Revamps 2025 Issue

500

460

Instant trip point not reached

Higher trip setting

Lower set point reached. Timer starts

TBD

450

Steam temp.

Pipe wall

Downstream system design temp Lower trip setting

400

temperature

280

Steady state operation at 230˚C

350

Pipe wall exceeds design temperature

230

300

Loss of HP spray water occurs

IHP steam temperature MP steam temperature Pipe wall temperature at B/L

250

Time

Time TTT delay

Available SIF response time

200

5 10 15

50 55

Process safety time

Time (mins)

Figure 4 HP spray water failure, control system fails to respond

Figure 5 HP spray water failure dynamic simulation results

• SIFs must function with no credit taken for favourable con- trol action. • The time delay must not degrade the integrity of the SIF in the event the control system fails to respond. • Where multiple SIFs are used, they must function to independently protect the system with no credit taken for one another. • The system does not ‘know’ which scenario has occurred; it just measures temperature and initiates automated responses. Simulation of this scenario, shown in Figure 5, during the design phase would require assumptions to be made about the response of the control system, such as the proportional, integral, and derivative gain settings of the MP spray water flow controller. These would be impossible to verify during the design phase, as the controller settings would not be determined until the plant is commissioned. As previously mentioned, credit for favourable control response must not be considered when assessing the robustness of the safety system. However, by dynamically simulating the two possible failure scenarios, the system can be assessed without the need to model the scenario where the control system does respond. Simulation of the total spray water scenario will determine the available SIF response time for the high set point trip. Simulation of the HP spray water scenario, with no credit taken for response of the control system, will determine the available SIF response time for the lower set point trip, and in the process will determine how long the incorporated time delay can be. The model will not confirm whether the control system will be able to respond, but it will determine the maximum amount of time that can be allowed for it to respond. This information can then be used by the plant operators when tuning the response of the control system. Dynamic simulation: HP spray water failure In this scenario, the system is operating at steady state at 230°C when HP spray water fails (see Figure 4 ). The steam temperature increases slowly as MP spray water continues to flow, and it is acceptable to assume that the MP spray water control valve remains fixed in position (no credit taken for favourable control action).

When the steam temperature reaches the lower set point of 280°C, it initiates the time-delayed trip. A timer starts to give the control system time to respond and ramp up the MP spray water flow rate to bring operation back to steady state at 230°C. If the timer runs out before the temperature drops back below the trip set point, this will initiate shut- down of the PRDS. The length of the time delay will be selected to ensure there is still sufficient time for the SIF to respond in the event that the control system fails to act. In this case, the PST includes the time delay in its definition: Process safety time = Time to trip + Time delay + Available SIF response time This scenario also determines the higher set point trip temperature. This should be high enough that it is not reached in the HP spray water failure scenario. However, selecting a lower set point allows more time for the SIF to respond in the total spray water failure scenario; therefore, a compromise must be found. Figure 5 shows the results of a dynamic simulation of the HP spray water failure scenario where the control system does not respond. The failure occurs five minutes into the dynamic simulation run. Therefore, all measured times must subtract this value (see Table 3 ). MP steam temperature pla- teaus at 393°C, so 400°C is proposed as the high set point trip, providing a reasonable margin above the expected MP steam temperature for this scenario. Simulation of the total spray water scenario will confirm whether this set point is acceptable. The sensor will be via a thermowell, and the action taken by the SIF is to close a 450 mm (18”) ND pneumatically actuated SDV. From Table 2, estimates for the thermowell response (5-40 seconds), logic solver (0.5-1.5 seconds), digital signal transmission (0.5 seconds), and valve clo- sure (9-18 seconds) give an estimated SIF response time of 15-60 seconds. Selecting a time delay of five minutes allows one minute, 12 seconds for the SIF to respond, which should provide enough margin to not restrict the control or instrumentation design. Detailed SIF response time calculations are typically performed by an instrumen- tation engineer. If the available SIF response time proves insufficient, a shorter time delay can be selected.

Revamps 2025