Computers and Chemical Engineering 30 (2006) 1102–1118

Large-scale dynamic simulation for security assessment

of an ethylene oxide manufacturing process
Helen H. Lou ∗ , Jayachandran Chandrasekaran, Rebecca A. Smith
Department of Chemical Engineering, Lamar University, Beaumont, TX 77710, United States
Received 7 July 2005; received in revised form 9 February 2006; accepted 14 February 2006
Available online 17 April 2006

Abstract
Safety is the second nature of chemical processes. Process security is the extended concept and practice of process safety. In large-scale chemical
manufacturing, unit operations interact closely through various mass, energy, and momentum transfers. This may cause many possible occurrences
of “chain-reaction” type disasters, which should be rooted out completely.
To ensure process security and safety, the first step is the accurate assessment of security status of the processes. In this paper, a security-
bearing, large-scale process dynamic modeling and simulation method is utilized to perform security assessment of an ethylene oxide production
process involving various units, including a multi-tubular plug flow reactor operated under high pressure and temperature, adsorption and sep-
aration units, heat exchangers, recycle stream, and purge stream. The chemicals involved in this process possess serious environmental and
health hazards. By simulating process behavior under various scenarios, this method can be used to classify the operational space, assess
process security status quantitatively, foresee possible security failures, and give a critical review of design and operation policy to secure
operation.
© 2006 Elsevier Ltd. All rights reserved.

Keywords: Process security; Dynamic simulation

1. Introduction techniques are effective in identifying process malfunctions

Chemical processes are typically more risky and more
environmentally detrimental than processes involved in other
manufacturing industries. Safety is the second nature of chem-
ical processes. Practically, process safety problems are mainly
caused by facility failure, operator error, design deficiency,
false measurement data, management ignorance, etc. Over the
past decades, various process safety techniques and tools have
been developed and implemented in the industries. HAZard and
OPerability analysis (HAZOP), Layer Of Protection Analysis
(LOPA), and Fault Tree Analysis (FTA) are among the most
popular methods (Allen & Shonnard, 2002; Crowl & Louvar,
2002; Dimitriadis, Hackenberg, Shah, & Pantelides, 1996; Lees,
1996). Inherently safe design concepts and methodologies have
been developed to link risk assessment with risk management
(Edwards & Lawrence, 1993; Hendershot, 2003). These
∗ Corresponding author. Tel.: +1 409 880 8207; fax: +1 409 880 2197.
E-mail address: louhh@hal.lamar.edu (H.H. Lou).
and deriving solutions to ensure safe production.
The scientific basis for these safety enhancement techniques
are probability and logical reasoning in order to determine the
root causes of adverse conditions. These methods utilize almost
exclusively steady-state data that are at the nominal conditions,
as well as the upper and lower operational limits. Solutions,
usually statistical and qualitative, are derived generally based
on experience (Dowell, 2002).
Process security is an extended concept and practice of pro-
cess safety (Uygun, Lou, & Huang, 2003). Today, scientists and
engineers are greatly challenged to promptly develop a knowl-
edge base of process security that can fundamentally help the
industries perform process security analysis, assessment, and
improvement (Ragan, Kiburn, Roberts, & Kimmerle, 2002). The
AIChE Center for Chemical Process Safety (CCPS, 2002) devel-
oped a Security Vulnerability Assessment (SVA) methodology
which uses “the best judgment of security, safety, and other
appropriate professionals” (CCPS). It is systematic, but qualita-
tive. Since then, the National Institute of Justice, in collaboration
with Sandia National Laboratories, advanced the CCPS’s SVA

0098-1354/$ – see front matter © 2006 Elsevier Ltd. All rights reserved.
doi:10.1016/j.compchemeng.2006.02.011
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
Fig. 1. Security zone mapping between input space and output space (Lou et al., 2003).
methodology by using numerical values to quantify the security
degree of chemical facilities. This facilitates the comparison of
security levels of facilities, along with the prioritization of secu-
rity enhancement efforts (Ashcroft, Daniels, & Hart, 2002; NIJ,
2002). Nevertheless, the methodology is still experience based.
A fundamental basis for process security analysis is the char-
acterization of process behavior in the entire operational space.
Lou, Muthusamy and Huang (2003) suggested partitioning the
process input and output spaces into four operation zones—(i)
Zone I: the normal operation zone where process security is not
an issue, (ii) Zone II: the security-alerting zone where a secu-
rity sensitive process change must be dealt with, (iii) Zone III:
the security-threatening zone where a security-assurance action
must be taken immediately, and (iv) Zone IV: the security dis-
aster zone where severe process changes are irreversible and
a disastrous consequence results. Zones III and IV combined
together are named SAT zones. Fig. 1 depicts the operation zone
classification for a general process and the mapping between the
input (SAT I) and the output (SAT O) spaces. Based on the zone
classifications, a numerical Process Operational Security (POS)
index is derived to quantify the security status of the process.
This methodology has been applied to the zone boundary clas-
sification and process security status quantification of a batch
reactor.
In large-scale chemical manufacturing, unit operations inter-
act closely through various mass, energy, and momentum trans-
fers. The “chain-reaction” type of disaster should be rooted out
completely by implementing process safety and security tech-
niques. Modeling and simulation techniques have been used for
studying safety issues in chemical processes (Heikkila, Hurme,
& Jarvelaien, 1996; Shacham, Brauner, & Cutlip, 2001). So
far, however, complete safety and security analysis based on
the dynamics of large-scale, multi-unit processes is rare. In
this paper, a study of an ethylene oxide manufacturing pro-
cess was performed for accurate process security assessment.
The inherent security vulnerability of process design and opera-
tions and the effect of security sensitive disturbance on the entire
process were identified through dynamic simulation. The oper-
1103
ating zone boundaries were evaluated from the process security
point of view. This will facilitate the quantitative evaluation of
process security status, the prediction of possible security fail-
ures, and the review of design and operation policy to secure
operation.
2. General properties of ethylene oxide
Ethylene oxide is an important commercial chemical. It
is used to make ethylene glycol (the primary ingredient in
antifreeze), poly(ethylene oxide), glycol ethers, ethanolamines,
and surfactants, etc. It is a colorless gas that condenses at low
temperatures into a liquid and is miscible with water and most
organic solvents. It is very flammable and explosive (Bailey &
Koleske, 1976; Baize, 1961; Britton, 1990; Carey et al., 2004).
Ethylene oxide is very reactive and is one of the most versatile
chemical intermediates. Ethylene oxide can be relatively toxic
in both liquid and gaseous forms and is considered as a potential
human carcinogen and reproductive hazard.
Ethylene oxide is flammable in air at all concentrations above
2.6% (by volume) at temperatures above 51.3 ◦ F. The auto-
ignition temperature (AIT) of ethylene oxide in air at atmo-
spheric pressure is 804 ◦ F. However, any contaminants present,
such as rust can significantly reduce the AIT. Pure ethylene oxide
vapor decomposes explosively if ignited—even in the absence
of air. Ethylene oxide decomposition is initiated if the chemical
is heated to about 1040 ◦ F, the auto-decomposition temperature
(ADT). Decomposition is also catalyzed by metal acetylides, in
addition to the metals copper, silver, mercury, and their alloys.
Increasing pressure lowers both the AIT and ADT. Solutions of
ethylene oxide in water may give rise to flammable vapor. Even
a 1% (volume) solution of ethylene oxide in water has a closed
cup flashpoint of 71.6 ◦ F (Coombs & Palombo, 1997).
Ethylene oxide is stable at room temperature in the absence
of catalysts. Solely, thermal initiation of polymerization begins
at around 212 ◦ F. The polymerization of ethylene oxide is highly
exothermic and if the temperature is not controlled by removal
of heat at a sufficient rate, the polymerization becomes self-
1104 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
accelerating. This can lead to vaporization of unreacted ethy-
lene oxide and possibly to an explosive decomposition of the
vapor.
It is clear that ethylene oxide processes have inherent safety
and security vulnerability. Several instances of fires and defla-
grations in ethylene oxide production units have been reported
in the past (Carey et al., 2004).
3. Case study of an ethylene oxide production plant
In this paper, an ethylene oxide production plant based on
the direct oxidation process (Huang, Resendez, & Tran, 1999;
Kirk, 2004) has been simulated using Aspen Dynamics simu-
lation software. The flow sheet of this process is presented in
Fig. 2. This process consists of the following parts: the reaction
system, the absorption system, and the ethylene oxide purifica-
tion system (Kiguchi, Kumazawa, & Nakai, 1976). The RKS-
MHV2 thermodynamic package is used in this simulation since
it is comparable to the PENG-ROB property method and it is
recommended for gas processing, refinery, and petrochemical
applications (Aspen Technology Inc., 2004).
3.1. Reaction system
In the reaction system, a shell and tube vertical packed plug
flow (Berg & DeJong, 1979) reactor (Unit ID: R-801) containing
silver/alumina catalyst is used, since it allows for high veloci-
ties and requires less volume than other types of reactors. Hot
spots can cause severe catalyst degradation and thermal run-
away temperatures can lead to catastrophic process failures.
In order to reduce hot spot formation and prevent runaway
reaction, the adoption of the shell and tube design is critical
(Coombs & Palombo, 1997). The feed to the reactor is com-
posed of high purity grade oxygen and ethylene. The diluter
Fig. 2. Flow diagram of an ethylene oxide process.
used in industrial reactors is methane. Since the diluter is inert
and is used only to decrease the concentration of oxygen in the
reactor recycle, it is assumed to be present and is not included
in the actual feed composition in this simulation. The cata-
lyst eases the partial oxidation of ethylene to ethylene oxide
and the complete oxidation of ethylene to carbon dioxide and
water (Kenson & Lapkin, 1999). The design details of this reac-
tor are presented in Table 1(a). To prevent runaway reactions
and hot spot formations, water is used as a cooling medium
on the shell side of the reactor and the details are presented in
Table 1(a).
Typical pressure drop across a reactor is between 10 and
20 psi (Huang et al., 1999). In this simulation, a pressure drop
of 15 psi is selected as the desired nominal operating condition
for this reactor. Stainless steel is chosen as the tube material and
carbon steel is chosen as the material of construction for the
reactor. Since ethylene oxide is very reactive with rust and there
is a large amount of ethylene oxide flowing through the tube
side, the use of stainless steel is critical to avoid a hazardous
situation.
Equimolar flow rates of fresh ethylene and oxygen are fed to
the plug flow reactor. Two major reactions occur in the ethylene
oxide reactor: the partial oxidation of ethylene to ethylene oxide,
with approximately 81% selectivity towards this reaction and the
total combustion of ethylene to carbon dioxide and water. The
stoichiometric reactions, along with the heat of reaction data are
shown below (Meyers, 1986).
Ag
C2 H4 + 21 O2 −→C2 H4 O + 101.1 Btu/mol (1)
Ag
C2 H4 + 3O2 −→2CO2 + 2H2 O + 1254 Btu/mol (2)
A third possible reaction, which could occur, is the formation
of ethylene glycol from the addition of water to ethylene oxide.
There are two reasons why this reaction is not considered in this
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118 1105

