DOI: 10.3303/CET25116025 Paper Received: 6 December 2024; Revised: 2 February 2025; Accepted: 2 April 2025 Please cite this article as: Lotti A., Maporti D., Baumgaertl M., Mocellin P., Pauletto G., 2025, Process Industry Undergoing Electrification: New Challenges in Functional Safety, Chemical Engineering Transactions, 116, 145-150 DOI:10.3303/CET25116025 CHEMICAL ENGINEERING TRANSACTIONS VOL. 116, 2025 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Bruno Fabiano, Valerio Cozzani Copyright © 2025, AIDIC Servizi S.r.l. ISBN 979-12-81206-18-2; ISSN 2283-9216 Process Industry Undergoing Electrification: New Challenges in Functional Safety Angela Lottia,b, Diego Maportia, Martin Baumgaertlb,c, Paolo Mocellina,d,*, Gianluca Paulettob,* b Università degli Studi di Padova, Dipartimento di Ingegneria Industriale. Via Marzolo 9, 35131, Padova, Italia b SYPOX, Department of Chemistry, Technical University of Munich, 88747 Garching, Germany c Technical University of Munich, Dept Chem, Catalysis Res Ctr, Lichtenbergstr 4, D-85747 Garching, Germany d Università degli Studi di Padova, Dipartimento Ingegneria Civile, Edile e Ambientale. Via Marzolo 9, 35131, Padova, Italia. paolo.mocellin@unipd.it, gianluca.pauletto@sypox.eu The process industry is transitioning from traditional fuel-fired equipment to electrically powered alternatives, particularly in syngas and hydrogen production, where electrified steam methane reforming (e-SMR) offers a cleaner, more energy-efficient solution. This shift reduces CO₂ emissions but introduces new safety challenges, particularly the need to de-energize high-power systems safely during emergencies. Historically, safety systems in SMR relied on mechanical devices like valves to manage hazards. In electrified systems, safely cutting off power is more complex, especially in high-current applications. Conventional approaches, such as using safety relays and contactors, create redundancy but lead to bulky, complex installations in large-scale systems. As part of the EReTech project, a 250 kW e-SMR was constructed, revealing similarities between the control systems of electric motors (inverters) and electrically heated reactors (thyristors). It was found that the Safe Torque Off (STO) function, commonly used in inverters, could provide a reliable and compact method for safely powering off thyristors. Implementing STO for e-SMR systems could significantly simplify installation while enhancing safety, making it a viable solution for large-scale electrification in the chemical industry. 1. Introduction The chemical industry plays a vital role in supplying essential materials and products but is also a major source of greenhouse gas emissions. In 2021, global CO₂ emissions from energy use and industrial processes rose by 6%, reaching 36.3 gigatons (Schneider Electric Blog, 2023). Electrification, powered by renewable energy, offers a potential solution to decarbonize the sector, especially as electricity costs are expected to fall below $45 MW h⁻¹ by 2030–2040. Currently, about 45% of industrial energy consumption comes from fuel combustion for heat, nearly half of which could be replaced by electricity using available technology (Roelofsen et al., 2020). High-temperature heat (400-1000 °C), essential for processes like steam methane reforming (SMR) and steam cracking, accounts for 16% of the fuel consumed for heat generation in industry (Maporti et al., 2022). Steam cracking alone represents about 8% of the chemical industry’s total energy use, while CO₂ emissions from SMR contribute approximately 1% to global greenhouse gas emissions. Despite the potential, electrification solutions for these processes are still under development, with ongoing efforts from industry and academia (Basf, 2021; Sypox GmbH, 2024; Wismann et al., 2019). 1.1 Electrified Steam Methane Reforming (e-SMR) Steam Methane Reforming (SMR) is the standard process for hydrogen and syngas production, requiring high- temperature heat (800–900°C) typically generated by fossil fuel-powered furnaces. For every kilogram of hydrogen produced, approximately 9 kilograms of CO₂ are emitted—50-65% from methane conversion and the rest from furnace combustion. The EReTech project, led by Sypox and involving 13 partners within Horizon 145 mailto:paolo.mocellin@unipd.it mailto:gianluca.pauletto@sypox.eu Europe, aims to replace fossil fuel-based heat in SMR by validating an electrically heated reactor. This reactor uses resistive heating wires embedded in a structured ceramic catalyst in direct contact with the reacting gases (Pauletto, 2021). The design offers several benefits over traditional SMR, such as: • High energy efficiency in electricity-to-heat conversion (up to 95%) compared to fireboxes (40-55%) (Sypox GmbH, 2024). • Ability to reach temperatures up to 1200°C at