MODULE III - PROCESS DESIGN

MODULE III - PROCESS DESIGN

In approaching the design of a flare system, process engineers should make reference to the methodology/guidelines described in the API Standard 521, Pressure-relieving and Depressuring Systems (5th Edition, January 2007), which is equivalent to ISO 23251. The standard contains very precise indications about the determination of individual relieving rates, definition of the system load, selection of disposal systems, as well as design criteria for the individual components of the disposal systems (e.g. flare headers, knockout drums, seal drums, etc.). In particular, in its latest edition, API STD 521 mentions two methods that allow the designer to evaluate the system design load with more accuracy than with traditional approach: dynamic simulation and combined probability analysis of installed HIPS (high-integrity protection systems). Since these techniques are relatively new, the attached paper gives an overview of both of them and illustrates the results of the application of the two techniques in some recent Projects developed by Foster Wheeler Italiana.

MODULE III – PROCESS DESIGN C.Gilardi – FOSTER WHEELER ITALIANA

March 2011

DYNAMIC SIMULATION, HIPS & COMBINED PROBABILITY ANALYSIS REDUCE FLARE LOADS Ingg. Chiara Gilardi, Mariateresa Tonello – FOSTER WHEELER ITALIANA

1.

Summary

The capacity of the existing flare system can represent a bottleneck in refinery expansion projects, which entail an increase of plants capacity and/or addition of new process units. As a consequence, the capital expenditure to revamp the flare system could penalize the economics of the overall project. On the other hand, it has been widely experienced that the relief loads calculated on the basis of a traditional approach (i.e. the API standards) are generally overestimated. The conventional methods for calculating the relief loads from the individual sources and combining them to determine the total release to flare are in fact based on a number of assumptions that allow a simple and conservative approach to the problem, but usually lead to overdesign the flare system. In a revamping project, the identification of the margins available can represent a viable solution to accommodate the extra loads from new/revamped plants without compromising the safety. Dynamic simulation, HIPS addition with combined probability analysis have been experienced as powerful tools to produce a system model that predicts more accurately the relief loads to flare compared to static shortcut method. The present paper gives an overview of both techniques, as well as a synthesis of the results obtained in recent FWI projects where they have been applied. 2.

Introduction

Many refineries have plans to implement major upgrade projects with the target to increase overall throughput, to improve the products quality and/or to increase conversion level, by revamping the existing facilities as well as by addition of new process units. This leads to an increase of the loads discharged to refinery flare and, typically, the capacity of the existing flare systems represent a bottleneck for the planned expansion. Increasing the plant throughput and/or adding new process units, in fact, the loads to flare due to plant wide emergency events are expected to be higher, thus directionally implying: a built-up backpressure increase inside the flare system, that could reduce the relief valves capacity with possible overpressurization, above design pressure, of the connected equipment, an increase of radiated heat during flaring, that could exceed the allowable intensity at grade. As a consequence, a number of modifications to the original flare system design could become necessary before proceeding with the plant expansion.

Dynamic simulation, HIPS & combined probability analysis reduce flare loads C.Gilardi, M.Tonello – FOSTER WHEELER ITALIANA

March 2011 - page 1

The economical benefit of the revamping could be therefore penalised by the cost of flare network upgrading in order to safely collect and dispose the calculated additional relief load. Furthermore, if some big modifications are involved (for example, replacement of an existing stack by a higher structure), the relevant environmental impact should be considered as a further constraint, in addition to the technical and economical considerations. On the other hand, it has been widely experienced that the relief loads calculated on the basis of a traditional approach (i.e. the API standards) are generally overestimated. The conventional methods for: calculating the relief loads from the individual sources (in particular, from towers), combining the individual loads to evaluate the total release to flare, are in fact based on a number of assumptions that allow a simple and conservative approach to the problem, but can lead to flare system overdesign. In the following tables, some of the most effective hypotheses are listed: Evaluation of relief load from an individual source (i.e. a tower) 1)

The fluid inventory is considered large enough to pressurize the tower up to the set pressure.

2)

Fluids’ composition is assumed not changing during the failure. This means, for example, that reboiler pinch effect is not considered.

