Reliability Assessment in a Freeze-Drying Process - American

Subscriber access provided by CORNELL UNIVERSITY LIBRARY

Article

Reliability assessment in freeze-drying processes Serena Bosca, Davide Fissore, and Micaela Demichela Ind. Eng. Chem. Res., Just Accepted Manuscript • Publication Date (Web): 16 May 2017 Downloaded from http://pubs.acs.org on May 22, 2017

Just Accepted “Just Accepted” manuscripts have been peer-reviewed and accepted for publication. They are posted online prior to technical editing, formatting for publication and author proofing. The American Chemical Society provides “Just Accepted” as a free service to the research community to expedite the dissemination of scientific material as soon as possible after acceptance. “Just Accepted” manuscripts appear in full in PDF format accompanied by an HTML abstract. “Just Accepted” manuscripts have been fully peer reviewed, but should not be considered the official version of record. They are accessible to all readers and citable by the Digital Object Identifier (DOI®). “Just Accepted” is an optional service offered to authors. Therefore, the “Just Accepted” Web site may not include all articles that will be published in the journal. After a manuscript is technically edited and formatted, it will be removed from the “Just Accepted” Web site and published as an ASAP article. Note that technical editing may introduce minor changes to the manuscript text and/or graphics which could affect content, and all legal disclaimers and ethical guidelines that apply to the journal pertain. ACS cannot be held responsible for errors or consequences arising from the use of information contained in these “Just Accepted” manuscripts.

Industrial & Engineering Chemistry Research is published by the American Chemical Society. 1155 Sixteenth Street N.W., Washington, DC 20036 Published by American Chemical Society. Copyright © American Chemical Society. However, no copyright claim is made to original U.S. Government works, or works produced by employees of any Commonwealth realm Crown government in the course of their duties.

Page 1 of 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Industrial & Engineering Chemistry Research

82x44mm (300 x 300 DPI)

ACS Paragon Plus Environment


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

297x200mm (96 x 96 DPI)


Page 2 of 42

Page 3 of 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


135x284mm (96 x 96 DPI)



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

394x308mm (96 x 96 DPI)


Page 4 of 42

Page 5 of 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


457x356mm (96 x 96 DPI)



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

446x365mm (96 x 96 DPI)


Page 6 of 42

Page 7 of 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


199x400mm (300 x 300 DPI)



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

199x249mm (300 x 300 DPI)


Page 8 of 42

Page 9 of 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


This document is confidential and is proprietary to the American Chemical Society and its authors. Do not copy or disclose without written permission. If you have received this item in error, notify the sender and delete all copies.

Reliability assessment in freeze-drying processes

Journal: Manuscript ID Manuscript Type: Date Submitted by the Author: Complete List of Authors:

Industrial & Engineering Chemistry Research ie-2017-00378m.R3 Article 13-May-2017 Bosca, Serena; Politecnico di Torino Fissore, Davide; Politecnico di Torino, Dipartimento di Scienza Applicata e Tecnologia Demichela, Micaela; Politecnico di Torino, Scienza dei Materiali e Ingegneria Chimica



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Reliability assessment in a freeze-drying process Serena Bosca, Davide Fissore, Micaela Demichela* Dipartimento di Scienza Applicata e Tecnologia, Politecnico di Torino, corso Duca degli Abruzzi 24, 10129 Torino (Italy)

Key words Freeze-drying, Recursive Operability Analysis, Risk analysis, Fault tree, 2k Design of Experiments

Abstract A risk analysis for a pilot scale-freeze-dryer is shown in this paper, aiming to build the basis for the risk-based decision making in plant and process design of a (pilot scale) freeze-dryer, to be then exploited in the design of a full scale safer plant. The risk analysis was performed using the Recursive Operability Analysis to point out the process top events and to identify their primary causes. The top events here considered are the undesired freezing velocity in the freezing stage, and the undesired heating profile and/or pressure value in the whole process, as they can be responsible of product overheating and, thus, jeopardize product quality. After the extraction of the fault trees, the minimal cut-sets were identified. The unavailability at mission time was then calculated and the contribution of the primary causes to the top events occurrence was evaluated. The more critical plant components were identified and a suitable 2k Design of Experiments was set up to evaluate how the uncertainty on the values of the failure rates of the various components affect the unavailability at mission time.

Address all future correspondence to: [email protected]


Page Page10 2 of 42 33

Page 11 3 ofof33 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Introduction

The risks identification is a key step for the safe design of a manufacturing process and, in this framework, once the threats of the process were pointed out, it is important to evaluate their consequences, as well as their causes. In this paper, the risk assessment was used to build the basis for the risk-based decision making in process and plant design of a pilot scale freeze-dryer, to be then exploited in the design of a full scale safer plant. Several Process Hazard Analysis (PHA) techniques are available to this purpose, as accurately reviewed by the Center for Chemical Process Safety1 (1992) and by Crawley and Tyler2. Among the available PHA techniques the most frequently used is the Hazard and Operability Analysis (HazOp), a disciplined procedure that allows identifying the deviations of process variables from their design values. The analysis is based on the critical exam of the process, and it requires particular attention for the identification of all the potential malfunctioning of each piece of equipment in the plant, and the evaluation of their consequences.3-7 Various authors modified the original HazOp methodology, aiming to evaluate the hazard impact, after the hazard identification step. Bendixen and O’Neill8 combined the HazOp with the fault tree (FT) analysis and obtained a versatile technique able to identify the hazards and, at the same time, to quantify their effects.9,10 An enhanced methodology, the Recursive Operability Analysis (ROA), was also proposed by Piccinini and Ciarambino11: the ROA is a qualitative method based on the analysis of the deviations of process variables from the normal operating conditions, and it allows identifying the plant malfunctioning and the risks associated to them.12,14 The recursive mechanism is applied on both the causes and the consequences of the deviations that were identified in the plant, and it allows pointing out the primary causes and developing the Top Events. The protection systems of the plant, and their set points, are also taken into account, thus introducing a sort of time dimension in the analysis, as evidenced by Demichela et al.15, who used the ROA for the safety analysis of a complex plant with multiple levels of protection. When the analysis is focused on the causes of process deviations, the ROA allows identifying the primary events, while when it is focused on the consequences, it allows identifying the top events. One of the main advantages of the ROA is that it allows retrieving immediately the logical trees, i.e. the incidental sequence diagram, the event tree, and the fault tree. The fault tree is a graphical representation of the logical links between the events, starting from the primary causes and arriving to the top event, and it is a strengthened tool for

