*Appendix A.1. Two-Level Formulation*

The two-level formulation approximates the solution of the KKT-formulation and may be impractical for large industrial applications since an iterative scheme is involved. The main idea of the two-level formulation is to decompose the max-min problem ((6) in Section 2.2) into two subproblems, which can be solved separately in an iterative procedure. The two subproblems are:


At iteration k, in the lower (control-design) level problem, the solution of the minimization problem (min x,z,d C(x, z, d, θ)) is approximated for fixed values of the uncertain parameters (obtained from upper (uncertainty) level problem in iteration k-1). In the upper (uncertainty) level problem, the solution of the maximization problem (max di <sup>θ</sup> ) is approximated by fixing the control variables to the values obtained by the lower (control-design) level problem while the uncertain parameters are relaxed to continuous variables within their respective bounds. The iteration procedure is stopped if the values obtained for the design variable di at the lower and upper level problem are within a previously defined range. By means of the two-level formulation, the operating point in the uncertainty span is obtained at which the maximum value for the design variable di is achieved while the cost function C(x, z, d, θ) is minimized (i.e., a potential critical point). For further details concerning the iterative procedure, see [44].

The iterative scheme can be tedious for large-scale industrial problems with many design variables, control variables, and uncertain parameters. To overcome this problem, the iterative scheme was automated as part of this study (see Supplementary Material). In this automation, the lower (control-design) level problem was solved using BARON and the upper (uncertainty) level problem was solved using the GAMS interface of CONOPT or IPOPT to obtain marginal values. In order to apply the two-level formulation, control variables need to be determined. Industrial systems may be complex and very interconnected, which results in many different and complex control strategies.

A mathematical analysis of the model equations (hi with i ∈ I) of the design proposals, which form the reduced superstructure of the illustrative example, revealed that the proposals demand either two (proposals 3 and 4) or three control variables (proposals 1, 2, and MER). This allows different combinations of control variables and it is worth mentioning that the obtained sets of critical points were not equivalent with respect to the solution of the final design problem. This will be explained at the example of design proposal 3. If the control variables are limited to the duties of the utility exchangers (Q3, Q4, and Q5 in Figure 3), three control variable combinations are possible. When using these different combinations to obtain the critical points through the two-level formulation and the set covering algorithm described in [44], different sets of critical points were obtained. These different sets, the TAC of the designs based on the different sets, and the corresponding flexibility index are shown in Table A1. As can be seen in Table A1, with only one of the tested control variable combinations, it was possible to achieve a feasible design.


**Table A1.** Results of the two-level formulation for design proposal 3.

It was identified that in order to be applicable to HEN retrofitting problems, including the possibility to increase the size of existing HEX units, the lower (control-design) level problem of iteration k (A1) of the two-level formulation (compare [44]) needs to be modified. For a selected design variable di, the lower (control-design) problem is relaxed the following way:

$$\begin{array}{l} \min\_{\mathbf{x}, \mathbf{d}, \mathbf{d}} \mathsf{C} \left( \mathbf{x}, \mathbf{z}, \mathbf{d}, \theta^{k-1} \right) \\ \text{s.t.} \\ \text{s.t.} \\ \mathsf{h}\_{\mathrm{i}} \{ \mathbf{x}, \mathbf{z}, \mathbf{d}, \theta^{k-1} \} = 0; \mathsf{i} \in \mathsf{I} \\ \mathsf{g}\_{\mathrm{j}} \{ \mathbf{x}, \mathbf{z}, \mathbf{d}, \theta^{k-1} \} \le 0; \mathsf{j} \in \mathsf{J} \\ \mathsf{g}\_{\mathrm{d}} \{ \mathbf{x}, \mathbf{z}, \theta \} - \left( \mathsf{d}\_{\mathrm{e} \mathrm{c} \mathrm{s} \mathrm{s} \mathrm{f}, \mathbf{d}} + \mathsf{d} \right) \le 0; \ \mathsf{d} \in \mathsf{D} \mathsf{V} \\ \mathsf{g}\_{\mathrm{d}, \mathrm{i}} (\mathbf{x}, \mathbf{z}, \theta) - \left( \mathsf{d}\_{\mathrm{i} \mathrm{c} \mathrm{s} \mathrm{i} \mathrm{s} \mathrm{f}, \mathbf{d} \right) = 0; \mathsf{d}\_{\mathrm{i}} \in \mathsf{D} \mathsf{V} \\ \mathsf{x}, \mathbf{z}, \mathsf{d} \in \mathsf{R}, \ \mathsf{d} \ge 0. \end{array} \tag{A1}$$