Table 1
Reactor specifications
(a) Design details

Process stream inlet pressure (psi) 221

Process stream outlet pressure (psi) 206
Process stream inlet temperature (◦ F) 266.0
Process stream outlet temperature (◦ F) 405.0
Coolant stream inlet pressure (psi) 85
Coolant stream outlet pressure (psi) 84
Coolant stream inlet temperature (◦ F) 252.9
Coolant stream outlet temperature (◦ F) 319.4
Coolant stream flow rate (lbmol/h) 4568.2
Heat transfer coefficient (Btu/(h ft2 ◦ R)) 31.0

(b) Nominal operating conditions

Number of tubes 6848

Length of tubes (ft) 38.00
Inner diameter of tubes (ft) 0.13
Pressure drop (psi) 15

Component Stream

Fresh ethylene (lbmol/h) Fresh oxygen (lbmol/h) Total feed stream (fresh + recycle) (lbmol/h) Outlet stream (lbmol/h)

(c) Feed and effluent data

Ethylene 1050.0 0.0 1513.5 571.8
Ethylene oxide 0.0 0.0 4.7E−05 862.6
Carbon dioxide 0.0 0.0 558.9 717.2
Water 0.0 0.0 3.9 162.1
Oxygen 0.0 1050.0 3215.4 2546.7

simulation. First, in the reaction unit, the concentration of water 3.2. Absorption system
in process streams is very low, providing a small driving force for
this reaction. Secondly, rust catalyzes this side reaction. Since The reactor effluent leaves the reactor and enters the absorber
stainless steel reactor tubes are used, rust is negligible (Kenson (Unit ID: C-801) after a heat exchanger, with a great deal of inert
& Lapkin, 1999). The rate laws of both reactions follow first- gases and unreacted ethylene. In the ethylene oxide absorber,
order kinetics in ethylene concentration, and they are expressed
using the following equations:

rethylene = k × cethylene (3)

k = k0 × eE/RT (4)

where rethylene is the reaction rate, lbmol/(L h); k the reaction

rate constant, h−1 ; k0 the pre-exponential factor, h−1 ; cethylene the
concentration of ethylene, lbmol/L; E the activation energy of the
reaction, Btu/lbmol; R the Gas constant, 3.575 Btu/(lbmol K); T
is the temperature, K.
For the desired EO production reaction, k0 = 1.1E + 12 h−1 ,
E = 3.84E+04 Btu/lbmol; for the undesired combustion reac-
tion, k0 = 4.8E + 14 h−1 , E = 5.2E+04 Btu/lbmol. It needs to be
pointed out that instead of using the first-order kinetics, the user
may choose a Langmuir–Hinshelwood type kinetics as presented
by Borman and Westertrep (1992) for the simulation as well.
The nominal operating conditions, as well as feed and efflu-
ent data of the reactor under nominal conditions are given
in Table 1(b and c). Based on the pre-exponential factor
and the activation energy values, the values of the rate con-
stants are predicted and plotted against temperature (Fig. 3a Fig. 3. Reaction rate constant vs. temperature graph for the temperature range
and b). of: (a) 450–700 ◦ F and (b) 270–450 ◦ F.
1106 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118

Table 2
Absorber specifications
(a) Design details

Number of stages 10
COOL OUT feed stage # 10
WATER feed stage # 1
ABS-TOP stage # 1
ABS-BTM stage # 10
Tray type Packed bed
Tray diameter (ft) 4.95

(b) Nominal operating conditions

Stage 10 pressure (psi) 483

Stage 1 pressure (psi) 481
Stage 10 temperature (◦ F) 73.2
Stage 1 temperature (◦ F) 139.8
Feed temperature (◦ F) 115.0

Component Stream
Absorber inlet (lbmol/h) Fresh solvent water to absorber (lbmol/h) ABS-TOP (lbmol/h) ABS-BTM (lbmol/h)

(c) Feed and effluent data

Ethylene 571.8 0.0 537.7 34.0
Ethylene oxide 862.6 0.0 5.5E−05 862.6
Carbon dioxide 717.2 0.0 648.4 68.8
Water 162.1 4950.0 4.5 5107.7
Oxygen 2546.7 0.0 2512.0 34.6

water is used to absorb the ethylene oxide from the raw prod- Table 3
uct stream. It is necessary to achieve nearly complete removal of Distillation Column C-802 specifications
ethylene oxide (Barker & Zomerdijk, 1973). The ethylene oxide
(a) Design details
exits at the bottom of the absorber (Stream ID: ABS-BTM), and
enters the purification system. The gases leave through the over- Number of stages 35
head (Stream ID: ABS-TOP) of the absorber. The top stream Feed to COL-1 stage # 25
COL1-TOP stage # 1
from the absorber is then sent to the splitter (Unit ID: S-801), COL1-BTM stage # 35
where a portion of the ABS-TOP stream is purged to the atmo- Reflux ratio 5.45
sphere and the remaining components are recycled back to the Tray type Sieve
reactor. The purge stream was set at 0.138 fraction of the total Tray diameter (ft) 7.50
molar flow of ABS-TOP. Table 2(a–c) give the design details, Length of reflux drum (ft) 8.00
Diameter of reflux drum (ft) 4.00
nominal operating conditions, as well as feed and effluent data Sump vessel height (ft) 4.00
of the absorber under nominal conditions. Sump vessel diameter (ft) 5.00