Evaluation of total relief load to flare 1)

2) 3)

The time dependence of individual releases is not considered, computing the maximum load as the sum of the peak loads from the single sources. Another approach, lacking of scientific evidence, is to consider 100% of the maximum single source load plus 50% of the other loads. The dynamic interaction between process items during emergency events is not considered. No full credit is given to the high integrity trips installed to reduce the total load to flare system. Many common practices (all based on experience or more frequently on the rule of thumb) are used to select which tripped loads contribute to the total load.

Therefore, in order to achieve a reduction of the flare design load, some margin exists if a more realistic modelling of the single sources and/or of the entire system can be performed. The continuous improvement of the calculation tools and the possibility of accessing a great number of historical plant data make now possible a more rigorous approach to the problem by applying dynamic simulation modelling and/or by installation of HIPS with probabilistic calculations of their availability to mitigate the relief to flare.


March 2011 - page 2

3.

Dynamic simulation to evaluate flare loads

Dynamic simulation is a powerful tool to describe the system behaviour during the emergency events. Most of the assumptions on which are based the conventional methods can be abandoned for a time-dependent model that better estimates the process variables trend. The dynamic approach can be applied individually to each relief source or to a group of items, to evaluate the effect of the possible reciprocal interactions during emergency situations. In parallel, if any interlock system is installed to reduce the flare load during upsets, a statistical evaluation can be carried out to establish if the trip intervention may be considered reliable on demand. SINGLE SOURCE

MULTIPLE SOURCES

DYNAMIC SIMULATION

TRIPS’ RELIABILITY STUDY

OVERALL LOAD REDUCTION The results obtained by a combination of the above described techniques produce a system model that predicts more accurately the relief loads in case of failure, without the need of including in the flare system design capacity the large margins typical of a static shortcut method. Furthermore, the availability of information about the model reaction to perturbations and about the reliability of the installed cutout devices could highlight the most critical features of the plant. Starting from that point, some technical solutions could be implemented to improve the system design so that a fail-safe position is reached during emergencies. It has to be highlighted that both techniques (i.e. dynamic simulation and trips’ reliability study) to reduce the overall flare loads are mentioned and accepted in API Standard 521, 5th Edition, January 2007 (equivalent to ISO 23251). In particular, reference is made to API 521 para. 5.22, 7.1.4 and Annex E.


March 2011 - page 3

3.1

Analysis of loads from single sources

For determining the relief loads from process equipment, two main improvements can be implemented by means of dynamic simulation: the time-dependence of the phenomena involving each real system can be considered, as a consequence, it is possible to take into account the accumulation terms in the material and energy balances. The introduction of the variable “time” allows the designer to study a series of real effects that are commonly experienced in field during upsets, but that can not be simulated and predicted by means of a stationary model. For example, the inertia of the system to process parameters rapid changes can be monitored: in many cases, when big towers have been analyzed, the time to reach the safety valve set pressure was extremely longer than the emergency duration or than the operator response time. Therefore, it has been reasonably assumed that no contribution to the total flare load had to be considered. Other effects that can contribute to a significant reduction of the calculated relief load from a single source are: The loss of liquid inventory, resulting in a stop of vaporisation. The continuous changes in liquid phase composition; as a consequence, the liquid hold-up raising temperature will result in a decrease of the heating medium driving force and consequently of the heat input. The intervention of protective measures to mitigate the upset consequence. For example, in case of general power failure, the automatic heat-off of a fired heater upstream a crude distillation tower will result in the decrease of heat input to the system. However, a critical analysis of the dynamic model is recommended to ensure that it correctly represents the real system. If possible, a comparison with actual plant transient data shall be made. When no data are available, the most conservative combination of assumptions shall be considered. The following table gives an indication of the loads reduction, compared to a conventional approach of calculation, achieved in revamping Projects for which FWI performed a dynamic simulation analysis.


March 2011 - page 4

Dynamic Simulation) Relief-load Reduction Results

Emergency event:

General Power Failure

Type of column

Relief load reduction, %

Preflash Tower

70

In addition to the significant load reduction, the dynamic model shows that the relief pressure is reached 16 minutes after the power failure occurrence.

