Computers and Chemical Engineering 40 (2012) 110–116

Contents lists available at SciVerse ScienceDirect

Computers and Chemical Engineering

journal homepage: www.elsevier.com/locate/compchemeng

Abnormal events management and process safety

Rigorous dynamic models for distillation safety analysis

William L. Luyben ∗
Department of Chemical Engineering, Lehigh University, Bethlehem, PA 18015, USA

a r t i c l e i n f o a b s t r a c t

Article history: Dynamic simulations of distillation columns are widely used to develop effective control structures. The
Received 27 October 2011 normal distillation models assume instantaneous heat transfer in the condenser and reboiler. However,
Received in revised form 13 February 2012 when dynamic simulations are used in the analysis of safety problems in the event of emergency situ-
Accepted 23 February 2012
ations, the basic model does not accurately represent the dynamic response. Accurate response times
Available online 3 March 2012
are essential in the design of safety systems for the column. For example, a failure of the supply of cool-
ing water will lead to rapid increases in pressures and temperatures that occur in seconds. Accurately
Key words:
determining the rates of increase in these important variables and the time period to reach critical limits
Safety analysis
Distillation simulation
(safety response time) permits the engineer to quantitatively design effective safety systems.
Distillation This paper illustrates how rigorous condenser and reboiler models can be developed in Aspen Plus and
Dynamic models their dynamics evaluated in Aspen Dynamics.
Aspen simulation © 2012 Elsevier Ltd. All rights reserved.

1. Introduction at some percentage of departure from normal pressure, perhaps

Dynamic simulation is widely used for developing control sys-
tems to handle normal operation around the desired steady state.
However dynamic simulation can also provide a useful tool for
predicting how fast variables change in the event of an operating
emergency or equipment failure. Modern dynamic simulators can
easily be used to provide this type of dynamic information.
When an emergency arises, the time it takes to approach a
high limit in some critical variables (temperature, pressure or com-
position) is important because it determines how fast the safety
protection equipment (sensors and valves) must be able to respond
to the detected event. A common example is a loss of coolant, which
could be refrigerant (low-temperature operation), cooling water
(medium-temperature operation) or boiler feed water (if cooling is
achieved by generating steam). This type of loss can be detected in
several ways. The most obvious is a measurement of the flowrate of
the coolant. But flow sensors are often noisy due to turbulent flow
conditions and have limited reliability. Impulse lines and orifice
plates can plug and foul. Shutting down a whole plant due to faulty
measurement signal is very undesirable. Therefore other more reli-
able sensors (temperature or pressure) are often used to infer a loss
of coolant. Multiple sensors based on different physical principles
are used to improve fault detection reliability.
There are several levels of action to be taken as the critical
variable moves away from its normal value. As sketched in Fig. 1,
10%, an alarm will be activated to alert the operator. At a larger
percentage (20%), an override system will begin to adjust other
manipulated variables not normally used to maintain the pressure
in an attempt to ride through the disturbance without necessitat-
ing a complete plant shutdown. For example, the feed flowrate
and/or the reboiler heat input could be reduced as the column pres-
sure approaches this “override” limit. If conditions worsen and the
pressure continues to rise up to perhaps 30% above normal, an inter-
lock system will be activated that shuts down the process. If these
actions are unable to prevent a further rise in pressure, the last line
of defense to protect the physical integrity of the vessels is opening
of safety valves or blowing of rupture disks at perhaps 40% above
normal. Of course, the vent/scrubbing/flaring systems into which
these discharges empty must be sized adequately to handle the
dynamic loads that occur during the event.
A discussion of the safety responses of several chemical reactor
systems has recently been presented (Luyben, in press). Reactors
often present critical safety issues, and the wide variety of differ-
ent reactor and reaction types and conditions yield a wide range of
safety reaction times. The current paper addresses dynamic simula-
tions for the safety analysis of a typical distillation column. Columns
are usually more benign than chemical reactors, and there a fewer
types of configurations and ranges of operating variables. A typical
numerical example is considered.

