know What already do we about reactor runaway? – A review Process Safety and Environmental Protection

ContentslistsavailableatScienceDirect

Process Safety and Environmental Protection

jo u r n al ho m e p a g e :w w w . e l s e v i e r . c o m / l o c a t e / p s e p

What do we know already about reactor runaway? – A review

Alex Kummer

, Tamás Varga

InstituteofChemicalandProcessEngineering,UniversityofPannonia,H-8200Veszprém,Hungary

a rt i c l e i nf o

Articlehistory:

Received6July2020

Receivedinrevisedform28August2020 Accepted25September2020

Availableonline1October2020

Keywords:

Runawayprevention Thermalsafety Earlywarningsystem Processsafety Thermalrisk

Safetyboundarydiagram

a b s t ra c t

Nowadays,reactorrunawayisstillacrucialphenomenfromthesafetyviewpoint.About120scientific journalarticlesarepublishedeveryyearinthelastdecadeinwhichthermalrunawayisakeyword.The possiblecauseandconsequencesofreactorrunawayareadressedwheretheworstcaseistheexplosion ofthereactor.Preventionstepstoavoidthedevelopmentofthermalrunawayincludetheappropriate designofthereactor,theoperationstrategyandanearlywarningdetectionsystem.Theavailableassess- mentmethodsforthermalriskanalysisareaddressedindetail.Reactorrunawaycriteriacanindicate earlythethermalrunaway,whichcriteriaareaddressedinthisreviewindetailunderthreeclasses:

geometry-,sensitivity-,andstability-basedrunawaycriteria.Operationstrategyofsemi-batchreactors canbedesignedbycalculatingWesterterp-diagramwhoseevolutionisclearypresented.Significant worksonthefieldofthereactordesign,operationandreactorsafetyarecollectedandevaluated.Finally possiblefurtherresearchareasaresuggestedtoimproveourknowledgeaboutthermalsafety,suchas investigatingparameteruncertaintyinrunawayindicationoroptimizethesafetyactionstomoderate theconsequencesofrunaway.

©2020TheAuthor(s).PublishedbyElsevierB.V.onbehalfofInstitutionofChemicalEngineers.Thisis anopenaccessarticleundertheCCBY-NC-NDlicense(http://creativecommons.org/licenses/by-nc-nd/

4.0/).

Contents

1. Introduction...461

2. Causeandconsequenceofthermalrunaway...463

3. Preventionofreactorrunaway...463

4. Methodstoevaluatethermalrisks...464

5. Reactorrunawaycriteria...465

5.1. Mathematicalmodel...465

5.2. Stability-basedcriteria...466

5.2.1. Semenov-criterion...466

5.2.2. VanHeerdenand“practicaldesign”criterion...467

5.2.3. Gilles-Hoffmanncriterion ... 467

5.2.4. Lyapunov-stabilityingeometric-andphase-plane...467

5.2.5. Strozzi-Zaldivarcriterion(Divergencecriterion)...467

5.2.6. Modifieddynamicandslopecondition...468

5.3. Geometry-basedcriteria...468

5.3.1. ThomasandBowescriterion...468

5.3.2. AdlerandEnigcriterion...468

5.3.3. VanWelsenaereandFromentcriterion(orMaxicriterion)...468

5.3.4. Adiabaticcriterion...469

5.4. Sensitivityanalysisofchemicalreactors(Morbidelli-Varmacriterion)...469

5.5. Data-basedpredictionofthermalrunaway...469

∗Correspondingauthor.

E-mailaddress:kummera@fmt.uni-pannon.hu(A.Kummer).

https://doi.org/10.1016/j.psep.2020.09.059

0957-5820/©2020TheAuthor(s).PublishedbyElsevierB.V.onbehalfofInstitutionofChemicalEngineers.ThisisanopenaccessarticleundertheCCBY-NC-NDlicense (http://creativecommons.org/licenses/by-nc-nd/4.0/).

6. Safetyboundarydiagrams...470

7. Safetyequipment/actionstomoderateseriousconsequences...471

8. Applicationexamplesofrunawaycriteria...472

8.1. Comparisonofreactorrunawaycriteria ... 472

8.2. Reactoroperationdesign...472

8.3. Processcontrol...472

8.4. Runawaypredictionandinhibition ... 473

9. Futuredirections...473

Acknowledgement...473

References...473

Nomenclature

A heattransferarea C concentration cp heatcapacity Da Damköhlernumber E activationenergy Ex exothermicitynumber I penaltyindices

ITHI inherentthermalrunawayhazardindex MF materialfactor

MTSR MaximumTemperatureofSynthesisReaction qgen generatedheat

qrem removedheat

P pressure

Pr probability r reactionrate R gasconstant RI riskindex Ry reactivitynumber

S severity

t_dos dosingtime

TMR_ad TimetoMaximumRateunderadiabaticconditions Tc criticalorcoolingtemperature

Tp;T processtemperature Tta targettemperature Tw walltemperature

U overallheattransfercoefficient

V volume

Wt Westerterpnumber Xac accumulatedreagent T_ad adiabatictemperaturerise Hr reactionheat

␣ UA/(V␳cp)

␤ Hr/(␳cp)

␥ ineticparameter

␦ E/R

␺ Semenovnumber

␧ relativevolumeincrease

␳ density

J Jacobianmatrix I identitymatrix

1. Introduction

Safetyassessmentisalwaysacrucialpointinchemicalplant design and operationdue to thecomplexity of modern, highly integrated plants,anditrequiresdeepknowledgeofallprocess unitsandalltheinteractionsbetweenthem.Itisnecessarytohave informationabouteveryimportantphysicalandphysic-chemical propertiesofeverycomponentwhichoccursorcanoccurinthe

system(Vernières-Hassimietal.,2017).Alsoprocesssafetyreg- ulationshave been gettingstricter in recent decades,and they covereveryprocessunitandsteponeverylevelinmodernchemi- caltechnology.Theseincreasingrequirementsfromprocesssafety systemtriggeredsignificantprogressin processsafety manage- mentthatmakespossibletoavoidunnecessaryeventsinnowadays fullyintegrated technologieswhichoperateina hecticbusiness environment,whichrequiremoreflexibletechnologiesthanever.

However,duetoevolutionarychangesintheindustry,newhaz- ardouseventsoccur,whicharemorerelatedtoorganization,safety culture,and lackof knowledge and awareness(Knegtering and Pasman,2009).

Itiswell-knownthatcertainoperatingconditions,socertain valuesoftheparameterscancausethesystembecomereallysen- sitivetovaluesoftheinitialoroperationparameters.Insensitive regionofthesystem,verysmallchangeininitialconditionleads fullydifferenttrajectorieswithrespecttopressure,temperature, concentrations,etc.Itismoreinterestingifanexothermicreaction iscarriedout,whererunawaycanoccurasaresultofsmallchanges.

Thermalreactorrunawaysarecharacterizedbyarapidincreasein thetemperatureandpressureduetocontinuouslyincreasingrate ofheatgeneration.Therateofheatgenerationincreasesexponen- tiallywiththetemperature,contrarilytheremovedheatincreases onlylinearlywithit.Theriskofthermalrunawayoccursisactu- allytheriskoflosingthecontrolofchemicalreactionswhichtake placeinthesystem(e.g.triggeringarunawayreaction).Areaction runawaymayhavemultipleconsequenceswheretheworstcaseis theexplosionofreactor(Stoessel,2008).

Duringthermalrunawayssomeofthecomponentscanvaporize ordecompositioncanoccurduetotheelevatedtemperature,which increasesthepressureintheprocessunit(Pasmanetal.,1992).In worstcaseitleadstoaBoilingLiquidExpandingVaporExplosion (BLEVE).Ifthepressureincreasingrateishigherthanthedischarge rate,thereactorwillexplodeduetothehighpressure(Liuetal., 2018a).In lesscatastrophic casespreventionofdevelopmentof thermalrunawayshouldbeavoidedbecauseso-calledhot-spots causeearlydeactivationofcatalystand/orqualitydrop.Hence,the determinationofstableoperatingregimesofareactorisacrucial stepinprocessdesignandoperation(Varga,2009).From1995to 200412%ofBLEVEtypeaccidentsoccurredduetorunawayreac- tions,alsofrom1926to20046BLEVEtypeaccidentoccurredled to19deathand171injuredpeople(AbbasiandAbbasi,2007).