Crude Tower (1st Project)

40

A model of the crude unit feed fired heater provided the feed temperature decay with time. The relief pressure is reached 5 minutes after the power failure occurrence.

Crude Tower (2nd Project)

50

A model of the crude unit feed fired heater provided the feed temperature decay with time. The relief pressure is reached 3 minutes after the power failure occurrence.

Gas Plant Stabilizer

30

Reboiler pinch reduces the relief load. The relief load decays to zero 5 minutes after the event occurrence.

C3/C4 Splitter

30

Load reduction is due to sensible heat capacity despite an assumption of constant duty in the reboiler

Gas Plant Deethanizer

50

Load reduction is due to sensible heat capacity despite an assumption of constant duty in the reboiler

Naphtha Splitter

50

Reboiler pinch reduces the relief load. The relief pressure is reached 7 minutes after the power failure occurrence.

Isomerization Unit Stabilizer

20

Reboiler pinch reduces the relief load. The relief pressure is reached 1 minute after the power failure occurrence.

CCR Stripper

20

Heater liquid hold-up vaporized is not sufficient to reach relief valve set pressure.

Raffinate Column

10

Small load reduction is due to the tray liquid hold-up contribution.

Stripper Column

100

Both the large volume of the system and the significant tray liquid hold-up prevent the column pressurization.

Xylene Column

100

Heater liquid hold-up vaporized is not sufficient to reach relief valve set pressure. Column pressure reaches its maximum after four minutes and then decays slowly.

Deethanizer Column

80

Load reduction is due to the large system volume to be pressurized before relief valve opening.

Note:

Comment

Above load reductions are taken from simulations runs developed for previous projects. Actual loads reduction for a specific system depends on heat and material balance, system configuration, operating conditions, size and type of equipment and control scheme.

In particular, for the crude towers mentioned in the table, the dynamic model was worked out taking into account the reduction of the heat input into the system by giving credit to the automatic shutdown of the fired heater in case of general power failure. Dynamic simulation, HIPS & combined probability analysis reduce flare loads C.Gilardi, M.Tonello – FOSTER WHEELER ITALIANA

March 2011 - page 5

The residual heat in the furnace refractory, on which the curve heat input versus time was built, has been estimated on the basis of the heater geometrical data, type of refractory and experimental data for similar systems. For the particular for project Crude Tower (1st Project), it was calculated that the heater duty would be reduced to approximately 45% of normal operating duty after 1 minute from the emergency heat off. In order to better understand the dynamic behaviour of such a system, reference is made to the following curves, in which the tower pressure and the relief load are plotted against time. On time axis, general power failure event occurs at minute 55.

th

74 min 37 t/h

63 rd min 30 t/h

The relief valve set pressure is reached 5’ after the general power failure occurrence, whereas the maximum load (37 t/h) is discharged approximately 15-20 minutes after the event. Dynamic simulation, HIPS & combined probability analysis reduce flare loads C.Gilardi, M.Tonello – FOSTER WHEELER ITALIANA

March 2011 - page 6

3.2

Combination of loads from multiple sources

In parallel with the analysis of single systems’ behaviour during emergency events, the dynamic approach shows how to proceed for calculating the total load to flare system during a failure that involves two or more sources. A curve “total load versus time” can be obtained by summing, during each period, the single releases at that time. Therefore, no empirical assumptions are anymore needed to consider that the peak loads from the individual items are not necessarily contemporary. In the following table, an example of the afore described calculation is given: Flare relief load from Crude Unit and Saturated Gas Plant (in t/h) Time after the general Power Failure occurrence Tower

Peak relief

5 min

10 min

15 min

20 min

25 min

30 min

Preflash Tower

6

0

0

0

6

6

6

Topping Tower

37

0

30

34

37

37

37

Stabilizer

86

86

0

0

0

0

0

Deethaniser

11

11

6

6

6

6

6

C3-C4 Splitter

20

10

18

19

20

20

20

Total

160

107

54

59

69

69

69

Looking at the figures in the table, worked out for a FWI past Project, it can be noted that the overall load to the flare from Crude Distillation Unit and Saturated Gas Plant has been reduced from 160 t/h to 107 t/h (-33%). 160 SUM OF PEAK LOADS 140 -33% Flare load (t/h)

120 TOTAL LOAD CURVE 100 80 60 40 CURVES OF SINGLE LOADS

20 0 0

5

10

15 20 Time after GPF (minutes)

25

30

Also in this case, however, a conservative approach and a critical analysis of the assumptions/results are recommended to the designer. As an example, particular attention shall be made to the interactions of contiguous systems during the contingency event. For complex systems, in fact, an assumption that appears conservative for one subsystem could lead to underestimate the load from another source.


