5838 Ind. Eng. Chem. Res.

2004, 43, 5838-5845

Risk-Based Design of a Regenerative Thermal Oxidizer

Micaela Demichela* and Norberto Piccinini
Centro Studi su Sicurezza Affidabilita` e Rischi (SAfeR), Politecnico di Torino, Dipartimento di Scienza dei
Materiali e Ingegneria Chimica, C.so Duca degli Abruzzi 24, 10129 Torino, Italy

Following an explosion in a piece of equipment [a thermal oxidizer (Loss Prev. Bull. 2003, 170,
8-10)] employed for the purification of gas streams contaminated by volatile flammable
compounds, a similar plant that is under construction was redesigned with a risk-based approach,
to increase both the reliability and operational safety of the regenerative thermal oxidizer (RTO)
and venting collection system (VCS). This paper, in particular, describes the methodologies that
were used and the results that were obtained in terms of the reduction of the frequency of
occurrence of the top event (TE) Explosion in the venting collection system. A recursive
operability analysis (ROA) was performed to identify primary events that could lead to a
possible explosion in the RTO or VCS, with their evolution toward the TE. Fault trees were
then directly derived from the ROA tables, through an intermediate logic diagram, the incidental
sequence diagram, and then quantified in order to assess the frequency of occurrence of a possible
explosion. The modifications that were suggested, thanks to the risk-based approach, should
reduce this frequency from 1.03 to 5.27 10-3 occurrences/year.

1. Risk-Based Approach in Design
A valid quantitative approach to a risk-based engi-
neering design involves acquiring and incorporating all
of the possible knowledge on the design into the decision
process.1-3 This means that empirical knowledge, phe-
nomenological knowledge, and intuitive knowledge must
be incorporated in a probabilistic framework.
In the case under study, the empirical knowledge that
was derived from an analysis of the accident that had
occurred in a similar plant demonstrated the necessity
of a better understanding of the process, which was
obtained through a thermoanalysis of the process resi-
dues. On the basis of this analysis and of the relevant
technical standards, a number of plant modifications
were suggested. Their effectiveness was then assessed
through a quantitative risk analysis (QRA).
Starting from the basic knowledge of the plant as
formalized in a well-structured recursive operability
analysis (ROA), it is possible to carry out a safety
analysis by turning the features of both the fault trees
(FTs) and event trees (ETs) into the best advantage, as
illustrated in the flowchart in Figure 1.4 This full
integration of qualitative and quantitative methods
ensures the essential features for probabilistic safety
analysis, namely, in qualitative terms, systematism,
completeness, and congruence, and, in numerical terms,
reliability and verification.
2. Description of the Plant
Thermal oxidation is an effective way of handling fast
gas flows contaminated with relatively low concentra-
tions of volatile flammable compounds (VFCs) through
the use of a regenerative thermal oxidizer (RTO).5,6 In
the plant that was the subject of this study, RTO is
employed for the purification of gases extracted from
an aluminum can painting unit. The units that were
* To whom correspondence should be addressed. Tel.:
+39 011 5644629. Fax: +39 011 5644665. E-mail: micaela.
demichela@polito.it.
10.1021/ie0342208 CCC: $27.50 2004 American Chemical Society
Published on Web 08/25/2004
analyzed with the aim of identifying the critical com-
ponents and operations were as follows:
Painting Section. Cans are painted in a coater
station, in a deco station, and then, on the inside, in an
internal lacquering station (Figure 2). After each sta-
tion, the cans are conveyed to an oven (the drying step
and Ross and internal bake ovens, respectively). Each
oven has a chimney and its own collection system, which
are identified by the numbers 11, 12, and 19 in Figure
2.
Venting Collection System (VCS). The VCS is
about 73 m long and 1.5 m in diameter. With reference
to Figure 2, the gases discharged from the ovens
(pipeworks 11, 12, and 19) are collected in the main duct
and then conveyed to the RTO. The gases from the
internal lacquering stations, instead, are not conveyed
to the RTO because the dusts that are generated
(classified as St 3, the most dangerous class according
to the Bartknecht classification7) are collected in a bag
filter. VCS operating conditions are as follows:
(i) Flammable substances normally present in flue
gases are at a concentration of about 0.1% of the lower
explosion limit (LEL).
(ii) The whole system works slightly under pressure
thanks to a fan that is located downstream to the RTO.
(iii) The total flow rate of the flue gases is about
13 700 m3/h at 130 C in the main duct.
(iv) The solvent flow rate in the flue gases outweighs
5 kg/h.
RTO. The polluting charge is burnt in a combustion
chamber (Figure 3) that is built on five towers contain-
ing ceramic saddle beds. A part of the sensible heat of
the flue gases is recovered thanks to the cyclic operation
of the towers. In the inlet phase, the process air rises
through the beds and reaches a temperature that is
close to the combustion chamber temperature (T 800
C). Two methane burners are present in case extra heat
is needed.
In the subsequent outlet phase, the flue gases pass
down through the ceramic saddle beds. The beds thus
absorb part of the sensible heat of the gases, and the

