16
A 10.0 m2
H 1.0 m 14

Estimated loss, ($)

Hset 0.5 m
D 0  50 % 12
Fio 0.05 (1 D) m3/s
Fi 0  Fio m3/s 10
Fo 0  0.1 m3/s
8

6
Loss Function
1000
4
900
2
800
0
700 0 20 40 60 80 100
Estimated losses, ($)

Time, (s)
600
Fig. 10. Estimated loss change with time.

500

400
0.2
300
0.18
200
0.16
100
0.14
0
0 0.2 0.4 0.6 0.8 1 0.12
Probability

Level height of tank, (m)

0.1
Fig. 9. Potential loss of tank process in operation.
0.08
set value) is considered. The loss function is shown in Eq. (10).
0.06
8  2

>
> 1

 h  0:5
; by pass pipeline not open
>
> EML by pass 1 e 2 2
0.04
< 
2

1  e 2 2
Lh  
>
>  h  0:5
2 0.02
> 1
1  e 2 2 ; by pass pipeline open
: EMLemergency
> 2 
1e 2 2 0
0 20 40 60 80 100
10 Time, (s)

As we have analyzed, there are two situations, when the bypass
is turned on and the emergency system activated. In these two
situations, the maximum estimated losses (EML) were judged here
as EMLby pass $1000 and EMLemergency $10,000, respectively. The
shape parameter 1.4, the distance 0.3 m. When bypass
pipeline is not open, the curve of loss function is showed in Fig. 9.
When bypass pipeline is open, the curve of loss function is similar
except the EML increased to $10,000.
The probability density function is a function of remaining
time; the detail is shown in Eq. (11):
( With the dened risk function, we could update the probability
0:01e  0:01t t Z 0
Pt 11
0 t o0
here we assume the expected remaining time is 100 s, as a
result, the value of is 0.01 s  1. The estimated loss of the tank
process is shown in Fig. 9.
4.1.3. Scenario 1: normal operation
The normal operation values are listed in Table 1; we can see
here the disturbance is assumed to be 0  50% of the inlet ow
rate. When given the value Fio 0.05 m3/s, with disturbance, the
maximum actual feedstock of inlet is 0.075 m3/s, which is smaller
than the maximum outlet ow rate (Fo 0.1 m3/s), and this means
the controller will handle all disturbances without triggering the
Fig. 11. Probability of overow changes with time.
bypass pipeline. The outlet ow rate started at 0.05 m3/s; after
that the outlet ow rate value is determined by the controller.
In a normal operating situation, the disturbances varied all the
time. When the disturbance is simulated randomly for 0  50%, the
estimated loss is estimated by the value of the height level in the
tank process, and it changes with time.
When the current value of tank level height is lower than the
set point, the estimated loss is zero in Fig. 10.
of occurrence in real time. The calculated results are shown in
Fig. 11 below.
Together with the estimated dynamic loss and continuously
updating probability, we can calculate the dynamic risk in the tank
process, and the result is shown in Fig. 12.
We can see that the dynamic risk value changed accordingly
with time. In Fig. 12, initial risk was zero, which means, at this
moment, the outlet ow rate is larger than inlet, or the level is
under the set point. In these situations the corresponding risk
values were zero.
In a normal situation, the control system in the tank process
can deal with the disturbance well, and the dynamic risk is low.
With continuously increased ow rate, the situation changes
gradually.
70 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

2 results of the real time risk assessment were shown in Fig. 13(b).
This is a safety mechanism, which makes the extra inlet ow turn
1.8
back in the bypass pipeline. As a result, the stress would reduce a
1.6 lot when the risk management system detected a trend indicating
the tank would overow. Here the bypass pipeline safety utility
1.4
plays a role to stop the level from increasing too quickly. This is
1.2 controlled by the risk management system; with a predicted value,
the bypass pipeline was controlled to decrease the risk in the
Risk, ($)

