69-Chiara Gilardi Foster Wheeler Italiana-Relief-E

MODULE III - PROCESS DESIGN
In approaching the design of a flare system, process engineers should make reference to
the methodology/guidelines described in the API Standard 521, Pressure-relieving and
Depressuring Systems (5th Edition, January 2007), which is equivalent to ISO 23251.
The standard contains very precise indications about the determination of individual
relieving rates, definition of the system load, selection of disposal systems, as well as
design criteria for the individual components of the disposal systems (e.g. flare headers,
knockout drums, seal drums, etc.).
In particular, in its latest edition, API STD 521 mentions two methods that allow the
designer to evaluate the system design load with more accuracy than with traditional
approach: dynamic simulation and combined probability analysis of installed HIPS
(high-integrity protection systems).
Since these techniques are relatively new, the attached paper gives an overview of both
of them and illustrates the results of the application of the two techniques in some recent
Projects developed by Foster Wheeler Italiana.
MODULE III – PROCESS DESIGN

C.Gilardi – FOSTER WHEELER ITALIANA March 2011
DYNAMIC SIMULATION, HIPS & COMBINED
PROBABILITY ANALYSIS REDUCE FLARE LOADS
Ingg. Chiara Gilardi, Mariateresa Tonello – FOSTER WHEELER ITALIANA
1. Summary
The capacity of the existing flare system can represent a bottleneck in refinery
expansion projects, which entail an increase of plants capacity and/or addition of new
process units. As a consequence, the capital expenditure to revamp the flare system
could penalize the economics of the overall project. On the other hand, it has been
widely experienced that the relief loads calculated on the basis of a traditional approach
(i.e. the API standards) are generally overestimated. The conventional methods for
calculating the relief loads from the individual sources and combining them to
determine the total release to flare are in fact based on a number of assumptions that
allow a simple and conservative approach to the problem, but usually lead to overdesign
the flare system. In a revamping project, the identification of the margins available can
represent a viable solution to accommodate the extra loads from new/revamped plants
without compromising the safety.
Dynamic simulation, HIPS addition with combined probability analysis have been
experienced as powerful tools to produce a system model that predicts more accurately
the relief loads to flare compared to static shortcut method.
The present paper gives an overview of both techniques, as well as a synthesis of the
results obtained in recent FWI projects where they have been applied.
2. Introduction
Many refineries have plans to implement major upgrade projects with the target to
increase overall throughput, to improve the products quality and/or to increase
conversion level, by revamping the existing facilities as well as by addition of new
process units.
This leads to an increase of the loads discharged to refinery flare and, typically, the
capacity of the existing flare systems represent a bottleneck for the planned expansion.
Increasing the plant throughput and/or adding new process units, in fact, the loads to
flare due to plant wide emergency events are expected to be higher, thus directionally
implying:
a built-up backpressure increase inside the flare system, that could reduce the
relief valves capacity with possible overpressurization, above design pressure, of
the connected equipment,
an increase of radiated heat during flaring, that could exceed the allowable
intensity at grade.
As a consequence, a number of modifications to the original flare system design could
become necessary before proceeding with the plant expansion.
Dynamic simulation, HIPS & combined probability analysis reduce flare loads
C.Gilardi, M.Tonello – FOSTER WHEELER ITALIANA March 2011 - page 1
The economical benefit of the revamping could be therefore penalised by the cost of
flare network upgrading in order to safely collect and dispose the calculated additional
relief load.
Furthermore, if some big modifications are involved (for example, replacement of an
existing stack by a higher structure), the relevant environmental impact should be
considered as a further constraint, in addition to the technical and economical
considerations.
On the other hand, it has been widely experienced that the relief loads calculated on the
basis of a traditional approach (i.e. the API standards) are generally overestimated.
The conventional methods for:
calculating the relief loads from the individual sources (in particular, from
towers),
combining the individual loads to evaluate the total release to flare,
are in fact based on a number of assumptions that allow a simple and conservative
approach to the problem, but can lead to flare system overdesign.
In the following tables, some of the most effective hypotheses are listed:
Evaluation of relief load from an individual source (i.e. a tower)
1) The fluid inventory is considered large enough to pressurize the tower up to

the set pressure.
2) Fluids’ composition is assumed not changing during the failure. This means,
for example, that reboiler pinch effect is not considered.
Evaluation of total relief load to flare
The time dependence of individual releases is not considered, computing the