pressures over 50 bar, boosting feedstock conversion (Sypox GmbH, 2024). • A reactor volume reduced by two orders of magnitude, enabling modular, decentralized plants and lowering CAPEX for centralized production (Wismann et al., 2019). • A 30% reduction in CO₂ emissions compared to traditional SMR, with residual CO₂ in a concentrated stream allowing for up to 85% capture (Maporti et al., 2024). A key milestone is scaling the reactor’s capacity to 250 kW, with a pilot unit constructed within a biogas plant. Challenges arose during the design and procurement phases, especially in addressing safety concerns. Identifying applicable regulations, such as the Pressure Equipment and ATEX Directives, proved complex. A major safety measure identified in the HAZOP session was the need for rapid reactor de-energization, though safely cutting power to the high-current system remains unresolved. 1.2 Intrinsic Safety and Control Strategies in Fired SMR In conventional fired reforming, unplanned shutdowns can result from issues such as high stack temperatures, low process flow, fuel pressure fluctuations, or loss of combustion air. When a shutdown is triggered, the control system must safely shut down the reformer and related units. Key actions include cutting off fuel to the burners, isolating the process feed, and purging the system with steam or nitrogen, venting gases to a safe location (Aiga, 2012). Operators then diagnose the cause and either restart the plant or proceed with a full shutdown, which includes isolating fuel and feed flows and reducing flammable gas concentrations below 25% of the lower flammability limit through nitrogen purging (Eiga, 2020). During shutdown, automatic systems activate. In natural draft furnaces, dampers fully open to vent flammable gases. Shut-off valves engage when fuel pressure or flow is too low. Many gas-fired furnaces use a double block and bleed (DB&B) valve system, consisting of two isolation valves and one bleed valve. Upon emergency shutdown, the isolation valves close and the bleed valve opens to release trapped gas, which is typically flared (Aiga, 2012; Eiga, 2020). DB&B systems should be located close to the furnace to minimize fuel volume in the reformer post-shutdown. Fast-acting actuators are often required for larger fuel lines (≥ 100 mm). Emergency shutdown procedures for fired reformers are well-established, with safety interlocks designed to meet the Safety Integrity Level (SIL) of each component (IEC 61511-3, 2016). However, for electrified reformers, safety interlock systems and reliability assessments remain underdeveloped, and clear procedures have yet to be defined. 2. Methods The need to control an electrified reactor became apparent during the risk assessment phase of a pilot plant utilizing this new technology. As part of the EReTech project, a pilot plant for electrically heated steam methane reforming was built, using biogas as the feedstock. Located within an existing biogas facility, the decentralized plant operates with a capacity of 100 Nm³/h of biogas, powering a 250 kW electrically heated reformer. 2.1 Hazard Identification and Mitigation The HAZOP analysis of the pilot plant identified several hazardous scenarios. To prevent critical events, significant risk mitigation measures were implemented. These included protection layers with sufficiently low Probability of Failure on Demand (PFD) to ensure safety measures would function during emergencies. Low- risk scenarios were mitigated through inherent design or via the Basic Process Control System (BPCS), which handles process control during normal operations through control loops of sensors, logic, and actuators. For higher-risk scenarios, alarms and human intervention were required to achieve acceptable PFD levels. In cases where these protections were insufficient, a Safety Instrumented System (SIS) was introduced. The SIS, operating independently of the BPCS, activates during emergencies to bring the process to a safe state. It consists of multiple Safety Instrumented Functions (SIF), which must meet specific Safety Integrity Level (SIL) requirements, ranging from SIL1 to SIL4, as outlined in the IEC 61511 standard. Achieving the required SIL involves implementing reliable safety sensors, logic solvers, actuators, and ensuring proper loop architecture, monitoring, and maintenance (IEC 61511-3, 2016). Figure 1 illustrates the distinct roles of the BPCS and SIS, providing an example of their respective loops. 146 Figure 1: BPCS and SIS implementation example. 