2. Process studied

∗ Tel.: +1 610 758 4256; fax: +1 610 758 5057. The binary separation of methanol and water is used an example
E-mail address: WLL0@Lehigh.edu column. A feed of 82 mol% methanol and 18 mol% water is fed to a

0098-1354/$ – see front matter © 2012 Elsevier Ltd. All rights reserved.
doi:10.1016/j.compchemeng.2012.02.019
 W.L. Luyben / Computers and Chemical Engineering 40 (2012) 110–116
Fig. 1. Safety constraints and actions; pressure limitations.
column with 40 trays (42 stages in Aspen terminology with feed on
Stage 27 and the condenser labeled as Stage 1). Condenser pressure
is 1 bar, condenser pressure drop is 0.1 bar and tray pressure drop is
0.01 bar per tray (giving a base pressure of 1.5 bar). Product purities
are 99.9 mol% methanol in the distillate and 99.9 mol% water in the
bottoms. The required reflux ratio is 0.8569. Column diameter is
5.61 m. Reboiler heat input is 64.1 MW. Condenser heat removal is
60.0 MW. The NRTL physical property package is used.
2.1. Basic Radfrac models
The basic Aspen “Radfrac” model incorporates implicitly a con-
denser and a reboiler. The process flow diagram of this base model
is shown in Fig. 2. The dynamics of the system depend on the col-
umn diameter, the tray weir height and the holdups in the column
base (reboiler) and reflux drum (condenser).
This basic model has several options for handling the dynamics
of the heat exchangers.
A. Constant duty model: The default mode is “Constant duty”
in which heat-transfer rates (QC in the condenser and QR in the
reboiler) are set immediately with no dynamic lags. These heat-
transfer rates are directly manipulated in the dynamic model and
their effects are immediately felt by column. There is no con-
sideration of heat-transfer area, temperature driving forces or
heat-transfer coefficient. The holdup of material on the utility-side
of the heat exchanger is not considered. In normal control stud-
ies, this assumption is valid because the composition dynamics
of the column trays, column base and reflux drum are typically
much slower than the dynamics of the heat exchangers. For pre-
dicting rapid responses to safety scenarios, the dynamics of the
heat exchangers should not be neglected.
B. Constant temperature model: The temperature of the cool-
ing medium in the condenser or the temperature of the heating
medium in the reboiler is set, and then Aspen calculates the
required “UA” product (overall heat-transfer coefficient U and heat-
transfer area A) from the known heat-transfer rate and temperature
differential driving force. This temperature is manipulated in the
dynamic simulations. No heat-exchanger dynamics are considered.
C. LMTD model: If the condenser uses the flowrate of a cooling
medium (typically cooling water) or if the reboiler used the flowrate
of a heating medium (hot oil), a model using a log-mean temper-
ature differential driving force (temperature differentials at outlet
and inlet ends) can be used. The inlet medium temperature and the
minimum approach temperature difference between the process
and the medium are specified. Then Aspen calculates the required
111
“UA” product (overall heat-transfer coefficient U and heat-transfer
area A) and the required flowrate of the medium from the known
heat-transfer rate.
The flowrate of the medium is manipulated in the Aspen
Dynamic simulations, not QC or QR directly. However, this model
contains no dynamics. The holdup of medium in the heat exchanger
is not considered. Medium flowrate changes produce instanta-
neous changes in temperature driving forces and subsequent
heat-transfer rates.
D. Condensing or evaporating medium models: An Evaporating
model can be used in the condenser, and a Condensing model can
be used in the reboiler if the cooling/heating medium undergoes a
phase change. If the reboiler is heated by a condensing vapor (typi-
cally steam), the difference in temperature between the condensing
steam at a specified temperature and the column base temperature
is used to calculate the “UA” and the flowrate of the steam from the
known reboiler duty QR . The flowrate of the steam is manipulated
in the Aspen Dynamics simulations, not QR directly.
If the condenser is cooled by a vaporizing liquid (boiler feed
water in high-temperature columns or liquid refrigerant in low-
temperature columns), the difference in temperature between the
specified temperature of the vaporizing liquid and the temperature
of the process in the condenser is used to calculate the “UA” and
the flowrate of the coolant from the known condenser duty QC .
The flowrate of the coolant is manipulated in the Aspen Dynamics
simulations, not QC directly.
E. Dynamic model for reboiler: There is one heat-exchanger
model in the standard model that considers heat-exchanger
dynamics, but is only available for the reboiler. The dynamic model
uses the holdup of the heating medium in the reboiler. The medium
is assumed to be at a single temperature (perfectly mixed). The
inlet medium temperature and the approach temperature to the
process are specified. Then Aspen calculates the required “UA” and
the medium flowrate from the known heat-transfer rate QR . The
larger the medium holdup, the more slowly the perfectly mixed
medium temperature changes for a change in medium flowrate. So
this model is the only built-in model that considers dynamic lags
in the heat exchanger equipment associated with the column.
However, this model can only be realistically used when the
reboiler heating medium is a hot liquid stream, and the holdup of
this liquid on the shell or tube side is significant. If the reboiler is
heated with a condensing vapor, which is much more frequently
the case, this dynamic model is not applicable.
2.2. Radfrac model with explicit heat-exchanger dynamics
Fig. 3 gives a process flow diagram of a more rigorous Aspen sim-
ulation that explicitly incorporates separate units for the condenser
and the reboiler. Fig. 4 gives a detailed flowsheet of operating con-
ditions and equipment sizes. The column itself is Radfrac column,
but it has no reboiler and no condenser. These are added externally
as standard Aspen HeatX models, as are a separate reflux drum and
liquid circulation from the base of the column through the reboiler.
A. Column: The top tray is now labeled Stage 1 in this absorber
model. So the feed stage and the bottom stage must be decreased
by one to make this column equivalent to the basic column. The
feed and reflux are fed to column along with a partially vaporized
stream from the reboiler. This vessel has no design specifications.
Top pressure is 1.1 bar. Base pressure is 1.5 bar.
B. Condenser: The overhead vapor from the column is condensed
in a water-cooled heat exchanger. The design specification for this
HeatX model is the exit temperature of the hot stream at 64.2 ◦ C (the
bubble-point temperature of the distillate at 1 bar). Cooling water
flows through the condenser (3.7 × 106 kg/h), entering at 32.2 ◦ C
and exiting at 47.6 ◦ C. With a heat-transfer rate of 60.06 MW and
112 W.L. Luyben / Computers and Chemical Engineering 40 (2012) 110–116