Knowledge aboutthe phenomenon of thermal runaway has improvedalotlately,butregretfullythatknowledgeisnotfully integratedintothepractice,anditcausessomeseriousfailuresand processmalfunctionsnowadays.Thermalrunawayisresponsible for26.5%ofthepetrochemicalaccidents(Balasubramanianand Louvar,2002),andreactorrunawaywasresponsiblefor25%ofthe accidentsinFrenchindustry(Dakkouneetal.,2018).Therewere manylethalornon-lethalaccidentsduetothermalrunawayinthe recentpast.TheSeveso-disasterin1976istheprimeexampleof theimportanceofknowingparticularlythephenomenonofther- malrunaway.Inthisdisasteratoxiccloudwasreleasedintothe 461

Fig.1.ExplosionofFu-Kaochemicalplantandthedamagednearbybuildings.Theshockwavedestroyedmanywindowswithinhalf-a-kilometer(KaoandHu,2002).

atmospherethrougharupturediskpoisoningalmost37,000peo- ple(CardilloandGirelli,1981;Fabianoetal.,2017;Jainetal.,2017).

In1990,inStanlowa15m³batchreactoratShellplantproducing 2,4-difluoro-anilinehadarunawayreactionleadingtoanexplo- sion,wheretheentireplantwasdestroyed(Cates,1992),(Mannan, 2014).In1996arunawayreactionoccurredinabatchreactorcre- atinghighpressurethatledtoruptureofthevessel(Partington and Waldram, 2002).In 1997,Ohio,anexplosionoccurredina resinsproductionunit,whereoneworkerdiedandfouremploy- eesinjured(UnitedStates,1999).In1998,inNewJerseyaviolent explosionandfireoccurredduetoareactorrunawayinjuringnine employees(GyenesandCarson,2017).In2001adestructiveexplo- sionoccurredinanacrylicresin manufacturingplantinTaiwan at the Fu-Kao Chemical Plant as a result of runaway reaction.

A batchreactorcarrying outpolymerizationreactionsexploded wheremorethan100peoplewereinjuredandonepersondied.

Thecatastrophicexplosiondestroyedthenearbyplantsanddam- agedthenearbybuildings,whichisshowninFig.1(KaoandHu, 2002).

InJanuary2006anacrylicpolymerbatchreactorexplodeddue tothisphenomenon(GyenesandCarson,2017).In2007areactor explodedanddestroyedinT2LaboratoriesinFloridabecauseofa thermalrunawayreactionleadtothedeathoffouremployees(Hall, 2010).In2008,USA,atBayerCropsciencepesticidemanufacturing unitathermalrunawaycausedanexplosionwhichdemolishedthe processunitleadingtotwolethaldamageandeightpeopleinhaled toxicchemicals(Abbasietal.,2010).Hydrogenperoxideisawidely usedchemical,buttheexothermicdecompositionofthischemical causedsomefireandexplosionaccidentsintherecentpast(Wuand Qian,2018).In2012,anexplosionoccurredinachemicalplantin Japaninjuring36personandkillingonepersonduetotherunaway polymerizationofacrylicacid(Fujitaetal.,2019).

Now it is clearthat wehave todeal withthermal runaway toavoidmoreorlesscatastrophicincidents,andwemust“learn from historyor you’redoomedtorepeatit”(the quoteis from

JesseVentura).Thefirstaspectisalwaysthesafety,whichcanbe realizedthroughstudyingthephenomenonofthermal runaway in detail. Our goalwith this review is toemphasize that engi- neersshouldneverforgetaboutthatthesafetyhasmuchhigher prioritythanincomedespitethefrequencyofaccidentsinchem- icalprocessesare decreasing.Especially onthefield of thermal safety,wheretheignoranceandtheirresponsibilitycanresultin seriousand unfortunately,sometimeslethalconsequences.This articleprovidesthemaincontributionswhichshouldbeknown byeveryprocessengineer.Besidethewell-designedreactor,an appropriate,reliableandearlywarningdetectionsystemshould bedevelopedforsafereactoroperation.Ifitisdone,wehaveto preparethesystemandoperatorsforemergencycases,sowemust designappropriatesafetyactionstomoderatetheconsequences ofthermalrunaway.Basedontheliteraturereviewwehighlight fourfutureresearchdirectionswhichisabouttoinvestigatethe impactofparameteruncertaintyonrunawayindication,handling parameteruncertaintyindetectionofrunawayduringoperation, presentingindetailthedesignphaseswithlaboratoryandpilot- plantexperiments,andperformingcomputationalfluiddynamics (CFD)simulationsforbetterunderstandingofthecausesandcon- sequences.

Thereviewwasmadetogiveacomprehensivepictureaboutthe phenomenonofthermalrunaway,whatthemaincausesandconse- quencesofrunawayare,andhowitcanbeprevented.Theemphasis isclearlyonthedevelopmentandapplicationofthermalrunaway criteriaincludinggeometry-,stability-andsensitivitybasedcrite- ria,andwealsodiscussthetopicofsafetyboundarydiagramsfrom Westerterp.

Theroadmapisasfollows:Section2providestherootcauses andconsequencesofthermalrunaway.Section3informsthereader aboutthebasicrequirementsforthepreventionofreactorrunaway.

InSection4thereadercangetinformationabouthowtoevaluate thethermal risks of a system.Section 5presents thestability- ,geometricandsensitivitybasedrunaway criteria,anda simple

modeltoinvestigaterunawaycriteriaispresented.Section6gives informationabouttheSafetyBoundaryDiagramsandsomeinsight abouthowtoapplythese.Section7providesinformationabout possiblesafetyactionstomoderatetheconsequencesofreactor runaway. InSection8someapplicationexamplesishighlighted fromtheliteraturewithrunawayrelatedresearchesinvestigating themainproblems(reactorandoperationdesign,reactorcontrol, mitigationsystems).Section9providesinsightintothepossible futuredirectionsofreactorrunawayrelatedresearch.

2. Causeandconsequenceofthermalrunaway

Thesafeoperabilityofchemicalreactorsishighlydependenton theappropriatedesignofsafetyaswellascontrolsystemsoftech- nologies.BartonandNolaninvestigatedcasehistories(169cases) from1962to1987.Basedontheirreviewthermalrunawayacci- dentsoccurduetothefollowingcauses(BartonandNolan,1991;

NolanandBarton,1987).

-a basic lack of understanding of the process chemistry and thermochemistry(e.g.noappreciationoftheheat ofreaction, unintendedreactionsandautocatalysisoccurred,productmix- turedecomposed,lowmaterialquality,etc.);

-inadequateengineeringdesignforheattransfer;

-inadequatecontrolsystemsandsafetyback-upsystems(e.g.loss ofcoolingwaterwhichwasnotmonitored,wronglypositioned probeoftemperaturemeasurement,thermocouplescoatedresult inslowresponse,etc.);

-inadequate operationalprocedures and operator training (e.g.

starting the reactorat low process temperature, mischarging ofreactants,inadequatemixing,poorcommunicationbetween operators,etc.).

RimSaadaetal.studiedthirtycasesfrom1988till2013,andthey alsoclassifiedthepossiblecausesthatleadtoarunawaysituation.

Theclassificationconsistsof“TechnicalandPhysicalCauses”and

“HumanandOrganisationalCauses”.Undertechnicalandphysical causesfivecaseswereduetomischargingthereactor.Thisincludes chargingchemicalsorcatalystsininappropriateorderandaddi- tionofincorrectamountofchemicals.Fourcaseshavebeencaused duetoagitatorfailures.Insomecasestracequantitiesofimpuri- tiescausedrunawayphenomena.Fourincidentsoccurreddueto poorplantdesign,andfiveothercaseswerecausedasaresultof wrong processcontrol.Under humanandorganisationalcauses thirteenincidentswereduetooperatorerrors.Operatorsdonot understandthebasicsofchemistryandthermodynamics,andin somecasestheoperatorsdecideontheirownwithoutdiscussing itwiththetechnicaladvisor.Inonecasethereactorwasoperated outsidethesafetylimits.Inadequatetraining,absenceofsupervi- sion,anincreaseinworkload,failuretofollowstandardoperating proceduresandincorrectopening/closingofthevalvesresultedin incidentstoo.Poormanagementinprocessoperationalsoresulted in11incidentsintheinvestigatedtime.Basedontheirsystematic evaluation,twenty-onepeoplediedand393peopleinjureddirectly duetothermalrunaway.Theirresearchindicatedthatlessonshave notbeenlearntfromtheconsequencesofthermalrunaways(Saada etal.,2015).Differentcasestudiesaboutreactorrunawayaccidents withcausesandconsequences isshownin(Gyenesand Carson, 2017;Etchells,1997;Pasquet,2017;Hoetal.,1998).