3.3. Ethylene oxide purification system (b) Nominal operating conditions

Condenser pressure (psi) 456

Raw ethylene oxide absorbed by water exits the absorber as Reboiler pressure (psi) 473
the bottom stream (Stream ID: ABS-BTM) and enters the first Condenser temperature (◦ F) 265.7
Reboiler temperature (◦ F) 461.6
distillation column (Unit ID: C-802) of the purification system.
Feed Temperature (◦ F) 109.6
The purification system consists of two distillation columns. Reboiler duty (MMBtu/h) 88.9
The first column is used to separate water from ethylene oxide Condenser duty (MMBtu/h) −42.6
and traces of other gases. The design details, nominal operat-
ing conditions, as well as feed and effluent data under nominal Component Stream
conditions for this column are given in Table 3(a–c). Water gets COL-1 feed COL1-TOP COL1-BTM
separated at the bottom of the Column C-802 and all the other (lbmol/h) (lbmol/h) (lbmol/h)
gases exit through the top of C-802. (c) Feed and effluent data
The top stream from the first column (Stream ID: COL1- Ethylene 34.0 34.0 6.9E−17
TOP) is then fed to second column (Unit ID: C-803), where Ethylene oxide 862.6 862.6 1.5E−05
ethylene oxide of 99.5% (mass) purity is obtained at the bot- Carbon dioxide 68.8 68.8 1.7E−15
Water 5107.7 12.2 5095.5
tom of the Column C-803 as PURE-EO stream and all other
Oxygen 34.6 34.6 1.1E−19
gases are vented out through the top of the Column through
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118 1107

Table 4 lution control and process machinery operations have also been
Distillation Column C-803 specifications reported (EPA, 1975). The largest source of organic emissions
(a) Design details to the atmosphere is the cycle purge. Based on careful review of
Number of stages 15
the entire process, the following process security sensitive input
Feed to COL-2 stage # 5 and output variables for each unit are identified.
VENT-GAS stage # 1
PURE-EO stage # 15 4.1. Process security sensitive variables for Reactor R-801
Reflux ratio 6.70
Tray type Sieve
Tray diameter (ft) 3.50
The following input and output security sensitive variables
Length of reflux drum (ft) 6.00 are considered for the reactor:
Diameter of reflux drum (ft) 3.00
Sump vessel height (ft) 2.00 Input variables:
Sump vessel diameter (ft) 3.00 - Molar flow rate of ethylene to reactor (lbmol/h).
(b) Nominal operating conditions
- Molar flow rate of oxygen to reactor (lbmol/h).
- Molar flow rate of cooling water to reactor (lbmol/h).
Condenser pressure (psi) 431 Output variables:
Reboiler pressure (psi) 440
Condenser temperature (◦ F) 9.1
- Reactor temperature (◦ F).
Reboiler temperature (◦ F) 285.9 - Reactor pressure (psi).
Feed Temperature (◦ F) 321.8 - Reactor pressure drop (psi).
Reboiler duty (MMBtu/h) 3.7
Condenser duty (MMBtu/h) −11.1 4.2. Process security sensitive variables for Absorber
Component Stream
C-801