2.2 Impact of Electrification on Safety Solutions In the EReTech pilot plant, the HAZOP analysis highlighted pressure and temperature as the key variables contributing to critical risk scenarios. Overpressure risks were mitigated using the BPCS and mechanical devices, such as pressure safety valves (PSVs). However, high-temperature scenarios, where line failure could lead to the release of flammable gases, required BPCS-independent safety interlocks. These scenarios involved the electric heater and electrically heated reformer, necessitating a different approach compared to conventional gas-heated systems, presenting new challenges to safety management. To mitigate these risks, the heat source had to be safely disconnected, which was achieved through a conventional safety relay and dual-contactor configuration. This widely used method ensures reliable electrical disconnection in industrial settings. 2.3 Dual-Channel Safe Power Off Figure 2 illustrates the solution implemented for safe power disconnection using a dual-contactor system, where two contactors are connected in series with the power load. In the EReTech pilot plant, a thyristor was also included to control the power supplied to the electric heater. The safety loop consists of three main components: the sensor, control logic, and actuators. A thermostat served as the sensor, detecting faults such as overheating. This sensor is connected to a safety relay, which acts as the control logic of the interlock system. Safety relays are highly reliable components that continuously monitor critical signals, initiating safety actions when dangerous conditions arise. Upon detecting a hazard, the relay opens its output contacts, bringing the system to a safe state. With diagnostic capabilities and redundancy, safety relays ensure that even in the event of a failure, protective measures remain effective, minimizing accident risks. Figure 2: Dual-channel configuration of a safety interlock to power off an electric heater. Sensor (thermostat), Logic (safety Relay) and Actuators (two contactors in series). In the dual-contactor system, the safety relay’s outputs control two contactors located between the thyristor and the power load, acting as the loop's actuators. When the thermostat detects overheating, the safety relay triggers, causing both contactors to open simultaneously, cutting off power to the heater. The redundancy ensures that if one contactor fails, the other can still open the circuit, maintaining the safety function (IEC 62061, 147 2021). This dual-channel architecture provides a reliable fail-safe power disconnection, meeting the high availability and safety standards set by IEC 62061 for machinery safety. The system effectively met the HAZOP requirements, ensuring a safe state for the electrically heated reformer, differing from traditional fired heaters. 2.4 Safe Torque Off (STO) During the EReTech project, an alternative method for safely disconnecting power was identified: the Safe Torque Off (STO) function, commonly used in electric motors. Unlike the dual-contactor setup, STO does not rely on mechanical components. In electric motor applications, hazardous scenarios may require an immediate motor shutdown to mitigate risk. Traditionally, dual channel architecture has been used for this purpose, where two contactors cut off the power supply, as shown in Figure 3a. In this case, a three-phase motor was selected, requiring speed control, which is managed by a Variable Frequency Drive (VFD). The VFD is a device which allows for precise motor’s speed and torque control by varying the frequency and voltage of its power supply. Within the drive, the AC input is first converted and stabilized into DC and then reconverted into AC through an inverter. Indeed, a stable DC source can be manipulated more easily, enabling precise control over motor speed and torque. The inverter is composed of solid-state relays (SSRs), called transistors which allow power to flow only when they are triggered by an external voltage supply. These switches are controlled by a pulse-width modulation (PWM) technique that rapidly turns them on and off to create a synthesized AC waveform. By modulating the switching frequency, it is possible to control the average value of the resulting signal, so the motor speed is adjusted. The quick response of the transistor allows for the immediate stopping of alternating current when the external power supply is disconnected. This fast action was crucial for the implementation of the safety feature called Safe Torque Off (STO) in VFDs. Over time, the Safe Torque Off (STO) function has emerged as a more compact solution to the traditional dual- channel architecture, as shown in Figure 3b. In the event of a fault, the STO function disables the ability of the drive to generate torque without physically cutting the power, providing a faster and more compact method for ensuring motor safety. Figure 3: (a) Dual-channel configuration of a safety interlock to stop an electric motor. Sensor (Thermostat), Logic (Safety Relay) and Actuators (two contactors in