1 system.
0.8
0.6
0.4
0.2
0 emergency situation.
0 20 40 60
Time, (s)
Fig. 12. Dynamic risk of tank process change with time.
Table 2
Parameters in the tank model.
Parameter Value
A 10.0
H 1.0
Hset 0.5
D 0  50
Fio 0.1(1 D)
Fi 0  Fio
Fo 0  0.1
4.1.4. Scenario 2: bypass pipeline open
The bypass pipeline system was implemented in the tank sys-
tem to prevent the rapid increase of the level in the tank process.
First of all, we can estimate the boundary of this situation. The
minimum remaining time can be estimated by Eq. (12).
AH Ht
t remained
F i 1 D  F o
AH Htmax
Z 12
F i 1 Dmax  F o
After calculating, we nd the minimum remaining time is 60 s,
when H(t)max 0.7H and Dmax 0.5. With this result, we can set
the lower boundary. If the risk management system predicts that
the tank process system will not eliminate the potential risk
within 60 s, the safety utility will be turned on; that is, the bypass
valve would be opened so that the extra volume can return to
lower the risk. This situation occurred when the inlet ow rate
continuously increased to a low rate of 0.1 m3/s, and the ranges of
variables are as listed in Table 2. With disturbance, the inlet ow
rate will always be larger than the maximum outlet ow rate. As a
result, there would be some situations when the predicted
remaining time is smaller than 60 s and the bypass pipeline valve
will open automatically. Then, as assumed, half of the inlet ow
will ow into the bypass to eliminate the level increasing speed.
The outlet ow rate started at the value of 0.05 m3/s, and then the
value was determined by controller.
The disturbances were random, as the expected maximum
disturbance was less than 50%. The estimated loss with time is
shown in Fig. 13(a). With an increasing inlet ow rate, the esti-
mated loss increases accordingly. When the bypass pipeline was
opened, the estimated maximum loss in the loss function changed
from $1000 to $10,000. Consequently, the estimated loss value
increased greatly. Also we can calculate the potential risk. The
The dynamic risk in this situation was shown in Fig. 13(c).
Compared to the dynamic risk in a normal situation (Fig. 12) the
dynamic risk in the current situation increased signicantly.
When the inlet ow rate changed continuously, with an ever
increasing inlet ow rate, the bypass pipeline safety feature would
not be able to prevent the overow. In this situation, the emer-
gency shutdown system would be activated to lower the risk of an
80 100
4.1.5. Scenario 3: emergency shutdown
As we continue to increase the inlet ow rate to 0.2 m3/s,
because this ow rate is very large, in spite of the activated bypass
pipeline, the level still goes up, and there would be the possibility
of overow. The ranges of variables are listed in Table 3.
The estimated minimum remaining time is formulated in
Unit Eq. (13) as follows:
m2 AH  Ht
t remained
m F i 1 D  F o
m
AH  Htmax
% Z 13
m3/s F i 1 Dmax  F o
m3/s
m3/s
In this situation, the minimum remaining time t15 s, when H
(t)max 0.7H and Dmax 0.5. The corresponding occurrence prob-
ability, Ps 0.86.
Here, when the remaining time is less than 15 s, we turn off the
valve of the inlet pipeline as an emergency shutdown strategy.
However, if the risk management system detects the probability
value is larger than Ps, the emergency shutdown system would be
triggered, and the inlet ow would be stopped immediately.
However, the outlet ow continued at 0.05 m3/s.
In this situation, the estimated loss was shown in Fig. 14(a). We
see that when the bypass pipeline was opened, the estimated loss
increased greatly. Also we can see the real time varied risk in
Fig. 14(b). Compared to Fig. 13(b) and Fig. 11, the average risk value
increased a lot, and the risk increased gradually in this situation.
After about 50seconds, the risk reached the shutdown value,
Ps0.86, the system shut down as an emergency situation, and
after that the risk decreased gradually. Finally the risk was elimi-
nated after the system shut down. Adding estimated loss and its
probability, we could calculate the dynamic risk in the tank pro-
cess, and the result was shown in Fig. 14(c).
As stated above, in this simple tank process, we implemented
the method to determine process dynamic risk. The risk consisted
of loss and probability; the former was calculated by loss function
at all times, the latter updated with the predicted remaining time.
With continuously updated loss and probability, we calculate the
dynamic risk in the tank process operation.
In this case, only one key variable, the tank level, was mon-
itored, and only one manipulated variable, the inlet ow rate, were
measured dynamically. In the next section, multiple key variables
and manipulated variables were involved to demonstrate the
effectiveness of the proposed method.
4.2. Tennessee Eastman process case study
In this section, the effectiveness of the proposed dynamic
quantitative risk assessment method was veried by further
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278 71

3000 0.25

2500
0.2

2000
Estimated loss, ($)

0.15

Probability
1500

0.1
1000

0.05
500

0 0
0 20 40 60 80 100 0 20 40 60 80 100
Time, (s) Time, (s)

900

800

700

600
Risk, ($)

500

400

300

200

100

0
0 20 40 60 80 100
Time, (s)

Fig. 13. Estimated losses, probability and risk change with time (a) estimated loss, these very high valued appear at the opened bypass. At this moment, the estimated
maximum loss is 10 times more than it is when closed (b) probability of overow (c) risk of tank process.

4.2.2. Model of Tennessee Eastman process

Table 3
Parameters in the tank model.
The process produces two products (G and H) and one bypro-
duct (F) from four reactants (A, C, D, E). These reactions are
Parameter Value Unit described in Eq. (14).