March 2011 - page 7

4. 4.1

HIPS & Combined Probability Trips’ reliability study

Traditionally, during emergency events that involve the intervention of multiple trips (e.g. cooling water failure, general power failure), a number of empirical rules were adopted to account for potential interlock failure, for example: the trip on the item producing the maximum load to flare is assumed to fail, a fixed percentage of trips are considered to fail. These approaches, supported only by the experience, can be replaced by a probabilistic analysis based on statistical data. The frequency of failure of: a single trip a combination of two or more trips is evaluated. On this basis, if the frequency is below a preset value, the trips system is deemed sufficiently reliable for its service and the loads associated to their failure are not accounted for in the flare system design load. The evaluation of trips reliability is based on a “Fault Tree” analysis starting from basic components unavailability data: LEVEL 1 BASIC COMPONENTS FAILURE 1.

LOGICAL COMBINATION

LEVEL 2 SINGLE TRIPS FAILURE 2.

LOGICAL COMBINATION

LEVEL 3 MULTIPLE TRIPS FAILURE Basic elements failure rates are available from data banks and specialist sources. Therefore, the unavailability of the basic elements is calculated depending on test frequency, test duration, maintenance duration. As a further step, a rigorous approach is used to calculate single trips failure rates: the relationships between interlock initiators and actuators are described by means of simple logical operations (“OR” and “AND”) and the trip failure frequency is calculated as a combination of the basic elements data. For example, the failure rate of a system composed of redundant initiators is lower than single initiator failure frequency, being lower the probability that all the elements fail to act contemporarily. Besides the evident advantages (simplicity, standardisation) of this method, a further benefit is the possibility of a critical analysis of the results, eventually identifying a number of viable modifications to increase the interlock reliability:


March 2011 - page 8

changing the configuration (for example, by adding redundant initiators or actuators), increasing basic element reliability (for example, by increasing the test frequency). Following the same probabilistic approach, the combined failure frequency of trips installed on different items can be evaluated, if their simultaneous intervention is expected due to a common process reason (for example, overpressurization due to a plantwide emergency). Applying this method in a revamping project, the first step is to determine a “target” maximum load to flare, so that the margin in the capacity of the flare system is saturated. The chance of releasing an overall flow higher than the flare capacity depends on the chance that two or more of the trips fail to act, therefore releasing a combined load over the evaluated target. Furthermore, as a result of the “fault tree” analysis, a probability value can be calculated for each of the possible combinations of all the trips in both the configurations of failure and intervention; the probabilities for those combinations producing an overall load exceeding the target are added together in order to obtain the combined probability to exceed the flare capacity. Finally, the obtained figure is combined with the frequency of the common emergency occurrence: if the resulting frequency is considered low enough (for example, 1 event every 1,000,000 years), the system is deemed reliable and the target flare load not exceeded. In the following table are shown the max flare capacities, compared with maximum load without considering trips action, for some projects for which FWI successfully performed the probability study, thus leading to the conclusion that no replacement/revamping the flare system was needed. Project

Max flare capacity / Maximum load (without considering trips action)

"A"

30 %

"B"

23 %

"C"

23 %

"E"

40 %

"F"

40 %

"G"

80 %

"H"

80 %


March 2011 - page 9

4.2

Level 1 - Basic component failure

The unavailability (also called Fractional Dead Time FDT) is the fraction of time whilst the system or one component is not available. In other words, the unavailability is the probability that, at any given time, the protection system does not respond. In order to calculate the unavailability of the single basic components, the following data need to be defined: 1 Failure rate λ (time -1) or the Mean Time Between Failure (time) MTBF = λ Time between test τ (TBT) (time) 1 Repair time µ (time -1) or the Mean Time To Repair MTTR = µ Test duration θ (time) References for sources of values in terms of failure rate, time between tests, repair time and test duration of the single basic component are for example:

Offshore Reliability Data Handbook (Oreda 84 & Oreda 97 & Oreda 2002) Safety Equipment Reliability Handbook (Exida 2007) Sintef Automatic Control – Comparative Reliability Assessment - 1991 The Institution of Chemical Engineers - Course Manual on Hazard Analysis (Hazan) - 1988.

Starting from the "Failure Rates", the probability that a single trip system could not be available (Fractional Dead Time) is calculated from the combined unavailabilities of the trip components causing the undesired system state (top event). Indicative failure rates, for reference only, of a number of single components are reported in the following table. Test duration (hours)

MTTR (hours)

Time between test (months)

Dangerous Failure rate (failure/year)

Pressure Switch

1

6

12

0.16

Pressure Transmitter

3

6

3

0.04

Solenoid valve

1

5

6

0.1

Block valve

1

10

12

0.25

Control valve (on gas)

(*)

10

(*)

0.32

ESD fail safe

(**)

(**)

3

0.001

Basic component

(*) Component in continuous operation. (**) ESD unavailability for maintenance and test is not considered due to ESD redundancy.

Frequency of test and accurate maintenance for trip components operating on demand is strictly related to the fixed probability threshold which is considered acceptable for the risk that the flare is subjected to handle more than the design flow.


March 2011 - page 10

Therefore, in order to maintain trip reliability at the fixed threshold, a test schedule and a maintenance program of instrumentation and trips systems components should be established. Tests shall be performed at the required frequencies and written record of test data/results shall be compiled by the personnel responsible for the tests. The impact of test frequency on the unavailability for solenoid valves is given, as an example, in the following table: Test interval Test No. per year

Probability to fail on demand No. of failures on demand

1

0.05

2

0.025

4

0.013

It is evident that the trip unavailability is directly proportional to the test interval. 4.3

Level 2 - Single trip failure

The fault tree analysis is a logical construction that permits the calculation of the unavailability of a complex system starting from data relevant to the single basic components of the system. Fault tree analysis is carried out in two stages: construction of the logic fault tree calculation of the unavailability of the system The fault tree is composed by a series of logical gates ("OR" and "AND"): the combination of the unavailability data for each branch of the gate results in the total probability of failure for the analyzed subsystem. The complexity of the fault tree is gradually increased up to reproduce the overall trip configuration. With reference to the trip’s architecture shown in Figure A): in Figure B) the fault tree analysis is shown for the 2 out of 3 PSHH; in Figure C) the fault tree analysis worked out for the complete trip (Block valve actuated by 2 out of 3 pressure switches) is enclosed. Figure A) Block valve actuated by 2 out of 3 pressure switches IA

PS HH

SOV PS HH

2oo3 voting system

I

PS HH

to atm

BV

process line



Figure B) 2 out of 3 PSHH fault tree analysis

Figure C) Block valve actuated by 2oo3 pressure switches

Dynamic simulation and combined probability analysis to reduce flare system loads C.Gilardi, M.Tonello – FOSTER WHEELER ITALIANA


As already discussed, one of the benefits of the rigorous approach introduced by the fault tree analysis is to provide a useful indication to the designer in order to improve the system reliability. As an example, looking at the figures in Figure C), it appears not convenient to further improve the ESD reliability, which is already high if compared with the reliability of the other system components, whereas the designer could decide to reduce the trip unavailability by decreasing the failure rate of the solenoid valve. For this purpose, the designer could decide either to install redundant elements and/or improve the system architecture. The influence of the trip configuration on the reliability is analyzed in the following example, in which the unavailability of a system composed of one/multiple solenoid valves (SOV) is evaluated considering different configurations. Four different arrangements have been considered: single solenoid valve, two solenoid valves in series, two solenoid valves in parallel and four solenoid valves (two in series by two in parallel). The configuration with two solenoid valves in series is more reliable than a single SOV system, but introduces a higher probability of spurious trips occurrence. On the other hand, the configuration with two solenoid valves in parallel reduces the frequency of spurious trips, but the system reliability is significantly penalized. Four solenoid valves’ arrangement (two in series by two in parallel) has a low incident of spurious trips and at the same time a high reliability. In the following table, the probability to fail on demand is compared for the different solenoids arrangement. The relevant probability is only an indication to compare the different cases.