2 Environment ACS Paragon Plus


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

the availability and reliability evaluation of complex systems.16 The fault trees associated to each top event can be logically solved, thus obtaining the minimal cut-sets, and the probability of occurrence of each top event can be calculated using the unavailability values of the primary events.17-21 This paper shows the results of a risk analysis of a lyophilisation process. In a freezedrying process water is removed at low temperature and low pressure and, thus it is particularly used for pharmaceutical and biological products as it allows preserving thermally labile molecules as the active pharmaceutical ingredients. In this case, the final solid product obtained from the original aqueous solution is characterized by a porous structure, by a longterm stability even at ambient temperature, and its reconstitution is fast thanks to the high specific surface.22-28 At the end of the process a dried product with high quality is desired. This means that the product must have the target content of residual moisture, a good appearance of the dried cake, and a porous structure allowing a fast reconstitution after rehydration. The most important factor that influences product quality is the temperature.29,30 For each product it is possible to identify a threshold value that, if trespassed, could jeopardize the final quality. Drug degradation, product melting, or dried cake collapse may occur if product temperature trespass the threshold value.31,32 Therefore, the operating conditions (namely, temperature of the technological fluid used to supply heat to the product, as ice sublimation is an endothermic process, and the pressure in the drying chamber) must be carefully selected in order to fulfil this constraint. The selection of conservative operating conditions (i.e. low chamber pressure and low fluid temperature) may prolong, often unnecessary, the process duration, thus increasing the costs of the operation. On the contrary, less conservative operating conditions (high chamber pressure and high fluid temperature) can result in product damages due to the exceeding of the limit temperature. In this study, a Recursive Operability Analysis was performed for a pilot-scale freezedrier, aiming to point out the major hazards and their primary causes. Then, the results obtained by the ROA are used to identify the fault trees, that are then quantified to determine the reliability of the plant. Reliability analysis of a freeze-drying plant was carried out for the first time by Bosca et al.33: in that case, the ROA and the fault trees analysis were used to propose some plant modifications aiming to get better performances, focusing, in particular, on the system used to control the pressure in the process and on the mechanical refrigeration system. In the present study the analysis if focused on the effect of the uncertainty on the values of the failure rate of the various components on the plant unavailability at mission



Page 13 5 ofof33 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


time: a 2k design of experiment is used to this purpose, as it will be discussed in the following. The analysis allowed to highlight the potential criticalities within the plant and to guide the technical and procedural solutions to be taken into account in the scale-up of the plant from the pilot to the industrial size.

Materials and methods

Case study The analysis was carried out for a pilot-scale freeze-drier, as sketched in Figure 1. The solution containing the drug is usually poured into vials, or in trays, loaded onto the shelves in the drying chamber. The freeze-drying cycle is composed of three stages. The first one is the freezing step, during which the aqueous solution is frozen and, then, undercooled to about -40°C through a technological fluid flowing into the shelves of the chamber. When the product is frozen, the pressure in the drying chamber is decreased to a value lower than to the ice vapour pressure, thus causing ice sublimation (primary drying). Simultaneously, the temperature of the technological fluid is increased, to a value that generally is below 0°C, thus heating the frozen product and favouring the sublimation of the ice crystals. The water vapour moves from the chamber to the condenser. For pressure control in the chamber, a nitrogen controlled stream is introduced. As the drying goes on, a “cake” of dried material is obtained. The primary drying can be considered completed when no more ice is present in the product and, thus, no more water vapour is present in the chamber. Simultaneously, product temperature reaches the value of the shelf temperature value as the heat supplied to the product is no longer used for ice sublimation. At the end of the primary drying stage the operating conditions are changed to start the secondary drying stage, when the desorption of the water bound to the product molecules is obtained: the pressure in the chamber is further lowered, and the temperature of the technological fluid is risen to 20°C or more. The process is stopped when the desired content of residual moisture in the product is obtained. The plant considered in this study is a standard one, as described by Bosca et al.33, composed by a drying chamber, with the shelves for the product, a condenser (C-01), a vacuum pump (VP-01), a heater (EH-01), a flowing pump (P-01), and a refrigeration unit, equipped with condensers (C-02 and C-03), evaporators (EV-01 and EV-02) and lamination valves (V-04 and V-05). As previously stated, the first step of the lyophilisation process is the freezing stage,