A 10.0 m2 Ag Cg Dg-Gl
H 1.0 m
Hset 0.5 m
D 0  50 % Ag Cg Eg-Hl
Fio 0.2(1 D) m3/s
Fi 0  Fio m3/s Ag Eg-Fl
Fo 0  0.1 m3/s
3Dg-2Fl 14

Three gaseous reactants are fed to the reactor, where catalyzed

testing on the Tennessee Eastman chemical process. In this pro-
cess, multiple state variables were monitored to estimate potential
losses and also disturbances to multiple manipulated variables
were measured to update the probabilities.
4.2.1. Flowchart of Tennessee Eastman process
There are ve major operation units in the Tennessee Eastman
chemical process: a reactor, a product condenser, a vaporliquid
separator, a recycle compressor, and a product stripper (Downs
and Vogel, 1993). The owchart of the Tennessee Eastman process
is shown as Fig. 15 (Downs and Vogel, 1993).
chemical reactions occur to form liquid products. The product stream
exits the reactor as vapor and is condensed at the condenser. Sub-
sequently, the product stream from the condenser passes through
the vaporliquid separator where the condensed product and the
non-condensed product are separated. The non-condensed product
stream is then recycled back to the reactor feed through a centrifugal
compressor. Meanwhile, the undesirable by-products and inert
reactants are purged from the process as vapor. Finally, the con-
densed product stream moves further into the stripper to be stripped
with stream 4 to remove the residual reactants. The nal product
stream exits from the base of the stripper and is pumped to the
downstream section for further renement (Downs and Vogel, 1993).
72 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

6000 1

0.9
5000
0.8

0.7
4000
Estimated loss, ($)

0.6

Probability
3000 0.5

0.4
2000
0.3

0.2
1000
0.1

0 0
0 10 20 30 40 50 0 10 20 30 40 50
Time, (s) Time, (s)

1800

1600

1400

1200
Risk, ($)

1000

800

600

400

200

0
0 10 20 30 40 50
Time, (s)

Fig. 14. Disturbance, estimated losses, probability and risk change with time (a) Estimated losses (b) probabilities of overow, the process shutdown at the 48th second
(c) dynamic risk of tank process.

The monitored variables of the Tennessee Eastman chemical process the reactor level. In calculation, the maximum result would be
system are listed in Table 4. selected to estimate the dynamic loss of the reactor.
In this process, we calculate the critical boundary use of 70% of The product separator unit and stripper loss were formulated
the space for limitations, and the calculated results are shown in by the inverted Beta loss function for the product separator level
Table 5. These variables were monitored to estimate the dynamic and stripper base level, respectively.
potential losses in the process operation. First, these target values of key state variables are listed in Table 7.
At the same time, there are 12 manipulated variables listed in The dynamic losses are formulated as follows.
Table 6 below. They were measured to track the inuences of 4.2.2.2. Loss functions for the reactor unit.
disturbances at all times. 0  1
P r  T P 2 Pr  T P Tr  TT T r  T T 2
In the dynamic model of the Tennessee Eastman process, 5 key 1 B
 1
21  2 2
r  2 U 1
r U 2
r
2
r
C
Lreactor_unit P r ; T r EMLreactor 2
@1  e 1 2
A
state variables were selected to be monitored in the process from 1 e  2

3 units to construct the loss functions, and also disturbances to 12

15
manipulated variables were measured to determine the prob-
ability updating.
In this situation, unlike for the simple tank process, there were The loss function that was formulated to estimate reactor unit
consequence by pressure and temperature is shown in Fig. 16.
multivariable as manipulated input, which was shown in Table 6.
Also the reactor unit loss can be estimated by the reactor level.
As a result, the disturbances of the input would be a vector.
The formula is in Eq. (16) below.
4.2.2.1. Loss function construction. The monitored key state variables
   !
reactor pressure and temperature were tightly coupled, so the 1  T L  r  1
 1  T Lr 1  r r

bivariate modied inverted normal loss function was introduced to Lreactor_unit Lr EMLreactor 1  T Lr 1  T Lr T Lr L r 1  L r T Lr
formulate the potential loss of the reactor unit. Also the loss of the
16
reactor unit would be estimated by the inverted Beta loss function by
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278 73

Fig. 15. Flowchart of the Tennessee Eastman chemical process system (Downs and Vogel, 1993).

Table 4
Monitored variables of the Tennessee Eastman Chemical process system.

Variable Description Variable Description

X1 A feed (stream 1) X12 Separator level

X2 D feed (stream 2) X13 Separator pressure
X3 E feed (stream 3) X14 Separator underow (stream 10)
X4 A and C feed (stream 4) X15 Stripper level
X5 Recycle ow (stream 5) X16 Stripper pressure
X6 Reactor feed rate X17 Stripper underow (stream 11)
(stream 6)
X7 Reactor pressure X18 Stripper temperature
X8 Reactor level X19 Stripper steam ow
X9 Reactor temperature X20 Compressor work
X10 Purge rate (stream 9) X21 Reactor cooling water outlet
temperature
X11 Separator temperature X22 Separator cooling water outlet
temperature

Table 5
The critical boundary for real time risk control.