Fig. 2. Base Aspen distillation column model.

an overall heat-transfer coefficient of 730.9 kcal h−1 m−2 K−1 , the
required area is 2788 m2 .
The volume of the tubes is estimated by assuming tubes 0.05 m
in diameter and 5 m in length. The number of tubes required to give
the necessary heat-transfer area is calculated and the inside volume
of these tubes (35 m3 ) is used to give dynamics in the HeatX model.
Shell volume is set equal to tube volume. In the Dynamics section
of the HeatX block, the default is Instantaneous. Use the drop-down
arrow to select Dynamic, and enter the inlet and outlet volumes on
both hot and cold sides of the heat exchanger.
The dynamic capacitance of the tube metal in the condenser
can also be included if it is significant compared to that of the
cooling water in the tubes. The mass of cooling water times its
heat capacity is (35 m3 ) (1000 kg/m3 ) (4.184 kJ/kg K) = 145,600 kJ/K.
Assuming a metal tube wall thickness of 0.00127 m, the volume of
the tube metal is 3.54 m3 . Then using a metal density of 7750 kg/m3
and a heat capacity of 0.836 kJ/kg K, the product of metal mass
times heat capacity can be calculated: (3.53 m3 ) (7750 kg/m3 )
(0.836 kJ/kg K) = 22,940 kJ/K. Thus the metal heat capacitance is
only 15% of the water capacitance.
C. Reflux drum: An Aspen Flash2 model is used for the reflux
drum with pressure set at 1 bar and design specification of a vapor
fraction of 10−5 , which makes the drum essentially adiabatic. A
small vapor flowrate is necessary so that the control valve in this
vent line can be sized. In the Aspen Dynamics simulation, the valve
is completely closed. The liquid holdup in the drum is set to give
5 min at 50% full (diameter 3 m and length 6 m).
D. Liquid split: Liquid from the drum is pumped up to 4 bar and
split into a reflux stream (set at exactly the value used in the base
case, 2826 kmol/h) and the distillate. See Fig. 3 (Splitter S1). As dis-
cussed below, the conditions in the reboiler will be adjusted to drive
the distillate to be the same as in the base case (3297.7 kmol/h).
D. Reboiler: Liquid from the column base is split (Splitter S2 in
Fig. 3) between the bottoms and a circulating stream that flows
through a HeatX model used for the reboiler. The bottoms flowrate
is set equal to that found in the base case (720.7 kmol/h). Note that

Fig. 3. Rigorous Aspen distillation column model; steady state.

 W.L. Luyben / Computers and Chemical Engineering 40 (2012) 110–116 113

Fig. 5. Flowsheet Equation.

3. Dynamic simulations

Both the base case column and the rigorous column/heat-

exchanger process were exported into Aspen Dynamics. A standard
conventional distillation control structure was installed on both
Fig. 4. Column flowsheet.
processes. Three of the loops are identical in both systems.

