HAZOP analysis based on sensitivity evaluation

Safety Science 88 (2016) 26–32

Contents lists available at ScienceDirect

Safety Science journal homepage: www.elsevier.com/locate/ssci

HAZOP analysis based on sensitivity evaluation Jianxin Kang, Lijie Guo ⇑ School of Environmental and Chemical Engineering, Yanshan University, Qinhuangdao, Hebei 066004, China Hebei Key Laboratory of Applied Chemistry, Yanshan University, Qinhuangdao, Hebei 066004, China

a r t i c l e

i n f o

Article history: Received 23 January 2016 Received in revised form 26 March 2016 Accepted 19 April 2016

Keywords: HAZOP analysis Sensitivity evaluation Deviation cause

a b s t r a c t Hazard and operability (HAZOP) analysis approach based on sensitivity evaluation is presented in this paper to ensure production safety in complex and large-scale chemical plants. In this approach, the sensitivity evaluation is introduced into HAZOP deviation analysis to measure the effect degree caused by each cause on the corresponding deviation. A quantitative sensitivity evaluation model of deviation cause is first established, in which the departure degree, time duration to reach the maximum deviation, and stability degree of the target process variable are determined as evaluation factors. The sensitivity evaluation of each deviation cause is performed based on the dynamic process simulation. The multiple deviation causes that correspond to the deviation are ranked based on sensitivity index, thereby identifying the significant effect causes on deviation from multiple causes; this identification will assist plant operators and safety management staff on their on-line process monitoring and fault diagnosis. Finally, the proposed approach is applied to the depropanization unit in a gas fractionation plant. The sensitivity evaluation was carried out for 10 deviation causes that correspond to the deviation ‘‘higher overhead pressure”, in which three and seven sensitive and non-sensitive causes were identified, respectively. The result of the case study demonstrates that the proposed approach can improve the readability and guidance of conventional HAZOP report, which is consistent with the actual production conditions. Ó 2016 Elsevier Ltd. All rights reserved.

1. Introduction Safety is particularly important to ensure normal production in the chemical industry. With the increasing demand of chemical products, more complex processes, as well as many different types of equipment and more automatic control instruments, are used in modern large-scale chemical industries. These advancements render large-scale chemical processes vulnerable to suffering from serious fault consequences. Once a fault occurs in such a complex system, an accident may cause casualties, large economic loss, and severe environment pollution. Although the chemical industry has recently focused on the production safety concern, industrial disasters that involve hazardous chemicals still inevitably occur (Zhao et al., 2013). For example, an explosion happened in Toulouse AZF chemical plant located in southwestern France in 2001 (Lenoble and Durand, 2011; Taveau, 2010); a fire and explosion took place in Jilin Petrochemical Company in China in 2005 (Sining, 2009); and an explosion occurred in a fertilizer factory in Texas, USA in 2013. All these learnings from these disasters in chemical industry raise our awareness that effective measures ⇑ Corresponding author at: YanShan University, Hebei Street 438, Haigang District, Qinhuangdao, Hebei 066004, China. E-mail address: [email protected] (L. Guo). http://dx.doi.org/10.1016/j.ssci.2016.04.018 0925-7535/Ó 2016 Elsevier Ltd. All rights reserved.

must be performed to eliminate or reduce potential process hazards to prevent the occurrence of the same catastrophic accidents. Process hazard analysis (PHA) is an important tool used to identify and evaluate the potential hazards and ensure process safety. Arguably, HAZOP analysis is the most widely used PHA methodology in the process industry (Wang et al., 2012). This analysis is a structural and systematic approach, which is carried out by a multidisciplinary team during a set of brainstorming meeting (Guo and Kang, 2015a). HAZOP ensures that the deviations from the design intent are determined by hazard scenario analysis so that the potential hazards can be identified so as to propose corresponding recommendations (Dunjo et al., 2010; Guo and Kang, 2015b). However, HAZOP approach has several inherent drawbacks. For instance, this approach is a qualitative analysis, requires long hours of work of a team, and relies entirely on human knowledge (Rossing et al., 2010). To use HAZOP more effectively, numerous studies on the improvements and extensions on HAZOP approach have been conducted, including (1) combination with other safety analysis approaches (Giardina and Morale, 2015; Guo and Kang, 2015a; Post, 2001; Ramzan et al., 2007), (2) quantitative analysis of the deviation (Eizenberg et al., 2006; Hu et al., 2009), and (3) automated HAZOP analysis (Galluzzo et al., 1999; Srinivasan and Venkatasubramanian, 1996; Zhang et al., 2004; Zhao et al., 2005).