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

where a cold fluid flows into the shelves to decrease product temperature in such a way that the liquid water is frozen. In this stage, carried out at atmospheric pressure, EH-01 and C-01 are turned off, and V-01 is closed. The temperature of the technological fluid is controlled through a refrigeration unit composed by an evaporator (EV-01), a compressor (CP-02), a condenser (C-03) and a lamination valve (V-05). In the refrigeration cycle the technological fluid is cooled to a temperature close to -50°C. A temperature control system (TC) measures the temperature of the technological fluid (TE2) and the opening of V-05 is manipulated to get the set point value. The pump P-01, equipped with a high-temperature alarm (Figure 2A), and connected to a flowmeter (FI1), guarantees the circulation of the technological fluid. When the temperature of the product reaches a value of about -40°C it is possible to start the primary drying stage. At first, C-01 is cooled by the refrigeration system. Due to the low temperature required, two units are used for the refrigeration: the evaporator EV-02, the lamination valve V-04, the compressors CP-01 and CP-02 and the condensers C-02 and C-03. In both condensers, C-02 and C-03, the target value of the temperature of the refrigeration fluid is obtained through a temperature control system acting, respectively, on V-08 (through gauge TE6) and on V-09 (through gauge TE7). A high-temperature alarm is also present in the refrigeration circuit (gauge TE4, Figure 2B). In this stage EV-01 is not working, and V-05 is closed. By this way, the temperature reached in the condenser is around -80°C. A temperature control (TC) measures the temperature of the condenser (TE4) and vary the opening of V-04 to keep the desired temperature in C-01. Beside this, the condenser is equipped with a high-temperature alarm (gauge TE4, Figure 2B). While C-01 is cooled, VP01 is turned on and chamber pressure starts decreasing. In the chamber two pressure sensors (PI1 and PI2) are connected to two alarms: the high-pressure alarm and the very high-pressure alarm (Figure 2C). The controller acts on V-03 to regulate a nitrogen flux in the chamber to keep the pressure value at the set point. During this step EH-01 is turned on, and it starts heating the technical fluid: a temperature control (TC) measures the temperature of the fluid (TE3) and manipulates the resistor power to get the set point value. Various protective means act on EH-01: the fluid heater circuit switch (TSL/interlock I1) turns on EH-01 when the technological fluid temperature (measured trough gauge TE1) is low, the heating safety thermo-switch (TSH/ interlock I2) turns on EH-01 when the fluid temperature is higher than the set point value (Figure 2D). Another protection is represented by the refrigeration cycle: in case the technological fluid reaches a too high temperature, the interlock I3 opens V-05, thus allowing the fluid to flow in EV-01, and restoring the set point value of the temperature. Once all the ice is sublimated, the primary drying is completed and the operating 5 Environment ACS Paragon Plus


Page 15 7 ofof33 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


conditions are modified in such a way that the desorption of the residual water (secondary drying) can occur. The temperature in C-01 in maintained at about -80°C through the refrigeration unit, VP-01 is used to decrease as much as possible the pressure in the drying chamber, EH-01 heats the technological fluid to the selected value for this stage of the process. After a certain (pre-determined) time interval, or then the target value of residual moisture is achieved, the secondary drying is finished and, thus, the equipment is stopped: EH-01 is turned off, as VP-01, V-01 is closed and the refrigeration unit is turned off. Aiming to restore the atmospheric pressure in the chamber, V-03 is fully opened, thus allowing the nitrogen to flow in the chamber. After product removal from the chamber, V-07 is opened and the pressure is restored also in C-01.

Recursive Operability Analysis The Recursive Operability Analysis (ROA) is a method used for the identification of the hazards in a process. The ROA was proposed by Piccinini and Ciarambino11 and it was used in this paper to analyse the lyophilization process carried out in the pilot plant described in the previous paragraph. The lyophilization process is a non-continuous process, composed of three successive stages (freezing, primary and secondary drying); thus, the analysis of the process was undertaken for each stage. In order to carry out the ROA, it is necessary to divide the system into sub-systems, each one characterized at least by one equipment, and then to define the points in each subsystem where deviations may occur, i.e. the nodes. In the case study, the freeze-drying plant was divided into three sub-systems. The sub-system 1 is the “drying chamber” and contains, in addition to the chamber, EH-01 and P-01. The sub-system 2 is the “condenser” and includes, beside C-01, VP-01 and V-01. The subsystem 3 is the “refrigeration unit” and it includes C-02 and C-03, CP-02 and CP-03 and V-04 and V-05. In each sub-system, some nodes were identified: they are listed in Table 1 and evidenced in Figure 1. The ROA was carried out in each node of the sub-system, for all the three stages, with the aim to identify both the top events and their primary causes.

Fault trees The ROA is a particularly suitable methodology to extract the fault trees thanks to the tables obtained during the analysis of the process variables’ deviations. Once the fault trees were



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

obtained, their quantification was gained using the software ASTRA-334-36, thus calculating the system unavailability at mission time, identifying the minimal cut-sets for each top event, and the contribution of each primary cause to the top event. A mission time for the system equal to 1 year was considered for the calculations. As the lyophilization is a non-continuous process, this means that for 1 operating year each stage takes only a portion of the entire time lapse, that is proportional to the duration of each stage during the entire cycle. For this study, a cycle duration of 50 hours was considered, where the freezing step lasts 10 hours, the primary drying 30 hours and the secondary drying the remaining 10 hours. Therefore, in 1 year about 150 cycles are carried out, and, thus, 1500 hours for the freezing step, 4500 hours for the primary drying and 1500 hours for the secondary drying. The primary causes defined with the ROA were quantified using the failure rates and the probabilities of occurrence listed in Table 2.37 For each primary event, a minimum and a maximum value of the failure rate are shown, thus evidencing the variability of this parameter in the available literature. Some of the data shown in this Table are rather old: on the other hand, they constitute a recognised and widely accepted literature based set, whose uncertainty and the possible effects on the quantification of the fault trees will be investigated in the followings. In order to get this result, the methodology used was the Design of Experiments (DOE), in particular the 2k factorial design.43 The 2k refers to a DOE considering k factors, where each factor has just two levels (i.e. minimum and maximum values of the failure rates of the primary events). By this way, it is possible to get as much information as possible with the minimum effort, pointing out how the probability of occurrence of the top event is affected by the variability of the values of the failure rates of the primary events. For the case study the effect of the value of the failure rate of three events (those whose contribution to the top event is more relevant), labelled as A, B and C was considered. For the j-th combination of the values of the failure rate of the primary events the unavailability at mission time (x) is calculated. At this point, as shown, among the others, by Montgomery43, the effect of the event A results to be given by: -  x a − x (1)  when the values of the events B and C are both low -  x ab − xb  when the value of the event B is high and the value of the event C is low; -  x ac − x c  when the value of the event C is high and the value of the event B is low; -  x abc − x bc  when the values of the events B and C are both high. Considering single effects calculated previously, the total effect of the event A on the