1)
maximum load as the sum of the peak loads from the single sources.
Another approach, lacking of scientific evidence, is to consider 100% of the
maximum single source load plus 50% of the other loads.
2) The dynamic interaction between process items during emergency events is
not considered.
No full credit is given to the high integrity trips installed to reduce the total
3)
load to flare system. Many common practices (all based on experience or more
frequently on the rule of thumb) are used to select which tripped loads
contribute to the total load.
Therefore, in order to achieve a reduction of the flare design load, some margin exists if
a more realistic modelling of the single sources and/or of the entire system can be
performed.
The continuous improvement of the calculation tools and the possibility of accessing a
great number of historical plant data make now possible a more rigorous approach to
the problem by applying dynamic simulation modelling and/or by installation of HIPS
with probabilistic calculations of their availability to mitigate the relief to flare.
3. Dynamic simulation to evaluate flare loads
Dynamic simulation is a powerful tool to describe the system behaviour during the
emergency events. Most of the assumptions on which are based the conventional
methods can be abandoned for a time-dependent model that better estimates the process
variables trend.
The dynamic approach can be applied individually to each relief source or to a group of
items, to evaluate the effect of the possible reciprocal interactions during emergency
situations.
In parallel, if any interlock system is installed to reduce the flare load during upsets, a
statistical evaluation can be carried out to establish if the trip intervention may be
considered reliable on demand.
SINGLE SOURCE MULTIPLE SOURCES
DYNAMIC SIMULATION TRIPS’ RELIABILITY STUDY
OVERALL LOAD REDUCTION
The results obtained by a combination of the above described techniques produce a

system model that predicts more accurately the relief loads in case of failure, without
the need of including in the flare system design capacity the large margins typical of a
static shortcut method.
Furthermore, the availability of information about the model reaction to perturbations
and about the reliability of the installed cutout devices could highlight the most critical
features of the plant. Starting from that point, some technical solutions could be
implemented to improve the system design so that a fail-safe position is reached during
emergencies.
It has to be highlighted that both techniques (i.e. dynamic simulation and trips’
reliability study) to reduce the overall flare loads are mentioned and accepted in API
Standard 521, 5th Edition, January 2007 (equivalent to ISO 23251). In particular,
reference is made to API 521 para. 5.22, 7.1.4 and Annex E.
3.1 Analysis of loads from single sources
For determining the relief loads from process equipment, two main improvements can
be implemented by means of dynamic simulation:
the time-dependence of the phenomena involving each real system can be
considered,
as a consequence, it is possible to take into account the accumulation terms in the
material and energy balances.
The introduction of the variable “time” allows the designer to study a series of real
effects that are commonly experienced in field during upsets, but that can not be
simulated and predicted by means of a stationary model.
For example, the inertia of the system to process parameters rapid changes can be
monitored: in many cases, when big towers have been analyzed, the time to reach the
safety valve set pressure was extremely longer than the emergency duration or than the
operator response time. Therefore, it has been reasonably assumed that no contribution
to the total flare load had to be considered.
Other effects that can contribute to a significant reduction of the calculated relief load
from a single source are:
The loss of liquid inventory, resulting in a stop of vaporisation.
The continuous changes in liquid phase composition; as a consequence, the liquid
hold-up raising temperature will result in a decrease of the heating medium
driving force and consequently of the heat input.
The intervention of protective measures to mitigate the upset consequence. For
example, in case of general power failure, the automatic heat-off of a fired heater
upstream a crude distillation tower will result in the decrease of heat input to the
system.
However, a critical analysis of the dynamic model is recommended to ensure that it
correctly represents the real system. If possible, a comparison with actual plant transient
data shall be made. When no data are available, the most conservative combination of
assumptions shall be considered.
The following table gives an indication of the loads reduction, compared to a
conventional approach of calculation, achieved in revamping Projects for which FWI
performed a dynamic simulation analysis.
Dynamic Simulation) Relief-load Reduction Results
Emergency event: General Power Failure
Relief load
Type of column Comment
reduction, %
In addition to the significant load reduction, the dynamic