In a betterscenario theconsequenceofa runawayis onlya lowqualityproduct;inaworsecasethereactorphysicallyexplode resultinareleaseoflargequantitiesofflammable,toxicandhaz- ardousmaterials.Liuetal.showedaflowchartofrunawayaccident sequencesshowninFig.2(Liuetal.,2018b).

Fig.2.Flowchartofrunawayaccidentsequences(Liuetal.,2018b).

Ifthegasphasewithhighconcentrationisignitedimmediately afireballoccurs,otherwise,itspreadsaroundthereactor.Thegas phasewilldiffuseanddilutemayresultinavapourcloudexplo- sionorformingapotentialtoxiccloud.Iftheliquidphaseisignited immediatelyapoolfireoccurs,otherwise,thereactantsmaycon- tinuethereaction.Theresidualliquidphasemayignitesandresult inapoolfireoritformsaspirationhazard(Liuetal.,2018b).The sizeofendangeredareacanbeeasilyestimatedbasedonCFDsim- ulations(Liuetal.,2018a),(Tauseefetal.,2011;Chenetal.,2019).

3. Preventionofreactorrunaway

Preventionofreactorrunawaybeginsinthedesignphase.As itisshowninSection2adetailedknowledgeaboutthechemicals anditsthermophysicalpropertiesisnecessaryforsafeoperation.

Detailedkineticinformationaboutthepossiblereactionsisneces- saryfortheappropriatedesignofthereactor.However,wemust calculatewithplant-modelmismatch,wenevercanbeconfident withthatthedevelopedmodelisadequateinnon-runawayand especiallyinrunawaysituations.Firstphaseofpreventionisthe appropriatedesignofthereactorsystemandoperatingconditions.

Engineersmustperforminherentlysaferdesign(ISD),whichis abouttopreventhumanerrorandinvalidationoffacilitytoreduce theriskofaprocessbywaysofminimizing,substituting,moderat- ingandsimplifying.Fourclassesismentionedasstrategestoward ISD(Feietal.,2018):

-Inherent:Eliminatingthehazardbyusingmaterialsandprocess conditionswhicharenon-hazardous.

-Passive:Eliminatingorminimizingthehazardbyprocess and equipmentdesignfeatureswhichreduceeitherthefrequencyor consequenceofthehazardwithouttheactivefunctioningofany device.

-Active:Usingcontrols, safetyinterlocks,emergencyshutdown systems,mitigationdevicestodetectpotentiallyhazardouspro- cessdeviationsandtotakecorrectiveactions.

-Procedural:Usingoperatingprocedures,administrativechecks, emergencyresponse,andothermanagementapproachestopre- ventincidents,ortominimizetheeffectsofanaccident.

Apartfrom theofflineinvestigations, alsoonline prevention measuresarenecessarytodetectanyunexpectedsituationlead- ingtoarunawayscenario.Anearlywarningdetectionsystemis indispensabletodetectunexpecteddangeroussituations.Online applicable thermal runaway criteria are excellent soft-sensors, whichcanpredictthedevelopmentofthermalrunawayandthecri- teriaareabletodistinguishbetweendangerousandnon-dangerous reactorstates.Therefore,arobustsafetycriterionisanessential

elementofanyEarlyWarningDetectionSystem(EWDS).EWDSis necessarytodetectandevaluateunexpecteddangeroussituations.

Wemustprovidesufficienttimeforaprotectionsystemortheplant operatortoperformthenecessarystepstostoportomoderatethe undesiredeffectsofruanwaydevelopment.Thereareseveraltime indiceswhichcanbeappliedtomeasurehowfarthesystemfrom arunawaystateis.Agoodreviewaboutthesetimeindicescanbe foundin(Varga,2009).Theseindicesare:

-Timeofoccurrence:thetimewhenfaultoccurs.

-Reactiontime:theminimumtimerequiredtoexecutearesponse step

-Executiontime:measuredexecutiontimeofthesystem -Responsetime:thetimebetweenthedetectionofinitiatingevent

andtheresponseofthesystem.

-Safetyreactiontime:thetimeneededtosenseaproblemand initiateasafetyshutdowntothecontrolelement.

-Time-in-alarm: the time between timestamps of alarm and return-to-normalevents.

-Irreducible minimum: the minimal time of response, usually approximately100ms.

-ProcessSafetyTime(PST):PSTistheperiodoftimeinwhichthe processcanbeoperatedwithoutprotectionandwithoutunde- siredeventoccurs.VargaandAbonyiintroducedhowPSTcanbe determinedincaseofhighleexothermicreactionsin(Vargaand Abonyi,2010)

-Timeof noReturn: afterthistime itisimpossibletocoolthe reactor(Stoessel,2008).

Thesafetystepstomoderatetheconsequencesofrunawaycan beanopeninga pressurereliefvalve,fullcoolingorquenching (i.e.,additionofinhibitororcoldinertliquidaswellasdumpingof thereactorcontentintoacoldcatchtank)(WesterterpandMolga, 2006).

4. Methodstoevaluatethermalrisks

Thegoalisalwaystoreducethermalrisks,forwhichwehave toanswersomequestions.Ifwearepreparedfortheworst-case scenario thenheavyconsequences canbeprevented.Therefore, a systematicassessment procedureisbased onthecoolingfail- urescenarioassumingadiabaticconditions.Inadiabaticcasethe processtemperaturecanrisetothehighest.Basedonthecharacter- istictemperaturelevelsarisingfromthescenario,criticalityclasses weredefinedby(Stoessel(2008).Therepresentationofworst-case scenarioasacoolingfailurewereintroducedbyGygax(1988),and hemadeascenarioforthermalassessment,whichcanbeseenin Fig.3.

In (Nanchenet al.,2009)a gooddescriptionofFig.3canbe found.The processis attemperature T_p when a coolingfailure occurs. Since the reaction is exothermic, in adiabatic case, the presence ofunreactedreagentswillreactincreasingthereactor temperaturewiththeadiabatictemperaturerise(T_ad).Themost crucialtimeforacoolingfailureiswhentheaccumulationofunre- actedreagentisatmaximum.MaximumTemperatureofSynthesis Reaction(MTSR)isintroducedfordescribingthepossiblereactor temperaturesduringtheoperation.AtMTSRsecondaryreactions mightbetriggered,andthesecondaryreactionwillincreasefurther toafinaltemperature(T_f).Thedurationofreactionrunawaycan beestimatedbycalculatingtheTimetoMaximumRateadiabatic parameter(TMR_ad).

MTSRcanbecalculatedbasedonthedegreeofaccumulation ofunconvertedreagentsandtheadiabatictemperatureriseatthe giveninstant.

MTSR=Tp+XacT_ad,rx (1)

Fig.3. Runawayscenario,wherenumbersrepresentthesixkeyquestions(Stoessel, 2009).

Table1

Assessmentcriteriafortheseverityofarunawayreaction(Stoessel,2009).

Severity Tad P Extension

Catastrophic >400 >Ptest >Site

Critical 200–400 Pmax<P<Ptest Site

Low 50–200 Pset<P<Pmax Plant

Negligible <50 P<Pset Equipment

TMR_adcanbecalculatedbasedonthefollowingformulausing theinitialheatreleaserateofthereaction.

TMR_ad=c_pRT²

qgenE (2)

Gygaxformulatedsixkeyquestionswhichhelpsfortheassess- mentofthermalrisk,whichwererefinedforeasierunderstanding (Nanchenetal.,2009).Thekeyquestionsarethefollowing:

1Whatistheheatevolutionrateasafunctionoftimeoftheoper- atingprocesstobecopedwithbytheoperationalequipment?So cantheprocesstemperaturebecontrolledbythecoolingsystem?

2Whattemperaturecanbereachedwhenthedesiredprocessruns away,assumingadiabaticconditionsforacoolingfailure?

3Whattemperature canbeattained after runaway of thesec- ondaryreaction?

4Whichisthemostcriticalinstantforacoolingfailure?Soatwhich timedoesthecoolingfailurehavetheworstconsequences?

5Howfastistherunawayofthedesiredreaction?

6HowfastistherunawayofthedecompositionstartingatMTSR?

ForthermalriskassessmentStoesselproposedaquantitative methodfordescribingtheseverityandprobabilityoftherunaway, whicharedescribedinTable1andinTable2.Fordefiningtheprob- abilityofrunawayanextended Tablecanbefoundin(Stoessel, 2009).