Page 17 9 ofof33 42

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


unavailability at mission time can be calculated: E ( A) =

1 a x − x(1) + x ab − x b + x ac − x c + x abc − x bc   4

(1)

The effects of the events B and C can be calculated in a similar way. The interactions between two factors, e.g. A and B, can be computed by means of the following equation: E ( AB ) =

1  abc x − x bc + x ab − x b − x ac + x c − x a + x (1)  4

(2)

and similarly, for BC and AC. The effect of the three parameters A, B and C can be calculated as follows:

E ( ABC ) =

1  abc x − xbc − x ac + x c − x ab + x b + x a − x(1)   4

(3)

Results

The top events considered for the analysis are the undesired process conditions that may occur during the cycle. The top events pointed out for each stage of the lyophilisation process are shown in Table 3. In particular, concerning the freezing step, the undesired condition that can occur is an undesired cooling velocity of the product caused by the technological fluid: if the cooling velocity obtained through the technological fluid is not the desired one, this will affect the ice crystals size44 and, as this influences the characteristics of the porous structure obtained during the successive drying stage, this undesired condition can affect the final quality of the dried product, and, in detail, it can jeopardize the fast reconstitution of the product after rehydration. With respect to the primary drying stage, two undesired conditions were considered: the occurrence of an undesired pressure profile in the chamber and of an undesired heating profile. The first one occurs when the value of the pressure in the drying chamber is not maintained to the set point. If the pressure value is higher with respect to the set point, the temperature of the product rises and, then, may exceed the limit value. On the contrary, a lower value of the pressure with respect to the set point ensures fulfilling the temperature limit, but it unnecessary prolongs the duration of the primary drying stage, thus increasing the costs of the process. Similar effects are obtained in case of an undesired value of the product temperature: if it increases, e.g. in case of too high value of technological fluid temperature, the limit value can be exceeded, while a too low temperature value leads to a worthless



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

extension of the primary drying stage. Finally, regarding the secondary drying stage, two undesired conditions can be identified: the undesired pressure value in the drying chamber and the undesired temperature profile. When the pressure value is not the desired one, then the vacuum level in the chamber can be not sufficient to favour the desorption of the residual water. If the temperature profile is not the desired one, then the heat transferred to the product is not sufficient to desorb the “bound” water, and the target residual moisture is not achieved at the end of the process. In Figure 3 the fault tree for the top event “undesired cooling velocity” during freezedrying step is shown, while the fault tree for the top event “undesired profile pressure” during the primary drying stage is presented in Figure 4, and the fault tree for the top event “undesired heating profile” during the primary drying stage is shown in Figure 5. The fault trees regarding the secondary drying stage are not shown as they are similar to those obtained for the primary drying stage, and the secondary drying stage is less critical then the previous stage. In fact, the product is almost dried, and variations on pressure and/or heating profile are less problematic with respect those occurring during the primary drying stage. Starting from the fault trees, the software ASTRA-3 was used to calculate the system unavailability at mission time, to identify the minimal cut-sets for each top event, and to evaluate the contribution of each primary cause to the top event. The quantification of the fault trees gives the values of unavailability at mission time, as shown in Table 4. The results were obtained using the average value of the failure rates shown in Table 2, as well as the values of the probabilities also reported in Table 2. All the components were defined as reparable, considering a test interval of the component equal to 50 h, i.e. a test is carried out before a new cycle is started, and a repairing time equal to 50 h, i.e. one cycle is lost for the repairing or the substitution of the damaged component. The “undesired cooling velocity” during the freezing step has a probability of occurrence of 14.9%: considering the fault tree in Figure 3, it appears that this high probability is due to the large number of events that can lead to this top event. The most significant cut-sets obtained through the analysis of the fault tree are reported in Table 4 with their unavailability. The cut-set with the higher probability (ID 1) corresponds to the fault of CP-02. In fact, this event causes the block of the refrigeration cycle and, thus, the technological fluid is no more cooled, and it does not freeze the product. The other first order cut-sets are the failure of the controller of the technological fluid temperature and the blockage of the pneumatic valves (V-05 and V-09). Both events influence the technological fluid temperature and affect the freezing of the product and, then, its final quality. Figure 6A


Page 18 10 of 42 33

Page 19 11 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


shows the primary events and their contribution to the top event “undesired cooling velocity”. The fault of CP-02 in the mechanical refrigeration cycle is one of the events that give the higher contribution to this top event. The freezing step can be also jeopardized by the fault of P-01, as the stop of the circulation of the technological fluid impairs the value of its temperature, affecting product freezing. Moreover, a failure of TE2 and TE7, that means wrong measurements of the temperature of the technological fluid, can induce the control system to act on V-05 when a regulation is not required. The top event with the highest probability of occurrence in the primary drying stage is the “undesired pressure profile”, with a probability of 0.88%, as reported in Table 2. The fault tree analysis carried out with ASTRA-3 provides results about the minimal cut-sets, as shown in Table 4. The cut-set with the highest probability is the failure of the pressure control system PIC. Other first order cut-sets are the blockage of V-03, which, failing open, impedes the regulation of the pressure in the drying chamber, and the failure of the pressure sensor (PI) that, providing wrong measures of chamber pressure, forces a pressure regulation when it is not necessary. In Figure 6B, the primary events that contribute to the occurrence of the top event “undesired pressure profile” are shown. The failure of CP-01 and CP-02 are the most significant events. In fact, as they are part of the refrigeration cycle, a fault of one of them causes a blockage of the refrigeration of the technological fluid that does not cool the condenser. An increase of the condenser temperature compromises the freezing of the vapours from the drying chamber and, thus, the set point value of pressure in the drying chamber cannot be maintained. The primary drying can be also affected by the failure of the control system of the chamber pressure (PIC-PT1), as previously pointed out. The last top event analysed in this paper is the “undesired heating profile” during primary drying. By analysing the fault tree shown in Figure 5 with the software ASTRA-3, the minimal cut-sets, identified and listed in Table 4, point out the mechanical problems to the circulation system as the primary cause, with the highest unavailability value. In fact, if the circulation of the technological fluid inside the shelves of the chamber is jeopardized, the heat transfer to the product can be compromised and, thus, the drying cannot proceed. The second first order cut set is the error when setting the set-point. In fact, the setting of a higher temperature with respect to the correct one can lead to the exceeding of the product limit temperature, and, thus, it could impair the final product quality. On the contrary, setting of a lower temperature with respect to the desired one, ensures the final quality of the product, but it increases the primary drying duration and, thus, the costs of the entire process. Figure 6C shows the primary events that mainly contribute to the occurrence of the top event “undesired