COL-2 feed COL2-TOP COL2-BTM The following input and output security sensitive variables
(lbmol/h) (lbmol/h) (lbmol/h)
are considered for the Absorber C-801:
(c) Feed and effluent data
Ethylene 34.0 33.7 0.4 Input variables:
Ethylene oxide 862.6 0.8 861.9
Carbon dioxide 68.8 68.8 0.0
- Total feed flow rate variation to absorber due to molar flow
Water 12.2 2.1E−04 12.2 rate change of ethylene to reactor (lbmol/h).
Oxygen 34.6 34.6 3.8E−06 - Total feed flow rate variation to absorber due to molar flow
rate change of oxygen to reactor (lbmol/h).
- Molar flow rate of solvent water to Absorber C-801
(lbmol/h).
VENT-GAS stream. Assuming a vent gas scrubber is present - Feed temperature (◦ F).
to remove the ethylene oxide going with VENT-GAS stream, Output variables:
although it is not included in this simulation. In the vent gas - Absorber temperature (◦ F).
scrubber, ethylene oxide is usually absorbed by a strong acid - Absorber pressure (psi).
stream which runs counter current to the vent gas (Coombs - Concentration of ethylene oxide in purge stream (mg/m3 ).
& Palombo, 1997). For the second column, C-803, the design
details, nominal operating conditions, as well as feed and efflu- 4.3. Process security sensitive variables for Column C-802
ent data under nominal conditions are given in Table 4(a–c),
respectively. The following input and output security sensitive variables
are considered for distillation Column C-802:
4. Identification of process security sensitive variables
Input variables:
Reactor temperature is a critical variable to maintain normal - Total feed flow rate variation to C-802 due to molar flow rate
production. The reactor stability is affected by the internal tem- change in ethylene to reactor (lbmol/h).
perature profile in the tubular catalyst bed (Kirk, 2004). The - Total feed flow rate variation to C-802 due to molar flow rate
reactor operation is also very sensitive to pressure and pressure change in oxygen to reactor (lbmol/h).
drop. High pressure increases production rate and conversion - Total feed flow rate variation to C-802 due to molar flow rate
rate, however, it reduces the flammable limit of the process gas change in water to absorber (lbmol/h).
as well as increases equipment costs. For the absorber and dis- - Temperature of feed to C-802 (◦ F).
tillation columns, pressure is more sensitive than temperature. - Condenser cooling duty (Btu/h).
Environmental concerns are also important for safety and secu- - Reboiler duty (Btu/h).
rity analysis. The primary air emissions from the formation of Output variables:
ethylene oxide by direct oxidation are ethylene, ethylene oxide, - Column C-802 temperature (◦ F).
carbon dioxide, and ethane. Traces of NOx and SOx from pol- - Column C-802 pressure (psi).
1108 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
4.4. Process security sensitive variables for Column C-803
The following input and output security sensitive variables
are considered for distillation Column C-803:
Input variables:
- Total feed flow rate variation to C-803 due to flow rate change
in ethylene to reactor (lbmol/h).
- Total feed flow rate variation to C-803 due to flow rate change
in oxygen to reactor (lbmol/h).
- Total feed flow rate variation to C-803 due to flow change
rate in water to absorber (lbmol/h).
- Feed temperature to C-803 (◦ F).
- Condenser cooling duty (Btu/h).
- Reboiler duty (Btu/h).
Output variables:
- Column C-803 temperature (◦ F).
- Column C-803 pressure (psi).
5. Identification of zone boundaries for output variables
In this work, based on the aforementioned process security
concerns, the security output zone boundaries for the reactor,
absorber, and distillation columns are identified one by one based
on the following factors:
- Physical limits and the related standards and regulations
imposed on the unit vessel based on the critical operation vari-
ables, such as temperature and pressure.
- Abnormal phenomena including hot spots, thermal runaway,
back flow, flooding in columns, etc.
- Environmental and health concerns including purge concen-
trations, storage concerns, etc.
- Physical and chemical properties of the chemicals including
flash point, AIT, ADT, etc.
The above factors are analyzed by studying not only the
effects of security sensitive disturbance on stand-alone units,
but also the comprehensive effect of disturbance propagation
throughout a large-scale system, to identify the security status
of the entire process system.
5.1. Zone boundary identification for output variables of
Reactor R-801
Reactor pressure and temperature are the output variables
considered in this case study. The security-bearing tempera-
ture boundaries are decided based on several factors, including
the rate constant versus temperature graph (Fig. 3a and b), the
auto-ignition temperature of ethylene oxide and the material for
construction of reactor. The AIT of ethylene oxide at atmo-
spheric pressure is 804 ◦ F. The reactor is operated at an inlet
pressure of 221 psi and an outlet pressure of 206 psi. Therefore,
the AIT of ethylene oxide will be well below 804 ◦ F. Since the
value of AIT is not available at these pressure ranges, the classifi-
cation on temperature boundary was made based on rate constant
versus temperature graph. From Fig. 3a, it is evident that above
Table 5
SAT output space zone boundaries for the Reactor R-801 based on reactor outlet
temperature
Zone number Zone category Reactor outlet temperature (◦ F)
Zone I Normal operating zone 405.0–450.0
Zone II Security-alerting zone 450.0–565.0
Zone III Security-threatening zone 565.0–600.0
Zone IV Security disaster zone >600.0
600 ◦ F the rate constant for the undesired reaction becomes much
higher than the rate constant for the desired reaction. There-
fore, the undesired secondary reaction dominates above 600 ◦ F.
Since the heat of combustion reaction is very high and can eas-
ily cause runaway, 600 ◦ F is considered as the boundary for the
security-threatening zone. Fig. 3a also shows that above 565 ◦ F,
the reaction rate constant for undesired combustion reaction
is starting to become greater than the desired ethylene oxide
reaction. Therefore, 565 ◦ F is taken as the zone boundary for
the security-alerting zone. From Fig. 3b, it is evident that until
450 ◦ F, the rate constant of the desired ethylene oxide reaction
is greater than that of the undesired combustion reaction. There-
fore, 450 ◦ F is taken as the boundary for normal operating zone.
The output zone boundaries based on temperature for the reactor
is given in Table 5.
Certainly, the pressure of the reactor is very critical for safety
and security purposes. The maximum allowable working pres-
sure (MAWP) of the reactor can be calculated based on safety
and health code using the formula (Virginia Safety and Health
Codes Board and Virginia Department of Labor and Industry,
2003):
E
The maximum allowable working pressure = Ts × t ×
R × FS
where Ts is the ultimate tensile strength of tube material,
74,500 psi; t the thickness of the tube, 0.204 in.; E the effi-
ciency of longitudinal joint, 40%; R the inside radius of the
tube, 1.56 in.; FS is the factor of safety allowed, 6.
Therefore,
MAWP of the Reactor R-801
74, 500 × 0.204 × 0.4
= = 649.5 psi
1.56 × 6
MAWP is set as the boundary of the security-alerting zone.
All pressure vessels other than unfired steam boilers shall
be protected by a pressure-relieving device that shall prevent
pressure from rising more than 10% of MAWP (American
Society of Mechanical Engineers, 1992). So, the value for
MAWP × 1.10 = 714 psi is set as the boundary for the security-
threatening zone.
A pressure of 10% more than the nominal setting
(221 psi × 1.10 = 243 psi) is considered as the boundary for the
normal operating zone. It needs to be pointed out that in this
dynamic simulation, it is observed that the reaction system is
extremely sensitive to the pressure change. If the pressure con-
trol valve cannot function, a very small disturbance can lead
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
to reaction runaway or convergence problems in the simulation.
Hence, in the following study, the pressure was tightly controlled
at the set point value to study the effect of the other security sen-
sitive variables.
Another important input security sensitive variable is the
reactor pressure drop. Typical pressure drop across a reactor
should be between 10 and 20 psi (Huang et al., 1999). In this
simulation, the reactor is operated at a nominal pressure drop
of 15 psi. A pressure drop of 10 psi leads to an unstable state,
therefore 10 psi is the boundary for normal operating zone. A
pressure drop of less than zero will produce back flow in the
reactor, which causes serious problems when the catalyst from
the reactor enters the ethylene storage tank and causes violent,
exothermic polymerization. Therefore, a pressure drop of zero
is taken as the boundary for security-threatening zone. Again,
since the simulation is extremely sensitive to the pressure drop,
the boundary of the security-alerting zone could not be identified
further. We can say that the boundary for the security-alerting
zone overlaps with the security-threatening zone in this case.
5.2. Zone boundary identification for output variables of
Absorber C-801
For Absorber C-801, pressure, concentration (in units of
mg/m3 ) of ethylene oxide in the purge stream, and tempera-
ture are considered as the security sensitive output variables,
and their zone boundaries are identified one by one. The maxi-
mum pressure and temperature at which any reactor or pressure
vessel can be used will depend upon the design of the vessel and
the materials used in its construction.
In identifying the pressure zone boundary, one guideline used
by many process engineers is that the design pressure can be set
as 10% more than the maximum operating pressure (Harvey,
1991; Leckner, 2000). Therefore, a value of 10% greater than
the normal operating pressure is considered as the boundary of
nominal operating zone. The normal operating pressure for C-
801 is 481 psi and 10% more than that value is 531 psi. Therefore,
531 psi is set as the boundary for normal operating zone. Simi-
larly, the MAWP value is set as the boundary for alerting zone
and 10% above MAWP will be the boundary for threatening
zone.
Calculation of MAWP for C-801:
E
Maximum allowable working pressure = Ts × t ×
R × FS
where Ts is the ultimate tensile strength of shell plate,
191,450 psi; t the minimum thickness of shell plate of weakest
course, 0.5 in.; E the efficiency of longitudinal joint depend-
ing upon construction, Brazed Steel, 80%; R the inside radius
of weakest course of shell, 31.32 in.; FS is the factor of safety
allowed, 4.
Therefore,
MAWP of the Absorber C-801
191, 450 × 0.5 × 0.8
= = 611 psi
31.32 × 4
1109
Hence, for the absorber, 611 psi is the zone boundary for
security-alerting zone and 10% more than MAWP, i.e. 672 psi
is taken as the boundary for security-threatening zone.
Since all materials lose strength at elevated temperatures,
any pressure rating must be stated in terms of the temperature at
which it applies (Parr Instrument Company, 2004a). There are
a number of factors that determine the maximum temperature
of a vessel. For most applications, it is the gasket material. For
vessels with O-ring seals, the temperature is limited to 437 ◦ F
(Parr Instrument Company, 2004b), which is kept as the zone
boundary for security-threatening zone. Since the maximum
acceptance temperature variation under normal conditions is
18% above the nominal value of 139.8 ◦ F, therefore 165.0 ◦ F
is considered as the boundary of the normal operating zone.
The concentration of ethylene oxide going from the purge
stream into the atmosphere are regulated based on health
data from inhalation exposure. National Institute of Occupa-
tional Safety and Health (NIOSH) recommended exposure limit
to 0.2 mg/m3 (Carey et al., 2004). This is to ensure that a
worker can escape from an exposure condition that is likely