1. Reflux-drum level is controlled by manipulating the flowrate of

distillate using a proportional control with KC = 2.
2. Column base level is controlled by manipulating the flowrate of
the feed and bottoms flowrates are set to same values as the base bottoms using a proportional control with KC = 2.
case. Therefore the distillate flowrate must also be the same. Using 3. The reflux flowrate is ratioed to the feed flowrate.
the same reflux flowrate should yield exactly the same tray and
product compositions, which is indeed true (99.9 mol% purities of The other two loops, a tray temperature controller and a pres-
both product streams. sure controller, are different in the two cases.
The circulating stream is pumped to 2.5 bar and enters the
reboiler at a high flowrate (7000 kmol/h) and 111 ◦ C. The circulat-
3.1. Base case control structure
ing loop mimics the flowrate found in a thermosiphon reboiler.
The heat duty in the reboiler is 64.13 MW, which produces a par-
For the base case, condenser pressure is controlled by con-
tially vaporize process exit stream (vapor fraction = 0.8096) at a
denser heat removal (direct QC ). The Aspen Dynamics default
temperature of 120 ◦ C.
tuning parameters are used (KC = 20 and  I = 12 min). A tempera-
Setting up this circulating loop is not trivial. The circulating
ture on Stage 40 is controlled by manipulating reboiler duty (direct
stream was “torn” and a guessed value for the flowrate of a stream
QR ). Stage 40 is selected because it is near the bottom but still in
entering the base of the column is assumed. The composition of
the region in which changes in the temperature profile are large,
the stream is known (same as bottoms). The vapor fraction of this
as shown in Fig. 6. A 1-min deadtime is installed in this loop, and
stream was varied using an Aspen Flowsheet design spec to drive
a relay-feedback test gives an ultimate gain KU = 2.8 and an ulti-
the distillate flowrate to the desired value. Then another Flowsheet
mate period PU = 3.6 min. The Tyreus–Luyben tuning rules give the
design spec was used to change the flowrate of the steam to produce
temperature controller tuning constants KC = 0.88 and  I = 8 min.
this vapor fraction.
When the recycle loop was closed in Aspen Plus, it would not
3.2. Rigorous case control structure
converge. However, after exporting into Aspen Dynamics, the loop
was successfully closed and converged to the steady state. In Aspen
For the simulation with external heat exchangers for the reboiler
Dynamics, the streams “6” and “2” are deleted, as is block “B1”
and condenser, the temperature and pressure loops have the same
(see Fig. 3), Then the source of stream “10” is reconnected to block
controlled variables but different manipulated variables than those
“VREB”.
used in the base case.
The steam used in the reboiler is medium-pressure steam
at 11 bar and 180 ◦ C with a flowrate of 104.5 × 103 kg/h. The
steam temperature in the reboiler shell is 144 ◦ C, which pro-
vide the necessary driving force to transfer 64.13 MW in the
3176 m2 heat exchanger using an overall heat-transfer coefficient
of 730.9 kcal h−1 m−2 K−1 .
The specification of the reboiler HeatX model in Aspen Plus is
a hot stream outlet vapor fraction of zero (liquid condensate leav-
ing from the stream trap). When the file is exported into Aspen
Dynamics, the default condition in the reboiler is a fixed steam-side
pressure. This, of course, is not what we want since the pressure
(and temperature) must vary to change the heat-transfer rate and
the steam flowrate. It is necessary to use Flowsheet Equations in
Aspen Dynamics to change the specification to have an exit hot
stream with a vapor fraction of zero. Fig. 5 shows the equation
used. It is also necessary to change the pressure of the hot exit
stream from fixed to free so that the system is not over specified. Fig. 6. Temperature profile.
114 W.L. Luyben / Computers and Chemical Engineering 40 (2012) 110–116
Fig. 7. Control structure for rigorous case.
Fig. 8. Pressure responses: loss of QC or cooling water.
Reflux drum pressure is controlled by manipulating the control
valve in the cooling water line as shown in Fig. 7. The Aspen Dynam-
ics default tuning parameters are used (KC = 20 and  I = 12 min).
Fig. 9. Other variable with loss of QC or cooling water.
The tray temperature controller now controls Stage 39 instead
of Stage 40 because of the difference in stage numbering in a strip-
ping column (top tray is Stage 1). The temperature and composition
profiles are identical in both columns. The temperature controller
manipulates the control valve in the steam line, not QR directly. A
1-min deadtime is installed in this loop, and a relay-feedback test
gives an ultimate gain KU = 17 and an ultimate period PU = 4.8 min.
The Tyreus–Luyben tuning rules give the temperature controller
tuning constants KC = 5.5 and  I = 11 min.
3.3. Comparison of dynamic responses
Two types of safety events are explored. In the first, there is
a failure in the supply of cooling water to the condenser. In the
second, a large surge in steam to the reboiler occurs.
A. Condenser cooling failure: With the basic model, this failure
is simulated by running at steady state for 10 s, putting the pressure