J. Kang, L. Guo / Safety Science 88 (2016) 26–32

Whether the typical or improved HAZOP analysis is selected, the final analysis results are submitted to plant staff in a formal report form. Remarkably, an important application of HAZOP analysis report is to assist plant operators and safety management staff in an on-line process monitoring and fault diagnosis of abnormal condition. The HAZOP report for documenting the analysis results generally involves deviation (combination of a guide word with a target process variable), causes, possible consequences, existing safeguards, and corresponding recommendations. The possible causes that correspond to a given deviation are usually multiple for a complex chemical plant. For example, the control valve fault, pump performance deterioration, and human error are the causes corresponding to the deviation ‘‘higher level of a container”. Moreover, the quantitative ranking of the deviation causes cannot be provided in the conventional HAZOP report. One of the main reasons is that all professional experts perform the identification of deviation causes based on their own knowledge and judgment, and more importantly, their thinking is divergent. Consequently, the deviation causes are listed simply without a fixed sequence in HAZOP analysis report. Therefore, accurate diagnosis of an abnormal condition caused by multiple deviation causes in a timely manner on the basis of HAZOP analysis report is often difficult for plant operators and safety management staff, specifically novice operators. To address this problem, the ranking approach of deviation causes should be introduced into the HAZOP analysis. However, only few related research studies are published to date. Hence, HAZOP analysis approach based on sensitivity evaluation is proposed to prioritize the deviation causes in this paper. The present paper aims to improve the availability of the HAZOP analysis report to provide effective on-line fault diagnosis foundations for plant operators and safety management staff.

2. HAZOP analysis based on sensitivity evaluation 2.1. Sensitivity evaluation approach In economics, sensitivity evaluation is widely used to measure the risk of uncertain factors in the investment project (Borgonovo and Peccati, 2006). This evaluation is applied to investigate which one or few factors contribute significantly to the economic index. Changing one-factor-at-a-time is one of the simplest and most common sensitivity evaluation approach to observe its effect on the output (Wikipedia, 2016). When all other are factors fixed to their central or baseline values, one uncertain factor value is changed; subsequently, the effect of this uncertain factor on economic index is analyzed and evaluated by monitoring the changes in the output. If a small change of one factor can cause a significant change to the economic index, the factor is defined as the sensitive factor; otherwise, the factor is classified as non-sensitive factor. Based on the sensitivity evaluation concept mentioned above in economics, the sensitivity evaluation of the deviation cause is also introduced to HAZOP analysis in this paper. Each deviation generally corresponds to multiple causes, but the change of each deviation cause has a different effect on the deviation in HAZOP analysis. Sensitivity evaluation can be used to measure the effect of each deviation cause on the target process variable included in the deviation. Higher sensitivity value means that the deviation cause can bring more significant change to the target process variable on the assumption that all operating parameters are set under the same condition. These sensitive causes possess high sensitivity index because they have higher potential hazards than other causes. Consequently, the possible causes resulting in deviation occurrence can be screened out in the on-line process monitoring and fault diagnosis. Ranking the sensitivity index of the deviation cause enables the operators to focus on the sensitive causes.

27

In this paper, the quantitative sensitivity evaluation model of deviation cause is established. The comprehensive sensitivity index is expressed as the departure degree of the target process variable deviating from the normal condition through the step disturbance generated by the deviation cause; this index is also corrected using time correction and fluctuation coefficients. The sensitivity (S) of the deviation cause can be evaluated as follows:

S¼Du

ð1Þ

where S is the sensitivity index of the deviation cause, D is the departure degree, and u is the correction coefficient. The parameter D in Eq. (1) indicates that the departure degree of the target process variable deviating from its normal condition when deviation cause occurs. D is defined as follows:

D¼

jC max  Nj eþmax  emax

ð2Þ

where Cmax is the maximum value of the deviation after the deviation cause occurs, N is the normal condition value of the target pro cess variable, and eþ max and emax are the upper and lower alarm limits of the target process variable, respectively. Considering that the state of the target process variable varies with time, u is given as follows:

u ¼ ht  hf

ð3Þ

where ht is the correction coefficient to time and hf is the fluctuation correction coefficient of the target process variable. ht is given as follows:

ht ¼ 1=½ðt=TÞ  100

ð4Þ

where t is the time duration of the target process variable to reach the maximum value after the deviation cause occurs and T is the total sampling time for the target process variable. hf indicates the stability degree of the target process variable under an abnormal condition generated by the deviation cause; it is a ratio that can be expressed as the difference between maximum and minimum values of the target process variable divided by the difference between its upper and lower alarm limits as follows:

hf ¼

C þmax  C max eþmax  emax

ð5Þ

 where C þ max and C max are the maximum and minimum values of the target process variable produced by the fluctuation under an abnormal condition, respectively.

2.2. HAZOP analysis approach based on sensitivity evaluation Fig. 1 shows a framework of HAZOP analysis approach based on sensitivity evaluation. This framework can be divided into the following steps: Phase 1: Deviation analysis After dividing the analyzed plant into multiple nodes, the possible abnormal deviation causes and adverse hazardous consequences of each deviation in each node are identified comprehensively by the expert team during the brainstorming discussion. Phase 2: Sensitivity evaluation of deviation cause Afterward, the sensitivity evaluation of deviation cause should be carried out. In sensitivity evaluation, the on-line abnormal

28

J. Kang, L. Guo / Safety Science 88 (2016) 26–32

Schedule Schedule Manager Manager

HAZOP analysis

Schedule Schedule 11

Deviation analysis

Schedule Schedule 22

Schedule Schedule N N

Sequence Sequence A A Dynamic process simulaiton

No.1 cause

No.2 cause

No.n cause

Event Event 11

Condition Condition Sensitivity evaluation

Action Action List List Sensitivity ranking of deviation cause

No.1' cause

No.2' cause

Action Action 11 No.n' cause

Action Action M M Event Event X X

HAZOP report

Sequence Sequence ZZ

Fig. 1. Procedure of HAZOP analysis based on sensitivity evaluation.

condition data acquisition of the target process variable is a key issue. Unfortunately, considering the limitation of safety and economic factors, the operating condition cannot be changed optionally, or the fault simulation cannot be performed randomly in the actual plant. Therefore, acquiring directly required on-line abnormal condition data from the actual plant is impossible. Furthermore, the records/database of the previous process deviations of the plant cannot provide all the required data for the sensitivity evaluation because not all the required types of faults have occurred in the actual plant. Therefore, fault records from the actual plant are insufficient. To overcome this problem in this study, UniSim Design software is applied to establish the process simulation model to simulate the dynamic effect of deviation cause on target process variable. This interactive process modeling software enables academia and engineers to develop process simulation models for plant design, performance monitoring, operational improvement, business planning, and asset management (Fatehi et al., 2014). The process simulation involves the steady-state and dynamic simulation. In general, the design engineer can use steady-state simulation to optimize the process by reducing capital and equipment costs while maximizing production. The actual chemical production is always operated in a dynamic state, not in an absolute steady state. Thus, the dynamic simulation model should be established to describe the offline behavior of the chemical process accurately using time variant instead of disturbing the actual process. Each cause as equipment malfunction is preprogrammed under the condition of the same change amplitude. Subsequently, the hazard propagation pathway of the system from the normal condition to the abnormal one is described through process simulation. The hazard propagation process is simulated using the event scheduler tool in UniSim Design software. The structure diagram of event scheduler is shown in Fig. 2. Each event schedule comprises sequences, which in turn, are composed of events. An event must have a condition. When the condition of the current event is satisfied, its action(s), if any, is(are) implemented. An action

Fig. 2. Structure diagram of event scheduler.

