Coker drum safety for crude oil refineries

Coker Drum Safety System prevents unsafe actions by coker drum operators.
The SIS-TECH Coker Drum Safety System (CDSS) automatically inhibits the opening of valves under unsafe process conditions. In a crude oil refinery, this prevents the release of hydrocarbons and/or hydrogen sulfide to the atmosphere, or introduction of hydrocarbons to an open drum. The CDSS logic solver makes sure that an in-service drum is not opened to the atmosphere, or that an open drum is not placed in service.

Understanding the Problem
OSHA (US Department of Occupational Safety & Health) says, in Hazards of Delayed Coker Unit (DCU) Operations, “The batch portion of DCU drum switching and coke cutting operations creates unique hazards, resulting in frequent and serious accidents.” The specific hazardous operating states are listed as coker drum switching, coker drum removal, and coke cutting (hydroblasting) operations.

Each DCU has at least two coker drums, and an operator is responsible for manually lining up the coker drums and valves. Although operator procedures and training emphasize the importance of correct line-up and the hazards of deviating from approved procedures, accidents often occur. Failure to open or close valves in the correct sequence can result in the release of hot hydrocarbons and/or hydrogen sulfide gas, and can also cause a fire.

Improper line-up of coker drums has led to several serious accidents, including fatalities. Because valve line-up is manually executed, operator error is one of the leading causes of these accidents.

Total Automation Solutions (TAS), recently installed a CDSS system at a major refinery. “The use of the CDSS in conjunction with the TAS Coker Interlock System eliminated the need to install a safety programmable logic controller (PLC),” said J.R. Thompson, senior vice president at TAS. “The installation was simple and straightforward, requiring only that we clearly defined the conditions under which certain valves could be opened or closed.”

Thompson has been working with refineries and coking systems for years, and he appreciates the safety and simplicity of the CDSS. “Without a CDSS, we would have to engineer, design and program a separate safety PLC system. This is a significantly more costly solution, and requires that the refinery have staff available to support the safety PLC.”
Monitoring Operator Actions
The SIS-TECH CDSS is a safety instrumented system independent of the TAS Coker Interlock System and other plant control systems. The CDSS monitors process conditions to prevent operations from opening the wrong valve or performing operations on the wrong drum. The CDSS provides a totally independent logic solver coupled with independent process sensors to provide a stand-alone layer of protection for the coker drum.

For each Coker Drum, the CDSS monitors three process variables: overhead pressure, overhead temperature and inlet temperature. It verifies safe conditions before allowing the TAS Coker Interlock System operator to open the vent, drain, top/bottom head, blowdown, overhead to fractionator, or inlet feed valves.

The CDSS logic solver monitors process variables to detect unsafe conditions. It then removes the permissive to operate the affected valves and sounds an alarm, thus preventing the valve from opening at the wrong time.

The CDSS is suitable for use up to SIL-3. The number of inputs and voting architecture (1oo1. 1oo2, 2oo2 or 2oo3) can be adjusted for each process variable to meet any SIL or reliability requirement. The CDSS is rated for -30 to 75C operation, meets Class I Div II requirements, and can be installed in harsh refinery environment near the equipment under control.

Field installation and implementation of the CDSS logic solver costs less than half that of a safety PLC. In addition, on-going support costs are much lower as the CDSS is much simpler to maintain than a safety PLC.

Overfill protection

The system protects refineries, tank farms and process plants from dangerous overfill conditions

SIS-TECH has announced the Automated Overfill Protection System (AOPS), a safety instrumented system (SIS) that can prevent dangerous overfill conditions in terminals, tank farms and process vessels.

The AOPS incorporates a non-programmable Logic Solver (suitable up to SIL-3) that receives signals from switches or transmitters, determines if an abnormal process condition is present, and provides outputs to close isolation valves, shut down transfer pumps, or open diversion valves. The system operates independently of the plant’s process control system with the capability to communicate to the control system via hardwire, Modbus, Ethernet or wireless communications.

The AOPS prevents overfill conditions that can result in vessel damage and release of hazardous chemicals to the environment. It can also be configured to prevent underfill conditions. Underfill conditions can cause loss of suction to transfer pumps with the potential for pump damage, or cause significant hazards when a floating roof tank is used and level is too low.