Physically, this reformulation implies that existing HEX units can be bypassed, which may be necessary to ensure the feasibility of the lower (control-design) level problem for given values of the uncertain parameters (obtained by the upper (uncertainty) level problem of the previous iteration).

As mentioned previously, the two-level formulation approximates the solution of the KKT-formulation, which would explain discrepancies between the sets of critical points identified with the two-level and the KKT-formulation. However, to the authors' knowledge, the influence of differently chosen control variables on the sets of critical points (and thereby on the flexibility index of the corresponding design) when applying the two-level formulation was not yet reported in the literature. It is worth mentioning that similar observations were made for proposal 4, although the values for the TAC and the flexibility index were different compared to Table A1.

Furthermore, it was observed that with more complex network structures, additional difficulties may occur if the two-level formulation is applied. This will be explained at the example of proposal 1. In the case of proposal 1, three control variables need to be defined, which are fixed when solving the upper (uncertainty) level problem. Again, different combinations were tested, and the flexibility indices of the derived designs were calculated (see Table A2). For explanation of the variable names of the control variables, refer to Figure A1 in Appendix B. As can be seen from the flexibility indices in Table A2, with none of the tested combinations of control variables, a feasible design could be derived. It is worth mentioning that depending on the choice of the control variables, convergence between the lower (control-design) level problem and the upper (uncertainty) level problem could not be achieved for at least some of the design variables of proposal 1. Similar observations were made when the two-level formulation was used to identify the sets of critical points for proposals 2 and MER.



These observations could have several explanations: Another, not tested, combination of control variables must be chosen, the calculation of the marginal values of GAMS is not sufficiently accurate, the set covering algorithm is not globally valid, or the approximative character of the solution of the two-level formulation is too strong. When analyzing the complete set of critical points of proposal 1, which is shown in Table A5 in Appendix B, it was found that the actual critical point is [240.0, 190.0, 19.0, 120.0, 10.0, 20.0, 20.8, 32.0] (i.e., this point is sufficient to derive a feasible design for proposal 1). An indication for a not valid set covering algorithm would be if this critical point can be found as a combination of one of the above presented points, i.e., if a "0" element in one of the points could be replaced with another value to achieve the critical point. This, however, is not possible. This is not proof that the set covering algorithm is globally valid. It indicates, however, that in the case of proposal 1, the set covering algorithm is not responsible for missing the critical point and one of the other above listed reasons must be responsible. Future work should focus on identifying strategies or guidelines for the application of the two-level formulation to HENs.

As mentioned previously, the difficulties experienced with the two-level formulation are not reported in the literature. These difficulties did not appear when the results reported in the literature (application of two-level formulation to the HEN example; see [44]) were reproduced. It was assumed that the experienced difficulties are related to structural differences. Compared to the structure of the HEN example in the literature, the structure of the examples presented in Section 4 differs. In the literature example, the respective HEN consists of more streams (seven) while the number of process-to-process HEX (four) is similar to (some of) the presented examples in Section 4. Consequently, it was observed that the distribution of HEXs is different in the literature example. For example, in the literature example, only one process stream is connected to two process-to-process HEXs while all other streams are connected to one process-to-process HEX, only. Additionally, the literature example demands only one control variable. Therefore, it can be assumed that the control structure of the literature example is simpler as the HEN itself is less interconnected compared to the HEN examples in this study. A preliminary conclusion drawn from this is that with increasing structural complexity of the HEN of interest, the risk for failure of the two-level formulation increases. Possible assessment criteria for the structural complexity of a HEN are:


It this context, it is worth mentioning that it was possible to derive the complete set of critical points by means of the two-level formulation for the structurally less complex design proposals 3 and 4 while it was not possible for the more complex design proposals 1, 2, and MER.