contains tasks that simulate the hazard propagation process that corresponds to the specific deviation cause, such as control valve fault, pump performance deterioration, or breakdown. The tasks can be triggered by a pre-determined simulation time or elapsed time, a logical expression becoming true, or a variable stabilizing to within a given tolerance for a set amount of time. Then, the simulation process proceeds to the next event in the sequence. In this manner, the maximum and minimum values of the target process variable, and time duration from the normal condition to the maximum value of the target process variable are gained. The above related data are substituted into the equations in Section 2.1 to calculate the sensitivity value of each cause. Phase 3: Sensitivity ranking of deviation cause Finally, the deviation causes are ranked and classified based on the sensitivity evaluation, and the ranking results are documented in HAZOP analysis report. 3. Case study In this section, the application of HAZOP analysis based on sensitivity evaluation is illustrated on the depropanization unit of a gas fractionation plant. Fig. 3 shows the schematic flow diagram of the depropanization unit. Liquefied petroleum gas (LPG) from the upstream unit enters the feeding tank and pumped LPG is then heated to bubble point in the preheater. Next, the LPG flows into the 27th tray of the depropanizer. After the distillation of the depropanizer, C2 and C3 fractions are gained as the overhead product, and C4 and C5 fractions are discharged from the column bottom into deisobutanizer. 3.1. HAZOP analysis Considering the constraint of space in this paper, only the sensitivity evaluation of the deviation cause corresponding to the

J. Kang, L. Guo / Safety Science 88 (2016) 26–32

29

Fig. 3. Schematic flow diagram of the depropanization unit.

deviation ‘‘higher overhead pressure” in the depropanization node is illustrated as a case. The 10 deviation causes corresponding to the deviation ‘‘higher overhead pressure” are identified by HAZOP analysis and presented in Table 1.

3.2. Establishment of the dynamic process model The dynamic process model for the depropanization node is established based on the actual plant information, including P&ID, detailed equipment information, and safety accessory equipment information. To compare the dynamic effect of the different causes on the deviation, each deviation cause is used as a step disturbance to be inputted to the simulation model, and the amplitudes of all the step disturbances have been uniformly set at 10% of the departure from the normal operation condition because the disturbance amplitude significantly influences the operation condition of the plant. If the disturbance amplitude is too small,

Table 1 Deviation causes corresponding to the deviation Higher Overhead Pressure. No. 1 2 3 4 5 6 7 8 9 10

Deviation cause High feed flow resulting from feed flow controller FIC101 fault High feed flow resulting from feed flow control valve FV101 fault High feed temperature resulting from feed temperature controller TIC101 fault High feed temperature resulting from feed temperature control valve TV101 fault High-column bottom temperature resulting from the temperature controller TIC103 of the column bottom fault Pressure controller PIC 102 of the column overhead fault High liquid level resulting from the liquid level controller LIC102 of overhead reflux tank fault High liquid level resulting from the liquid level control valve LV102 of overhead reflux tank fault High reflux temperature resulting from the temperature controller TIC102 of the overhead reflux fault Low reflux flow resulting from the overhead reflux pump P-103 fault

then some faults that corresponds to the fault cause will not occur because of the automatic adjustment of the control system; that is, the plant is under normal operating conditions. By contrast, if the disturbance amplitude is too high, then some faults that corresponds to the fault cause will result in a sudden shutdown of the plant; consequently, fault propagation cannot be monitored during dynamic process simulation. The disturbance amplitude is finally set at 10% of the departure from the normal operation condition on the basis of the results of several simulation experiments. In the dynamic simulation, the controller fault is preprogrammed by the following equation:

PV 0 ¼ PV  10% PV

ð6Þ

0

where PV represents the preset value corresponding to the controller fault and PV represents the set value of the controller under normal condition. The simulation of the control valve fault is realized through the adjustment of the valve position. The valve position is prespecified by the following equation:

VP 0 ¼ VP  10% VP

ð7Þ

where VP0 denotes the valve preset position corresponding to the control valve fault and VP denotes the position of the control valve under normal condition. The pump fault is simulated by the following equation:

U 0 ¼ U  90% 0

ð8Þ

where U is the efficiency of the pump under abnormal condition and U is the normal condition efficiency of the pump. In this manner, the hazard propagation pathways from 10 preprogrammed deviation causes to the deviation ‘‘higher overhead pressure” are reproduced. The duration of the simulation process is 5 h, and the 10 step disturbances are loaded into the dynamic model at 0.5 h. The sampling interval of the data is 20 s, hence the 810 data samples are obtained for each deviation cause under the abnormal condition. Fig. 4 presents the dynamic simulation

30

J. Kang, L. Guo / Safety Science 88 (2016) 26–32 200 7

9 8

Overhead pressure /KPa

2,000 1,900 0.0

0.5

1.0

2,000

1.5

2.0

3

2.5

10

3.0

3.5

4.0

4.5

5.0

2

1,960 4

5

1

1,920

Difference of Max and Min value /KPa

6

2,100

1,880

160

120

80

40

0

1 0.5

0.6

0.7

0.8

0.9

1.0

1.1

1.2

2

1.3

3

4

5

6

7

8

9

10

Serial number of deviation cause

Time /h Fig. 7. Difference of overhead pressure between maximum and minimum value generated by 10 causes.