4.4

SOV configuration

Probability to fail on demand No. of failures on demand

one SOV

0.05

two SOV in series

0.003

two SOV in parallel

0.1

four SOV (two in series by two in parallel)

0.006

Level 3 - Multiple trips failure - Combined Probability

The probability of releasing to flare an overall flow higher than flare capacity will be dependent on the chance that two or more trips fail to act. A probability value can be calculated for each of the possible trips combinations in all configurations of failure. The probabilities for those combinations producing an overall load exceeding the “Target Flowrate" are added together in order to obtain the combined probability. For complex systems, the calculation is usually made by means of a dedicated computer program. The combined probabilities to exceed the "Flare System Target Flowrate" have to be correlated at the frequency of the event. The probability that the flare capacity is exceeded will be the combined probability multiplied the frequency of the event (e.g. the general power failure frequency). Dynamic simulation and combined probability analysis to reduce flare system loads C.Gilardi, M.Tonello – FOSTER WHEELER ITALIANA


The probability gives the frequency at which the flare capacity may be exceeded; anyhow the risk that such event may happen anytime is not excluded. In the following table, an example of combined probability calculation is given. Reported data refer to a revamping Project for which FW performed a flare load reduction analysis for power failure contingency. Trip Number 1 2 3 4 5 6 7 8 9 10 11 12 13 14 TOTAL

Flowrate discharged for trip action kg/h 23000 0 0 0 0 0 0 0 0 0 0 0 0 0 23000

Target flowrate: Power failure frequency: Probability to exceed target: Target flowrate exceeded:

Flowrate discharged for trip failure kg/h 93000 190000 20000 3500 54000 41000 22000 10600 30000 42000 88000 30000 30000 10000 664100

Probability to fail 7.17E-04 1.34E-04 6.55E-05 6.55E-05 3.33E-02 8.83E-03 1.28E-02 1.70E-02 6.55E-05 6.55E-05 1.22E-04 6.38E-05 1.30E-04 6.58E-05 -

270,000 kg/h 1 event every 5 years 3.0 E-7 once every 16,700,000 years

It has to be pointed out that without considering the trips action a total flowrate to flare would have been 664,000 kg/h, while the design can be based on the target flowrate (60% reduction) following the results of probabilistic analysis. Similar considerations could be applied for hydraulic calculation. Flare system piping, sub-headers and headers, should be hydraulically verified or designed based on the same approach. For each sub-header and for the header, combined probability of multitrip failure instead of conventional approach, could allow a flow reduction for which the suitability of the already installed piping shall be checked reducing the requirement for piping modification. 5.

Conclusion

There are no universally applicable criteria to define whether or not risks are tolerable; this is a social and political judgment, which can be guided but not replaced by technical advice. It is therefore impossible to be precise about whether a risk is tolerable because:



The value judgments about what is tolerable vary between individuals and between societies, alter with time, accident experience and changing expectations of life, and depend on the perceived risks and benefits of the particular activity; The risk estimates themselves contain uncertainties, often estimated to be an order of magnitude. The criteria recently followed by some official authorities to set the individual risk threshold for the public, such as VROM (the Netherlands, see note 1) and HSE (United Kingdom, see note 2), refer to a tolerable risk in the range of 10-5 / 10-6. As a general rule, the risk criteria associated to new installations are set to be more stringent than for existing situations. With reference to the above example, it was deemed not necessary to revamp the existing flare system, by accepting the probability to exceed the target flowrate resulting lower than once every 1,000,000 years. Notes: (1) Ministry of Housing, Physical Panning and Environment (VROM) of the Government of the Netherlands. (2) Health and Safety Executive (HSE) of the Government of the United Kingdom.