Process variable Normal operating limits Shut down limits Critical boundary

Low limit High limit Low limit High limit Low limit High limit

Reactor pressure (Pr) None 2895 kPa None 3000 kPa None 2968.5 kPa
Reactor level (Lr) 50%(11.8 m3) 100%(21.3 m3) 2.0 m3 24.0 m3 13.9% 109.9%
Reactor temperature (Tr) None 150 C None 175 C None 167.5 C
Product separator level (Lp) 30%(3.3 m3) 100%(9.0 m3) 1.0 m3 12.0 m3 10.2% 125.8%
Stripper base level (Ls) 30%(3.5 m3) 100%(6.6 m3) 1.0 m3 8.0 m3  9.5% 122.1%
74 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

The dynamic estimated loss of reactor was summarized in 4.2.2.3. Loss function for the product separator unit.
Eq. (17) 0 !1  p
1  TL
  p

Lproduct_separator_unit Lp EMLproduct_separator @1  T Lp 1  T Lp TL
p

Lreactor_unit P r ; T r ; Lr maxLreactor_unit P r ; T r ; Lreactor_unit Lr 17

1  TL
!p  1 1
  p

Lp 1 Lp
TL
p A 18
Table 6
Manipulated variables in TE process.

Variable name Base case value Low High limit Units 4.2.2.4. Loss function for the stripper unit.
   !
1  T L  s  1
(%) limit
 1  T Ls 1  s s
Lstripper_unit Ls EMLstripper 1  T Ls 1  T Ls T Ls L s 1  L s T Ls
D feed ow 63.053 0 5811.000 kg/h
E feed ow 53.980 0 8354.000 kg/h
19
A feed ow 24.644 0 1.017 kscmh
A and C feed ow 61.302 0 15.250 kscmh
Compressor recycle valve 22.210 0 100 %
Purge valve 40.064 0 100 %
The loss functions of reactor, product separator and stripper
Separator pot liquid ow 38.100 0 65.710 m3/h estimated by levels are shown in Fig. 17.
Stripper liquid product ow 46.534 0 49.100 m3/h
Stripper stream valve 47.446 0 100 % 4.2.2.5. Loss function for Tennessee Eastman process. The total esti-
Reactor cooling water ow 41.106 0 227.100 m3/h
mated loss was the sum of these losses in every unit, as shown in
Condenser cooling water 18.114 0 272.600 m3/h
ow Eq. (20).
Agitator speed 50.000 150 250 rpm
LTEP P r ; T r ; Lr ; Lp ; Ls Lreactor_unit P r ; T r ; Lr Lproduct_separator_unit Lp
Lstripper_unit Ls 20

Table 7 4.2.2.6. Probability updating. There are 5 key state variables mon-
Target values of key state variables (normal operating set point). itored, which are shown in Table 5. Consequently, when the risk
Process variable Values Unit
management system tried to calculate the remaining time to cri-
tical boundaries, there would be one remaining time for every key
Reactor pressure (Pr) 2705.0 kPa state variables upper/lower boundaries, and totally there would
Reactor level (Lr) 75 % be 8 remaining times at most in the process to achieve the critical
Reactor temperature (Tr) 120.4 C
Product separator level (Lp) 50 %
boundaries in theory. They are: remaining time of upper reactor
Stripper base level (Ls) 50 % pressure, remaining time of lower/upper reactor level, remaining
time of upper reactor temperature, and remaining time of lower/

5
x 10
180
)

160
9
Reactor temperature, (

5
x 10
140
10
120 8
9

8 100
7

7 80
Estimated lossess, ($)

6 6
2400 2600 2800 3000 3200
5
Reactor pressure, (kPa)
5
4
5
3 x 10
4
2
8
Estimated lossess, ($)

1
3
0
6
180
160 2
3200 4
140
Re 3000
ac 120 1
tor 2800 2
tem 100
pe 2600 a)
rat , (kP
ure 80 2400 sure
,( r pres 0 0
) 60 2200 Reacto 2400 2600 2800 3000 3200
Reactor pressure, (kPa)

Fig. 16. Estimated Losses of reactor unit by reactor pressure and temperature values. The target values are (2705.0 kPa, 120.4 C), the rst EML value is pressure at 2968.5 kPa,
or temperature at 167.5 C.
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278 75

5 Table 9
x 10
10 Remaining time for every variable to cross the critical boundary.

9 Variable name Lower boundary Upper boundary

IBLF of reactor unit, TV=75%,
Lower=13.9% Upper=109.9%
8 Reactor pressure NAa 1.1034
IBLF of product separator unit, TV=50%,
Lower=10.2%, Upper=125.8% Reactor level 1.0648 NA
7 Reactor temperature NA 1.1079
IBLF of stripper unit, TV=50%,
Estimated losses, ($)

Lower=-9.5%, Upper=122.1% Product separator level NA 1.0048

6 Stripper base level NA 0.3548

5 a
NA: means not available.