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

heating profile”. The main contributor is the fault of CP-02, whose effect is the same already analysed for the previous top event. In addition, the fault of P-01, affecting the circulation of the technological fluid, causes the increase of the temperature of the product, as it is no longer cooled. Finally, wrong measurements of the technological fluid temperature, due to the failure of the temperature probe, cause the unnecessary activation of the control system, thus affecting the temperature of the product. The quantification of the fault trees presented in Table 3 is based on average values of the failure rates and probabilities calculated from the data given in Table 2 and, thus, the unavailability at mission time calculated is strictly dependent on the data used. Therefore, it is necessary evaluating how these results are affected by the values of the failure rates and probabilities considered in the calculations. As previously stated, a 2k Design of Experiments (DOE) was used to this purpose, considering the minimum and the maximum values of the parameters to calculate the unavailability at mission time, and taking into account, as primary events, those of the minimal cut sets, identified through the quantification of the fault trees, whose contribution to the top event is more relevant. Concerning the freezing step, as pointed out in Table 4, the primary events considered are the fault of CP-02 (event A), the failure of the temperature controller TIC (event B) and the blockage of the pneumatic valve (event C). By taking into account the minimum and the maximum values of the failure rates of each events, a DOE 23 was built, as shown in Table 5, where “-“ refers to the minimum value of the parameter and “+” to the maximum value. The unavailability at mission time of the system was calculated for each combination of failure rates of the events and the results are given in Table 5. These values were used to calculate the effect of the uncertainty of the failure rates associated to the events A, B and C to point out the effect of this uncertainty on the final value of unavailability at mission time. Table 7 shows the results obtained, pointing out that the failure rate of CP-02 has the strongest effect on the calculated unavailability. As a consequence, the effect of this parameter on the unavailability at mission time for the event “undesired cooling velocity” during the freezing step was calculated, considering the maximum and the minimum failure rates for the events B and C, and results are shown in Figure 7 (graph A), pointing out that the effect of the uncertainty on the values of failure rates for the events B and C is almost negligible. The other top event analysed was the “undesired pressure profile” during the primary drying stage. The events selected for the analysis are the fault of the pressure controller PIC (event A), the blockage of the pneumatic valve (event B) and the failure of the pressure sensor PI (event C). Also in this case, the DOE 23 was developed considering the maximum and the


Page 20 12 of 42 33

Page 21 13 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


minimum values of the failure rates, and the results obtained are summarised in Table 6. Similarly to the previous study, the effect of the uncertainty of the failure rates associated to the events A, B and C on the final value of unavailability at mission time was calculated. Results are shown in Table 7, where it appears that the uncertainty on the failure rate of the pressure controller has the strongest effect on the calculated unavailability. As a consequence, the effect of this parameter on the unavailability at mission time for the event “undesired pressure profile” during the primary drying stage was calculated, considering the maximum and the minimum failure rates for the events B and C, and results are shown in Figure 7 (graph B), pointing out that the effect of the uncertainty on the values of failure rates for the events B and C is almost negligible.

Conclusions

A risk assessment for the lyophilization process was shown in this work. The case study was a pilot plant for the freeze-drying process, that was described evidencing all the control loops and the protective means implemented. The Recursive Operability Analysis (ROA) was used to determine the top events and to identify their primary causes in all stages of the process. From the tables of the ROA, the fault trees of the top events were extracted, and by means of the software ASTRA-3 they were quantified, providing results such as the probability of occurrence of each top event, the minimal cut-sets and the percent contribution of each primary cause to the unavailability of the system. Among the analysed top events, those with the highest probability were the “undesired cooling velocity” during the freezing step and the “undesired pressure profile” during the primary drying stage. The primary causes that mainly contribute to the occurrence of the top event “undesired cooling velocity” are the fault of CP02 of the mechanical refrigeration cycle, the fault of P-01 and the failure of the temperature sensors that measure the technological fluid temperature. Instead, concerning the top event “undesired pressure profile” the fault of CP-01 and CP-02 are the primary causes with highest contribution to the top event, followed by the failure of the control system on the chamber pressure. An analysis about the influence of the failure rates characterizing the primary events on the value of the unavailability at mission time calculated was done using the 2k factorial Design of Experiment. Finally, it is worthwhile remarking that all the top events mentioned in this study refers



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

to undesired conditions during the operation of the plant. No quantification of the entity of the consequences that these deviations have on the final product quality was considered. A future work will focus on this topic: the risk analysis will be performed based on product quality and a costs-benefits analysis will be provided with the purpose to evaluate which are the more appropriate modifications to be implemented in the plant to increase its availability.

Acknowledgement

The authors gratefully acknowledge the contribution of Rafael L.B. Raoni (Universidade Federal do Rio de Janeiro) for the help in the construction and the solution of the Fault Trees.