Fig. 4. Dynamic behavior of 10 deviation causes.

Table 2 Sensitivity evaluation results of the deviation cause.

5

Time /h

4

3

2

fault load time

No.

D

ht

hf

S  100

Rank ordering

1 2 3 4 5 6 7 8 9 10

0.08 0.01 0.42 0.05 0.04 1.84 1.6 0.61 1.57 0.06

0.31 0.53 0.53 0.53 0.06 0.25 0.01 0.01 0.10 0.16

0.17 0.03 1.25 0.14 0.31 1.84 1.60 0.61 1.57 0.12

0.40 0.02 27.37 0.37 0.07 84.99 3.11 0.42 24.71 0.12

6 10 2 7 9 1 4 5 3 8

1

0 0

1

2

3

4

5

6

7

8

9

10

changes. Moreover, the effect amplitude of each deviation cause on the target process variable is also very different. Therefore, the sensitivity of the process variable on each deviation cause is not same.

Serial number of deviation cause

3.3. Sensitivity evaluation of deviation cause Fig. 5. Duration of time reaching to overhead pressure maximum value with respect to each cause.

2150

Pressure safety valve set pressure

Overhead pressure /KPa

2100

2050

High alarm limit

2000

Normal condition value 1950

0

1

2

3

4

5

6

7

8

9

10

Serial number of deviation cause Fig. 6. Maximum overhead pressure generated by each cause.

results of 10 deviation causes. The dynamic behavior of the system generated by various deviation causes is relatively different under the same simulation condition. The dynamic behavior of the system can be categorized into sharp fluctuation, and slow and rapid

Based on above dynamic simulation results, the duration from the normal condition to the overhead pressure maximum value generated by each deviation cause is shown in Fig. 5. The time duration to reach the overhead pressure maximum value with respect to nos. 1, 2, 3, 4, 6, 9, and 10 deviation cause is extremely short. The overhead pressure reaches the peak values within a short time span after the occurrence of these deviation causes. Consequently, the operator cannot monitor these abnormal conditions timely. According to Eq. (4), the time coefficient of the above deviation causes is large, whereas the time coefficient of both nos. 7 and 8 deviation causes is small. Fig. 6 depicts the maximum overhead pressure generated by each deviation cause, on the basis of dynamic simulation results. Fig. 6 also exhibits the maximum pressure corresponding to nos. 1, 2, 3, 4, 5, and 10 deviation cause is lower and does not reach the upper alarm limit. Thus, the change magnitude of overhead pressure is less affected by the above six deviation causes. Conversely, after the occurrence of other deviation causes, all overhead pressure maximum exceeds the upper alarm limit. Specifically, the overhead pressure will be more than the set value (2100 kPa) of the pressure safety valve once nos. 6, 7, and 9 deviation causes occur. In this case, the pressure safety valve opens up. However, this condition is a potential hazard condition. Fig. 7 shows the difference between the maximum and minimum overhead pressures generated by each deviation cause. The larger difference means that the target process variable will

31

J. Kang, L. Guo / Safety Science 88 (2016) 26–32 Table 3 HAZOP analysis results based on sensitivity evaluation. Deviation: Higher overhead pressure of depropanizer. Sensitivity ranking of causes (1) Pressure controller PIC 102 of the column overhead fault

Consequences (1) Over pressure can occur in the column, which will destroy the column or leak substances from the static sealing components. In case of high-temperature flammable substance or open fire, fire or exploration accident will occur (2) The quality of the product can deteriorate

Existing safeguards Pressure relief valve; high overhead pressure alarm

(2) Feed temperature controller TIC101 fault

Pressure relief valve; high overhead pressure alarm; temperature detection on feed of column

(3) Temperature controller TIC102 of the overhead reflux fault

Pressure relief valve; high overhead pressure alarm; temperature detection on overhead substance