3 Table 10
Disturbance of manipulated variables.
2
Disturbance Value Disturbance Value
1
d1  0.2198 d7  0.1040
0 d2  0.0504 d8  0.0342
-20 0 20 40 60 80 100 120 140 d3 0.0134 d9  0.2423
Level height, (%) d4  0.0416 d10 0.2420
d5 0.0784 d11  0.1664
Fig. 17. Estimated losses of reactor unit, product separator unit and stripper unit by
d6 0.0640 d12  0.1969
reactor level, product separator level and stripper base level respectively. The TV is
the target value and is the same as set point operating value. The Lower is the rst
EML value at the lower boundary, the upper is the rst EML value at the upper
boundary.
Table 11
Disturbance of manipulated variables.
1
Disturbance Value Disturbance Value
0.9
=20 d1 0.0429 d7 0.1291
TEP
0.8 d2  0.1629 d8 0.1935
d3 0.1143 d9  0.2156
0.7 d4 0.0171 d10  0.1582
d5  0.1235 d11 0.1185
0.6 d6 0.2085 d12 0.0984
Probability

0.5
failed unit would stop the whole process. As a result, in practice
0.4 we would not have to wait for the second remaining time when
the rst danger had already occurred; consequently, the minimum
0.3
remaining time would be selected as the remaining time of the
0.2 disturbance.

0.1
t TEP P r ; T r ; Lr ; Lp ; Ls mint upper P r ; t upper T r ; t upper Lr ; t lower Lr ;
0
0 0.5 1 1.5 2
Remaining time,(h) t upper Lp ; t lower Lp ; t upper Ls ; t lower Ls 21
Fig. 18. Probability of loss change with remaining time.
With the remaining time of the Tennessee Eastman process, we
could update the probability of the process. The probability den-
sity function was in Eq. (22) as follows and the calculated prob-
Table 8
ability curve is shown in Fig. 18.
Disturbance of manipulated variables.
(
TEP e  TEP tTEP ; t TEP Z 0
Disturbance Value Disturbance Value Pt TEP ; TEP 22
0; t TEP o 0
d1 0.2079 d7 0.1583
d2  0.1995 d8  0.1919
d3  0.1821 d9  0.0057 4.2.3. Dynamic risk in Tennessee Eastman process
d4 0.1792 d10  0.0763 For the normal case, calculate the remaining time to trigger the
d5  0.2407 d11 0.1369
d6 0.1142 d12  0.1074
critical boundary. The rst achieved critical boundary was the
upper reactor pressure. The remaining time was 1.01 h, and the
second achieved critical boundary was the lower critical line of the
upper product separator level, and remaining time of lower/upper product separator level; the remaining time was 1.15 h. Also we
stripper base level. could continue to calculate the remaining times of other critical
Usually there will be 5 remaining times for these ve mon- lines. As analyzed above, the remaining time should be the mini-
itored state variables. But sometimes, there were less than mum of these two already achieved remaining times, that is,
5 remaining times because the process would be shut down before 1.01 h. We observed that in this normal situation, the process was
the process continued operating to cross another certain critical running well, and there was plenty of remaining time. The system
boundary. Because the chemical process is strongly coupled, one was safe in the current situation, and the risk was low. In a normal
76 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278

operating condition, the estimated loss is $527555.73, and the the product separator level, the lower boundary of the reactor
occurrence probability is 1.69e  9, and thus the risk is about level, the upper boundary of the reactor pressure and the upper
$8.90e  4, which can be regarded as zero. boundary of the reactor temperature, respectively.
In this situation, the remaining time is 0.35 h, and rst achieved
4.2.3.1. Scenario 1: stripper base level triggered. In another situa- was the upper critical line of the stripper base level. In this sce-
tion, consider the disturbance of each manipulated variable. The nario, the estimated total loss was $1311779.85, the probability is
value is shown in Table 8. 9.12e  4, and the risk is $1196.19.
With the disturbance described in Table 8, the risk manage-
ment system would calculate all remaining time of monitored key
state variables. The result is shown in Table 9. 4.2.3.2. Scenario 2: reactor pressure triggered. In another situation,
From Table 9 we can see that with the same disturbance, the consider the disturbance of each manipulated variable in Table 10.
remaining time of these key variables to reach the critical In this situation, the remaining time is 0.16 h, and rst achieved
boundary varies. The rst met critical boundary is the upper was the reactor pressure critical line. In this scenario, the esti-
boundary of the stripper base level. Next, it is upper boundary of mated total loss was $554656.22, the probability is 4.08e  2, and
the risk is $22609.01. This case is a very high risk situation; the
Table 12 disturbance was found to demonstrate the process rst reached
Disturbance of manipulated variables. the upper boundary of reactor's pressure.