Figure 1. Flow chart to develop a quantitative safety analysis.
towers are then reset for the subsequent inlet phase.
During this inversion phase, about half the volume of
the towers is occupied by a plug flow of process air that
has not yet reached the combustion chamber. A fraction
of the flue gases is therefore withdrawn into the
chamber (purge phase).
3. Empirical Knowledge: Analysis of the
Accident
The accident occurred in a plant with a three-tower
RTO used to abate volatile organic carbon emissions
from a painting line that is almost identical with the
one described in this paper. Its safety only relied up a
sprinkler extinguishing system with breakable bulb
detectors inside the VCS pipework.
Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004 5839
The accident started from a localized fire and rapidly
developed into an explosion, with the release of flam-
mable gases and flames from several collapsed pipes.
An examination of the damage showed that ignition
occurred in one of the towers.
It is known that flue gases tend to deposit consider-
able quantities of flammable material along the inner
surfaces of the pipework (20 cm of resins was found
inside the pipework). Furthermore, a thermoanalysis of
the deposits demonstrated that (i) the source of the
flammable atmosphere was the exothermic decomposi-
tion of the deposits (if their quantity had been suf-
ficiently high, the LEL could have been reached) and
(ii) the self-igniting temperature of the vapors that were
generated from the decomposition (about 450-480 C)
5840 Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004

Figure 2. Flow sheet of the plant.

Figure 3. RTO.

Table 1. Flue Gas Composition and Flow Rates

chimney 11 chimney 12 chimney 19
concn flow rate concn flow rate concn flow rate
solvent [mg/Nm3] [g/h] [mg/Nm3] [g/h] [mg/Nm3] [g/h]
2-methoxyethanol 5.76 15.35 21.50 64.71
n-butanol 15.24 40.61 40.26 121.18 53.41 192.00
methyl isobutyl ketone 1.00 2.66
xylene (isomers) 13.25 26.68 8.31 25.01
2-butoxyethanol 25.87 68.41 151.88 457.15 54.55 196.13
other solvents (such as xylene) 279.50 744.86 913.80 2750.50 107.96 388.91

lay within the operating range of the towers (from
137 C at the bottom to 810 C near the combustion
chamber). The results of the investigation highlighted
the importance of determining the chemical and physi-
cal characteristics of the substances that are present
in the VCS, without neglecting the deposits that flue
gases may form.
4. Phenomenological Knowledge:
Thermoanalysis
Both the flue gases and the deposits were then
characterized with the aim of (i) identifying both the
nature and quantity of hydrocarbons in the 11, 12, and
19 chimney flue gases, (ii) assessing the flammability
properties of the pipework deposits and identifying their
pyrolysis products, and (iii) characterizing the decom-
position process as a function of the temperature.
The flue gas samples that were drawn from each stack
(11, 12, and 19), when analyzed through gas chroma-
tography, revealed the composition shown in Table 1.
Pipework residues were analyzed through differential
scanning calorimetry. The samples (five for each stack)
were heated from 20 to 450 C at a 10 C/min rate; all
of them showed a general endothermic behavior due to
pyrolysis phenomena at low temperatures (<150 C) and