(4) Liquid level controller LIC102 of overhead reflux tank fault (5) Liquid level control valve LV102 of overhead reflux tank fault (6) Feed flow controller FIC101 fault (7) Feed temperature control valve TV101 fault

Pressure relief valve; high overhead pressure alarm; local level gauge

(8) Overhead reflux pump P-103 fault

Pressure relief valve; high overhead pressure alarm; overhead pressure controller; standby pump Pressure relief valve; high overhead pressure alarm

(9) Temperature controller TIC103 of the column bottom fault (10) Feed flow control valve FV101 fault

fluctuate very sharply when this cause occurs. The unsteady condition can directly result in the production quality deterioration. Based on Figs. 5–7, the sensitivity index of 10 deviation causes is figured out according to Eqs. (1)–(5); these indices are summarized in Table 2. The sensitivity index of nos. 6, 9, and 3 deviation causes that correspond to the deviation ‘‘high overhead pressure” is considerably higher than that of other deviation causes. Consequently, overhead pressure, feed temperature, and overhead reflux temperature controls are classified as sensitive cause corresponding to higher overhead pressure. The other deviation causes are evidently classified as non-sensitive cause. In addition, the practical operation experience from the operators of the depropanizer also suggests that nos. 6, 3, and 9 deviation causes have significant and direct effect on overhead pressure rise; these causes are also relatively critical factors. Therefore, the study result is consistent with the actual production conditions. 3.4. HAZOP analysis result based on sensitivity Table 3 shows the sensitivity index of the deviation causes corresponding to the deviation ‘‘higher overhead pressure”, which are

Pressure relief valve; high overhead pressure alarm; local level gauge; high level alarm

Recommendations (1) Instrument/maintenance checks (2) Install independent monitors and alarms (3) Install fire detection and prevention (4) Install emergency depressurizing system (1) Instrument/maintenance checks (2) Install high temperature alarm at the inlet to the depropanizer (1) Instrument/maintenance checks (2) Install high-temperature alarm at the bottom of the depropanizer

Category Sensitive cause

Nonsensitive cause (1) Valve travel position indicator check (2) Install LV102 valve position detector

Pressure relief valve; high overhead pressure alarm Pressure relief valve; high overhead pressure alarm; feed temperature controller

Pressure relief valve; high overhead pressure alarm; feed temperature controller

(1) Valve travel position indicator check (2) Install TV101 valve position detector

(1) Install high-temperature alarm at the bottom of the column (1) Install FV101 valve position detector

sorted with descending order in the HAZOP worksheet. Based on the corresponding priorities, the plant operators and safety management staff can locate deviation cause sequentially in an online process monitoring and fault diagnosis. The deviation causes with higher sensitivity index can lead to larger departure degree of the target process variable than deviation causes with lower sensitivity index under a fixed set of conditions. Accordingly, the plant operators and safety management staff should prioritize to focus on the deviation causes with higher sensitivity index, which can be more potentially hazardous factors in the system. 4. Conclusions HAZOP analysis is a widely used safety analysis approach. The analysis results are provided to plant operators and safety management staff as an important making-decision foundation. With the large number of items involved in HAZOP analysis report, the readability and guidance of the report are important. To improve the availability of HAZOP analysis report, HAZOP analysis approach based on sensitivity evaluation is developed in this paper. Considering the effect of the deviation cause on the departure degree, time duration to reach the maximum deviation, and stability

32

J. Kang, L. Guo / Safety Science 88 (2016) 26–32

degree of target process variable generated by the step disturbance that is generated by the deviation cause, a quantitative sensitivity evaluation model is established. Subsequently, the sensitivity evaluation is introduced into the deviation analysis, in which the effect degree caused by each cause on deviation is determined. Based on the sensitivity ranking of cause, the causes can be classified as sensitive and non-sensitive factors. The occurrence of sensitive causes can lead to a serious departure of the target process variable from the normal condition; thus, plant operators and safety management staff should focus on preventing the occurrence of sensitive causes based on sensitivity evaluation results. Consequently, the sensitivity ranking of deviation causes will assist in the identification of fault causes and elimination of the fault timely and accurately in an on-line process monitoring and fault diagnosis. The process simulation approach is used for investigating the fault dynamic behavior of the deviation cause to obtain the required data for the sensitivity evaluation in this paper. Hence, the accuracy of data has a critical influence on the reliability of sensitivity evaluation. Notably, the size, type of equipment, and control program of the system must be established according to the actual plant during the establishment of the process simulation model. Moreover, the related parameters should be adjusted constantly in the process simulation to facilitate the established model’s consistency with the actual condition. Acknowledgment The authors would like to acknowledge the support of the National Natural Science Foundation of China (Approved Grant No. 51205340). References Borgonovo, E., Peccati, L., 2006. Uncertainty and global sensitivity analysis in the evaluation of investment projects. Int. J. Prod. Econ. 104, 62–73. Dunjo, J., Fthenakis, V., Vilchez, J.A., Arnaldos, J., 2010. Hazard and operability (HAZOP) analysis. A literature review. J. Hazard Mater. 173, 19–32.