Disturbance Value Disturbance Value

4.2.3.3. Scenario 3: reactor level triggered. This scenario considers
d1 0.1965 d7 0.2069
d2 0.1016 d8 0.1034 the disturbance of each manipulated variable in Table 11.
d3 0.0279 d9 0.0289 In this situation, the remaining time is 1.33 h; rst achieved
d4  0.1578 d10  0.0933 was the lower critical line of the reactor level. In this scenario, the
d5  0.1440 d11  0.1669 estimated total loss was $1100529.00, the probability is 2.80e  12,
d6  0.2113 d12 0.0612
and the risk is $3.09e  6, it is approximately zero.

5
x 10
12 0.014

0.012
10

0.01
Estimated losses, ($)

8
Probability

0.008
6
0.006

4
0.004

2
0.002

0 0
0 20 40 60 80 100 0 20 40 60 80 100
Time, (min.) Time, (min.)

10000

9000

8000

7000

6000
Risk, ($)

5000

4000

3000

2000

1000

0
0 20 40 60 80 100
Time, (min.)

Fig. 19. Estimated loss, probability and risk change with time, (a) Estimated losses, (b) probability and (c) risk.
 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278 77

Table 13
Remaining time for every variable to cross the critical boundary.

Variable name Threshold 30% Threshold 50% Threshold 70% Threshold 90%

Reactor pressure 1.0977 1.1033 1.1033 1.1078

Reactor level 0.8748a 1.0048 1.0648 1.1033
Reactor temperature 1.0911 1.1033 1.1078 NAb
Product separator level 0.9348 0.9848 1.0048 1.0448
Stripper base level 0.2948 0.3248 0.3548 0.3948

a
Reactor level triggered lower critical boundary, others triggered the upper boundaries.
b
NA, process has shut down because of an excess of the reactor liquid level before getting the value.

1.4 Table 15
Times for trigger critical boundary lines (total: 10,000 times).

1.2 Variable name Lower boundary Upper boundary

Reactor pressure NAa 5830

1 Reactor level 1 20
Remaining time, (h)

Reactor temperature NA 0
Reactor pressure Product separator level 648 394
0.8 Reactor level Stripper base level 1819 1288
Reactor temperature
a
Product separator level NA: means not available.
0.6
Stripper base level
5. Discussion
0.4
5.1. The safety threshold
0.2
In this paper the safety threshold was set to 70%; that is, the
point was set at 70% from the normal allowed value to the danger
0
30 50 70 90 value. The value of the safety threshold denotes how close the
Safety threshold, (%) process system operating point was allowed to approach the
danger operating point. If the value is small, and if it is very close
Fig. 20. Remaining time under different safety threshold value.
to the normal operating point, the warning would be frequently
triggered, and if the value is large, close to 100%, it means the
operating point was allowed to get much closer to the danger
operating point, and the risk in this situation is very high. As a
Table 14
Remaining time in different ranges of result, the value will be identied carefully in a tradeoff between
disturbance. frequent warnings and high risk. In this paper, the value is set to
70%, and here we study 30%, 50% and 90%, with the same dis-
Disturbance range (%) Remaining time (h)a
turbances studied in Case 1 of the Tennessee Eastman process
25 0.1981 (Table 13).
50 0.1847 From Fig. 20, we can see that, as the safety threshold increased,
75 0.0916 the remaining time increased accordingly.
100 0.0675