to cause death or immediate or delayed permanent adverse
health effects or prevent escape from the environment. ACGIH
TLV—American Conference of Governmental and Industrial
Hygienists’ threshold limit value is expressed as a time-weighted
average; the concentration of a substance to which most work-
ers can be exposed to without adverse effect is 1.8 mg/m3
(Carey et al., 2004). According to AIHA ERPG—American
Industrial Hygiene Association’s Emergency Response Plan-
ning Guidelines (ERPG), 90 mg/m3 is the maximum airborne
concentration (Carey et al., 2004). Below this particular value,
it is believed nearly all individuals could be exposed to up
to 1 h without experiencing other effects that could impair
their abilities to take protective action. Based on the afore-
mentioned regulations, 0.2 mg/m3 is set as the boundary limit
for normal operating zone, 1.8 mg/m3 is set as the bound-
ary for security-alerting zone, and 90 mg/m3 of ethylene oxide
concentration in the purge stream is set as the boundary for
security-threatening zone. Table 6 lists the output variable
zone boundaries for absorber based on pressure and purge
concentration.
5.3. Zone boundary identification of output variables for
Column C-802
The column pressure and temperature are considered as
the output sensitive variables for Column C-802. The pressure
Table 6
SAT output space zone boundaries for the Absorber C-801
Zone Zone category Pressure Concentration of
number (psi) ethylene oxide in
purge (mg/m3 )
Zone I Normal operating zone 483–531 0–0.2
Zone II Security-alerting zone 531–611 0.2–1.8
Zone III Security-threatening zone 611–672 1.8–90.0
Zone IV Security disaster zone >672 >90.0
1110 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
Table 7
SAT output space zone boundaries for the Column C-802
Zone number Zone category Bottom pressure (psi)
Zone I Normal operating zone 473–520
Zone II Security-alerting zone 520–626
Zone III Security-threatening zone 626–689
Zone IV Security disaster zone >689
boundaries can be set based on similar discussions of zone
boundaries for the Absorber C-801. A value of 10% more than
the normal operating pressure is considered to be the normal
operating zone boundary. Bottom pressure of C-802, under
normal operating conditions, is 473 psi and 10% more than that
value yields a pressure of 520 psi. Therefore, 520 psi is set as
the boundary for normal operating zone. Maximum allowable
working pressure is calculated for the column based on the
design specifications of C-802:
E 191, 450 × 0.45 × 0.6
Maximum allowable working pressure = Ts × t ×
R × FS
where Ts is the ultimate tensile strength of shell plate,
191,450 psi; t the minimum thickness of shell plate of weakest
course, 0.8 in.; E the efficiency of longitudinal joint depending
upon construction, Brazed Steel, 80%; R the inside radius of
the column, 48.9 in.; FS is the factor of safety allowed, 4.
Therefore,
191, 450 × 0.8 × 0.8
MAWP of C-802 = = 626 psi
48.9 × 4
From this calculation, 626 psi is the zone boundary for
security-alerting zone, and 10% more than MAWP, i.e. 689 psi,
is taken as the boundary for security-threatening zone. Table 7
lists the zone boundaries based on pressure (output variable) for
C-802.
For vessels with contained PolyTetraFluoroEthylene (PTFE)
seals, the maximum temperature that they can stand is 662 ◦ F
(Parr Instrument Company, 2004a,b). Since the maximum tem-
perature in the column is 461 ◦ F under normal conditions, a
limit of 662 ◦ F is kept as the zone boundary for security-
threatening zone of this column. Since the temperature of
the distillation column will not change too much unless it is
intentionally heated, so the temperature zone is not further
classified.
5.4. Zone boundary identification of output variables for
Column C-803
The column pressure and temperature are considered as
the output sensitive variables for Column C-803. The pressure
boundaries can be set based on the same method of setting zone
boundaries for the Absorber C-801. A value of 10% more than
the maximum operating pressure is considered to be the bound-
ary of the normal operating zone. Under nominal setting, the bot-
tom pressure of C-803 is 440 psi. 10% more than 440 psi yields a
pressure of 484 psi. Therefore, 484 psi is set as the boundary for
normal operating zone. Maximum allowable working pressure
Table 8
SAT output space zone boundaries for the Column C-803
Zone number Zone category Bottom pressure (psi)
Zone I Normal operating zone 440–484
Zone II Security-alerting zone 484–588
Zone III Security-threatening zone 588–647
Zone IV Security disaster zone >647
for this column is calculated using the design details of C-803:
E
Maximum allowable working pressure = Ts × t ×
R × FS
where Ts is the ultimate tensile strength of shell plate,
191,450 psi; t the minimum thickness of shell plate of weakest
course, 0.45 in.; E the efficiency of longitudinal joint depending
upon construction, single butt weld, 60%; R the inside shall be
used, 21.96 in.; FS is the factor of safety allowed, 4.
Therefore,
MAWP of C-803 = = 588 psi
21.96 × 4
Hence, 588 psi is the zone boundary for security-alerting zone
and 10% more than MAWP, i.e. 647 psi is taken as the boundary
for security-threatening zone. Table 8 lists the zone boundaries
based on the pressure of C-803.
The maximum temperature in the Column C-803 under nor-
mal conditions is 285.5 ◦ F. As mentioned before, there are a
number of factors that determine the maximum temperature of
vessel. For most applications, it is the gasket material. Ves-
sels with O-ring seals are limited to 437 ◦ F (Parr Instrument
Company, 2004b), hence 437 ◦ F is kept as the boundary for
security-threatening zone of Column C-803. Again, since the
temperature of the distillation column will not change too much
unless it is intentionally heated, so the temperature zone is not
further classified.
6. Zone boundary identification for security sensitive
input variables
By knowing the security sensitive output variables, the input
security sensitive variables are varied to study their zone bound-
aries based on the limits imposed by the output variables. The
variation in one input variable might cause more than one unit
to move to a different zone. In such cases, the tightest con-
straint that cause any unit to first cross the boundary of one of its
specific output zone is considered as the boundary of that spe-
cific zone for the entire process. Using the dynamic simulation
model created via Aspen Dynamics, the input variables were
varied and their effects on different unit operations were iden-
tified. It needs to be pointed out that in reactor operation, both
pressure and pressure drop are the most sensitive variables. Even
with small variation in pressure and pressure drop, convergence
problems may occur. Hence, the pressure and pressure drop in
the reactor are fixed in the simulation. In this work, throughout
the case studies, when each variable is varied, all the other input
variables and operating parameters are kept at the nominal oper-
ating condition, then the dynamic simulation is conducted. In
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
Fig. 4. Reactor and its coolant temperature profile for decrease in ethylene flow rate at: (a) nominal ethylene flow rate, (b) 23.3% decrease in ethylene flow rate, (c)
33.3% decrease in ethylene flow rate, and (d) 42% decrease in ethylene flow rate.
the future, the combined effects of different disturbances will be
studied as well. To illustrate the process security zone classifica-
tion methodology, case studies on the following list of security
sensitive input variables are presented in the following sections:
- Decrease in molar flow rate of fresh ethylene to reactor
(lbmol/h).
- Increase in molar flow rate of fresh oxygen to the reactor
(lbmol/h).
- Decrease in molar flow rate of cooling water to reactor
(lbmol/h).
- Decrease in molar flow rate of solvent water to Absorber C-
801 (lbmol/h).
- Increase in feed temperature to Absorber C-801 (◦ F).
- Decrease in condenser duty of Column C-802 (Btu/h).
Especially, the effect of variations of fresh ethylene flow and
oxygen flow to the reactor as well as the decrease in solvent
water flow to the absorber are delineated in detail to elaborate
the “chain effect” of security sensitive disturbance to different
units.
6.1. Decrease in molar flow rate of fresh ethylene to reactor
The effect of decrease in ethylene molar flow rate to the
reactor on the Reactor R-801, Absorber C-801, and the two dis-
tillation columns, C-802 and C-803, were studied. In the normal
operating condition, fresh ethylene feed to the reactor system is
1050 lbmol/h. Simulation results are recoded to study the change
of reactor temperature and coolant temperature profile versus
decrease in ethylene molar flow rate.
For the reaction kinetics shown in Eqs. (2)–(4), both the
desired reaction and undesired combustion reaction’s reaction
rates are first order with the concentration of ethylene. If the
ethylene flow is decreased, the residence time in the reactor
increases. As the residence time is increased, the conversion
of ethylene increases and the temperature along the reactor
increases as shown in Fig. 4. As the temperature increases, the
undesired combustion reaction whose heat of reaction is very
high as shown in equation Eq. (2) dominates the ethylene oxide
1111
reaction. Therefore, a decrease in ethylene flow causes very high
increase in temperature. The reactor and the coolant tempera-
ture profile (Fig. 4) under different scenarios are also presented.
At nominal operating pressure of 84 psi, the boiling temperature
of water is at 320 ◦ F as shown in Fig. 4a. However, at a 23.3%
decrease in fresh ethylene molar flow rate to the reactor, the
temperature after 30 ft of reactor starts increasing sharply. As a
result, the cooling water starts superheating, the cooling water
stream’s temperature continues increasing to 350 ◦ F (Fig. 4b). At
33.3% decrease of ethylene molar flow rate, the temperature dif-
ference in the reactor after 30 ft reaches a value of 170 ◦ F, which
is too high. Therefore, 23.3% is the boundary for Normal oper-
ation limit and 33.3 may be the boundary for security-alerting
zone (Fig. 4c). From Fig. 4d, a 42% decrease in ethylene molar
flow rate causes the reactor outlet temperature to cross 600 ◦ F,
which is the boundary of security-threatening zone. Therefore,
42% decrease in ethylene is taken as the boundary for security-
threatening zone. The trend of reactor outlet temperature change
versus decrease in fresh ethylene molar flow rate is summarized
in Fig. 5a and the trend of ethylene conversion rate change versus
decrease in ethylene flow rate is presented in Fig. 5b.
It needs to be explained that at 26% decrease of ethylene flow
rate, the reactor outlet temperature reaches 450 ◦ F as shown in
Fig. 5a. Although 450 ◦ F is the boundary of normal operating
zone based on analysis of reaction kinetics, whereas at 23.3%
decrease of ethylene flow, the coolant starts to superheat and
affects the reactor temperature profile. Therefore, the tighter
constraint of a 23.3% decrease in ethylene molar flow rate is
taken as the boundary for the normal operating zone.
Similarly, at 39.0% decease ethylene flow rate, the reactor
outlet temperature reaches 565 ◦ F as shown in Fig. 5a. Although
565 ◦ F is the boundary of security-alerting zone based on the
analysis of reaction kinetics, whereas at 33.3% decrease of ethy-
lene flow, hot spot generated after 30 ft of the tube. Hitherto, the
tighter constraint of a 33.3% decrease in ethylene molar flow
rate is taken as the boundary for security-alerting zone.
Simulation results also show that decreasing ethylene
flow to the reactor has marginal effects on the absorber’s
temperature and pressure profile. However, at a 42% decrease
in ethylene molar flow rate, all trays are flooded. This is because
1112 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118