Preflash Tower 70 model shows that the relief pressure is reached 16 minutes
after the power failure occurrence.
A model of the crude unit feed fired heater provided the
Crude Tower (1st Project) 40 feed temperature decay with time. The relief pressure is
reached 5 minutes after the power failure occurrence.
A model of the crude unit feed fired heater provided the
Crude Tower (2nd Project) 50 feed temperature decay with time. The relief pressure is
reached 3 minutes after the power failure occurrence.
Reboiler pinch reduces the relief load. The relief load
Gas Plant Stabilizer 30
decays to zero 5 minutes after the event occurrence.
Load reduction is due to sensible heat capacity despite an
C3/C4 Splitter 30
assumption of constant duty in the reboiler
Load reduction is due to sensible heat capacity despite an
Gas Plant Deethanizer 50
assumption of constant duty in the reboiler
Reboiler pinch reduces the relief load. The relief pressure
Naphtha Splitter 50
is reached 7 minutes after the power failure occurrence.
Reboiler pinch reduces the relief load. The relief pressure
Isomerization Unit Stabilizer 20
is reached 1 minute after the power failure occurrence.
Heater liquid hold-up vaporized is not sufficient to reach
CCR Stripper 20
relief valve set pressure.
Small load reduction is due to the tray liquid hold-up
Raffinate Column 10
contribution.
Both the large volume of the system and the significant
Stripper Column 100
tray liquid hold-up prevent the column pressurization.
Heater liquid hold-up vaporized is not sufficient to reach
Xylene Column 100 relief valve set pressure. Column pressure reaches its
maximum after four minutes and then decays slowly.
Load reduction is due to the large system volume to be
Deethanizer Column 80
pressurized before relief valve opening.
Note: Above load reductions are taken from simulations runs developed for previous projects. Actual
loads reduction for a specific system depends on heat and material balance, system
configuration, operating conditions, size and type of equipment and control scheme.
In particular, for the crude towers mentioned in the table, the dynamic model was
worked out taking into account the reduction of the heat input into the system by giving
credit to the automatic shutdown of the fired heater in case of general power failure.
The residual heat in the furnace refractory, on which the curve heat input versus time
was built, has been estimated on the basis of the heater geometrical data, type of
refractory and experimental data for similar systems.
For the particular for project Crude Tower (1st Project), it was calculated that the heater
duty would be reduced to approximately 45% of normal operating duty after 1 minute
from the emergency heat off.
In order to better understand the dynamic behaviour of such a system, reference is made
to the following curves, in which the tower pressure and the relief load are plotted
against time. On time axis, general power failure event occurs at minute 55.
th
74 min
37 t/h
63 rd min
30 t/h
The relief valve set pressure is reached 5’ after the general power failure occurrence,
whereas the maximum load (37 t/h) is discharged approximately 15-20 minutes after the
event.
3.2 Combination of loads from multiple sources
In parallel with the analysis of single systems’ behaviour during emergency events, the
dynamic approach shows how to proceed for calculating the total load to flare system
during a failure that involves two or more sources.
A curve “total load versus time” can be obtained by summing, during each period, the
single releases at that time. Therefore, no empirical assumptions are anymore needed to
consider that the peak loads from the individual items are not necessarily contemporary.
In the following table, an example of the afore described calculation is given:
Flare relief load from Crude Unit and Saturated Gas Plant (in t/h)
Time after the general Power Failure occurrence

Tower Peak relief 5 min 10 min 15 min 20 min 25 min 30 min
Preflash Tower 6 0 0 0 6 6 6
Topping Tower 37 0 30 34 37 37 37
Stabilizer 86 86 0 0 0 0 0
Deethaniser 11 11 6 6 6 6 6
C3-C4 Splitter 20 10 18 19 20 20 20
Total 160 107 54 59 69 69 69
Looking at the figures in the table, worked out for a FWI past Project, it can be noted
that the overall load to the flare from Crude Distillation Unit and Saturated Gas Plant
has been reduced from 160 t/h to 107 t/h (-33%).
160
SUM OF PEAK LOADS
140
-33%
120
TOTAL LOAD CURVE
Flare load (t/h)
100
80
60
40
CURVES OF SINGLE LOADS
20
0
0 5 10 15 20 25 30
Time after GPF (minutes)
Also in this case, however, a conservative approach and a critical analysis of the
assumptions/results are recommended to the designer.
As an example, particular attention shall be made to the interactions of contiguous
systems during the contingency event. For complex systems, in fact, an assumption that
appears conservative for one subsystem could lead to underestimate the load from
another source.
4. HIPS & Combined Probability
4.1 Trips’ reliability study