Figure 4. Stack 11 samples analyzed through DSC.
Table 2. Vapor Flammability in Air Streams
flammable vapor ignition combustion
generation temp [C] temp [C] temp [C]
chimney 11 120-150 170-175 220-250
chimney 12 210 280 >450
chimney 19 210 300 >450
one exothermic peak due to polymerization of the
nonreacted paint between 150 and 230 C. In the
samples from stack 11 (the drying step), a second
exothermic peak was found between 230 and 320 C
(Figure 4) as a result of decomposition of the deposit to
form flammable vapors.
The residues reach their glass transition at about 140
C; therefore, the residue can be considered as a liquid
at higher temperatures. The vapor flammability in the
air stream was assessed, obtaining the results reported
in Table 2.
5. Process and Plant Modification
Because there are a number of permanent sources of
ignition in the plant (production oven burners, RTO
combustion chamber burners, the high temperature in
the RTO ceramic saddle beds, and so on), it is necessary
to maintain the flammable vapor concentrations at
levels lower than LEL to avoid fires and explosions.
The results of the thermoanalysis thus highlighted
the effectiveness of combining the flows from the drying
step (45 C) and the Ross oven (225 C). The resulting
temperature of about 140 C allows a gradual decom-
position of the solid residues without generating gas
mixtures in the flammability range.
The following safety measures have also been intro-
duced:8,9
(i) Periodic inspection and cleaning procedures.
Through an inspection and housekeeping procedure,
the thickness of the deposits is maintained lower than
2 cm in all of the VCS pipeworks.
(ii) Flammability monitors (FMs). Four continuously
operating FMs were installed along the VCS pipework
and connected to the alarm and automatic plant shut-
down devices, which are described in Table 3.
Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004 5841
(iii) Fireproofing system (FPS). An FPS endowed with
an alternating series of sprinklers and water spray
nozzles was installed.10,11 The bulbs break at 160 C.
(iv) Deflagration vents (DVs) and protection barriers
in the discharge area. The VCS venting system is made
of 12 DVs, which were installed where flue gases change
flow direction. The blowoff area for the RTO was divided
into five DVs, one for each tower.12,13
6. Probabilistic Framework
A ROA, an advanced development of the classical
HazOp directed toward the elaboration of logic trees,
was used to verify the effectiveness of the proposed
modifications.14,15
The ROA allows six TEs to be identified, these being
critical operating states due to the nonintervention of
their protection systems following a process deviation.
Table 4 shows the portion of the ROA that relates to
TE 1: Explosion generated by the accumulation of
deposits and their subsequent decomposition into VFC.
This was the only TE under study because it represents
the sequence of events that could lead to an accident
similar to the one that actually occurred.
A detailed piping and instrumentation (P&I) diagram
of the VCS is shown in Figure 5.
The relevant process variable is the VFC concentra-
tion in the VCS. The deviation that was detected (high
VFC concentration, 15% LEL) is caused by decomposi-
tion of the deposits. The consequence of this deviation
is a very high VFC concentration that forms in the
absence of the intervention of either the plant shutdown
(ASH-400) or the operator (alerted by AAH-400). The
recursive mechanism is clearly visible in the next step:
consequence 3. very high VFC concentration, 35% LEL
becomes a deviation (shift from the third to the first
column); the cause can only be due to the previous
deviation, i.e., 3. high VFC concentration, 15% LEL
(shift from the first to the second column). This leads
to the identification of a new consequence that arises
from the nonintervention protective means: Explosive
mixture in the VCS. Failure of the DVs, because of
their damaging or design errors, results in TE 1.
Development of Logic Trees. ROA both realizes
the full value of the classic strong points of the method,
5842 Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004

Table 3. FM Alarms and Shutdown Devices

alarm and interlock devices
high concentration ASAH-400
very high concentration ASAHH-400
detector malfunctioning
a Opening of the XV-442 and XV-482 butterfly valves and deviation of the flue gases into the atmosphere.
description
shutdown and the conveyance of fresh air into the plant activated when all of the detectors
reach the threshold valuea
alarm set at 35% of the LEL; shutdown occurs when all of the detectors (AI-401/404) reach
this threshold value at the same time; fresh air is conveyed into the plant,a the production
oven burners and the RTO are turned off, and the vent valves on the towers are opened
detectors automatically check their own operating conditions; a periodic calibration system
was installed on the line; each detector activates an alarm when it detects its own
malfunctioning; the shutdown device comes into operation if AI-401 and AI-404
malfunction at the same time, and fresh air is conveyed into the planta

Table 4. ROA of VCSa

a Asterisks indicate primary events. HE: human error.