Why is Level Control so Difficult?
Level seems simple to monitor, but it’s often just one of many process variables on an HMI display. Compounding the problem, incorrect level often doesn’t affect unit operation or cause any other significant process variable disturbance until the safe fill level is exceeded.

In many processes, level doesn’t have direct significance to plant production or product quality, and absolute level often varies over a large range around what is considered normal. In tank farms, the operating level is simply inventory to be managed and normally varies across a large range.

High level is often an indirect hazard, with the direct hazard being too much mass or volume. Some overfills challenge the tank or vessel, causing it to overpressure or to collapse when the retained mass exceeds the equipment structural design limits. Many overfills occur because of loss of containment when liquid passes to downstream equipment that is not designed to receive it.

The key problem is that, even though a tank may be approaching a dangerous overfill condition, the steadily increasing level does not cause any process upsets or other alarm conditions. This makes it very difficult for an operator to be aware of the dangerously approaching condition and, more importantly, the operator may not immediately know what to do to correct the situation.

For example, hazards may occur when operators take manual actions in response to high level, such as draining knock-out drums. Planned operator procedures must provide sufficient time for the operator to take action and provide a means to verify the process response. Further, there should be time to evacuate the area if the action doesn’t work as expected. In some cases, if the operator does not respond quickly enough or isn’t completely familiar with the manual procedures, a disaster can occur.

Three Billion-Dollar Disasters
Loss of level control has been a contributing cause in three significant industrial incidents:

• The Esso Longford explosion (September 25, 1998) in Australia resulted in 2 fatalities, 8 injuries, and A$1.3 billion in losses.
  
• The BP Texas City explosion (March 23, 2005) in the United States caused 15 fatalities and more than 170 injuries. Facility production was profoundly affected for months after the incident. Losses to BP were in excess of $1.6 billion.
  
• The Buncefield explosion (December 11, 2005) in the England, injured 43 people and devastated the Hertfordshire Oil Storage Terminal, The economic impact on regional businesses was estimated to be in the range of ₤130–170 million, and estimated total losses were ₤1 billion.

These incidents involve three different industries located in three different countries. Each incident propagated uniquely, arriving at its final outcome through different mechanisms. Yet, all suffered the same process deviation of high level, and all resulted in devastating consequences.

Automated Response is the Best Answer
Automated trips ensure protection even when the operator is focused on other duties. A SIS, such as the AOPS, can detect high level and prevent filling beyond the safe fill limit. The system uses independent sensors such as a switch or transmitter to detect high level, and independent final elements such as a motor control circuit or block valve to divert or terminate feed. The SIS trip action is automatically initiated at a setpoint that allows sufficient time for the action to be completed safely. Risk analysis determines the safety integrity level (SIL), typically SIL-1 or SIL-2, required to ensure that the overfill risk is adequately addressed.

The AOPS is a low-cost, stand-alone, independent, non-PE logic solver suitable for use up to SIL 3. Rated for –30C to +75C and constructed using Class I Div 2 components, the AOPS can be installed in the harshest process units near the tank. Further, the number of inputs and voting architecture (1oo1, 1oo2, 2oo2 or 2oo3), can be adjusted for each process variable to meet any SIL or reliability requirement.

The AOPS is flexible and can be customized for any specific level application. For the ultimate in remote, stand-alone installation—solar power provides SIL protection without the need for utilities, while wireless communication sends system status to centralized control rooms. As compared to safety PLCs, total lifecycle costs are 50% less

Safety in process

Overpressure protection for reactors, pipelines and pressure vessels.

The DIAMOND-SIS High Integrity Protective System, from SIS-Tech, is a low-cost standalone logic solver certified for use in applications up to Safety Integrity Level (SIL) 3. It is used to provide overpressure protection for scenarios where the opening of the pressure relief valve poses unacceptable process safety risks.

API 521 and Code Case 2211 of ASME Section VIII, Division 1 and 2 allow the use of a High Integrity Protective System (HIPS), such as this one, in lieu of a pressure relief device as long as the instrumented system meets or exceeds the protection provided by the pressure relief device. To achieve this performance, the HIPS design and management must also follow IEC 61511 and the logic solver should be compliant with IEC 61508 SIL 3. The DIAMOND-SIS HIPS complies with these requirements.