Traditionally, during emergency events that involve the intervention of multiple trips
(e.g. cooling water failure, general power failure), a number of empirical rules were
adopted to account for potential interlock failure, for example:
the trip on the item producing the maximum load to flare is assumed to fail,
a fixed percentage of trips are considered to fail.
These approaches, supported only by the experience, can be replaced by a probabilistic
analysis based on statistical data. The frequency of failure of:
a single trip
a combination of two or more trips
is evaluated. On this basis, if the frequency is below a preset value, the trips system is
deemed sufficiently reliable for its service and the loads associated to their failure are
not accounted for in the flare system design load.
The evaluation of trips reliability is based on a “Fault Tree” analysis starting from basic
components unavailability data:
LEVEL 1
BASIC COMPONENTS FAILURE
1. LOGICAL COMBINATION
LEVEL 2
SINGLE TRIPS FAILURE
2. LOGICAL COMBINATION
LEVEL 3
MULTIPLE TRIPS FAILURE
Basic elements failure rates are available from data banks and specialist sources.
Therefore, the unavailability of the basic elements is calculated depending on test
frequency, test duration, maintenance duration.
As a further step, a rigorous approach is used to calculate single trips failure rates: the
relationships between interlock initiators and actuators are described by means of
simple logical operations (“OR” and “AND”) and the trip failure frequency is calculated
as a combination of the basic elements data.
For example, the failure rate of a system composed of redundant initiators is lower than
single initiator failure frequency, being lower the probability that all the elements fail to
act contemporarily.
Besides the evident advantages (simplicity, standardisation) of this method, a further
benefit is the possibility of a critical analysis of the results, eventually identifying a
number of viable modifications to increase the interlock reliability:
changing the configuration (for example, by adding redundant initiators or
actuators),
increasing basic element reliability (for example, by increasing the test
frequency).
Following the same probabilistic approach, the combined failure frequency of trips
installed on different items can be evaluated, if their simultaneous intervention is
expected due to a common process reason (for example, overpressurization due to a
plantwide emergency).
Applying this method in a revamping project, the first step is to determine a “target”
maximum load to flare, so that the margin in the capacity of the flare system is
saturated.
The chance of releasing an overall flow higher than the flare capacity depends on the
chance that two or more of the trips fail to act, therefore releasing a combined load over
the evaluated target.
Furthermore, as a result of the “fault tree” analysis, a probability value can be calculated
for each of the possible combinations of all the trips in both the configurations of failure
and intervention; the probabilities for those combinations producing an overall load
exceeding the target are added together in order to obtain the combined probability to
exceed the flare capacity.
Finally, the obtained figure is combined with the frequency of the common emergency
occurrence: if the resulting frequency is considered low enough (for example, 1 event
every 1,000,000 years), the system is deemed reliable and the target flare load not
exceeded.
In the following table are shown the max flare capacities, compared with maximum load
without considering trips action, for some projects for which FWI successfully
performed the probability study, thus leading to the conclusion that no
replacement/revamping the flare system was needed.
Max flare capacity / Maximum load

Project
(without considering trips action)
"A" 30 %
"B" 23 %
"C" 23 %
"E" 40 %
"F" 40 %
"G" 80 %
"H" 80 %
4.2 Level 1 - Basic component failure
The unavailability (also called Fractional Dead Time FDT) is the fraction of time whilst
the system or one component is not available. In other words, the unavailability is the
probability that, at any given time, the protection system does not respond.
In order to calculate the unavailability of the single basic components, the following
data need to be defined:
1
Failure rate λ (time -1) or the Mean Time Between Failure (time) MTBF =
λ
Time between test τ (TBT) (time)
1
Repair time µ (time -1) or the Mean Time To Repair MTTR =
µ
Test duration θ (time)
References for sources of values in terms of failure rate, time between tests, repair time
and test duration of the single basic component are for example:
Offshore Reliability Data Handbook (Oreda 84 & Oreda 97 & Oreda 2002)
Safety Equipment Reliability Handbook (Exida 2007)
Sintef Automatic Control – Comparative Reliability Assessment - 1991
The Institution of Chemical Engineers - Course Manual on Hazard Analysis
(Hazan) - 1988.
Starting from the "Failure Rates", the probability that a single trip system could not be
available (Fractional Dead Time) is calculated from the combined unavailabilities of the
trip components causing the undesired system state (top event).
Indicative failure rates, for reference only, of a number of single components are
reported in the following table.
Dangerous
Test duration MTTR Time between
Basic component Failure rate
(hours) (hours) test (months)
(failure/year)
Pressure Switch 1 6 12 0.16
Pressure Transmitter 3 6 3 0.04
Solenoid valve 1 5 6 0.1
Block valve 1 10 12 0.25
Control valve (on gas) (*) 10 (*) 0.32
ESD fail safe (**) (**) 3 0.001
(*) Component in continuous operation.