namely, the systematic nature and completeness of the
analysis, and enables simple checks to be made of the
real attainment of the objectives. In addition, direct
extraction of the incidental sequence diagram (ISD)
from an ROA provides an otherwise impossible check
of the congruity of the analysis and a rapid development
of FT and ET.4,14,15 The ISD in Figure 6 graphically
represents the logical links within TE 1 (explosion), its
primary causes, and nonintervention of the protection
systems. ISD stops at the depth reached by ROA. When
the events that cause the nonintervention of protective
means are fully develpoed, a FT is obtained (Figure 7).
A reduction and quantification of the FT was per-
formed using ASTRA,16,17 a software that was developed
by JRC-Ispra. The failure rates and unavailability data
reported in Figure 7 come from the literature.18,19 All
of the components were considered to be unrepairable;
the test time interval () for the protective systems was
6 months. The mission time was calculated considering
5 working days/week. The common cause failures for
redundant components, mainly owing to the breakdown
of plant utilities (power, air, etc.), were neglected
because of a highly reliable independent system dedi-
cated to safety equipment.
Nine minimal cut sets (MCSs) were obtained with
orders ranging from 5-7. The most critical ones were
as follows:
MCS 1. (E01, E09, E11, E12, E13, E14) w
W1 ) 2.77 10-3 occurrences/year.
MCS 2. (E01, E04, E05, E09, E11, E12, E16) w
W2 ) 9.94 10-4 occurrences/year.
MCS 3. (E01, E04, E05, E09, E13, E14, E16) w
W3 ) 9.94 10-4 occurrences/year.
The whole frequency of occurrence of TE 1 was
W ) 5.27 10-3 occurrences/year.
Because primary events E01 (nonintervention of DV)
and E09 (nonobservation of cleaning procedures) appear
in all of the MCSs, it is clear that they indicate the
occurrence frequency of each MCS. It can therefore be
supposed that an even better result could be obtained
by keeping the thickness of the deposits down through-
out the VCS and designing appropriate DVs with their
maintenance procedures.
The situation prior to the accident can be illustrated
by the FT of Figure 7 if event G12 is replaced by TE 1.
When the accident occurred, there were, in fact, no FMs
with their respective high and very high VFC
concentration alarms nor DVs. The frequency of occur-
rence of a possible explosion in the plant where the

Figure 5. P&I diagram of the VCS.
Figure 6. ISD of TE 1.
accident occurred can be assessed through the calcula-
tion of the gate G12 frequency of occurrence because
no protective means were installed. This results in an
expected number of failures (ENOF) (explosion) of 1.03
occurrences/year. The FTA results, therefore, confirm
the effectiveness of the modifications of the risk-based
design project and show further possibilities of improve-
ment.
Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004 5843
The other TEs identified through the ROA are not
affected by the plant modifications suggested.
As can be seen in the flow sheet in Figure 1, the
second logic tree that can be readily extracted from an
ROA is the ET. This diagram identifies, and in some
cases quantifies, the possible consequences of an initiat-
ing event. Account is also taken of the events that
consist of the complete or partial intervention of the
5844 Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004
Figure 7. FTA of TE 1.
Figure 8. ET for TE 1.
means of protection.4,14 The ET developed for this plant
(Figure 8) validated the intervention sequence of the
means used to protect the VCS.
7. Conclusions
Following an explosion that occurred in an RTO of a
can painting shop, a risk analysis was performed on a
similar plant in order to modify its design before it was
constructed and the production started. A risk-based
design approach was adopted. The empirical knowledge
obtained from the accident analysis highlighted the need
for a better phenomenological knowledge of the char-
acteristics and the behavior of the solid residues re-
leased into VCS pipeworks from flue gases. This was
achieved through the thermal analysis of the residues
themselves.
It was found that the more dangerous residues were
released by the drying flue gases and that, to control

