Interlocks and Pumps

[GibbsDuhem]

I have a control strategy that has been through multiple reviews and has finally cleared through the MOC approval process we have at my company.

It has landed on my task list to implement these controls.

There are a couple of issues that I've noticed with this control strategy and the one that I would very much appreciate any feedback from folks here concerns closing a valve on the output of a pump pair that has no minimum flow spillback.

This question is primarily about the pump and whether or not there is a risk of damaging the seals and potentially causing a fire.

Typically I would expect to simultaneously shutdown the pump when it is required to automatically initiate a command to close the valve on the pump discharge, but this is nowhere to be found in the design that has been approved for this change.

Operations has advised that it is their fundamental practice to manually stop pumps when the pumps' discharge valve is closed by an automated interlock.

Not so surprisingly, this might explain part of the causes that I've heard about this plant having a fair amount of reliability issues with its pumps.

In my opinion deadheading a centrifugal pump flowing butane is not quite what I would consider a recognized and generally accepted good engineering practice.

Thanks in advance for taking the time to share your thoughts on this subject.

 

[thebard3]

I agree with your concern. Not a particularly difficult process to pump hydrocarbons with a centrifugal pump. Deadheading a centrifugal pump for an extended period, regardless of the process fluid, is not a good idea, nor is there any reasonable explanation I could see for wanting to do so. I can't imagine why you would want to automate the valve sequence without automating the pump operation too.
Perhaps somebody in your organization heard of a problem in the past that someone else misdiagnosed and attributed to shutting a pump off automatically instead of leaving it run until somebody remembered to turn it off.

Brad Waybright

The more you know, the more you know you don't know.

 

[georgeverghese]

Strange, how did this control scheme get past the MOC reviews at your company? What are justifications for running these pumps dead headed, especially on a fluid like butane ? What API shaft seal plan do these pumps have ? Do these pumps automatically go into min speed when these trip valves begin to close ?

 

[GibbsDuhem]

Thanks guys.

@georgeverghese

It got past, to describe how it did so is something I definitely could use help with from James Michener, as there is a fair amount of drama involved, but not quite enough to make into a movie or a book until something blows up.

Deadheading a CF pump is of itself not necessarily a matter of certain and immediate concern.

According to my understanding of pumps, it is not an obvious no-no as it would be with a PD pump.

I think the seals are API plan 52 for the most part.

These are not VFD driven pumps. They are on/off pumps.

So the impeller continues to spin and the seals are designed to contain the fully developed dP.

The analysis I think then concerns how long can the impeller continue to spin before it heats the butane to a point that its vapor pressure exceeds the design capacity.

 

[thebard3]

Process fluid will heat up gradually as the pump runs without liquid flowing, so will eventually either cause a seal failure or perhaps the hydrocarbon (butane) to turn to vapor and other unforeseen trouble as a result. I'll just say that you shouldn't do it, ss there's no reason to and a number of reasons why you should not.

Brad Waybright

The more you know, the more you know you don't know.

 

[georgeverghese]

So this pump must be going into "control off" mode when the trip valve closes (which will then allow the pump to go back into control on mode automatically when the trip valve re opens) rather than a trip off (which requires a manual operator restart at DCS)??

 

[GibbsDuhem]

@thebard3

I suspect that there are a significant number of pumps in this plant that lack minimum flow spillback piping and have either DCS or SIS valves that will automatically deadhead the pumps with a subsequent need to manually shutdown the pumps in the field.

As you previously mentioned this could perhaps be a legacy holdover from previous practices that may have had some type of rationalized basis that is no longer recognized as a best practice. I am not generally familiar with having seen controls lacking permissives and interlocks for pump motor circuits in these scenarios, but it used to be not uncommon that it was a preferred practice to require that starting most pumps had to be done in the field. Nowadays due to my experiences with several projects for a few different clients, I have seen that auto-starts of standby pumps has become an acceptable practice if not quite maybe a preferred or best practice. For my own part, I favor auto-starts on standby pumps from the ideal that they may assist with keeping a process in its steady-state. The potential reasons not to auto-start standby pumps include fire cases and although there are means to automate detection of such an event and include that it is not happening as a permissive condition to auto-start a standby pump, I've not seen much integration of Fire & Gas controls as part of BPCS or SIS controls.