a
The range limit the maximum variation
from base value. The result would be slight
changed with different disturbances.
4.2.3.4. Scenario 4: product separator level triggered. This situation
considers the disturbance of each manipulated variable in
Table 12.
In this situation, the remaining time is 0.57 h; rst achieved
was the lower critical line of the product separator level. In this
scenario, the estimated total loss was $1350129.68, the probability
is 1.12e  5, and the risk is $15.12.
4.2.3.5. Scenario 5: the dynamic risk and disturbances change with
time. In this process, we simulate the dynamic system, and
introduce the disturbance randomly to test the proposed method.
We calculate the dynamic risk change with time. The risk and
disturbances change with time as shown in Fig. 19.
In Fig. 19, the process risk is monitored in real time, which is
helpful to manage the risk. The dynamic risk of the process under
disturbance is accessed and its value can be used to take action to
manage the risk.
5.2. The disturbance ranges
In this paper, the disturbances of the Tennessee Eastman pro-
cess are limited to a range of [  0.25, 0.25]. Here we studied the
disturbances using the different values of 25%, 50%, 75% and 100%
(Table 14).
Here we change the disturbance range of disturbance, and then
calculate the remaining time of the process. We found that with a
larger disturbance we get less remaining time, which means the
disturbances were harmful to the system's safety.
5.3. The distribution of trigger variables
In our method, the rst trigger for the critical boundary
remaining time is the remaining time of the process with the
current disturbance. Here we simulate the process 10,000 times
and collect the numbers of every critical boundary. The result is
shown in Table 15.
From Table 15, we can see the upper boundary of reactor
pressure was very sensitive, and more than half of the remaining
times were based on the value of the remaining time for the
78 H. Wang et al. / Chemical Engineering Science 142 (2016) 6278
reactor pressure to achieve its upper boundary. On the other hand,
the boundaries of the reactor level and the temperature were
seldom encountered. As we discussed before, the safety threshold
determines the remaining time to some extent, so we can con-
clude that the safety threshold of reactor pressure may be too
small and the temperature may be too high.
Based on the distribution, we could improve our safety strategy
so that these boundaries would play a function for a similar
situation. For example, we can select a critical operating point
closed to the upper limit and at the same time reduce the
threshold of reactor level and temperature so that there is more
chance for the reactor level and temperature trigger the safety
mechanism.
6. Conclusion
In this paper, we propose a dynamic quantitative risk assess-
ment (DQRA) method, in which a consequence loss function of a
process consisting of multiple units with multiple monitored
variables is formulated to estimate loss dynamically, and also
remaining time is introduced to update the occurrence prob-
ability with the currently measured disturbances with multiple
manipulated variables. A simple tank system and a typical Ten-
nessee Eastman process are tested to show the effectiveness of the
proposed method. According to this method, the risk of the pro-
cess is estimated dynamically, and as a result, we conclude it is
more proactive to assess and manage risk in a chemical process
operation.
In this work, the loss estimation is considered to be the
deviation from the normal operating point, but considering the
result in the consequence of the end process scenario, it also has
impacts on the environment, human health, etc., and these losses
also should be considered as part of the potential losses. Also, the
probability of loss occurrence is dynamically updated with the
remaining time of the process, and the remaining time is based on
the current measured values. It would be more accurate to con-
sider the historical data at the same time to predict the remaining
time while updating the probability. These problems will be
improved in future work.
Acknowledgments
The authors gratefully acknowledge the nancial support pro-
vided by the Vale Research Chair grant, and the Natural Sciences
and Engineering Research Council of Canada.
References
Adams, E.E., 1995. Total quality safety management: an introduction. American
Society of Safety Engineers Des Plaines.
CCPS, 2007. Guidelines for Risk Based Process Safety. John Wiley & Sons, 768 pages,
ISBN is 978-0-470-16569-0.
Downs, J.J., Vogel, E.F., 1993. A plant-wide industrial process control problem.
Comput. Chem. Eng. 17, 245255.
Dumas, R., 1987. Safety and quality: the human dimension. Prof. Saf. 32, 1114.
Garca Herrero, S., Mariscal Saldaa, M.A., Manzanedo del Campo, M.A., Ritzel, D.O.,
2002. From the traditional concept of safety management to safety integrated
with quality. J. Saf. Res. 33, 120.
Hashemi, S.J., Ahmed, S., Khan, F., 2014a. Loss functions and their applications in
process safety assessment. Process. Saf. Prog. 33, 285291.
Hashemi, S.J., Ahmed, S., Khan, F.I., 2014b. Risk-based operational performance
analysis using loss functions. Chem. Eng. Sci. 116, 99108.
Kalantarnia, M., Khan, F., Hawboldt, K., 2009. Dynamic risk assessment using failure
assessment and Bayesian theory. J. Loss Prev. Process. Ind. 22, 600606.
Kalantarnia, M., Khan, F., Hawboldt, K., 2010. Modelling of BP Texas City renery