InadditionStoesselformulated5criticalityclassesbasedonthe relativeorderoffourspecifictemperaturelevels,rangingfromthe leastcritical(1–2)tothemostcritical(3–5)presentedin

Fig.4(Stoesseletal.,1997).Thefourspecifictemperaturelevels arethefollowing:

-Theprocesstemperature(Tp):theinitialtemperatureinthecool- ingfailure;

Table2

Assessmentcriteriafortheprobabilityoflossofcontrolofarunawayreaction (Stoessel,2009).

Probability Controllability TMRad[hr]

Frequent Unlikely <1

Probable Difficult 1–8

Occasional Marginal 8–24

Seldom Feasible 24–50

Remote Easy 50–100

Almostimpossible Notaproblem >100

Fig.4. Criticalityclassesofscenario(Stoessel,2009).

-Maximumtemperatureofsynthesisreaction(MTSR):itdepends onthedefreeofaccumulationofunconvertedreactants;

-TemperatureatwhichTMR_adis24h(T_D24):itisthehighesttem- peratureatwhichthethermalstabilityofthereactionmassis unproblematic;

-Maximumtemperaturefortechnicalreasons(MTT):itcanbea boilingpointinanopensystem,oritcanbeatemperatureatthe maximumpermissiblepressureinaclosedsystem.

Thecriticalityclassificationisausefultoolfortheriskassess- ment and also for the choice and definition of adequate risk reducing measures.InClass1and Class2 thelossofcontrol of themainreactiondoesnottriggersecondary reactionsandalso thetechnicallimitisnotreached.InClass3thetechnicallimitis reachedandmayserveasasafetybarrier,butthesecondaryreac- tionsarenottriggered.InClass4thesecondaryreactionscouldbe triggered,butthetechnicallimitmayserveasabarrier.InClass 5thesecondaryreactionsaretriggeredandthetechnicallimitis reachedastherunawayistoofastforasafetybarriertobeefficient (Stoessel,2009).

Junchengetal.improvedandappliedtheearliermentionedclas- sifications,andtheydevelopedinherentthermalrunawayhazard index(ITHI),whichiscalculatedbymultiplyingthematerialfactor (MF)andriskindex(RI)(Junchengetal.,2020).

ITHI=MF·RI (3)

Riskindexiscalculatedbasedontheseverityofrunawayreac- tionandtheprobabilityoftherunawayreaction.

RI=S·Pr (4)

Materialfactor(MF)iscalculatedbasedontheinitialreaction temperature(Tonset),andMaxpowerdensity(MPD),whereMFis limitedin(Vernières-Hassimietal.,2017;KnegteringandPasman, 2009).MPDisthefunctionofheatofdecompositionandthemax- imumreactionrate.

MF=1+I_Tonset·I_MPD

16 (5)

whereITonset,IMPDarepenaltyindexes.Severityandprobabilityof runawayreactionsaredeterminedbasedonquantitativeintervals basedondifferentpenaltyparameters,whichparameterscanbe foundin(Junchengetal.,2020).

Fig.5. ModifiedStoesselcriticalitydiagram(Jiangetal.,2019).

Jiangetal.developedamodifiedStoesselcriticalitydiagramto considerthefinaltemperature(T_f)oftheprocess.Theirthoughtis basedonthatifthefinaltemperaturedoesnotexceedthetechni- callimit(MTT)thenthetechnicalsafeguardcanreducetheaccident risk.Basedonittheyextendedthecriticalityclasses1and3,crit- icalityclasses2,4and5remainedthesameasStoesselpresented (Jiangetal.,2019).Fig.5presentsthemodifiedStoesselcriticality diagram.

Inthefirstcaseofcriticalityclass1thereactiontemperature willnotreachthetechnicallimitanditwillnotcauseasecondary reaction.MTTcanbereachedonlyifthereactionmixtureisleft intheheataccumulationforalongtime.Inthesecondcaseifthe reactionmixturestaysintheheataccumulationforalongtime,it mayinduceasecondaryreaction,butthefinaltemperaturecannot exceedthetechnicallimit.

Inthefirstcaseofcriticalityclass3thetechnicallimitisreached butasecondaryreactionisnottriggered.Inthesecondcasethe secondaryreactionistriggered,butthefinaltemperaturedoesnot exceedthetechnicallimit.

Nomenetal.developed anopeativetool fortherisk assess- ment(Checkcardsforrunaway(CCR)),whichfollowsafactor-based strategy. Five factors are defined toassess a thermal runaway, whichare:mischargingchemicals,autocatalyticreactions,segre- gation,accumulation,andtemperaturehazard(Nomenetal.,2004).

5. Reactorrunawaycriteria

Reactorrunawaycriteriacanbeappliedtodefinetheboundaries ofsafeandunsaferegimesthroughdistinguishingtherunawayand non-runawaystates. Thisfeatureallowstoapplycriteriain off- linetasks(likeprocessdesign,optimization)andinon-linetasks too(likeearlywarning).Therefore,thermalrunawaycriteriaare applicableindesigningandoperationofchemicalreactors(Jiang etal.,2011).Abriefhistoryaboutthereactorrunawaycriteriauntil 2006canbefoundin(Shouman,2006).

Thermalrunaway criteria can be classifiedinto three types, which are geometry-based criteria, stability-based criteria and sensitivity-based analysis can beperformed to define runaway boundaries,whicharepresentedinthefollowingSections5.2–5.4.

Therunawaycriteriaandtheyearoftheirfirstpublicationarepre- sentedinTable3.Section5.1presentsasimplemathematicalmodel ofatubularreactor(orbatchreactor),onwhichthederivationof runawaycriteriacanbepracticedeasily.

5.1. Mathematicalmodel

Afirstorderreactioncarriedoutinabatchreactorispresentedin thissectionwhichwillprovideasabaseforpresentationofthermal runawaycriteria.Thereactorwasconsideredasperfectlymixedso

Table3

Thermalrunawaycriteriadevelopmentsovertime.

Criterion Yearofpublication Reference

Semenov-criterion 1928 Semenoff(1928),

Semenov(1940)

“PracticalDesign”criterion 1938 Berty(1999)

vanHeerdencriterion 1953 vanHeerden(1953)

Gilless-Hoffmanncriterion 1961 Berty(1999),Gillesand Hofmann(1961) ThomasandBowescriterion 1961 Thomas(1961),Varma

etal.(2005) AdlerandEnigcriterion 1964 AdlerandEnig(1964) vanWelsenaereandFroment

criterion

1970 vanWelsenaereand

Froment(1970) Morbidelli-Varmacriterion 1987 MorbidelliandVarma

(1988)

Adiabaticcriterion 1988 Gygax(1988)

Hopf-bifurcationanalysis 1989 Colantonioetal.(1989)

Vajda-Rabitzcriterion 1992 VajdaandRabitz

(1992)

Strozzi-Zaldivarcriterion 2003 Zaldívaretal.(2003)

Lyapunov-stability 2006 Szeifertetal.(2006)

Adiabaticcriterionbasedon Strozzi-Zaldivarcriterion

2016 Guoetal.(2016)

Kähm-Vassiliadiscriterion 2018 KähmandVassiliadis (2018a)

ModifiedSlopeCondition 2019 KummerandVarga

(2019a)

ModifiedDynamicCondition 2019 KummerandVarga (2019a)

thefollowingdifferentialequationscanbewrittentodescribethe dynamicalbehaviour:

dc

d =−r (6)

dT

d =q_gen−q_rem (7)

q_gen=ˇr (8)

qrem=˛(T−Tw) (9)

Where r=exp

− E RT

c (10)

˛=5l

h,ˇ=180m³K

kmol,=20,E

R =6600K,c0=1kmol

m³ , T0=300K(11) Fig.5showshowthepresentedmodel(Eqs.6–11)issensitiveto

thewalltemperature,anditpresentsthedevelopmentofthermal runaway.

5.2. Stability-basedcriteria

Thestateofthesystemcanbeconsideredstableifafterasmall disturbancethesystemreturnstoinitialstateandduringthetran- sientbehaviourthestateofthereactorstaysclosetothatinitial state.Thistheorycanbeusedtoinvestigatereactorrunawaysince incaseofrunawayreactionssimilarsituationoccurs,wherethe positivefeedbackinthetemperatureandreactionraterelationship canresultinthedevelopmentofrunaway.Thatfirststateofthesys- tem,whenrunawayisoccurredcanbeconsideredasunstablestate, fromwhichthereactorcannotgobacktotheinitialstate.Numer- ousstability-basedrunawaycriteriawereproposedtoindicatethe developmentofthermalrunaway,whicharenowpresentedinthe followingsection.

