Plant Wide Shutdown For High Level in Flare KO drum

[Sawsan311]

Dear All,


I am seeking your technical views on API 521 section 5.7.8.8 recommending to have an action of wide plant shutdown at high high liquid level of the flare KO drum specially for upstream O&G facilities with multiple trains where it would be difficult to identify which train is experiencing an emergency while a common flare KO drum is provided among them all for accommodating the relief requirements.

At the same time, API 521 is advising on the time to be considered for liquid emergency release above the point where the plant wide facility shutdown has occured in order to accommodate the continued liquid / gas release, do you agree that the basis of the time provided for the flare KO maximum liquid inventory above the high high level plant wide shutdown emerges from the below underlying consideration:

a- although flare KO pumps are there to pump out the liquid from drum, the drum is considered to be filled prior to the emergency which doesn't consider the reliable power supply to the pumps and hence their unavailability. typically, the level settings below the high level trip setting are set based on normal pump out capacity, so based on the relief rate (even if the drum is initially empty), the time available would be quite too short based on incoming liquid flow rate.
b- upon sensing the high alarm, operator is expected to take action to identify the source of the release and attempt to close the source.
- after surpassing all the alarm setting limits, if liquid build up hits the high high level trip setting and operator failed to close the source, this means the plant is in an uncontroller situation where wide plants shutdown is initiated.
c- The 20-30 minutes nominated by API 521 above the LAHH corresponds to the fact of longer time required to isolate the inlet and identify the source of the release. This also corresponds to the fact that possible the production separator which has experiencing earlier the blocked outlet with liquid build up and release to flare has also failed to close its inlet by the activation of its own SIF function! accordingly, API 521 considers this 20-30 minutes of incoming steady max liquid rate to achieve the maximum level above which sufficient gas cap to be availed to achieve the separation.
d- The gas cap is supposed to consider that as a result of blocked liquid, the gas outlet of the production separator also closed and hence the two phase release has come into the flare KO drum which mandates separation to avoid burning rain/liquid carry over to flare tip.

e- as an alternative to point c, API 521 is nominating the potential implementation of a SIL-3 SIF at the production separator (s) in order to guarantee the closer of the production separator, in this case, API 521 section 5.7.8.8 is nominating only 2-10 minutes time above the LAHH as a liquid release time corresponding to the closing time of the inlet SDVs.

My question is now:
- By shutting down the plan, are we ensure no further cascade effect within the process is happening due to the abnormal situation causing level build up?
- can the 20-30 minutes nominated by API 521 (in absence of a SIL-3 SIF on the production separator) reflects a typical release time of liquid as a result of the blocked in scenario. can this time be demonstrated by dynamic simulations or it would be sufficient to go ahead with the API 521 time basis, is this time historically demonstrated to be good enough for sizing the mutliphase relief into the flare KO drums
- would installing an additional layer of closing an SDV at the inlet of the flare KO drum contribute in reducing the time of liquid release into the vessel.


Thank you very much in advance

Regards,

 

[georgeverghese]

At the OpCo I used to work in, we use max 5min above LAHH-1, not 15min. A high integrity plant wide PSD initiated at this level via 2oo3 voting LT on the drum which closes all SDVs' in the plant, including feeder SDVs'. There is no inlet SDV at the FKOD for this setup. However, this approach required Operations and Engineering Authority signoff / approval for this reduced emergency response / residence time.

 

[Sawsan311]

Thank you Mr.George for your response,

so basically the underlying basis of tripping the facility at LAHH-1 is as a result of the unstable plant operation caused by the continuous feed to the production separators despite the presence of SIL-1 or SIL-2 high level trip or high pressure trip at the production separator- in addition to the fact that the flare KO pumps have not started at high level. Kindly advise your opinion on this basis..

One Engineer asked me, if the feed has continued to go into the separator which has its SIF fail to close the inlet, what would the 2oo3 high level PSD at the flare KO drum close exactly. I am sure there are upstream SDVs on the incoming lines to the plant which can close as well as any associated processing units should suspend their operation to prevent domino effect as a result of the unstable condition.

