No replies to this topic

[VeryProfessionalEngineer]

Hi All,

 

I am working on a project where we are upgrading the safety instrumented systems of our downstream assets to comply with ISA 84 and meet the needs of the plant layers of protection analyses. One of the risks identified was an overpressure of the suction side of a high pressure pump upon a sudden pump trip, for which we need to identify multiple SIL rated protection layers. This is of particular concern for hydroprocessing plant reactor feed pumps, where high pressure hydrogen could very quickly backflow from a mix point downstream of the feed pump discharge. The pressure downstream would still be maintained due to the process inventory of the reactors and the recycle gas compressor.

 

We have allowed multiple check valves to be credited to reduce the amount of backflow to an internally defined leakage rate, which allows us to credit a PSV on the suction of the pump sized for the anticipated leakage rate. However, we do not credit the check valves on their own, leaving us short of one protection layer.

 

The industry standard for an additional safeguard in this case appears to be a low-flow interlock to a quick-closing valve on the discharge line. The problem is that it has been difficult to develop a reasonable method for defining how quickly this valve must close. On one hand, using our current criteria of 1 or 2 seconds of closure time has been criticized as prohibitively conservative for these designs, which typically have an 8 or 10", 1500# (or greater) pipe class line. The last actuator we designed under this criteria was about 4' ID by 12' length, perched atop an 8" line. On the other side, I can't really say whether 1 or 2 seconds is even fast enough, depending on a few plant details and basic assumptions. Below are the two criteria that appear to have the most impact.

 

1. Many of these pumps lack of a dedicated feed surge drum for the pump, and instead take their feed directly from a booster pump upstream that routes feed from another section of the refinery or through some other equipment. The booster pump upstream is equipped with a check valve, which means that in the event of a trip of the reactor feed pump, the entire suction line is liquid packed and open to the full pressure of the reactor (assume some failure or leakage of the check valve). In this case I would imagine the suction piping would be shown to overpressure nearly immediately regardless of whatever method we employed, and any calculation I did would tell me I needed a valve that closed in some completely impractical amount of time (<<1 second).
2. For pumps that have open suction lines to a feed surge drum, there is an argument that restrictions in the discharge piping could absorb the pressure drop as liquid backflowed against it, at least until the hydrogen backflows to the suction side. Using this methodology it is relatively straightforward to calculate the required valve response time using piping details and the volume of liquid between the pump and hydrogen mix point. However, I have found this to be highly dependent on the treatment of the check valves. The problem here is that we have already taken credit for the check valves as part of an independent safeguard (the PSV's on the suction side of the pump), and people are generally wary of taking check valve credit due to prior experiences of check valve failure. If no credit is taken for the check valve in the line (i.e.- it is treated as failed open), then the hydrogen blows through to the suction side in <<1 second, at which point the pressure will spike almost immediately.

Does anyone have any experience with the specification of Process Safety Time for this scenario? I have considered commissioning a dynamic model of our process, but confirmed with the group that would assist in this work that it wouldn't be able to give us a useful answer due to the issues above. I have also considered that perhaps the pump would take some time to "wind down" and the momentum of the fluid would require time for the flow to reverse, but not only would this seem difficult to quantify, the idea would be at odds with field observations that the field flow indication drops to 0 essentially immediately following a pump trip/shutdown.

 

Any ideas, prior history, rules of thumb, or leads to any applicable industry best practices would be appreciated. For the record, I have scoured ISA 84, API 521, API 581, API 598, API 610, API 615, API 598, our internal experts, our design contractor's experts, and Google trying to find something to point me in the right direction.