5.2.1. Semenov-criterion

Firstpioneerworkinthefieldofreactorrunawaywasdoneby Semenov,whichworklaidthegroundworkforfurtherresearches.

Thissectioniswrittenbasedon(Stoessel,2008;Semenoff,1928;

Semenov,1940).Semenovconsideredanexothermalreactionwith zero-orderkinetics.Semenov-diagrampresentstheheat-releasein reactionand theremovedheatbyheattransferasafunctionof temperature.

Fig.7 presents therelationship betweenthe generated and removedheat,wherethegeneratedheatvariesexponentiallywith processtemperature,whiletheremovedheatvarieslinearlywithit.

ThreeessentialpointsdrawattentioninSemenov-diagram,which aremarked asA, Band C, andthe belongingtemperaturesare markedasT_w¹, T_w² andT_w³.InAwecanrespectastableoperating pointsinceifthecoolingtemperatureislowerthan T_w²,thepro- cesstemperaturewilldecreaseduetothehigherremovedheat untilA,andnoself-ignitionoccurs.Ifthecoolingtemperatureis higherthan T_w²,self-ignitionoccurssince thegenerated heatis continuouslyhigherthantheremovedheat.Cpointrepresentsthe criticalpointincaseofahighercoolingtemperature,wherethe generatedheatcurveistangentatonepointtotheremovedheat line.Thebelongingcoolingtemperatureisconsideredascritical, orasthelowesttemperatureofself-ignition.Inthispointalittle increaseincoolingagenttemperaturethecoolinglinewillhaveno intersectionbetweenthegeneratedheatandremovedheatcurve leadstotherunawayofreaction.

Fortheaimofavoidingthermalrunawayitisnecessarytooper- atethereactor faraway from critical conditions. Based onthe Semenov-diagramandfurtherinvestigationofthecriticalpointa runawaycriterioncanbederived.Inthecriticalpointthegenerated andremovedheat,andalsotheirderivativeswithrespecttotem- peratureequals,thiscanbewrittenasEqs.12–15presents.Since thereagentconsumptionisneglected,thereactionratevariesonly withtemperature,hencethepartialderivativeofthereactionrate canbeconsidered.

qgen=q_rem (12)

ˇr=˛(Tc−Tw) (13)

dqgen

dT = dq_rem

dT (14)

ˇrT=˛ (15)

Dividingthe13and15.equationsthefollowingcriticalequation istheresult:

r rT =RT_c²

E =(Tc−Tw)=Tc (16)

Eq.16 presents that thereis a minimal temperaturedifference betweentheprocessandcoolingtemperaturetokeepthereac- tionoperationstable.Semenov-diagramhelpsustoformulatethe runawaycriterion,becausethecriticaltemperaturedifferenceis alwayssatisfiedwhenthetemperatureisbelowthecriticaltem- peraturevalue.

(T−Tw)≤ RT_c²

E (17)

FromEq.17thecriticaltemperaturecanbecalculatedbysolving thequadraticequation.

Tc=1−

1−^4RTE^w 2R

E

∼= 2

E

E

+4

E

...

2R E

(18) Ifweconsideronlythefirsttwotermsontherightside,the followingrunawaycriterion(Semenov-criterion)canbederived:

(T−T_w)≤ RT_w²

E (19)

WepaytributetotheSemenov-number,whichistheratioof dimensionlessreactionheatparameterand theheattransfer,as follows:

= (−Hr)kcⁿ UA

E

RT² (20)

Forverylargeactivationenergiesthefollowingcriterioncanbe defined,mentionedintheliteratureasSemenov-criterion(where eisthenaturalnumber):

<1

e= c (21)

Thisequationisdeterminingintheresearchfieldofthermal ignition,becausethefollowingresearchesfocusonhowtodeter- mine thecritical Semenov-number in more realistic cases, like withoutneglectingthereactantconsumption.

However,wearegoingtopresenttherunawaycriteriawith- outinvestigatingtheconcretevalueofSemenov-numbersinthe followingsections,insteadwearegoingtopresentthebasethe- ory.Criticalstates(temperature,concentration,etc.)canbedefined though,andthecriticalSemenov-numberscanbecalculatedfrom thesevariables.

5.2.2. VanHeerdenand“practicaldesign”criterion

BertyclearlypresentedthetheorybehindVanHeerdencrite- rion,whichisoftencalledas“SlopeCondition”(Berty,1999;van Heerden, 1953). In a steady-state operationthe generated and removedheatareequal. Itisevidentalsothattheheatgenera- tionand heatremovalrateincreaseswithtemperature,butthe generatedheatincreasesexponentially.Ifthereisanydisturbance inthereactortemperaturetheheatremovalrateshouldincrease fasterwithtemperaturethanthegeneratedheat,itwouldprevent temperaturerunaways.Mathematicalformofthecriterionisthe following:

dqgen

dT ≤dqrem

dT (22)

TheareaofsensitivedomainwasdefinedbyVanHeerdenin 1953(vanHeerden,1953).Perkinsassumedzeroorderkineticsto defineasafeboundary.ConsideringEqs.22and12thefollowing criterioncanbedefined:

T−Tw≤RT²

E (23)

Bashiretal.derivedthesamecriterioninvestigatingtheinflec- tionpointinageometricplane(Bashiretal.,1992),statingthatthe calculatedmaximumtemperatureinEq.23isthelimitingvaluefor runawayattheinflectionpoint.

5.2.3. Gilles-Hoffmanncriterion

Gilles and Hoffmannin1961 recognizedthe“Dynamic Con- dition”, whichistheconditionthat setsthelimitstoavoidrate oscillation.Criterionisstatedastheincreaseofheatremovalrate withtheincreaseoftemperaturemustbelargerthanthediffer- encebetweenheatgenerationrateincreaseduetotemperature alone andreaction ratedecrease duetotheconcentrationdrop alone(Berty,1999;GillesandHofmann,1961).

∂qgen

∂T

c

+ ∂m

∂c

T

≤dqrem

dT (24)

wheremisthematerialbalancefunction.

5.2.4. Lyapunov-stabilityingeometric-andphase-plane

Szeifertetal.proposedtouseLyapunov’sindirectmethodto forecastreactorrunaway(Szeifertetal.,2006;Sastry,1999).The

stabilityanalysisofasystemdefinedbyasetofnonlineardiffer- entialequationsofthestatevariablesapplyingLyapunov’sindirect methodisreducedtoaneigenvalueanalysisoftheJacobianmatrix.

J= ∂f

∂x (25)

IfrealpartofeacheigenvaluesoftheJacobianmatrixisnegative thenthemodelisstable,butifanyofthesearepositivethensystem isunstableattheinvestigatedoperatingpoint.Lyapunov-stability canbeperformedingeometric-andinphase-planetoo.Thespatial stabilitycriterionisalwaysmoreconservative,becausethestabil- ityinphasespacealwaysfollowsfromthespatialstabilitywhile inverselydoesnot.

In2008López-Garcíaetal.proposedtoinvestigatethesteady- statesolutionswithaperturbationmodel,becausethedynamic studyisessentialtoguaranteethethermallystableoperation.The methodis basedonthelinearization oftheperturbationmodel whichresultintheanalysisoftheeigenvaluesofJacobianmatrix (López-GarcíaandSchweitzer,2008).VajdaandRabitzsimilarly investigatedtheperturbationmodelearlierin1992,buttheyinves- tigatedthesensitivityofmaximumvalues ofeigenvaluesofthe Jacobianmatrix(VajdaandRabitz,1992).

Forinvestigating thedynamicsof asystem,Hopf-bifurcation analysiswassuggested,whichisbasedoninvestigatingtheeigen- values too.Ifthe realpartof a complex-conjugate pairs ofthe Jacobianmatrixbecomespositivethenbifurcationoccurs,andthat meansreactorrunawaymaydevelop(Colantonioetal.,1989;Ball andGray,2013;GómezGarcíaetal.,2016;McAuleyetal.,1995;

Kimetal.,1991;BallandGray,1995;Ball,2011).

5.2.5. Strozzi-Zaldivarcriterion(Divergencecriterion)

StrozziandZaldivarinvestigatedthephase-spacevolumecon- tractionsduringthereactoroperationbasedoninvestigatingthe Lyapunov-exponentsand thedivergence ofthe system(Strozzi etal.,1999).Ithasbeenshownthatthedivergencecriterioncan beappliedfordevelopingsafetyboundarydiagramstodistinguish therunawayandnon-runawaystatesforseveraltypesofreactors (BR,SBR,CSTR)andformultiplereactions,alsowithandwithout ofacontrolsystem(Zaldívaretal.,2003).