(**) ESD unavailability for maintenance and test is not considered due to ESD redundancy.
Frequency of test and accurate maintenance for trip components operating on demand is
strictly related to the fixed probability threshold which is considered acceptable for the
risk that the flare is subjected to handle more than the design flow.
Therefore, in order to maintain trip reliability at the fixed threshold, a test schedule and
a maintenance program of instrumentation and trips systems components should be
established.
Tests shall be performed at the required frequencies and written record of test
data/results shall be compiled by the personnel responsible for the tests.
The impact of test frequency on the unavailability for solenoid valves is given, as an
example, in the following table:
Test interval Probability to fail on demand

Test No. per year No. of failures on demand
1 0.05
2 0.025
4 0.013
It is evident that the trip unavailability is directly proportional to the test interval.
4.3 Level 2 - Single trip failure

The fault tree analysis is a logical construction that permits the calculation of the
unavailability of a complex system starting from data relevant to the single basic
components of the system.
Fault tree analysis is carried out in two stages:
construction of the logic fault tree
calculation of the unavailability of the system
The fault tree is composed by a series of logical gates ("OR" and "AND"): the
combination of the unavailability data for each branch of the gate results in the total
probability of failure for the analyzed subsystem.
The complexity of the fault tree is gradually increased up to reproduce the overall trip
configuration.
With reference to the trip’s architecture shown in Figure A):
in Figure B) the fault tree analysis is shown for the 2 out of 3 PSHH;
in Figure C) the fault tree analysis worked out for the complete trip (Block valve
actuated by 2 out of 3 pressure switches) is enclosed.
Figure A) Block valve actuated by 2 out of 3 pressure switches

PS IA
HH
SOV
PS 2oo3 I to atm
HH voting
system
PS
HH
BV
process line
Figure B) 2 out of 3 PSHH fault tree analysis
Figure C) Block valve actuated by 2oo3 pressure switches
Dynamic simulation and combined probability analysis to reduce flare system loads
As already discussed, one of the benefits of the rigorous approach introduced by the
fault tree analysis is to provide a useful indication to the designer in order to improve
the system reliability.
As an example, looking at the figures in Figure C), it appears not convenient to further
improve the ESD reliability, which is already high if compared with the reliability of the
other system components, whereas the designer could decide to reduce the trip
unavailability by decreasing the failure rate of the solenoid valve.
For this purpose, the designer could decide either to install redundant elements and/or
improve the system architecture.
The influence of the trip configuration on the reliability is analyzed in the following
example, in which the unavailability of a system composed of one/multiple solenoid
valves (SOV) is evaluated considering different configurations.
Four different arrangements have been considered: single solenoid valve, two solenoid
valves in series, two solenoid valves in parallel and four solenoid valves (two in series
by two in parallel).
The configuration with two solenoid valves in series is more reliable than a single SOV
system, but introduces a higher probability of spurious trips occurrence.
On the other hand, the configuration with two solenoid valves in parallel reduces the
frequency of spurious trips, but the system reliability is significantly penalized.
Four solenoid valves’ arrangement (two in series by two in parallel) has a low incident
of spurious trips and at the same time a high reliability. In the following table, the
probability to fail on demand is compared for the different solenoids arrangement. The
relevant probability is only an indication to compare the different cases.
SOV configuration Probability to fail on demand

No. of failures on demand
one SOV 0.05
two SOV in series 0.003
two SOV in parallel 0.1

four SOV
0.006
(two in series by two in parallel)
4.4 Level 3 - Multiple trips failure - Combined Probability
The probability of releasing to flare an overall flow higher than flare capacity will be
dependent on the chance that two or more trips fail to act.
A probability value can be calculated for each of the possible trips combinations in all
configurations of failure. The probabilities for those combinations producing an overall
load exceeding the “Target Flowrate" are added together in order to obtain the
combined probability.
For complex systems, the calculation is usually made by means of a dedicated computer
program.
The combined probabilities to exceed the "Flare System Target Flowrate" have to be
correlated at the frequency of the event. The probability that the flare capacity is
exceeded will be the combined probability multiplied the frequency of the event (e.g.
the general power failure frequency).
The probability gives the frequency at which the flare capacity may be exceeded;
anyhow the risk that such event may happen anytime is not excluded.
In the following table, an example of combined probability calculation is given.
Reported data refer to a revamping Project for which FW performed a flare load
reduction analysis for power failure contingency.
Trip Flowrate discharged Flowrate discharged Probability