The scenario under which these controls have been developed does provide a reason to close these valves, however the reason is primarily based upon a PSM semi-quantitative risk analysis associated with the potential flammability of the process fluid. These semi-quantitative risk analyses are not well respected by many engineers, counting myself among them. The parameters used I suppose constitute the "semi" part of the description. The frequency parameters are quite obviously out of sorts with meaningful probabilities when the categories are set at increments of once a year, once a decade, once a century and lastly once a millennium. There are also sketchy frequency parameters for estimating for example how many people are in a given plant area. The conservative value for this is simply that one is too many and can be expected to be in the area. It's not like these plants are run like clean rooms or other types of strictly controlled entry areas.

On the other hand we have an absolutely certain and well known problem with deadheading a CF pump running in petrochem service.

Clearly from my point of view there needs to be some more discussion of this MOC, and yet there is an unfathomable vibe I get that management has little interest in further discussions of the matter. I suppose I am on the verge of having no recourse other than to go to HR with my concerns if my attempt on Monday to convey my concerns for the last time to management meets with further resistance.

In fact, I see that there is a need to audit the controls at this facility to identify all of the cases where automatic valve closures are in service without corresponding motor circuit outputs to shutdown the pumps.

Egads! I detest games of chance, unlike apparently so many mathematicians. It's become the equivalent of playing a game of poker. I'll see your semi-quantitative PSM analysis and raise you with a CF pump deadhead gap assessment!

Ridiculous....

@georgeverghese

It seems the practice at this facility for pump controls is perhaps a legacy approach requiring both starts and stops of pumps to be done by operations in the field. As I mention above, I've seen numerous examples of facilities that require starts to be effected by ops personnel in the field, but I've not seen a lack of automated shutdowns as I see at this facility.

Thank you very much for taking the time to respond to this post - most appreciated.

 

[thebard3]

I now see you have a great understanding of the process, inherent hazards, and management challenges. For my part, I recently left my employment with a chemical manufacturer where part of my role was to provide capability to include any combination of permissives, interlocks, and alarm conditions for any discrete operator action. I also provided for relevant information and diagnostic messages so operators aren't left scratching their heads when something doesn't work. However, I relied on process engineering to define how things are supposed to work and how to deploy it. Recently most of them are hired directly from college so they have no practical knowledge to provide appropriate direction. If I raised concerns to a level that might demand attention then I was considered 'that grouchy old cumudgeon' by higher management. I'm now approaching retirement and was always concerned about my exposure to liability in the eventuality of a serious accident. I don't want responsibility for someone to get hurt or worse, and neither to spend my retirement years in prison. I'm moving on to greener pastures now.

Brad Waybright

The more you know, the more you know you don't know.

 

[georgeverghese]

There is a difference between control on/off which corresponds to pump auto on / auto off, as compared to trip on / off. Also, any valves used for control on/off operation should not be doubled up to serve in safety trip service - each should have its own valve.

Going out to Company HR will cast a completely different shade to things, and should never be an option. Consider it a technical crusade to convince Engineering and Operating folks to adopt auto start / auto stop of pumps as acceptable practice, since there are no abnormalities during these normal control sequence operations. To make things safer, you could even interlock valve status as permissive to normal control sequence. Valve proximity/position switches these days are more reliable than they were many years ago. In many companies, Operations staff and management have significantly more clout then Engineering, so focus your efforts on convincing Ops first.

 

[djs]

A year or so ago, I was involved with a jet fuel pipeline. This pipe line had two feed or priming pumps. Which pump was connected to the pipeline was determined by manual open close valves. What happened (once) during operation, the isolated pump turned on due to a control malfunction. No one noticed until the pump and piping go hot enough to start to smoke! The tank farm operators shut the pump off and ran a fire hose over the piping and pump to cool everything down. Needless to say the pump controls were completely redesigned and rebuilt to prevent this from happening again.

Running a pump deadheaded is not OK.

 

[waross]

I saw a dead-headed grey water pump generate superheated steam hot enough to burn the paint off.

--------------------
Ohm's law
Not just a good idea;
It's the LAW!

 

[PersonalProfile]

The following inexhaustive examples of the risk of deadheading pumps may be of interest:

1. Slurry pump explosion,

https://www.rshq.qld.gov.au/safety-notices/mines/slurry-pump-explosion

2. Centrifugal Pump Explosions, and

https://www.ketopumps.com/media/1342/keto-green-paper-centrifugal-pump-explosions.pdf

3. Centrifugal Pump Explosions

http://www.amre.org.za/amre/admin-downloads/seminars/16March2006/Pump explosions Amplats.pdf

 

[Carlos Cardoso]

Could it be that it was assumed that all pumps should stop without a path from/to open?

Ridiculous, I know, but I’ve seen stuff like this before.