series). (b) STO function implemented in a VFD to safely stop an electric motor. Sensor (Thermostat), Logic (Safety Relay) and Actuator (VFD with STO). To ensure reliable detection and monitoring, the fault signal must come from a high-availability system, such as a safety relay. The safety relay's output is connected to the STO input, which enables the drive. When this input is active (i.e., no fault), the motor produces torque. In the event of a fault, the enable signal is disconnected, and the motor stops rotating. Upon disconnection of the STO signal, the switching signals to the transistors are also interrupted, preventing the generation of the alternating current and the creation of a magnetic field (Control Techniques, 2020). Consequently, even in worst-case scenarios, such as unintended conduction through the transistors, only a temporary direct current would flow to the motor, insufficient to generate torque. As a result, the STO function ensures an inherently fail-safe drive by eliminating the possibility of torque generation, maintaining the safety integrity of the system. a) b) 148 3. Results Integration of STO Logic to High-Power Resistive Loads: SFO (Safe Fire Off) Both the dual-contactor system and the STO function serve the same purpose—safely cutting off power to prevent unintended operation. However, unlike the dual-contactor system, STO avoids mechanical components, eliminating the risk of failures such as contact welding. This provides an equivalent level of safety without relying on redundancy, significantly reducing installation footprint. Avoiding additional contactors is particularly beneficial in large-scale systems, where megawatt-level power demands increase the size and complexity of contactors, leading to greater space requirements, maintenance challenges, and intricate wiring. As a result, conventional methods become impractical for large applications. Therefore, the feasibility of using STO-like logic for safely de-energizing high-power resistive loads was explored. It was found that no existing market solution currently offers a safety function for de-energizing high-power resistive loads. This concept, termed "Safe Fire Off" (SFO), could be applied to electric heaters or electrically heated reactors. A potential configuration is shown in Figure 4, following the same logic as STO (Figure 3b), but adapted to resistive loads. Figure 4: Potential configuration of a SFO function implemented in a thyristor to power off a high-voltage resistive load. Sensor (thermostat), Logic (safety Relay) and Actuator (Thyristor with SFO). Not yet in the market. Thyristor power control involves the use of thyristors, solid state relays that conduct current only when externally triggered and remain on until the current drops to zero. Unlike transistors, which can be turned off instantly, thyristors are better suited for high-power applications but require more complex control due to their inability to turn off immediately. Although there are specific thyristor configurations that allow for an off capability, their implementation can be complex, posing an additional challenge when integrating them into SFO systems. However, implementing the SFO function to safely disconnect power from high-voltage loads offers several advantages in the evolving industry of electrically heated equipment, including: • faster response time: enables quick deactivation of loads in emergency situations, enhancing safety; • reduced footprint: minimizes space requirements for installation, facilitating integration; • increased reliability and lifespan: solid state relays have a lifespan up to 100 times longer than electromechanical relays due to the absence of moving mechanical parts (Finder, 2021); • versatility: suitable for a wide range of high-power resistive loads. Despite these benefits, there are two main challenges related to the application of the SFO system. The first is technical, due to the intrinsic design of the thyristor, which makes it difficult to avoid residual current and prevent unintentional reactivation. The second challenge is regulatory, concerning functional safety certification. The STO function is certified according to IEC 61800-5-2, which defines safe disconnection for motor applications. However, there are currently no specific directives for safely disconnecting non-rotating loads. This means new certification procedures must be developed to ensure the safety and compliance of SFO systems in high-power resistive load applications. 4. Conclusions The EReTech project highlighted the need to rethink safety measures as the process industry transitions toward electrification. Shifting from traditional fuel-powered equipment to electric alternatives, such as electrically heated reformers, introduces new risks specific to electrically powered systems. Electrical faults, like overheating, pose hazardous scenarios that must be managed through effective power isolation mechanisms. 