Fig. 6. Effect of increasing fresh oxygen flow rate to reactor on the absorber
pressure.

conducted to examine the operations of the reactor, absorber,

and distillation columns. This case study is more complicated,
since the pressure of the reactor, purge stream concentration,
and hydraulic analysis of the absorber all play important roles
in this study.
An increase in the molar flow rate of oxygen to the reactor
decreases the residence time and thereby the amount of product
decreases, which results in temperature decrease. As proved by
Fig. 5. Reactor outlet temperature and conversion rate vs. decrease in fresh
ethylene flow rate: (a) reactor outlet temperature change vs. decrease in ethylene the dynamic simulations, increase in oxygen molar flow rate
flow rate and (b) ethylene conversion rate change vs. decrease in ethylene flow does not make the temperature or pressure in the reactor to cross
rate. the alerting or threatening zone boundaries of the reactor’s output
variables specified in Table 5.
However, the increase in oxygen flow has a significant effect
absorber’s feed temperature increases due to the sharp increase
on the absorber. Increasing the fresh oxygen flow causes an
in the reactor’s effluent temperature. From the stand alone
increase in total oxygen flow to the reactor; thus, the molar
analysis of the reactor, this 42% decrease is the boundary of
flow rate of reactor effluent, which is the feed to the absorber,
security-threatening zone. It is also shown that within 42%
increases. As the feed to the absorber is increased, the pressure
decrease, the decreasing ethylene molar flow to the reactor does
and temperature of the absorber increases. The change of the
not cross the security-alerting zone or security-threatening zone
absorber’s bottom pressure versus increase percentage of oxygen
boundaries for the two distillation columns, hence the zone
flow rate is presented in Fig. 6. Based on the output zone bound-
boundaries defined for ethylene flow rate decrease based on the
aries on bottom pressure of the absorber, input zone boundaries
reactor were used as the security zone boundaries for the entire
for fresh oxygen molar flow rate to reactor can be identified. As
process. Table 9 lists the input security zone boundaries for
shown in Fig. 6, at 7% increase in fresh oxygen flow rate to the
fresh ethylene molar flow rate to the reactor as well as the entire
reactor, the pressure at the bottom of the absorber reaches the
process.
normal operating zone boundary. At 12.2% increase, it reaches
the security-alerting zone of pressure. At 16.5% increase in oxy-
6.2. Increase in molar flow rate of fresh oxygen to reactor gen flow rate, the pressure reaches the security-threatening zone
and beyond which the absorber goes into disaster zone.
Another case study is for the effect of increase in oxygen flow Another important security sensitive output variable is the
rate to the reactor on the security status of the entire process. purge stream concentration. Due to the increase of feed flow
The nominal value of oxygen molar flow rate is 1050 lbmol/h. rate to absorber, the separation efficiency also gets affected. As
Simulations under different oxygen molar flow rates have been a result, the amount of ethylene oxide going from the top of
the absorber increases. The purge stream that is vented to the
Table 9 atmosphere has to obey environmental and safety regulations.
SAT input space zone boundaries for fresh ethylene flow to reactor
According to the output zone boundaries based on the concentra-
Zone Zone category Fresh ethylene Decrease in tion of ethylene oxide in the purge stream, input zone boundaries
number flow rate fresh ethylene on oxygen flow are defined by analyzing the result of dynamic
(lbmol/h) flow rate (%)
simulations.
Zone I Normal operating zone 1050.0–805.0 0.0–23.3 As illustrated by Fig. 7a, increase in oxygen flow to reactor
Zone II Security-alerting zone 805.0–700.4 23.3–33.3 increases the concentration of ethylene oxide in purge stream. At
Zone III Security-threatening zone 700.4–609.0 39.0–42.0
Zone IV Security disaster zone <609.0 >42.0
11 and 13% increase in oxygen flow to the reactor, the absorber
reaches the boundaries of normal operating zone (0.2 mg/m3 )
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
Fig. 7. Effect of increasing fresh oxygen flow rate to reactor on EO concentration
of the absorber’s purge stream for the range of: (a) 0–15% increase in fresh
ethylene flow rate and (b) 0–30% increase in fresh ethylene flow rate.
and security alerting (1.8 mg/m3 ) zones, respectively. Fig. 7b
shows that with the increase of oxygen flow rate, the concen-
tration of ethylene oxide in purge stream increases initially and
then goes down. The concentration of ethylene oxide in purge
Fig. 8. The effect of increasing the oxygen flow rate to reactor on absorber hydraulics: (a) vapor profile of absorber at normal condition, (b) vapor flow profile of
the absorber at 7.1% increase of oxygen flow rate to reactor, (c) vapor flow profile of the absorber at 9.5% increase of oxygen flow rate to reactor, and (d) vapor flow
profile of the absorber at 11.9% increase of oxygen flow rate to reactor.
1113
stream reaches the peak value of 40 mg/m3 at 27% increase of
oxygen flow rate. This phenomenon is due to two reasons: first,
with the increasing oxygen flow rate, the production of ethy-
lene increases initially and then decreases. Second, the exces-
sive oxygen dilutes the EO concentration in the reactor outlet
stream.
Hydraulic analysis is an effective approach to identify the
possible flooding of the absorbers and distillation columns.
Fig. 8 shows the stage-by-stage profile of ideal minimum vapor
flow rate, hydraulic maximum vapor flow rate and actual vapor
flow rate of the absorber under different scenarios. At 7.1%
increase in fresh oxygen flow (Fig. 8b), the last three stages
of the absorber starts flooding; at 9.5% almost every stage is
flooded or close to be flooded; while at 11.9% increase, the
entire absorber is flooded (Fig. 8b). Simulation of the two distil-
lation columns shows that the increasing oxygen molar flow rate
within 11.9% to the reactor does not cross the security-alerting
zone or security-threatening zone boundaries for the two distil-
lation columns. Hence, if only hydraulic analysis is considered,
the zone boundaries defined for oxygen flow rate based on the
absorber were used as the security zone boundaries for the entire
process.
Finally, comparing the zone boundaries due to oxygen flow
rate increase based on pressure, ethylene oxide in purge, and
hydraulic analysis (Table 10), the tightest constraints of 7.0,
9.5, and 11.9% increase are taken as the boundaries for the
normal operating, security alerting, and threatening zones each
(Table 11).
6.3. Decrease in cooling water flow rate to the reactor
Decreasing the cooling water flow rate to the reactor causes
the amount of heat removed from the reactor to decrease.
1114 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118

Table 10
SAT input space zone boundaries for fresh oxygen flow rate to reactor based on pressure of the absorber, concentration of EO in purge, and hydrolysis analysis
Zone number Zone category Decrease in fresh oxygen flow rate (%)

Conclusion based on Conclusion based on Conclusion based on

absorber pressure concentration of EO in purge hydrolysis analysis

Zone I Normal operating zone 0.0–7.0 0.0–11.0 0.0–7.1

Zone II Security-alerting zone 7.0–12.2 11.0–13.0 7.1–9.5
Zone III Security-threatening zone 12.2–16.5 13.0–27.0 9.5–11.9
Zone IV Security disaster zone >16.5 >27.0 >11.9

Therefore, hot spot formation in this plug flow reactor is
possible (Fig. 9). The security zone boundaries are determined
based on the hot spot formation in the reactor. Within a 10%
reduction of cooling water flow rate, the reactor can still
maintain normal production. At a 20% reduction in the water
flow rate, hot spot starts forming between the range of 30
and 35 ft. At 24% decrease the temperature difference from
the 35 ft to the end of the tube (38 ft) goes to 70 ◦ F, which is
too high. The zone boundaries based on cooling water flow
rate decrease is given in Table 12. Ten percent, 20, and 24%
reduction of cooling water rate is set as the boundaries for the
normal operating, security alerting, and threatening zones each.