Eizenberg, S., Shacham, M., Brauner, N., 2006. Combining HAZOP with dynamic simulation – applications for safety education. J. Loss Prevent. Proc. 19, 754– 761. Fatehi, P., Catalan, L., Cave, G., 2014. Simulation analysis of producing xylitol from hemicelluloses of pre-hydrolysis liquor. Chem. Eng. Res. Des. 92, 1563–1570. Galluzzo, M., Bartolozzi, V., Rinaudo, C., 1999. Automating HAZOP analysis of batch processes. Comput. Chem. Eng. 23S, S661–S664. Giardina, M., Morale, M., 2015. Safety study of an LNG regasification plant using an FMECA and HAZOP integrated methodology. J. Loss Prevent. Proc. 35, 35–45. Guo, L., Kang, J., 2015a. An extended HAZOP analysis approach with dynamic fault tree. J. Loss Prevent. Proc. 38, 224–232. Guo, L., Kang, J., 2015b. A hybrid process monitoring and fault diagnosis approach for chemical plants. Int. J. Chem. Eng. Hu, J., Zhang, L., Liang, W., Wang, Z., 2009. Quantitative HAZOP analysis for gas turbine compressor based on fuzzy information fusion. Syst. Eng. – Theory Pract. 29, 153–159. Lenoble, C., Durand, C., 2011. Introduction of frequency in France following the AZF accident. J. Loss Prevent. Proc. 24, 227–236. Post, R.L., 2001. HAZROP: an approach to combining HAZOP and RCM. Hydrocarb. Process. 80, 69–76. Ramzan, N., Compart, F., Witt, W., 2007. Application of extended hazop and eventtree analysis for investigating operational failures and safety optimization of distillation column unit. Process Saf. Prog. 26, 248–257. Rossing, N.L., Lind, M., Jensen, N., Jorgensen, S.B., 2010. A functional HAZOP methodology. Comput. Chem. Eng. 34, 244–253. Sining, C., 2009. An analysis of the ‘‘11.13” fire and explosion accident in jilin chemical plant: the environment hazards resulted by disposal measures against chemical product accidents. In: 2009 International Conference on Environmental Science and Information Application Technology, Wuhan, China, pp. 52–55. Srinivasan, R., Venkatasubramanian, V., 1996. Petri net-digraph models for automating HAZOP analysis of batch process plants. Comput. Chem. Eng. 20A, S719–S725. Taveau, J., 2010. Risk assessment and land-use planning regulations in France following the AZF disaster. J. Loss Prevent. Proc. 23, 813–823. Wang, F., Gao, J., Wang, H., 2012. A new intelligent assistant system for HAZOP analysis of complex process plant. J. Loss Prevent. Proc. 25, 636–642. Wikipedia, 2016. Sensitivity analysis. . Zhang, B., Wu, C.G., Xia, T., 2004. Method and modeling study on computer automatic HAZOP based on signed directed graph (SDG). In: Wang, Y.J., Huang, P., Li, S. (Eds.), Progress in Safety Science and Technology. Part A – Proceedings of the 2004 International Symposium on Safety Science and Technology, vol. 4, Beijing, pp. 52–59. Zhao, C., Bhushan, M., Venkatasubramanian, V., 2005. Phasuite: an automated hazop analysis tool for chemical processes Part I: Knowledge engineering framework. Process. Saf. Environ. 83, 509–532. Zhao, J., Joas, R., Abel, J., Marques, T., Suikkanen, J., 2013. Process safety challenges for SMEs in China. J. Loss Prevent. Proc. 26, 880–886.