Page 22 14 of 42 33

Page 23 15 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


List of references

1.

Center for Chemical Process Safety. Guidelines for hazard evaluation procedures. Second edition with worked examples, American Institute of Chemical Engineers: New York, 1992.

2.

Crawley, F.; Tyler, B. Hazard identification methods, Institution of Chemical Engineers: Rugby, 2003.

3.

Lawley, H. Operability studies and hazard analysis. Chem. Eng. Progr. 1974, 70, 45.

4.

Kavianian, H.R.; Rao, J.; Brown, G. Application of hazard evaluation techniques to the design of potentially hazardous industrial chemical processes, US Department of Health and Human Services, Public Health Service, Centers for Disease Control, National Institute for Occupational Safety and Health, Division of Training and Manpower Development: Cincinnati, 1992.

5.

Knowlton, R. A manual of hazard and operability studies, Chemetics International Ltd. Vancouver, 1992.

6.

Crawley, F.; Preston, M.; Tyler, B. HAZOP guidelines: guide to best practice (guidelines to best practice for the process and chemical industries), European Process Safety Centre Institution of Chemical Engineers: Rugby, 2000.

7.

Dunjó, J.; Fthenakis, V.; Vìlchez, J.A.; Arnaldos, J. Hazard and operability (HAZOP) analysis. A literature review. J. Hazard. Mater. 2010, 173, 19.

8.

Bendixen, L. M.; O'Neill, J. K. Chemical plant risk assessment using HAZOP and fault tree methods. Process Saf. Prog. 1984, 3, 179.

9.

Ozog, H. Hazard identification, analysis and control. Chem. Eng. 1985, 92, 161.

10.

Ozog. H.; Bendixen L.M. Hazard identification and quantification: the most effective way to identify, quantify, and control risks to combine hazard and operability study with fault tree analysis. Chem. Eng. Progr. 1987, 83, 55.

11.

Piccinini, N.; Ciarambino, I. Operability analysis devoted to the development of logic trees. Reliab. Eng. Syst. Safe. 1997, 55, 227.

12.

Piccinini, N.; Scarrone, M.; Ciarambino, I. Analisi di operabilità quantitativa. Proceedings of the Third meeting ATIG, 1990.

13.

Piccinini, N.; Scarrone, M.; Ciarambino, I. Probabilistic analysis of transient events by an event tree directly extracted from operability analysis, J. Loss Prev. Proc. Ind. 1994, 7, 23.

14.

Piccinini, N.; Spadoni, G., Tutorial on probabilistic risk assessment: level 1. Proceedings of European Conference ESREL, 2001, Tutorial notes: 63-106.

15.

Demichela, M.; Marmo, L.; Piccinini, N. Recursive operability analysis of a complex plant



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

with multiple protection devices. Reliab. Eng. Syst. Safe. 2002, 77, 301. 16.

Witter, R.E. Guidelines for hazard evaluation procedures. Plant/Operations Progr. 1992, 11, 50.

17.

Barlow, R.E.; Fussel, J.B.; Singpurwalla, N.D. Reliability and fault tree analysis; Society for Industrial and Applied Mathematics: Philadelphia, 1975.

18.

Dhillon, B.S.; Singh, C. Engineering reliability: new techniques and applications, John Wiley & Sons, Inc.: New York, 1981.

19.

Henley, E.J.; Kumamoto, H. Probabilistic risk assessment: reliability engineering, design, and analysis, IEEE Press: New York, 1981.

20.

Vesely, W.E.; Goldberg, F.F.; Roberts, N.H.; Haasl, D.F. Fault tree handbook, Create Space Independent Publishing Platform; Washington, 1981.

21.

Demichela, M.; Piccinini, N.; Ciarambino, I.; Contini, S. On the numerical solution of fault trees. Reliab. Eng. Syst. Safe. 2003, 82, 141.

22.

Mellor, J.D. Fundamentals of freeze-drying, Academic Press: London, 1978.

23.

Liapis, A.I.; Pim, M.L.; Bruttini, L. Research and development needs and opportunities in freeze drying. Drying Technol. 1996, 14, 1265.

24.

Oetjen, G.W. Freeze-drying, Wiley-VCH: Weinheim, 1999.

25.

Jennings, T.A. Lyophilization: Introduction and basic principles, Interpharm-CRC Press: Boca Raton, 1999.

26.

Oetjen, G.W.; Haseley, P. Freeze-drying (2nd edition), Wiley-VHC: Weinheim, 2004.

27.

Sadikoglu, H., Ozdemir, M.; Seker, M. Freeze-drying of pharmaceutical products: Research and development needs. Drying Technol. 2006, 24, 849.

28.

Franks, F. Freeze-Drying of Pharmaceuticals and Biopharmaceuticals, Royal Society of Chemistry: Cambridge, 2007.

29.

Pikal, M.J. Freeze-drying of proteins. Part I: Process design. BioPharm Intern. 1990a, 3, 18.

30.

Pikal, M.J. Freeze-drying of proteins. Part II: Formulation selection. BioPharm Intern. 1990b, 3, 29.

31.

Barresi, A.A.; Ghio, S.; Fissore, D.; Pisano, R. Freeze drying of pharmaceutical excipients close to collapse temperature: influence of the process conditions on process time and product quality. Drying Technol. 2009, 27, 805.

32.

Johnson, R.; Lewis, L. Freeze-drying protein formulations above their collapse temperatures: possible issues and concerns. Am. Pharm. Rev. 2011, 14, 50. 33. Bosca, S.; Fissore, D.; Demichela, M.; Raoni, R.L.B. Risk management in freeze-drying processes. In: Safety and Reliability of Complex Engineered Systems, Podofillini, L; Sudret,


Page 24 16 of 42 33

Page 25 17 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


B.; Stojadinovic, B; Zio, E.; Kröger, W.; Eds. Taylor & Francis Group, London, 2015, 3409-3417. 34.