controller on manual and setting controller output signal (which is
QC directly) to zero. The dashed line in Fig. 8 shows the response of
reflux-drum pressure. There is an immediate rapid rise in pressure
from the operating level of 1 bar. It takes only 10 s for the pressure
to climb to 1.2 bar.
For the rigorous model, the failure is simulated by running at
steady state for 10 s, putting the pressure controller on manual and
setting controller output signal (which is signal to the air-to-close
valve) to 100% (valve completely closed). The solid line in Fig. 8
shows the response of reflux-drum pressure. The rise in pressure
is less rapid, taking about 20 s to reach a pressure of 1.2 bar.
Fig. 9 shows how several other variables change for the two
models. The middle graph on the left shows how the reboiler heat
input is unchanged with the base model (dashed lines). However
with the rigorous model, the steam flowrate drops off (middle
graph on right). This occurs because the base temperature rises
as column pressure rises, which reduce the temperature differen-
tial in the reboiler and lowers the heat-transfer rate (solid line in
middle graph on left).
Thus the dynamic response of pressure is slowed down by both
the thermal capacitance of the condenser and the rigorous handling
of heat transfer in the reboiler.
 W.L. Luyben / Computers and Chemical Engineering 40 (2012) 110–116
Fig. 10. Pressure responses: surge in steam or QR .
B. Heat-input surge: A second event that could result in
over-pressuring the column would be a sudden increase in heat-
input. This could be caused by an operator mistakenly putting
the temperature controller on manual and opening the steam
valve.
With the basic model, this failure is simulated by running
at steady state for 0.5 min (note the change in the time scale),
putting the temperature controller on manual and setting the
controller output signal (the reboiler duty) equal to twice the
steady-state value. The dashed lines in Fig. 10 show the response
of reflux-drum pressure to this disturbance. The pressure rise is
much slower and much smaller in magnitude than for a condenser
cooling failure. It takes about 1 min for the pressure to rise up
to 1.037 bar.
For the rigorous model, the failure is simulated by running at
steady state for 0.5 min, putting the temperature controller on man-
ual and setting controller output signal (which is signal to the
air-to-open valve) to 100% (valve completely open). The solid line in
Fig. 10 shows that the response of reflux-drum pressure is slower,
taking about 1.4 min to reach 1.037 bar.
Fig. 11 compares the responses of the two models for sev-
eral other variables. The middle left graph shows that there is an
Fig. 11. Other variable with surge in steam or QR .
115
Fig. 12. Simultaneous loss of condenser cooling and reboiler heating.
immediate large rise in reboiler duty for the base model, but in
the rigorous model, the change in reboiler duty is fairly small. This
occurs because the change in the steam flowrate (middle right
graph) doubling the control valve opening does not double the
steam flowrate, which is set by the heat-transfer rate (as deter-
mined by the temperature differential between the steam and
column base).
Note that the pressure controller is on automatic during this dis-
turbance, so the condenser heat removal is increased in the base
model (dashed line in top left graph in Fig. 11) and condenser cool-
ing water flowrate is increased in the rigorous model (top right
graph).
It is interesting to see what the effect on pressure dynamics
would be if an immediate change in the reboiler duty is made when
condenser cooling is lost. Responses for the scenario are shown in
Fig. 12 for the two models. The rise in pressure is limited to only
1.18 bar in the base model and 1.12 in the rigorous model. Of course
the column temperatures would drop and product quality would
quickly go off-specification (methanol would drop out the bottom).
But over pressuring could be prevented by interlocking the reboiler
steam.
116 W.L. Luyben / Computers and Chemical Engineering 40 (2012) 110–116
4. Other issues
The numerical example used in this study has a large col-
umn (5.61 m in diameter) with large reboiler and condenser
duties. Are these results applicable with smaller columns?
The answer is yes. All the vessel volumes and heat-transfer
areas scale directly with flowrates, so the dynamics should
be the same. The only exception is tray liquid hydraulics
because weir lengths scale directly with column diame-
ter, not cross-sectional area. So liquid height of the weir
is different for different capacities. However, the short-
term pressure responses should not be affected by liquid
flowrates.
5. Conclusion
The standard basic Radfrac model in Aspen simulations does
not accurately predict the rapid pressure changes during emer-
gency situations because the default heat-exchanger models do
not account for heat-exchanger dynamics (condenser and reboiler).
Simulations can be developed that include external heat exchang-
ers whose dynamics can be incorporated with the model of the
column vessel.
Reference
Luyben, W. L. Use of dynamic simulation for reactor safety analysis. Computers and
Chemical Engineering, doi:10.1016/j.compchemeng.2012.02.013, in press.