StrozziandZaldivarprovidedthefollowingderivationoftheir runawaycriterion(Strozzietal.,1999).AccordingtotheLiouville’s theorem,contractionofastatespacevolumeofad-dimensional dynamicalsystemcanbedefinedbasedonitsdivergence(Arnold, 2006).

dV(t) dt =

divF[x(t)]dx1(t)...dx_d(t) (26) wherethedivergenceofthesystemcanbecalculatedas

divF[x(t)]=∂F1[x(t)]

∂x₁(t) +∂F2[x(t)]

∂x₂(t) +···+∂F_d[x(t)]

∂x_d(t) (27) Assumingthatthed-dimensionalvolumeissmallenoughthat thedivergenceofthevectorfieldisconstantoverV(t),then dV(t)

dt =V(t)divF[x(t)] (28)

IntegratingEq.28theinitialphase-spacevolumeV(0)changeswith timeas

V(t)=V(0)exp

t 0

divF[x(t)]d

(29) Hencetherateofchangeofthestate-spacevolumeisgivenby thedivergenceofthesystem,whichislocallyequivalenttothetrace oftheJacobianofF.Theexpansionandcontractionofthestate- spacevolume,sothatthedivergenceoftheinvestigatedsystemis inrelationwithrunawayandnon-runawaysituations.Practically

itmeansthatifthestatevariablesdriftoffforasmallperturba- tionthenthesystemisunstable.Incasethedivergenceisnegative therewillbenorunaway,althoughifthedivergenceispositive, runawaywilldevelop.Therefore,theproposedrunawaycriterion isthefollowing:

divF[x(t)]≤0 (30)

Copelli etal. modified theoriginal divergence criterion,and theyproposedtodisregardallcontributionsarisingfromextent- of-reactions that are not related toheat evolution. Other state variablescangenerateastrongstate-spacevolumecontractionthat isnotrelatedtothedevelopmentofrunawaywhichmayleadsto thefailureofdivergencecriterioninpredictingreactorrunaway.It meansthatforexamplethecomponentswhicharenotreactantare neglectedwhenevaluatingthemodifieddivergenceofthesystem (Copellietal.,2014),(Kahm,2019).

Strozzietal.alsoinvestigatedtheLyapunov-exponentstodefine sensitivity.Lyapunov-exponentcanmonitorthebehaviouroftwo neighbouringpointsofasysteminadirectionofthephasespaceas afunctionoftime:IftheLyapunov-exponentispositive,thenthe pointsdivergefromeachother,iftheexponentbecomesnegative, thenthepointsconverge.Lyapunov-exponentsarerelatedtothe eigenvaluesoftheJacobianmatrix,sinceitaveragestherealparts ofalleigenvaluesalongatrajectory(Strozzietal.,1994;Strozzi andZaldívar,1994).AlthoughtheLyapunov-exponentscanunder- estimatetherunaway boundaryfor likeautocatalyticreactions, becauseitusestheintegralovertimewhich isslowtorespond tofastchange.Therefore,Strozzietal.proposedtoapplydiver- gencecriterion(Strozzietal.,1999).Kähmetal.laterinvestigated theLyapunov-exponentsnotinsensitivitycontext,butinvestigat- ingthevaluesofit.IftheLyapunov-exponentbecomespositive,an unstableprocessispresent(KähmandVassiliadis,2018a;Kähm andVassiliadis,2018b;KähmandVassiliadis,2018c).

We cancalculate thedivergenceonline, withoutneeding to knowthedifferentialequationsofthesystembyusingthetheory ofembedding.Statespacereconstructionisapossibletechnique toaddressthis problemusingtimedelayembeddingvectorsof theoriginalmeasurements(i.e.,temperatureorpressuremeasure- ments)(Boschetal.,2004a;Boschetal.,2004b).Althoughthereis severalmethodsofreconstruction,butthereisnoapriorimethodto decidewhichoneisthebest.In(Zalı ´dvaretal.,2005)Zaldivaretal.

testedseveralmethods:timedelayembeddingvectors;derivative coordinatesandintegralcoordinates,buttheresultsweresimilar andtheyusedderivativecoordinatesbecauseoftheirclearphysical meaning.Therearetworeconstructionparameters:theembedding dimension,andthetimedelay.Theembeddingdimensionisthe dimensionofthestatespacerequiredtounfoldthesystemfrom theobservationofscalarsignals,whereasthetimedelayisthelag betweendatapointsinthestatespacereconstruction(Boschetal., 2004b).

Guoetal.developedanadiabaticcriterionbasedonthediver- genceofanadiabaticmodelofthereactorsystemwithzerofeed rateresultinamorestrictrunawaycriterion(Guoetal.,2016;Guo etal.,2017a).

WalterKähmdevelopedastabilitycriterionbasedontheorigi- naldivergencecriterion,whichisbasedonthedifferencebetween thedivergenceoftheJacobianmatrixoftheinvestigatedreactor systemvariablesandthecorrectionfunction.Thecorrectionfunc- tionisderivedasafunctionofthedivergenceoftheJacobianatthe previoustimestep;Damköhlernumber;Barkelewnumber;Arrhe- niusnumberandtheStantonnumber.Theyintroducedthisstability criterion,becausedivergencecriterionmayoverpredictthether- malrunawaypotentialofthesystem.Thederivationisbasedon a linearapproximationofthedivergence(KähmandVassiliadis, 2018a;Kahm,2019;KähmandVassiliadis,2018d).Theproposed

stabilitycriterionissuccessfullygeneralizedformultiplereactions (KähmandVassiliadis,2019).

5.2.6. Modifieddynamicandslopecondition

KummerandVargainvestigatedthemostfrequentlyapplied criteriaand derived two newcriteria as a result(Kummer and Varga,2019a).Eq.31presentstheModifiedSlopeCondition(MSC) andEq.32presentstheModifiedDynamicCondition(MDC).We investigatedthreedifferentreactionsystems(singlereactionwith areagent,twoparallelreactions,andanautocatalyticreactionsys- tem)tovalidatetheModifiedDynamicandSlopeConditioncriteria, whichinthereliabilityandthetimeofindicationwerecompared.

MDCdidnotmissanythermalrunawaydevelopment,buttheper- formanceofMSCiscompatiblewiththeinvestigatedones.

∂qgen

∂T

c

≤dqrem

dT

1+qgen

q_rem

(31)

∂qgen

∂T

c

+ ∂m

∂c

T

≤ qgen

qrem

dqrem

dT (32)

5.3. Geometry-basedcriteria

Several reactor runaway criteria exist based on a geomet- ric characterization of temperature trajectories, which will be presentedinthis section.Advantagesof inflexion-basedcriteria (ThomasandBowes-,AdlerandEnigcriterion)andadiabaticcri- terionisthatitrequiresonlyatemperatureprofileortrajectory toevaluatethereactionstates,althoughwithoutinvestigatingthe states on a prediction horizon the runaway indications proba- blyoccurslately.Inflection-basedcriteriadonotgiveinformation abouttheintensityofthereactorrunaway.VanWelsenaereand Fromentcriterionisquiteconservativethoughandindicatesreac- torrunaway quite early,but a model of thereactor system is requiredfortheapplication.

5.3.1. ThomasandBowescriterion

ThomasandBowesproposedtoindicatereactorrunawayasthe situationinwhichaninflexionpointappearsbeforethetempera- turemaximuminthegeometricplane(inversustimeorlength).It meansthatthereactoroperationstayscontrollableifthefollowing statementsaresatisfied(Thomas,1961;Varmaetal.,2005).

d²T

dt² <0whiledT

dt >0 (33)

DenteandCollinain1964independentlyproposedthesame criterion(Varmaetal.,2005).

5.3.2. AdlerandEnigcriterion

AdlerandEnigfounditmoreconvenienttoworkinaphase- plane(intemperature-conversion)thaninthegeometricplane.To indicatereactorrunaway aninflexionpointmustappearbefore thetemperaturemaximuminthephase-plane.Itmeansthatthe reactoroperationstayscontrollableifthefollowingstatementsare satisfied,wherexistheconversion(AdlerandEnig,1964).

d²T

dx² <0whiledT

dx >0 (34)

5.3.3. VanWelsenaereandFromentcriterion(orMaxicriterion) vanWelsenaere and Fromentdetermined critical conditions basedonthelocusoftemperaturemaximainthetemperature- conversion plane. This criterion can be eliminated based on obtainingtherelationbetweenmaximumprocesstemperatures

Fig.6. Sensitivityofthereactormodelwithrespecttowalltemperature.