Fig. 9. Temperature profile of the reactor at different cooling water flow rate: (a) temperature profile at nominal water flow rate, (b) temperature profile at 10%
decrease in cooling water flow rate, (c) temperature profile at 20% decrease in cooling water flow rate, and (d) temperature profile at 24% decrease in cooling water
flow rate.
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118 1115

Table 11
Overall process’s SAT input space zone boundaries for fresh oxygen flow rate
to reactor
Zone Zone category Fresh oxygen Increase in fresh
number flow rate oxygen flow rate
(lbmol/h) (%)

Zone I Normal operating zone 1050.0–1123.5 0.0–7.0

Zone II Security-alerting zone 1123.5–1149.8 7.0–9.5
Zone III Security-threatening zone 1149.8–1175.0 9.5–11.9
Zone IV Security disaster zone >1175.0 >11.9

6.4. Decrease in solvent water flow rate to the absorber

Decrease in the molar flow rate of solvent water to the

absorber reduces the efficiency of the absorption of ethylene
oxide by water. As a consequence, a larger amount of ethylene
oxide that goes into the purge stream will be emitted to the atmo-
sphere. On the other hand, results show that a decrease in molar
flow rate of water causes subtle variation in the absorber’s tem-
perature and pressure and these changes are within the normal
operating limits. However, the decrease of solvent water flow
rate has a significant influence on the concentration of ethy-
lene oxide in purge stream. From Fig. 10a, we can see that at
18% reduction in molar flow rate, the concentration of ethylene
oxide in purge reaches the normal operating limit of 0.2 mg/m3 ;
Fig. 10. Concentration of EO in purge vs. the decrease of solvent water flow
at 22% decrease in water molar flow to the absorber, the concen- rate to the absorber for the range of: (a) 0–26% decrease in solvent water and
tration of ethylene oxide in purge stream reaches the boundary of (b) 0–41% decrease in solvent water.
security-alerting zone of 1.8 mg/m3 ; Fig. 10b shows that at 32%
decrease of solvent water, the EO concentration in the purge With the decrease of molar flow rate of solvent water to the
stream reaches the boundary of security-threatening zone of absorber, the molar flow rate of feed to the Column C-803 is
90 mg/m3 . decreased as well. If all the other operating conditions are kept
Reduction in solvent water flow rate to the absorber also the same, the vapor flow rate in Column C-803 increases, causing
affects the columns C-802 and C-803, as the feed flow to the the pressure increases. As shown in Fig. 12, the pressure relieve
columns get reduced. Since the flow rate of feed to C-802 is valve at the top of Column C-803 saturated at 3.0% reduction of
decreased, if the heat duty to the reboiler and condenser of the the solvent water flow rate. At 11.5% reduction of the solvent
columns and other operating conditions are maintained the same, water flow rate, the pressure at the bottom of Column C-803
the vapor flow in C-802 will increase and the pressure will build reaches 588 psi, the boundary of security-alerting zone based on
up as shown in Fig. 11. If solvent water flow rate to the absorber pressure. With 14.0% reduction of the solvent water flow rate, the
is reduced beyond 52.52%, C-802 enters security-alerting zone pressure at the bottom of Column C-803 reaches 630 psi, which
due to the pressure built up of 520 psi and the pressure relief is close to the boundary of security-threatening zone based on
valve gets saturated (Fig. 11). Since the absorber reaches the
security-threatening zone at 32% of solvent water reduction, it
is obvious that the security zone boundaries defined based on the
effects on absorber are tighter that the one based on the effect
on C-802.

Table 12
Overall process’s SAT input space zone boundaries for cooling water flow rate
to reactor
Zone Zone category Cooling water Decrease in
number flow rate cooling water
(lbmol/h) flow rate (%)

Zone I Normal operating zone 4568.2–4111.4 0.0–10.0

Zone II Security-alerting zone 4111.4–3654.5 10.0–20.0
Zone III Security-threatening zone 3654.5–3471.8 20.0–24.0
Zone IV Security disaster zone <3471.8 >24.0 Fig. 11. Effect of decreasing solvent water flow rate to absorber on Column
C-802 pressure.
1116 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118

Fig. 12. Effect of decreasing solvent water flow rate to absorber on Column Fig. 13. Effect of increasing feed temperature to absorber on absorber pressure.
C-803 pressure.

Table 13
Overall process’s SAT input space zone boundaries for solvent water flow rate exchanger, the feed temperature to the absorber will be var-
to absorber ied. The increase in feed temperature to the absorber causes the
Zone Zone category Water flow rate Decrease in water vapor flow to increase and the absorption efficiency of water
number (lbmol/h) flow rate (%) absorbing ethylene oxide to decrease. This leads to an increase
in temperature and pressure at the top and bottom of the absorber
Zone I Normal operating zone 4950.0–4801.5 0.0–3.0
Zone II Security-alerting zone 4801.5–4380.8 3.0–11.5 and also the increase in the concentration of ethylene oxide in
Zone III Security-threatening zone 4380.8–4257.0 11.5–14.0 the purge stream. Based on these factors, the operating zone
Zone IV Security disaster zone <4257.0 >14.0 boundaries were identified for increase in feed temperature to
the absorber. At 170 ◦ F feed temperature, the pressure at the bot-
tom of the absorber reaches the boundary of normal operating
pressure is 647 psi. Due to these observations, if only consider zone (528 psi) and at 309 ◦ F feed temperature, the bottom pres-
the effect of solvent water flow rate reduction on Column C-803, sure reaches the boundary of security altering zone (611 psi).
3.0, 11.5, and 14.0% should be taken as the boundaries for the These data are presented in Fig. 13.
normal operating, security alerting and threatening zones each. This increase in the absorber’s feed temperature also influ-
Finally, comparing the boundaries set by the effect of ences the hydraulics of the absorber and the purge concentra-
solvent water flow rate reduction on Absorber C-801, and tions. Based on the hydraulic analysis of the absorber (Fig. 14),
columns C-802 and C-803, and the tightest limits of 3.0, at 240 ◦ F tray no. 9 is flooded and the system enters the threat-
11.5, and 14.0% should be taken as the boundaries for the ening zone. On the other hand, as shown in Fig. 15, based
normal operating, security alerting, and threatening zones of on the amount of ethylene oxide in purge stream, at 152.5 ◦ F
the entire process (Table 13). It is obvious that the current the ethylene oxide concentration reaches the boundary of the
pressure relieve valve in Column C-803 is not sized enough normal operating zone boundary (0.2 mg/m3 ), at 160 ◦ F the con-
for handling abnormal situations. If a larger pressure relieve centration reaches the zone boundary of security-alerting zone
valve can be installed, then these zone boundaries can be (1.8 mg/m3 ); and at 193 ◦ F it reaches the boundary of security-
relaxed. threatening zone (90 mg/m3 ). By comparing all these factors,
we identified that the ethylene oxide concentration in the purge
6.5. Increase in feed temperature to absorber stream poses the tightest constraint. The overall process’s normal
operating, security alerting, and threatening zone boundaries on
The normal feed temperature to the absorber is 115.0 ◦ F. the increase in the feed temperature to the absorber are identified
Before entering the absorber, the reactor effluents will go as 152.5, 160, and 193 ◦ F, respectively. These data are listed in
through a heat exchanger. If there is any disturbance in the heat Table 14.