Then in order to account for the response time in closing the feed either by the SDVs stroke time or the by the isolation of the FEEDs inlet, API 521 is stating to follow 15-20 minutes above that LAHH-1 to accomodate the emergency liquid release which has continued in absence of a SIL-3 HIPS function (as defined by Annexure E of API 521) otherwise 5 minutes would be sufficient for the maximum emergency liquid release above LAHH-1 corresponding to roughly to conservative HIPS SDV closing time.

Thanks

Regards,

 

[georgeverghese]

In my experience, a SIL-3 rated HIPS is not required here - we are taking credit several layers of risk mitigation to claim this reduced response time
a)Primary level trip at the source separators / columns - USD level
b)Secondary level trip triggered at the flare drum - PSD-1
c)Tertiary level trip triggered by 2oo3 voting LAHH at flare drum to close all feeders also - PSD-2 (*)
d)Some credit taken for well trained operators and adequate manning at CCR
e)Some credit taken for reasonable integrity of shutdown system logics, trip loops and supervisory control of trip loop bypasses at all times which is regularly audited by Operations Management Audit Team.

(*) At this level when all remaining incoming feeders are also closed, even for a DN600 SDV, it should take only no more than 30seconds for an ordinary air powered SDV to fully close. Would suspect that this final trip at PSD-2,on its own, would qualify for SIL-2, but not as SIL-3.

 

[Sawsan311]

Thank you Mr.George for your response,

The overlapping presence of various layers may justify the reduction in the considered release time of emergency liquid above LAHH

However, I was mainly asking about the initial basis of considering the inactive status of the SIF functions on the production separators as well as the pump out action of the flare KO drums.

Regards,

 

[JOHN T SMALL]

I understand you wish to mitigate the risk of causing plant-wide shutdown due to HH level in Flare Knockout Drum during blocked outlet of one of several trains of production separators; the design shall be in compliance with API 521.
Assumptions: fluids entering the separators are capable of overpressuring them; separate feeds to each separator train.

You may consider the following, to reduce the risk of occurence of HH level to acceptable value:

Install a flare KO drum for each of the multiple trains (hooked up to a common flare).
Install two shutdown valves upstream of each separator, initiated by both high pressure and high level. This IPF could be be designed to be classified SIL-3, and would allow relief valves sized for blocked gas outlet only, minimizing the requirements for liquid relief.
This may allow you to effectively eliminate the risk of occurence of HH level in the Flare KO Drum.
Note that horizontal drums up to circa 4m diameter x 20m long can be fabricated and transported.

 

[Sawsan311]

Thank you very much Mr.John, we are both aligned with respect to the alternatives in optimizing the sizing of the KO drum as well as deciding on the requirement for LAHH trip when each train is provided with its dedicated KO drum.

My initial question was, that do you agree that we have ignored the action of the KO pumps to start on high level and accordingly have considered:

- Drum was initially full prior to the release as a maintenance drop out pump
- OR that the release has continued upon the emergency scenario in any of the inlet trains which has cause the increase to LAHH

in other words, what would have caused the level to reach LAHH prior to initiating the plant wide shutdown. In some designs, API 521 allows providing time for operator to respond in closing the inlets and accordingly 10 minutes time can be allowed prior to tripping the plant.

Regards,

 

[JOHN T SMALL]

The purpose of the SIL-3 shutdown system I have suggested for the separators is to effectively PREVENT release of liquid via the separator relief valve into the flare drum. Liquid level in the flare drum would not ever reach LAHH. This solution removes any requirement for operators to close the separator inlets.

 

[Sawsan311]

Hi Mr.John, I was not questioning about the elimination in reaching the LAHHH, I was asking if HIPPS would not have been there, what would be the underlying scenario which would have caused the release to continue up to and beyond LAHH for even 15 minutes as well

Regards

 

[JOHN T SMALL]

Blocked liquid outlet at the production separator and failure of the high level and high pressure trips, would result in full flow liquid + gas release via the separator relief valve to the flare KO drum. The relief valve would continue to operate until the separator inlet was closed. Flare KO drum pumps are quite low capacity, typically 5-10 cu m/hr, and therefore would not evacuate the flare KO drum even if they operated as designed. Flare KO drum is not typically designed for full plant flow, and would soon be flooded.

 

[Sawsan311]

Thank you very much Mr.John!