Fig.7.Semenov-diagram.

evolvingatdifferentcoolingagenttemperatures(vanWelsenaere andFroment,1970).

dT

dx >0dcm

dTm

>0 (35)

5.3.4. Adiabaticcriterion

Afrequentlyappliedrunawaycriterion(eveninindustrialappli- cation)isthattheprocesstemperatureevolvingunderadiabatic conditions(sotheMTSR)cannotexceedtheMaximumAllowable Temperature(Abeletal.,2000).

Tp+T_ad=MTSR≤MAT (36)

5.4. Sensitivityanalysisofchemicalreactors(Morbidelli-Varma criterion)

A.Varmaetal.wroteanexcellentbookabouttheparametric sensitivitiesinchemicalsystems(Varmaetal.,2005).Theanalysis ofhowasystemrespondstochangesintheparametersiscalled parametricsensitivity(Varmaetal.,2005).Inthecontextofchemi- calreactorsBilousandAmundsonperformedapioneerworkonthe fieldofparametricsensitivity,wheretheresearchersshowedhow themaximumtemperaturealongthereactorlengthvarieswith theambient(cooling)temperature(BilousandAmundson,1955;

BilousandAmundson,1956;Grayetal.,1981;Emigetal.,1980;

Grayetal.,1981).Theresultofasimilaranalysiscanbeseenin Fig.6.Sensitiveregionsofoperationsshouldbeavoidedbecauseits

performancebecomesunreliableandchangessharplywithsmall variationsinparameters.Althoughsomeexperimentalstudiesare availableintheliterature(Emigetal.,1980;LewisandVonElbe, 2014),itisdifficulttoperformwholesomeinvestigationsaboutthe reactionsystems(nottomentiontheindustrialsystems),because thesesystemsinvolvemany parametersaffectingthebehaviour ofthereactor.Therefore, modelbasedinvestigations areneces- sary.For theaimofinvestigationthesensitivity ofreactors we shoulddefinevaluableoutputs(dependentvariables),andvalu- ableinputs(independentvariables).Dependentvariablescanbe investigatedingeometric-or/andinphase-plane,whichcanbefor exampleproductivity,processtemperature,processpressureetc.

Inputvariablestypicallyareinitialconditions,operatingconditions andgeometricparametersofthesystem.

MorbidelliandVarmausedthefactthatneartheexplosion(run- away)boundarythesystembehaviourbecomessensitivetosmall changesinsomeoftheinputorinitialparameters,andtheydefined theboundarybetweenrunawayandnon-runawayzonebasedon thissensitivityconcept.Thefirst-orderlocalsensitivityorabsolute sensitivityofthedependentvariable(y)withrespecttotheinput parameters()canbecalculatedbasedonthefollowingform:

s^y= ∂y

∂ (37)

Anotherquantityrelatedtolocalsensitivityisthenormalized sensitivity,whichcanbedefinedas:

S^y= y

∂y

∂ = ∂lny

∂ln=

ys^y (38) Theadvantageofnormalizedsensitivityisthatitnormalizesthe magnitudesoftheinputparameterandthevariabley.

In Morbidelli-Varma criterion the parametrically sensitive regionofthesystemorcriticalityforthermalrunawaytooccuris definedasthatwheretheabsolutevalueofthenormalizedsensitiv- ityofthetemperaturemaximumreachesitsmaximum(Morbidelli andVarma,1988),(MorbidelliandVarma,1989;Chemburkaretal., 1986).Lacey(1983)andBoddingtonetal.(1983)independently proposedtousethesensitivitymaximumofthetemperaturemax- imum with respect to Semenov number, to define the critical conditionsforthermalexplosion,butMorbidelliandVarmagener- alizedthiscriterionconsideringotherphysicochemicalparameters ofthereactingsysteminthedefinitionofthesensitivity.

Jianget al.proposedtoapplytheabsolutesensitivity inthe followingform:Safeoperatingconditionscanbedefinedbythe temperaturesensitivityvaluewhichislessthanoneinthewhole intervalexceptintheinitialpoint.Theboundarybetweenrunaway andstableconditionisestablishedbythemaximumvalueofthe sensitivityfunctionwhichequalsone,soas:

max

s^y

=1(exceptt=0) (39)

Theyexplaineditthrough analysingthemaximumvalues of absolutesensitivities,andnotingthatlowersensitivityvaluesmean lesssensitivesystems.Practicallytheyjustmadeathresholdto makethesystemsaferandthecriterionstricter(Jiangetal.,2011).

5.5. Data-basedpredictionofthermalrunaway

Runaway criteria were developed using data-mining tools, where datawere generated based onthemodel of thereactor system.In(Vargaetal.,2009)adecision-treebasedapproachis developedtodistinguishbetweenrunawayandnon-runawaysit- uation,where thecasestudy isan industrialreactor producing phosgene.A similarapproach is presented in (Dakkouneet al., 2020),wherebinarydecisiondiagramsandlinearclassifierswere appliedtodiagnosethefault.Theydetectedrunawaycriteriabased

on dynamic thresholdsevaluated by investigating temperature characteristics(Amineetal.,2018).Themajordrawbackofthese criteria,thatahugeamountofprocesssimulationsshouldbeper- formed to obtain the necessary amount of data. However, the resulteddecision-treecanbeeasilyunderstoodbyaprocessoper- ator,andthemostappropriatesafetyactionscanbedetermined foranyoftherunawaystates.Kummeretal.developedagenetic programming-basedmethodforconstructingtailoredrunawaycri- teriatoreachamorespecificcriticalequation,thistechniquecanbe usedforanykindofcombinationofreactorandreactionsystems, andtheresultedcriterionismuchmoresuitableforthatsystem thananygeneralcriteriafromtheliterature(Kummeretal.,2019).

6. Safetyboundarydiagrams

Incaseofoperationofbatchandsemi-batchreactorscarrying out exothermicreactionssafetyboundarydiagramscangivean efficientsupportforsafeoperation.Westerterpetal.hadalotof pioneerworkonthisfield,alsoadimensionlessnumberiscalled asWesterterp-number(Wt,earlierCoolingnumber,Co,(Pohorecki and Molga,2010))andthesafetyboundarydiagramoftenmen- tionedasWesterterp-diagram.HugoandSteinbachhaveobserved thatanaccumulationofthenon-convertedcomponentinSBRmay causerunawayevents,andalsoinvestigatedhowthemaximum processtemperaturevariesincaseofabreakdownofcooling(Hugo andSteinbach,1986;Hugoetal.,1988).Westerterpetal.general- izedtheconceptofavoidingreagentaccumulationthroughsafety boundarydiagrams.Theyinvestigatedheterogeneousliquid-liquid andhomogeneousreactionstoo(SteensmaandWesterterp,1988;

SteensmaandWesterterp,1991;SteensmaandWesterterp,1990).

Theproposedsafetyboundarydiagramcanbeappliedgenerally, hencemostoftherecentarticlesusethesamegeneralreactorand homogenousreactionsystemforfurtherinvestigations(Molgaand Lewak,2009).Of course,laboratoryexperimentswerealsoper- formed toinvestigatethe safetyboundary diagrams,a detailed work aboutthethermallysafeoperationofa nitricacidoxida- tioninSBRcanbefoundin(vanWoezik,2000;vanWoezikand Westerterp,2002),

Inidealcasesthereactionrateequalsthefeedrate,meansthat thedosedreagentreactsawayimmediatelyavoidingthereagent accumulation.Inthatcasethereactortemperaturefollowsatra- jectorycalledthetargettemperature,whichcanbeestimatedwith thefollowingequation.Derivationofthisequationcanbeseenin (Westerterpetal.,2014).

Tta=Tc+ 1.05T_ad,0 ε

Wt

1+ε

+RH

whereTcisthecoolingtemperature,T_ad,0isaninitialadiabatic temperaturerise,εistherelativevolumeincrease,WtisWesterterp number, isdimensionlesstime,RHistheratioofheatcapacities ofthedispersedandthecontinuousphase.

If thedosingiscompleted Eq.40. canbeusedtodefinethe targettemperaturebeside␪=1.Atthetargettemperaturethereac- tionrateishighenoughforavoidingreagentaccumulation,sothe reactorisoperatedsafely.Therefore,reactorrunawayoccursifthe processtemperatureexceedsthetargettemperature.