Fig. 14. Effect of increasing feed temperature to absorber on absorber hydraulics: (a) under nominal feed temperature of 115 ◦ F and (b) at a feed temperature of
240 ◦ F.
 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
Fig. 15. Effect of increasing feed temperature to absorber on purge concentration
for the feed temperature range of: (a) 110–170 ◦ F and (b) 110–200 ◦ F.
6.6. Decrease in condenser cooling duty of Column C-802
The nominal value of condenser cooling duty of Column C-
802 is −42.65 MMBtu/h. If the condenser duty is decreased
and the reboiler duty is kept at a constant level, the vapor
flow increases. At a 42.5% decrease in condenser duty, the
pressure relief valve at the top of the column gets saturated
and the pressure starts increasing (Fig. 16). Hence, 42.5% is
defined as the boundary of the normal operating zone (520 psi).
At 46 and 50.5% reduction of the condenser duty, the column
reaches the boundary of the security-alerting zone (626 psi) and
security-threatening zone (688 psi), respectively, as the pressure
increases. Hydraulic analysis is also conducted, which shows no
flooding in any tray even with significant reduction in condenser
duty. The zone boundaries based on decreasing condenser duty
is given in Table 15. Same method can be applied for assess the
effect of condenser cooling duty of Column C-803, which is not
presented in the paper in order to avoid repetition.
Table 14
SAT input space zone boundaries for feed temperature to absorber
Zone number Zone category Feed temperature (◦ F)
Zone I Normal operating zone 115.0–152.5
Zone II Security-alerting zone 152.5–160.0
Zone III Security-threatening zone 160.0–193.0
Zone IV Security disaster zone >193.0
1117
Fig. 16. Effect of decreasing condenser duty to Column C-802.
Table 15
SAT input space zone boundaries for condenser duty to Column C-802
Effect of decrease in condenser Condenser duty Decrease in
duty to COL-2 (MMBtu/h) duty (%)
Normal operating zone −42.70 to −24.55 0.0–42.5
Security-alerting zone −24.55 to −23.06 42.5–46.0
Security-threatening zone −23.06 to −21.14 46.0–50.5
Security disaster zone >−21.14 >50.5
7. Conclusions
Process security is a natural extension of process safety, and
it addresses the most critical issues in chemical processing. To
fully ensure process security, a comprehensive and deep inves-
tigation of a process system of interest must be conducted. For
large-scale processes which consist of various units connected
through various streams, this task becomes even more challeng-
ing due to the “chain effects”.
In this work, a large-scale ethylene oxide manufacturing pro-
cess is studied for assessing process security, and identifying
opportunities for security enhancement. The security sensitive
output and input variables are identified first, then the zone
boundaries of the security sensitive output variables of each
individual unit are judged based on insight into reaction kinet-
ics, physical limits, regulations, codes, and engineering practice.
The most intriguing feature of this work lies in the identification
of the zone boundaries for the security sensitive input variables.
For variation in the value of each input variable, the effects on all
the related process units are analyzed carefully via comprehen-
sive dynamic simulation. It is discovered that different process
units may react with a different degree of deviation from the
normal operating zone, as reflected in the performance of their
security sensitive output variables. To ensure process security,
if any one of these units’ output variable across a specific zone
boundary, then we say the entire production system moves into
that specific zone. Or, it is to say, the tightest zone boundaries
among all the related individual units are considered as the over-
all zone boundaries for the entire process for each of the security
sensitive input variable.
1118 H.H. Lou et al. / Computers and Chemical Engineering 30 (2006) 1102–1118
An important finding through the case study is that even with-
out the complete failure of a key equipment or instrument, a
slight or moderate variation in some input sensitive variables in
one unit may cause uncontrollable disastrous situation to occur
in another unit. This kind of process security problems might
not be noticed in the plant and should be prevented as early as
possible.
Acknowledgements
This work is in-part supported by the National Science Foun-
dation under Grant CTS-0407494, the Texas Advanced Technol-
ogy Program under Grant No. 003581-0044-2003, and the Gulf
Coast Hazardous Substance Research Center.
References
Allen, D. T., & Shonnard, D. R. (2002). Green engineering: Environmentally
conscious design of chemical processes. New Jersey: Prentice Hall.
American Society of Mechanical Engineers (1992). Boiler and pressure vessel
code. Section VIII, division 1. http://www.asme.org.
Ashcroft, J., Daniels, D. J., & Hart, S. V. (2002). A method to assess the vul-
nerability of U.S. chemical facilities. Washington, DC: U.S. Department
of Justice, Office of Justice Programs.
Aspen Technology Inc. (2004). Hysys dynamics and Aspen dynamics, user
manual. http://www.aspentech.com.
Bailey, F. E., & Koleske, J. V. (1976). Polyethylene oxide. New York: Aca-
demic Press Inc.
Baize, T. H. (1961). Polymerization of ethylene oxide. Industrial Engineering
Chemistry, 53, 903.
Barker, K. R., & Zomerdijk, J. C. (1973). Purification of ethylene oxide.
European Chemical News Chemscope, 24, 28.
van den Berg, P. J., & DeJong, W. A. (1979). Introduction to chemical process
technology. Holland: D. Reidel Publishing Company Delft.
Borman, P. C., & Westertrep, K. R. (1992). An experimental study of the
selective oxidation of ethene in a wall cooled tubular packed reactor.
Chemical Engineering Science, 47, 2541.
Britton, L. G. (1990). Thermal stability and deflagration of ethylene oxide,
Union Carbide Corporation. Plant/Operations Progress, 9, 75.
Carey, B., Chipman, P., Cubillas, M., Lakin, M., Slezak, D., Townsend, D.,
et al. (2004). http://www.ethyleneoxide.com/html/properties.html.
Center for Chemical Process Safety (CCPS). (1992). Guidelines for hazard
evaluation procedures. New York: AIChE.
Center for Chemical Process Safety (CCPS). (2002). Guidelines for analyzing
and managing the security vulnerabilities of fixed chemical sites. New
York: AIChE.
Coombs, J. D. K., & Palombo, L. (1997). Cleanse clearlake ethylene oxide
reactors revamp. USA: Jchem Inc.
Crowl, D. A., & Louvar, J. F. (2002). Chemical process safety: Fundamentals
with applications (2nd ed.). New Jersey: Prentice Hall.
Dimitriadis, V. D., Hackenberg, J., Shah, N., & Pantelides, C. C. (1996). A
case study in hybrid process safety verification. Computers and Chemical
Engineering, 20(Suppl.), s503.
Dowell, A. M., III. (2002). Layer of protection analysis: Lessons learned.
In ISA technical conference series: Safety-instrumented systems for the
process industry.
Edwards, D. W., & Lawrence, D. (1993). Assessing the inherent safety of
chemical process routes: Is there a relation between plant costs and inher-
ent safety? Transactions of the IChemE, 71(B), 252.
Environmental Protection Agency (1975). Engineering and cost study of air
pollution control for the petrochemical industry, vol. 6. EPA report no.
EPA-450/3-73-006-f. Washington, DC: EPA.
Harvey, J. F. (1991). Theory and design of pressure vessels (2nd ed.). New
York: Van Nostrand Reinhold.
Heikkila, A. M., Hurme, M., & Jarvelaien, M. (1996). Safety considera-
tions in process synthesis. Computers and Chemical Engineering, 20,
s115.
Hendershot, D. C. (2003). Designing for safety in the chemical process indus-
try: Inherently safer design. Accident precursors workshop: Linking risk
assessment with risk management. Washington, DC: National Academy
of Engineering.
Huang, J., Resendez, D., & Tran, G. (1999). Ethylene oxide reactor system.
JEO & Associates. Executive summary report.
Kenson, R. E., & Lapkin, M. (1999). Reactions of ethylene and ethylene
oxide on a silver catalyst. Kinetics and Mechanism of Ethylene Oxidation,
1493.
Kiguchi, I., Kumazawa, T., & Nakai, T. (1976). For EO: Air and oxygen.
EO Hydrocarbon Processing, 55, 69.
Kirk, O. (2004). Encyclopedia of chemical technology. New York: John Wiley
& Sons Inc.
Leckner, P. (2000). Rupture disks for process engineers, from the process
design engineer’s perspective. Part 3. How do we set the burst pressure?
http://www.cheresources.com/asiseeit5.shtml.
Lees, F. P. (1996). Loss prevention in the process industries (2nd ed.). Lon-
don, UK: Butterworths.
Lou, H. H., Muthusamy, R., & Huang, Y. L. (2003). Process security
assessment: Operational space classification and process security index.
Transactions of the IChemE Part B: Process Safety & Environmental
Protection, 81, 418.
Meyers, R. A. (1986). Handbook of chemical production processes. New
York: McGraw-Hill.
Luyben, W. (1990). Process modeling, simulation and control for chemical
engineers (2nd ed.). New York: McGraw-Hill.
National Institute of Justice (NIJ). (2002). Chemical facility vulnerabil-
ity assessment methodology. Washington, DC: U.S. Department of
Justice.
Parr Instrument Company (2004a). Pressure and temperature limits:
Stirred reactors and pressure vessels. http://www.parrinst.com/default.
cfm?page id=162.
Parr Instrument Company (2004b). Temperature limits: Optional fittings.
http://www.parrinst.com/default.cfm?page id=235.
Ragan, P. T., Kiburn, M. E., Roberts, S. H., & Kimmerle, N. A. (2002).
Chemical plant safety: applying the tools of the trade to a new risk.
Chemical Engineering Progress, 98, 62.
Shacham, M., Brauner, N., & Cutlip, M. B. (2001). Prediction and pre-
vention of chemical reaction hazards: Learning by simulation. Chemical
Engineering Education, 35, 268.
Uygun, K., Lou, H. H., & Huang, Y. L. (2003). Process security analysis:
␥-Analysis and ␴-maps. AIChE Journal, 49, 2445.
Virginia Safety and Health Codes Board and Virginia Department of Labor
and Industry (2003). Boiler and pressure vessel rules and regula-
tions. http://www.doli.state.va.us/whatwedo/boiler safety/pdf/comboilfinal
%202003.pdf.