Number for trip action for trip failure to fail
kg/h kg/h
1 23000 93000 7.17E-04
2 0 190000 1.34E-04
3 0 20000 6.55E-05
4 0 3500 6.55E-05
5 0 54000 3.33E-02
6 0 41000 8.83E-03
7 0 22000 1.28E-02
8 0 10600 1.70E-02
9 0 30000 6.55E-05
10 0 42000 6.55E-05
11 0 88000 1.22E-04
12 0 30000 6.38E-05
13 0 30000 1.30E-04
14 0 10000 6.58E-05
TOTAL 23000 664100 -
Target flowrate: 270,000 kg/h

Power failure frequency: 1 event every 5 years
Probability to exceed target: 3.0 E-7
Target flowrate exceeded: once every 16,700,000 years
It has to be pointed out that without considering the trips action a total flowrate to flare
would have been 664,000 kg/h, while the design can be based on the target flowrate
(60% reduction) following the results of probabilistic analysis.
Similar considerations could be applied for hydraulic calculation. Flare system piping,
sub-headers and headers, should be hydraulically verified or designed based on the
same approach. For each sub-header and for the header, combined probability of multi-
trip failure instead of conventional approach, could allow a flow reduction for which the
suitability of the already installed piping shall be checked reducing the requirement for
piping modification.
5. Conclusion
There are no universally applicable criteria to define whether or not risks are tolerable;
this is a social and political judgment, which can be guided but not replaced by
technical advice. It is therefore impossible to be precise about whether a risk is tolerable
because:
The value judgments about what is tolerable vary between individuals and
between societies, alter with time, accident experience and changing expectations
of life, and depend on the perceived risks and benefits of the particular activity;
The risk estimates themselves contain uncertainties, often estimated to be an order
of magnitude.
The criteria recently followed by some official authorities to set the individual risk
threshold for the public, such as VROM (the Netherlands, see note 1) and HSE (United
Kingdom, see note 2), refer to a tolerable risk in the range of 10-5 / 10-6.
As a general rule, the risk criteria associated to new installations are set to be more
stringent than for existing situations.
With reference to the above example, it was deemed not necessary to revamp the
existing flare system, by accepting the probability to exceed the target flowrate resulting
lower than once every 1,000,000 years.
Notes:
(1) Ministry of Housing, Physical Panning and Environment (VROM) of the Government of the
Netherlands.
(2) Health and Safety Executive (HSE) of the Government of the United Kingdom.

69-Chiara Gilardi Foster Wheeler Italiana-Relief-E

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

69-Chiara Gilardi Foster Wheeler Italiana-Relief-E

Caricato da

Copyright:

Formati disponibili

MODULE III - PROCESS DESIGN

MODULE III – PROCESS DESIGN

Evaluation of relief load from an individual source (i.e. a tower)

1) The fluid inventory is considered large enough to pressurize the tower up to

Evaluation of total relief load to flare

The time dependence of individual releases is not considered, computing the

SINGLE SOURCE MULTIPLE SOURCES

DYNAMIC SIMULATION TRIPS’ RELIABILITY STUDY

OVERALL LOAD REDUCTION

The results obtained by a combination of the above described techniques produce a

Emergency event: General Power Failure

In addition to the significant load reduction, the dynamic

Time after the general Power Failure occurrence

4.1 Trips’ reliability study

Max flare capacity / Maximum load

Pressure Transmitter 3 6 3 0.04

Solenoid valve 1 5 6 0.1

Block valve 1 10 12 0.25

Control valve (on gas) (*) 10 (*) 0.32

ESD fail safe (**) (**) 3 0.001

(*) Component in continuous operation.

Test interval Probability to fail on demand

4.3 Level 2 - Single trip failure

Figure A) Block valve actuated by 2 out of 3 pressure switches

Figure C) Block valve actuated by 2oo3 pressure switches

SOV configuration Probability to fail on demand

two SOV in series 0.003

two SOV in parallel 0.1

4.4 Level 3 - Multiple trips failure - Combined Probability

Trip Flowrate discharged Flowrate discharged Probability

Target flowrate: 270,000 kg/h

Potrebbero piacerti anche

Control valve (on gas) () 10 () 0.32

ESD fail safe () () 3 0.001