Contini, S. A new hybrid method for fault tree analysis. Reliab. Eng. Syst. Safe. 1995, 49, 13.

35.

Contini, S.; Scheer, S.; Wilikens, M.; De Cola, G.; Cojazzi, G.G.M. ASTRA, an integrated tool set for complex systems dependability studies. In: Berghammer, R.; Lakhnech, Y (Eds.) Tool support for system specification, development and verification. Springer: Vienna, 1998, 77-91.

36.

Contini, S.; Cojazzi, G.G.M. On the exact analysis of non-coherent fault trees: The Astra package. Proceedings of the 8th International Conference on Probabilistic Safety Assessment and Management, New Orleans, May 14-18, 2006.

37.

Mannan, S. Lee’s loss prevention in the process industries. Butterworth-Heinemann: Oxford, 2005.

38.

CCPS - Center for Chemical Process Safety. Guidelines for process equipment reliability data with data tables, John Wiley & sons Inc.: New York, 1989.

39.

Smith, C.R. Seismic design approach for the Sizewell B nuclear power plant. Earthquake Engineering in Britain, Institution Civil Engineers: London, 1985.

40.

Rasmussen, N.C. Reactor safety study. An assessment of accident risks in U. S. commercial nuclear power plants. Executive Summary, Nuclear Regulatory Commission. Washington, 1975.

41.

IAEA - International Atomic Energy Agency. Generic component reliability data for research reactor PSA. Safety Assessment Section IAEA: Vienna, 1997.

42.

Williams, J.C.; Munley, G.A.; Ramsay C.G. A user manual for the human reliability assessment method, DNV Technica: Gloucester, 1992.

43.

Montgomery D.C. Design and analysis of experiments, John Wiley & Sons, Inc.: New York, 2001.

44.

Bosca, S.; Barresi, A.A.; Fissore, D. Design of a robust soft-sensor to monitor in-line a freezedrying process. Drying Technol. 2015, 33, 1039.



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

List of Tables

Table 1

List of nodes considered for the various subsystems for the Recursive Operability Analysis.

Table 2

Values of the failure rates and of the probabilities of occurrence for the primary events determined using the Recursive Operability Analysis

Table 3

List of the top events identified for each step of the freeze-drying process, and corresponding values of the unavailability at mission time calculated with ASTRA-3.

Table 4

Description, and unavailability values, of the minimal cut-sets identified for the top events analysed.

Table 5

Design matrix of the 23 DOE for the top event “undesired cooling velocity” during the freezing step and calculated unavailability at mission time (event A: fault of the compressor CP-02, event B: failure of the temperature controller; event C: blockage of the pneumatic valve).

Table 6

Design matrix of the 23DOE for the top event “undesired pressure profile” during the primary drying stage and calculated unavailability at mission time (event A: fault of the pressure controller, event B: blockage of the pneumatic valve, event C: failure of the pressure sensor).

Table 7

Effect of the uncertainty on the values of failure rates of the events A, B and C on the unavailability at mission time for the event “undesired cooling velocity” during the freezing step and for the event “undesired pressure profile” during the primary drying stage.


Page 26 18 of 42 33

Page 27 19 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


List of Figures

Figure 1

Sketch of the pilot-scale freeze-drier considered in this study. The points evidence the nodes considered in the study (see Table 1).

Figure 2

Sketch of the alarms and of the automatic protective systems of various pieces of equipment of the plant. A: pump P-01; B: condenser C-01; C: drying chamber; D: heater EH-01. The points evidence the nodes considered in the study (see Table 1).

Figure 3

Fault tree obtained for the top event “undesired cooling velocity” occurring during the freezing step of the freeze-drying process.

Figure 4

Fault tree obtained for the top event “undesired pressure profile” occurring during the primary drying stage of the freeze-drying process.

Figure 5

Fault tree obtained for the top event “undesired heating profile” occurring during the primary drying stage of the freeze-drying process.

Figure 6

Relative contribution of the primary events to the occurrence of the top events “undesired cooling velocity” during the freezing step (A), “undesired pressure profile” (B) and “undesired heating profile” (C) during the primary drying stage.

Figure 7

Graph A: Unavailability at mission time as a function of the failure rate of the compressor (event A), considering the maximum (■) and the minimum (□) failure rates for the events B and C. Graph B: Unavailability at mission time as a function of the failure rate of the pressure controller (event A), considering the maximum (■) and the minimum (□) failure rates for the events B and C.



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Page 28 20 of 42 33

Table 1

List of nodes considered for the various subsystems for the Recursive Operability Analysis.

Subsystem

1 drying chamber

2 condenser

3 refrigeration cycle

Node*

Position in the plant

1.1

Between the flowing pump P-01 and the evaporator EV-01

1.2

Between the evaporator EV-01 and the heater EH-01

1.3

Between chamber and the throttle V-01, on the pipeline

1.4

On the inlet line of nitrogen before valve V-03

1.5

Inside the chamber

2.1

Between the condenser C-01 and the evaporator EV-02, on the pipe entering the evaporator

2.2

Between the evaporator EV-02 and the condenser C-01 on the pipe entering the condenser

2.3

On the outlet line after the vacuum pump VP-01

2.4

Inside the condenser C-01

2.5

After the throttle V-01

3.1

Inside the evaporator EV-02

3.2

Inside the evaporator EV-01

3.3


3.4



Page 29 21 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Table 2

Values of the failure rates and of the probabilities of occurrence for the primary events determined using the Recursive Operability Analysis