Three zonescan bedistinguishedbased ontheevolution of temperature and concentration trajectoriesin SBRs, which are:

marginalignition(MI,ornoignition),thermalrunaway(TR)and QFS (quick onset, fair conversion, smooth temperature profile) zones,asitcanbeseeninFig.8.Inthemarginalignitionthereactor temperatureisalwaysmuchlowerthanthetargettemperature,the reactiondoesnotignite;hencetheaccumulationistoohighforsafe operation.Inthethermalrunawayzonetheprocesstemperature exceedsthetargettemperature,alsoreachesmuchhighervalues

Fig.8.Safetyboundarydiagram(Westerterpetal.,2014).

thanthetargettemperaturebecauseoftheaccumulatedreagent abruptignitesthereactionbehavingcloselytoabatchoperation.In QFSzonetheprocesstemperaturetrajectoryisveryclosetothetar- gettemperaturetrajectory,becausethefedreagentreactsalmost immediately,whichisthegoalintheoperation.

Thethreezonesarecharacterizedbytwodimensionlessnum- ber,exothermicity(Ex)andreactivity(Ry),whicharedefinedas follows:

Ex= T_ad,0(E/R)

T_c²ε(R_H+Wt)= _ad,0

ˇ²_cε(R_H+Wt) (41)

Ry=

Da(T_R)exp

1−_ˇ¹_c

ε(R_H+Wt) (42)

whereTcisthecoolingtemperature,T_ad,0isaninitialadiabatic temperaturerise,Eisactivationenergy,Risthegasconstant,εis therelativevolumeincrease,WtisWesterterpnumber, isdimen- sionlesstime,RHistheratioofheatcapacitiesofthedispersedand thecontinuousphase,_ad,0isdimensionlessadiabatictempera- turerise,istheArrheniusnumber,ˇcisthedimensionlesscooling temperature,DaistheDamköhlernumber.

Theexothermicitynumberspresentstheratioofthemaximal powergeneratedduetothereactionandthecoolingabilities.The reactivitynumberpresentstheratioofthereactionrateandthe coolingrate.Theboundarylineindicatesthecasewheretheprocess temperaturedoesnotexceedthetargettemperature,onlytouches it(Molgaetal.,2007).Theboundarydiagramsandtheboundary linesdependonthevalueoftheWesterterp-number(Wt)andthe ratioofheatcapacitiesof(R_H).

Westerterp-numberpresentsthecoolingabilityrelatedtothe heatcapacityofthereactorcontentatthebeginningoftheprocess.

Dosingtimeisalsoappearsinthisdimensionlessnumberconsider- ingtherateofheatevolution.Westerterp-numbercanbecalculated asfollows:

Wt= (UA)₀t_dos ε

Vcp

0

(43) whereU₀istheinitialheattransfercoefficient,A₀istheinitialheat exchangesurface,t_dosisthedosingtime,εistherelativevolume increase.

TheWesterterp-numberisthekeyparametertodeterminethe differencebetweenthebehaviourofthelargescale,industrialreac- torandthelaboratoryreactor(WesterterpandMolga,2004).There isaninherentlysaferegion,asitcanbeseeninFig.8.Theydeter- minethemaximumoftheexothermicityvaluesbelowwhichthe heatevolutionisalwaystoolow,hencereactorrunawaydoesnot

Fig.9. SafetyboundarydiagramconsideringMAT(Nietal.,2016).

develop. Thereisalsoa minimumreactivityvalueabovewhich reagentaccumulationdoesnotoccurbecauseofthehighreaction rate,hencereactorrunawaydoesnotdevelopeither(Westerterp and Molga, 2006). These specific values determine unambigu- ouslytheinherentlysaferegion.Boundarydiagramsafetycriterion (BDSC) isbased oncomparingthereactivity and exothermicity numbers to themaximal exothermicityand minimal reactivity numbers,forfurtherinformationsee(Westerterpetal.,2014).The safetyboundarydiagramscanbeeasilyusedforanexistingreactor toidentifythermallysafeoperatingconditionswithoutsolvingthe mathematicalmodelofthereactor.AlsotheWesterterp-diagram canbeeasilyusedtoscalingupreactors(MaestriandRota,2005a;

MaestriandRota,2005b),andalsoakinetics-freeapproachcanbe foundin(Guoetal.,2019).Flowchartfordesigningthermallysafe operatingconditionsbasedonsafetyboundarydiagramscanbe foundin(Molgaetal.,2007;Guoetal.,2017b).

AlthoughtheWesterterp-diagramisunderstandableandeasy touse, thereis nodirectinformation aboutthemaximumpro- cess temperaturesevolvingduring thereactoroperationin the QFS zone, which always should bechecked, because the reac- torsystemmaycannotstandit(maximumprocesstemperature exceeds MAT),or thecoolingcapacity maybenothighenough totransferthedevelopingreactionheat.MaestriandRotaintro- ducedTemperatureDiagrams(TD),whichcanbeappliednextto theWesterterp-diagram. TDs allowfor boundingthemaximum process temperatureas a function of exothermicityor reactiv- itynumbers(MaestriandRota,2006a;MaestriandRota,2006b;

Copellietal.,2010).

Nietal.consideredsecondreactionregiontoothroughinclud- ingtheMATvalueinthedevelopmentofsafetyboundarydiagram, asitcanbeseeninFig.9.EGcurverepresentsthemarginalignition, runawayregionislocatedbetweenEGandEF.QFSregionislocated betweenABCDandEGcurves,andthesecondreactionregionis aboveABCDcurve(Nietal.,2016).Theyalsosuccessfullyapplied thismethodforanautocatalyticreactionsystem,wheretheauto- catalyticbehaviourwasdefinedasparallelreactions,andforthis theyproposedamodifiedExothermicityandreactivitynumber(Ni etal.,2017).

Maximum temperature of synthesis reaction (MTSR) is an importantcriterionforreactordesignandprocesshazardassess- ment, becausein case of a coolingfailure this parametergives information abouttheevolvingprocesstemperatures. Forsafety reasonsitshouldbelowerthantheMAT.Guoetal.investigated thisphenomenonindetail(Guoetal.,2015).Baietal.appliedMTSR valuesinsteadofprocesstemperaturesforcomparingitwiththe

Fig.10.ExtendedBoundaryDiagram(Guoetal.,2018).

targettemperaturevaluestobuildsafetyboundarydiagramsresult inasaferreactoroperation.TheircriterionisdenotedasMaximum temperatureofasynthesisreactioncriterion(MTSRC)(Baietal., 2017a).Flowchartsfordesigningthermallysafeoperationsconsid- eringMTSRvaluescanbefoundin(Baietal.,2017a;Baietal.,2017b;

Zhangetal.,2019).Amoregeneralizedmethodforincludingand investigatingthemaximumprocesstemperaturesdeveloping at givenoperatingparametersareproposedin(Guoetal.,2018).Guo etal.proposedanartificiallydefinedconstanttemperature,which canbecalculatedasfollows:

Tn=Tc+ nT_ad,0

ε[Wt+RH]n≥1.05 (44)

TngivesinformationabouttheMTSRvaluesevolvingataspecific operationconditions,forexampleatn=2thegivenT₂ pointsin SBDcanbeseeninFig.10,whereMTSRvaluesequalsT₂(Guoetal., 2018).

Recentlyamulti-featurerecognition(MFR)criterionbasedon patternrecognitionwasproposedtodevelopsafetyboundarydia- grams(Zhangetal.,2020).

Thepresentedmethodsaregreatandeasytouse,butitrequires constantfeedrateofreagents.However,ifwewouldliketomax- imizetheproductivityorotherefficiencymetricsthefeedingrate shouldbevariedintime.Inourhumbleopinionsafetyboundary diagramsshouldbeusedtodefinethesuitableinitialconditions,so todefineinitialprocesstemperature,flowrateofcoolingagentand reagents.ThewholeconceptofSBDsistoavoidtheaccumulation ofreagents,butasthereactortemperatureincreasesthefeedrate ofreagentscanbeincreasedwhereaccumulationwillnothappen.

7. Safetyequipment/actionstomoderateserious consequences

In case we have the most reliable criterion which can be achievedtoforecastrunaway,thenextstepistoprepareoursys- temtodecreasetheeffectofrunawaydevelopment.Whenrunaway occursanditcannotbehandledinnormaloperationsitisneces- sarytostopthereaction,sowecanavoidundesiredscenarios.In suchasituation,shutdownofthereactorisperformedbysome safetyinterlockoremergencyshutdownsystem.Whenpressure increasestoohighacommonlyappliedmitigationsystemisusing apressurereliefvalvewhichdirectstheflowtoaknownlocation,in thiswaythepressurecanbedecreased.However,someconsider- ationalwaysmustbegiventothedirectionandlocationoftheend oftheventline.Duringventing,thedischargemaybepassedto:a