It is an SIL 3 logic solver with 2oo3 voting, which provides the end user with a fault tolerant logic solver that it is physically and functionally independent from the process control and unit safety instrumented system. With the Diamond-SIS HIPS, each vessel or pipeline is independently protected against overpressure such that no single HIPS failure results in simultaneous overpressure of multiple vessels or pipelines. By using an independent logic solver for each HIPS, the potential for common cause failure impacting multiple process units is significantly reduced.

In a typical installation, it takes inputs from multiple sensors that can detect abnormal process operating conditions. The logic solver processes the inputs and sends the necessary outputs to final elements such as block valves or pumps.

The unit is rated for –30°C to +75°C and suitable for installation in Class I Div II environments, allowing it to be installed in the field near the process equipment. This reduces the implementation costs typically associated with systems using cabinet-mounted safety PLCs.

The DIAMOND-SIS HIPS is used in many overpressure protection system applications, such as wellhead piping protection, where electric submersible pumps (ESP) are installed for enhanced oil recovery. In these applications, the unintended block-in of the ESP initiates a scenario where the maximum discharge pressure from the pump exceeds the maximum allowable working pressure of the downstream piping, potentially rupturing the pipeline.

Traditional overpressure protection with a pressure relief valve results in a discharge that cannot be effectively managed. Instead, it is used to detect high pressure and to shutdown the ESP, preventing pipeline overpressure.

HIPS are now accepted for vessel protection with the latest release of API 521 and with the recent update to the ASME pressure vessel code. The Minerals Management Service has approved HIPS as a new technology application for off-shore installations in the Gulf of Mexico.

Papers describing various HIPS applications can be downloaded from www.sis-tech.com.

Automated independent backup system

SIS-TECH now has the DIAMOND-SIS automated independent backup (AIB), a low-cost, standalone safety instrumented system (SIS) that backs up current process control trip logic and meets the requirements of IEC 61511. The system includes an IEC 61508 logic solver that is functionally independent from the process control system, supplements existing logic, and meets all appropriate safety standards.

This system provides high integrity and process reliability. It is available in single, dual, and triplicated channel configurations with on-line diagnostics, testing, and maintenance capabilities. The single and dual channel systems are acceptable for SIL 2, while the triplicated channel system is certified by Factory Mutual to SIL 3. This means that it can meet the fault tolerance and PFavg requirements of any application.

With its 5A output rating, the system can de-energize multiple final elements including motor control circuits and/or solenoid operated valves. Local or remote manual reset ensures controlled process re-start after shutdown.

It is particularly useful with legacy control systems that do not meet current SIS standards. Typically, during the early days of digital control, users implemented safety logic within their process control systems. Today, they do not want to impose SIS requirements or management restrictions within the existing systems.

Instead, they need an independent backup safety logic system that connects easily to existing plant equipment, meets all safety standards and requirements, and requires no reprogramming of process logic since it fulfills all of those requirements.

Easier to install and maintain than a Safety PLC
A single channel DIAMOND-SIS AIB system includes a pre-mounted and wired DIN-rail signal isolator, a Model 340 logic solver, a fuse block, and five terminals ready to accept existing wiring. All components are rated for -30 to 75 degrees C and Class I Div II operation, and meet the mechanical integrity requirements of IEC 61511.

The system can typically be mounted in an existing DCS marshalling cabinet, and the user wires the logic solver contacts in series with the DCS contacts. The logic solver then independently backs up the trip functionality of the DCS.

Each DIAMOND-SIS logic solver module can accept virtually any analog input. Its two field adjustable trip points allow the process to be shut down on high and/or low process variables, or to detect an out of range signal fault. The number of inputs and the voting architecture—such as 1oo1, 1oo2, 2oo2 or 2oo3—can be adjusted to meet performance requirements. The process shut-down signal from the logic solver can be sent to both the DCS, and directly to a shut-down device such as a relay or solenoid.

The installation does not require any reprogramming of the existing DCS. In addition, the installation cost of a system is 80% less than that of an equivalent Safety PLC with the same number of loops. Maintenance costs are also greatly reduced as it’s not necessary to purchase, implement and renew programming software.

The Safety Requirements Specification, including Safety Integrity Level (SIL) verification documentation, can be supplied as an option. This makes the DIAMOND-SIS AIB the perfect packaged solution to address low I/O SIS needs, and the low cost alternative to safety PLCs.