-1

Failure rate, h

Primary Event

min 36

max

Circulation pump fault

-7

8.1·10

4.5·10-4

Compressor fault36

3.1·10-6

5.7·10-3

Vacuum pump fault37

-

2.0·10-5

Throttle failure-open37

1.0·10-6

3.0·10-5

Pneumatic valve failure-open38

4.2·10-6

4.2·10-5

Electrical heater fault39

1.9·10-6

1.1·10-5

Controller (TIC PIC FIC) fault36

2.4·10-6

2.6·10-4

-

2.9·10-5

8·10-7

2.8·10-6

1.1·10-6

2.4·10-6

9·10-7

2.3·10-6

Mechanical fault35

-

2.0·10-7

Gasket35

-

3.0·10-6-

PLC fault35 Flowmeter failure39 Pressure sensor failure39 Temperature sensor failure39

Probability of occurrence

Setting error40

4.00·10-4

Operator error40

3.10·10-3



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Page 30 22 of 42 33

Table 3

List of the top events identified for each step of the freeze�drying process, and corresponding values of the unavailability at mission time calculated with ASTRA�3) Stage Freezing

Primary Drying

Secondary Drying

Top Event Undesired freezing velocity

Mission time (h) 1500

Undesired heating profile

Unavailability at mission time (%) 14.91 0.18

4500 Undesired pressure profile

0.88

Undesired heating profile

0.12 1500

Undesired pressure profile


0.03

Page 31 23 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Table 4 Fault tree obtained for the top event “undesired pressure profile” occurring during the primary drying stage of the freeze�drying process.

Cut-set ID (order 1)

unavailabilit y (h-1) Undesired cooling velocity (freezing step) Events

DOE ID

1

Compressor (CP-02) fault

1.31·10-1

A

2

Controller failure (TIC)

6.88·10-3

B

-3

C

3

Actuators valve (V-09 and V-05)

1.30·10

Undesired pressure profile (primary drying stage) 1 2

Controller failure (PIC)

6.88·10-3

A

Actuators valve (V-03)

1.30·10

-3

B

1.70·10

-4

C

3

Pressure sensor failure (PI1)

1

Undesired heating profile (primary drying stage) Mechanical problem on circulation 8.99·10-4 system Setting error* 4.00·10-4*

2

*this is a probability value



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Page 32 24 of 42 33

Table 5 Design matrix of the 23 DOE for the top event â€œundesired cooling velocityâ€ during the freezing step and calculated unavailability at mission time (event A: fault of the compressor CP�9", event B: failure of the temperature controller; event C: blockage of the pneumatic valve). Unavailability at A B C ID mission time (%) – – – (1) 0.66 +

–

–

a

43.81

+

+

–

ab

46.63

–

+

–

b

5.65

–

+

+

bc

6.36

–

–

+

c

1.41

+

–

+

ac

44.23

+

+

+

abc

47.01


Page 33 25 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Table 6

Design matrix of the 23DOE for the top event “undesired pressure profile” during the primary drying stage and calculated unavailability at mission time (event A: fault of the pressure controller, event B: blockage of the pneumatic valve, event C: failure of the pressure sensor).

A

B

C

ID

–

–

–

(1)

Unavailability at mission time (%) 0.12

+

–

–

a

2.66

+

+

–

ab

3.03

–

+

–

b

0.51

–

+

+

bc

0.51

–

–

+

c

0.13

+

–

+

ac

2.67

+

+

+

abc

3.04



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Page 34 26 of 42 33

Table 7 Effect of the uncertainty on the values of failure rates of the events A, B and C on the unavailability at mission time for the event “undesired cooling velocity” during the freezing step and for the event “undesired pressure profile” during the primary drying stage.

Effect on the Unavailability at mission time

A

“undesired cooling velocity” during the freezing step 41.9

“undesired pressure profile” during the primary drying stage 2.5325

B

15.54

1.51

C

0.565

0.0075

AB

-1.085

-0.0075

AC

-0.165

0.0025

BC

-0.02

-0.0025

Event

ABC

9.15·10

-16

0.0025


Page 35 27 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Sketch of the pilot-scale freeze-drier considered in this study. The points evidence the nodes considered in the study (see Table 1). 297x200mm (96 x 96 DPI)



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Figure 2 Sketch of the alarms and of the automatic protective systems of various pieces of equipment of the plant. A: pump P-01; B: condenser C-01; C: drying chamber; D: heater EH-01. The points evidence the nodes considered in the study (see Table 1). 135x284mm (96 x 96 DPI)


Page 36 28 of 42 33

Page 37 29 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Figure 3 Sketch of the alarms and of the automatic protective systems of various pieces of equipment of the plant. A: pump P-01; B: condenser C-01; C: drying chamber; D: heater EH-01. The points evidence the nodes considered in the study (see Table 1). 394x308mm (96 x 96 DPI)



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Figure 4 Fault tree obtained for the top event “undesired pressure profile” occurring during the primary drying stage of the freeze-drying process. 457x356mm (96 x 96 DPI)


Page 38 30 of 42 33

Page 39 31 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Figure 5 Fault tree obtained for the top event “undesired heating profile” occurring during the primary drying stage of the freeze-drying process. 446x365mm (96 x 96 DPI)



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

Figure 6 Relative contribution of the primary events to the occurrence of the top events “undesired cooling velocity” during the freezing step (A), “undesired pressure profile” (B) and “undesired heating profile” (C) during the primary drying stage. 199x400mm (300 x 300 DPI)


Page 40 32 of 42 33

Page 41 33 of 42 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Figure 7 Graph A: Unavailability at mission time as a function of the failure rate of the compressor (event A), considering the maximum (■) and the minimum (□) failure rates for the events B and C. Graph B: Unavailability at mission time as a function of the failure rate of the pressure controller (event A), considering the maximum (■) and the minimum (□) failure rates for the events B and C. 199x249mm (300 x 300 DPI)


Page 1 of 33

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60


Graphical abstract 82x44mm (300 x 300 DPI)


Page 42 of 42

Reliability Assessment in a Freeze-Drying Process - American

Recommend Documents