IPP&T Magazine Online

Applying safety instrumented systems

March 6, 2017  

Print this page

In the production of gases from natural gas wells, safety instrumented systems (SIS) can protect critical piping and dehydration processes from high pressures, while minimizing the risk of undesirable emissions. Raw natural gas commonly contains varied concentrations of methane, carbon dioxide, hydrogen sulfide, nitrogen, helium, and water at high pressures. The raw gases contain both free and entrained water; dehydration systems remove the water.

Removing water
Dehydration facilities typically collect the raw natural gas from multiple wells that are miles apart. Their purpose is to minimize the corrosive nature of the gas. Following dehydration, the gas goes to a plant that separates the dried gas into its various components in a form suitable for marketing. Raw gases often flow from the well field in insulated underground pipes at pressures that can range upwards of 3000 psi. Typically, they first enter production manifolds that mingle the gases from several wells. Here a basic process control system, in conjunction with expansion vessels, reduces the gas pressure substantially, permitting free water to drop to the bottom of the vessels for disposal.

At this point the gases still contain entrained water. In many cases, piping takes the gases to triethylene glycol dehydrators that absorb the entrained water. In these systems, the gases flow from the bottom to the top of the dehydrator columns, while triethylene glycol enters from the top. Trays within the column promote contact between the gas and triethylene glycol, which absorbs the entrained water. A reboiler later removes the water from the triethylene glycol, which is re-circulated back to the top of the dehydration columns. The collected water flows to filters that remove particulatesprior to disposal in wells.

Safety system analysis
At the production manifolds, where the gases lose pressure to condense free water, the pressure rating of piping changes from high to a much lower value. Pipe pressure ratings will often switch from values as high as 3500 psi to pipe with ratings half that value. Downstream equipment, all rated at pressures far below the pressures of the raw gas, must be protected from pressure excursions

A safety instrumented system with Safety Integrity Level (SIL) value of 2 offers excellent protection for downstream piping. By definition, in a SIL 2 system the probability of a dangerous failure per hour is 10-6 to 10-7 (between one chance in a million to one chance in 10 million).

Safety instrumented systems (SIS) consist of sensors, programmable logic solvers, and final elements such as valves. The objective of the SIS is to detect a hazardous condition and immediately take the process to a safe condition. The SIS acts independently from the normal operating process controls, which typically include a computerized distributed control system. If the installed safety instrument system detects a pressure excursion near the rating of the downstream piping, it isolates the high pressure gases from the downstream production manifolds with fast-acting shut-off valves.

In developing an SIL 2 level safety system, the design engineers may decide to install redundant components. For example, they may install three redundant pressure transmitters to monitor the downstream pressures, using a majority voting system to pick the measured pressure. As an alternative, they may specify only two pressure transmitters specifically designed to meet the requirements of SIL 2. Instrumentation in this safety critical class must be certified to a desired level of safety by an independent recognized agency, such as TÜV or Factory Mutual. SIL 2 pressure transmitters work in pairs to monitor safety critical points. A pair of SIL 2 rated pressure transmitters offers the same protection as three redundant conventional pressure transmitters. Generally the installed and operating cost of specialized safety-critical transmitters is far less than that of the required conventional transmitters to meet a specific SIL value. Key capabilities of this class of safety transmitters are: a high level of redundancy and self-diagnostics; a high level of measurement diagnostics; and the ability to transmit diagnostic information to the programmable logic controllers that make up the safety instrumented system. Modern pressure transmitters in safety instrumented systems have a safety failure fraction of 94%.

Signals from each of the safety critical pressure transmitters will go to the logic solver component of the safety instrumented system. The logic solvers must also satisfy the requirements necessary for attaining an SIL 2 system. If either of a pair of SIS pressure transmitters measures a pressure beyond the specified value, the logic solver activates an emergency shut down. It typically de-energizes a pneumatically operated valve, letting spring pressure shut the valves. The shut-off valves, installed in the high-pressure piping, must also meet the requirements of a SIL 2 system. Often engineers will install two or more redundant shut-off valves in series within the high-pressure pipes to ensure a high level of safety.

Instrument engineers generally design the operational controls such that if the DCS initially detects a pressure excursion, it acts quickly enough to initiate a “soft” shutdown. In this case the regular operating control system shuts the valves in such a way that reactivation is relatively simple and requires no manual intervention. But if the pressure excursion continues, reaching the setpoint of pressure protection in the safety instrumented system, the SIS will immediately shut the valves and latch them in such a way that a person has to physically come to the site and re-latch them.

The SIS acts independently of any conventional pressure safety valves installed within the downstream processes. A pressure excursion that causes these valves to lift will usually send the gas through a flare stack, which may cause undesirable environmental emissions. To avoid emissions, the engineers will set the SIS to shut the process down before these safety valves activate. SIL ratings of the safety
instrumented system depend on regular preventive maintenance. Operations technicians should calibrate the SIS regularly to maintain the SIL level. This maintenance must include regular testing of the shut-off valves.