their decomposition in order to avoid the formation of
vapor mixtures within flammable limits, the tempera-
ture of the flue gases must be kept at around 140 C.
To maintain this temperature, the drying step flue
gases were collected in the same duct as those from the
Ross oven.
A number of preventive and protective measures was
also suggested: (i) periodic inspection and cleaning
procedures; (ii) FMs; (iii) FPS; (iv) DVs and protection
barriers in the discharge area. These measures were
included in a probabilistic framework in order to verify
their effectiveness.
The ENOF (explosion) was assessed through the
quantitative solution of a FT that was directly drawn
from the tables of a ROA performed on the plant. The
value decreased by 3 orders of magnitude when the
suggested preventive and protective measures were
considered: from 1.03 occurrences/year (for the plant
in which the explosion occurred) to 5.3 10-3 occur-
rences/year. This value thus confirms the effectiveness
of the suggested measures and also the one of the risk-
based approach as a tool to improve plant design.
Acknowledgment
An early version of this study was presented at the
ESREL 2001 European Conference.20
Notation
DSC ) differential scanning calorimetry
DV ) deflagration vent
ENOF ) expected number of failures
ET ) event tree
FM ) flammability monitor
FPS ) fireproofing system
FT ) fault tree
FTA ) fault tree analysis
HE ) human error
ISD ) incidental sequences diagram
JRC ) Joint Research Center-Ispra (VA), Italy
LEL ) lower explosion limit
MCS ) minimal cut set
Q ) unavailability
QRA ) quantitative risk analysis
) test time interval
ROA ) recursive operability analysis
RTO ) regenerative thermal oxidizer
VCS ) venting collection system
VFC ) volatile flammable compound
TE ) top event
W, W ) occurrence frequency
) failure rate
) repair rate
Literature Cited
(1) Turney, R. Explosion within a thermal oxidizer. Loss Prev.
Bull. 2003, 170, 8-10.
Ind. Eng. Chem. Res., Vol. 43, No. 18, 2004 5845
(2) Galvagni, R.; Clementel, S. Risk Analysis as an instrument
of design. In Safety Design Criteria for Industrial Plant; Cumo,
M., Naviglio, A., Eds.; CRC Press: Boca Raton, FL, 1989.
(3) Antona, E.; Fragola, J.; Galvagni, R. Risk-based decision
analysis in design. 4th SRA Europe Conference, Rome, Italy, Oct
18-20, 1993.
(4) Piccinini, N.; Scarrone, M.; Ciarambino, I. Probabilistic
analysis of transient events by an event tree directly extracted
from operability analysis. J. Loss Prev. Process Ind. 1994, 7, 23-
32.
(5) Waldern, P. J.; Nutcher, P.; Lewandowski, D. Options for
VOC reduction in a Regenerative Thermal Oxidizer (RTO). Emerg-
ing Solution VOC Air Toxic Control; Air and Waste Management
Association: Pittsburgh, PA, 1996; pp 462-483.
(6) Self, F. E.; Hill, J. D. Safety considerations when treating
VOC streams with Thermal Oxidizer. AIChE 1997 Spring National
Meeting Case Histories and Miscellaneous Topics; AIChE 31st
Annual Loss Prevention Symposium, Houston, TX, Mar 1997.
(7) Eckhoff, R. K. Dust Explosions in Process Industries;
Butterworths-Heinemann: Oxford, 1991.
(8) Clark, D. G.; Sylvester, R. W. Ensure Process Vent Collec-
tion System Safety. Chem. Eng. Prog. 1996, 1, 65-77.
(9) Thomas, C. D.; Schoenmaker, G. Implement Proper Furnace
Safety Interlocks. Chem. Eng. Prog. 1996, 7, 45-49.
(10) National Fire Protection Association. Installation of Sprin-
kler Systems; National Fire Protection Association: Boston, 1994;
p 13.
(11) National Fire Protection Association. Water Spray Fixed
Systems for Fire Protection; National Fire Protection Association:
Boston, 1994; p 15.
(12) National Fire Protection Association. Standard on Venting
of Deflagration; National Fire Protection Association: Boston,
1994; p 68.
(13) National Fire Protection Association. Standard on Explo-
sion Prevention Systems; National Fire Protection Association:
Boston, 1992; p 69.
(14) Piccinini, N.; Ciarambino, I. Operability analysis devoted
to the development of logic trees. Reliab. Eng. Syst. Saf. 1997, 55
(3), 227-241.
(15) Demichela, M.; Marmo, L.; Piccinini, N. Recursive Oper-
ability Analysis Of Systems With Multiple Protection Devices.
Reliab. Eng. Syst. Saf. 2002, 77, 301-308.
(16) Contini, S.; de Cola, G.; Wilikens, M.; Cojazzi, G. ASTRA,
an integrated tool set for complex systems dependability studies.
Workshop on Tool Support for System Specification, Development
and Verification, Malente, Germany, 1998.
(17) Contini, S. Recenti Sviluppi metodologici dellanalisi degli
alberi di guasto. Valutazione e gestione del rischio negli insedia-
menti civili e industriali, Convegno nazionale VGR 98, Pisa, Oct
1998.
(18) Center for chemical process safety of the AIChE. Guide-
lines for process equipment reliability data; AIChE: New York,
1989.
(19) Procaccia, H.; Arsenis, S. P.; Aufort, P. European Industrial
Reliability Data bank, 3rd ed.; Crete University: Iraklion, 1998.
(20) Piccinini, N.; Quattrini, A.; Rapone, N. The Safety of A
Regenerative Thermal Oxidiser and its Venting Collection System.
ESREL 2001, Torino, Italy, Sept 16-20, 2001.
Received for review October 29, 2003
Revised manuscript received June 9, 2004
Accepted June 17, 2004
IE0342208