149 While safety relays and dual-contactor systems provide essential safeguards, they often result in complex configurations, especially in high-power applications, where traditional methods may become inefficient. The project also identified similarities between the control systems of electric motors and electrically heated reactors, such as thyristor power controllers. Implementing methods like the Safe Torque Off (STO) function could enhance safety and simplify the setup for large-scale electrified SMR systems. Given the identified gaps in safety management for high-power loads, future research should prioritize developing robust systems that integrate advanced controls with effective safety protocols. This will ensure that electrified systems operate safely and efficiently, addressing the needs of an evolving industrial landscape. Nomenclature AC - Alternating Current CAPEX - Capital Expenditures DB&B - Double Block and Bleed DC - Direct Current e-SMR - Electrified Steam Methane Reforming HAZOP - Hazard and Operability Analysis PSV - Pressure Safety Valves PWM - Pulse Width Modulation SMR - Steam Methane Reforming SFO - Safe Fire Off SIS - Safety Instrumented System SIF - Safety Instrumented Functions SIL - Safety Integrity Level SSR - Solid-State Relay STO - Safe Torque Off VFD - Variable Frequency Drive Acknowledgements This research was performed within the EReTech project, which was conducted with the financial support of the European Union's Horizon Europe Research and Innovation Program under grant agreement No 101058608. References Aiga. (2012). combustion safety for steam reformer operation. Basf. (2021, March 24). Basf, Sabic and Linde join forces to realize the world first’s eletrically heated steam cracker furnace. www.basf.com Eiga. (2020). safe start up and shut down practices for steam reformers doc 185/20 safe start up and shut down practices for steam feformers. www.eiga.eu Finder (2021). Is a solid state relay right for you? Available at: https://www.findernet.com/en/uk/news/is-a-solid- state-relay-right-for-you/ (Accessed: 24 October 2024). Wismann, S. T., Engbaek, J. S., Vendelbo, S. B., Bendixen, F. B., Eriksen, W. L., Aasberg-Petersen, K., Frandsen, C., Chorkendorff, I., & Mortensen, P. M. (2019). Electrified methane reforming: A compact approach to greener industrial hydrogen production. Science, 364, 756–759. https://www.science.org From, T. N., Partoon, B., Rautenbach, M., Østberg, M., Bentien, A., Aasberg-Petersen, K., & Mortensen, P. M. (2024). Electrified steam methane reforming of biogas for sustainable syngas manufacturing and next- generation of plant design: A pilot plant study. Chemical Engineering Journal, 479. https://doi.org/10.1016/j.cej.2023.147205 GM International. (2024). Why use a safety relay. https://news.gminternational.com/why-use-a-safety-relay IEC 61800-5-2:2016, Adjustable speed electrical power drive systems - Part 5-2: Safety requirements – Functional (2017) IEC 61511-3:2016, Functional Safety — Safety Instrumented Systems for the Process Industry Sector — Part 3: Guidance for the Determination of the Required Safety Integrity Levels (2024). IEC 62061:2021+A1-Safety of Machinery - Functional Safety of Safety-Related Control Systems (2021). Maporti, D., Nardi, R., Guffanti, S., Vianello, C., Mocellin, P., Pauletto, G. (2022). Techno-economic Analysis of Electrified Biogas Reforming. Chemical Engineering Transactions, 96, 163-168. Maporti, D., Guffanti, S., Galli, F., Mocellin, P., & Pauletto, G. (2024). Towards sustainable hydrogen production: Integrating electrified and convective steam reformer with carbon capture and storage. Chemical Engineering Journal, 499. https://doi.org/10.1016/j.cej.2024.156357 Pauletto, G. (2021). A reactor with an eletricaaly heated stuctured ceramic catalyst (Patent EP3895795 A1). Roelofsen, O., Somers, K., Speelman, E., & Witteveen, M. (2020). Plugging in: What electrification can do for industry. Control Tecniques. (2020). Safe torque off a guide to the application of the control techniques safe torque off safety function and its compliance with iec 61800-5-2. Schneider Electric Blog. (2023). Process electrification in the chemical industry. https://blog.se.com/energy- management-energy-efficiency/2023/08/15/process-electrification-in-the-chemical-industry/ Sypox GmbH. (2024). Get to know the first technology able to electrify the chemical industry. https://sypox.eu/technology/ 150 http://www.basf.com/ http://www.eiga.eu/ https://www.science.org/ https://news.gminternational.com/why-use-a-safety-relay https://sypox.eu/technology/ 27lotti.pdf Process Industry Undergoing Electrification: New Challenges in Functional Safety