accident using dynamic risk assessment approach. Process. Saf. Environ. Prot.
88, 191199.
Khakzad, N., Khan, F., Amyotte, P., 2012. Dynamic risk analysis using bowtie
approach. Reliab. Eng. Syst. Saf. 104, 3644.
Khan, F., Abunada, H., John, D., Benmosbah, T., 2010. Development of risk-based
process safety indicators. Process. Saf. Prog. 29, 133143.
Khan, F.I., Iqbal, A., Ramesh, N., Abbasi, S.A., 2001. SCAP: a new methodology for
safety management based on feedback from credible accident-probabilistic
fault tree analysis system. J. Hazard. Mater. 87, 2356.
Krause, T.R., 1993. Safety and quality: two sides of the same coin. Occup. Hazards 55
47-47.
Leung, B.K., Spiring, F., 2002. The inverted beta loss function: properties and
applications. IIE Trans. 34, 11011109.
Leung, B.P., Spiring, F.A., 2004. Some properties of the family of inverted probability
loss functions. Qual. Technol. Quant. Manag. 1, 125147.
Meel, A., Seider, W.D., 2006. Plant-specic dynamic failure assessment using
Bayesian theory. Chem. Eng. Sci. 61, 70367056.
Meel, A., Seider, W.D., 2008. Real-time risk analysis of safety systems. Comput.
Chem. Eng. 32, 827840.
Pariyani, A., Seider, W.D., Oktem, U.G., Soroush, M., 2012a. Dynamic risk analysis
using alarm databases to improve process safety and product quality: Part I
data compaction. AIChE J. 58, 812825.
Pariyani, A., Seider, W.D., Oktem, U.G., Soroush, M., 2012b. Dynamic risk analysis
using alarm databases to improve process safety and product quality: Part II
Bayesian analysis. AIChE J. 58, 826841.
Spiring, F.A., 1993. The reected normal loss function. Can. J. Stat. 21, 321330.
Sun, F.-B., Larame, J.-Y., Ramberg, J.S., 1996. On Spiring's normal loss function. Can.
J. Stat. 24, 241249.
Venkatasubramanian, V., Rengaswamy, R., Kavuri, S.N., 2003a. A review of process
fault detection and diagnosis: Part II: qualitative models and search strategies.
Comput. Chem. Eng. 27, 313326.
Venkatasubramanian, V., Rengaswamy, R., Kavuri, S.N., Yin, K., 2003b. A review of
process fault detection and diagnosis: Part III: process history based methods.
Comput. Chem. Eng. 27, 327346.
Venkatasubramanian, V., Rengaswamy, R., Yin, K., Kavuri, S.N., 2003c. A review of
process fault detection and diagnosis: Part I: quantitative model-based meth-
ods. Comput. Chem. Eng. 27, 293311.
Wang, H.Z., Chen, B.Z., He, X.R., Qiu, T., Zhao, J.S., 2008. Stability analysis based
method for inherently safer process design at conceptual design stage. In:
World Conference on Safety of Oil and Gas Industry. 801 University Drive East,
College Station, Texas, United States.
Wang, H.Z., Chen, B.Z., He, X.R., Qiu, T., Zhao, J.S., 2009. Singularity theory based
stability analysis of reacting systems. Comput. Aided Chem. Eng. 27, 645650.
Wang, H.Z., Chen, B.Z., He, X.R., Zhao, J.S., Qiu, T., 2010a. Modeling, simulation and
analysis of the liquid-phase catalytic oxidation of toluene. Chem. Eng. J. 158,
220224.
Wang, H.Z., Chen, B.Z., He, X.R., Zhao, J.S., Qiu, T., 2010b. Numerical analysis tool for
obtaining steady-state solutions and analyzing their stability characteristics for
nonlinear dynamic systems. J. Chem. Eng. Jpn. 43, 394400.
Wang, H.Z., Chen, B.Z., Qiu, T., He, X.R., Zhao, J.S., 2012a. An Approach Considering
Both Operation Stability and System's Hopf Bifurcations to Chemical Process
Design. 2012 AIChE Annual Meeting, Pittsburg, PA.
Wang, H.Z., Chen, B.Z., Qiu, T., He, X.R., Zhao, J.S., 2012b. An integrated quantitative
index of stable steady state points in chemical process design. In: Proceedings
of the 11th International Symposium on Process Systems Engineering-PSE2012,
Singapore.
Wang, H.Z., Yuan, Z.H., Chen, B.Z., He, X.R., Zhao, J.S., Qiu, T., 2011. Analysis of the
stability and controllability of chemical processes. Comput. Chem. Eng. 35,
11011109.
Wang, H.Z., Yuan, Z.H., Chen, B.Z., Zhao, J.S., Qiu, T., 2010c. Inherently safer design
oriented segregation of chemical process operating region. In: Mary Kay
OConnor Process Safety Center International Symposium. Hilton Conference
Center, 801 University Drive East, College Station, Texas, United States.
Wang, H.Z., Zhang, N., Qiu, T., Zhao, J.S., Chen, B.Z., 2014a. Method for regulating
oscillatory dynamic behavior in a zymomonas mobiliz continuous fermentation
process. Ind. Eng. Chem. Res. 53, 1239912410.
Wang, H.Z., Zhang, N., Qiu, T., Zhao, J.S., He, X.R., Chen, B.Z., 2012c. Analysis of Hopf
points for a zymomonas mobilis continuous fermentation process producing
ethanol. Ind. Eng. Chem. Res. 52, 16451655.
Wang, H.Z., Zhang, N., Qiu, T., Zhao, J.S., He, X.R., Chen, B.Z., 2013. A process design
framework for considering the stability of steady state operating points and
Hopf singularity points in chemical processes. Chem. Eng. Sci. 99, 252264.
Wang, H.Z., Zhang, N., Qiu, T., Zhao, J.S., He, X.R., Chen, B.Z., 2014b. Optimization of a
continuous fermentation process producing 1,3-propane diol with Hopf sin-
gularity and unstable operating points as constraints. Chem. Eng. Sci. 116,
668681.
Yu, H., Khan, F., Garaniya, V., Ahmad, A., 2014. Self-organizing map based fault
diagnosis technique for non-gaussian processes. Ind. Eng. Chem. Res. 53,
88318843.
Zadakbar, O., Imtiaz, S., Khan, F., 2012. Dynamic risk assessment and fault detection
using principal component analysis. Ind. Eng. Chem. Res. 52, 809816.
Zadakbar, O., Imtiaz, S., Khan, F., 2013. Dynamic risk assessment and fault detection
using a multivariate technique. Process. Saf. Prog. 32, 365375.