/s4_1 by AFA Association

23rd AFA Int.’l Technical Conference & Exhibition June 29 – July 1, 2010 Ramada Plaza Tunis Hotel, Tunisia

SIL classification in Urea Plants

Luc Dieltjens Senior Process Engineer, Stamicarbon

Netherland

SIL Classification in Urea Plants The concept of Safety Integrity Levels (SIL) was introduced during the development of IEC 61508/61511 as measure of the quality or dependability of an instrumented system that has a safety function (SIS). To comply with internationally recognized standards, Stamicarbon introduced the concept of SIL in its standard design urea plants. This paper focuses on the risk graph method, which is a means of quickly assessing and screening a large number of scenarios resulting in loss of containment (LOC). A limitation of the risk graph method however is that it leaves some subjective elements in assessing the consequences (severity) of LOC scenario, whereas these consequences are increasingly important in the ever increasing capacities of urea plants and equipment. To overcome this limitation Stamicarbon developed a quick reference chart covering all sections of the urea plant that allows quick and objective assessment of the severity and SIL parameters. Further, the paper highlights SIL-equivalents for safety relief valves in crystallizing media and risk reduction by means of Safety Instrumented Systems (SIS).

Luc Dieltjens Senior Process Engineer Stamicarbon BV, The Netherlands

Stamicarbon

tamicarbon, the licensing and IP Center of Maire Tecnimont, is the global market leader in the development and licensing of urea technology and services with more than 50% market share in synthesis and 35% market share in urea granulation technology. Stamicarbon’s leading position is the result of its continuous highquality innovations in close cooperation with research institutes, suppliers and customers. Stamicarbon has over 60 years’ experience in licensing its urea technology through licensed contractors, delivering optimum environmental performance, safety, reliability and productivity at the lowest investment level. Around the world over 250 licensed urea plants have used, or are currently using, its technology. Furthermore Stamicarbon has completed over 90 revamp projects in Stamicarbon and non-stamicarbon plants.

Hazard and Operatibility Studies The technique of Hazard and Operatibility Studies, commonly referred to as HAZOP’s, has been used and developed over approximately four decades for “identifying potential hazards and operability problems ”caused by“ deviations from the design intent” of process plants. The HAZOP techniques was initially developed by ICI in the United Kingdom, but it only started to become more widely used within the chemical process industry after the Flixborough disaster in 1974. At Stamicarbon, HAZOP’s by means of “keyword combinations” has been practiced for more than twenty years. Moreover, Maire Tecnimont’s corporate safety requirements, call for HAZOP updates on a regular basis. In its latest HAZOP study, Stamicarbon opted to use the “Integrated HAZOP” method. Traditionally, HAZOP and SIL Assessment are two separately facilitated sessions, which produce two unique databases. SIL Validation

is yet a third task, using another set of tools, and producing a third database. In our new integrated approach, only one facilitated session is required for HAZOP and SIL assessment. The link between HAZOP and SIL is illustrated in Figure 1 below: Figure 1: Classification flowchart

Cause of scenario

LOC

No LOC

End

No realistic scenario

End

Minimal LOC/ effect radius

End

yes Realistic risk

yes Major effect

yes Classification risk graph

In the HAZOP, the unwanted events that may result in LOC must be identified before they can receive a SIL classification. In general, multiple independent failures are not considered during the HAZOP. Identification techniques of unwanted events however are beyond the scope of this paper.

SIL classification by means of Risk Graph The risk graph method focuses on the evaluation of risk from the point of view of a person being exposed to the incident impact zone. It is consequence driven and four parameters are used to characterize a potential hazardous event: Consequence (C), Frequency of exposure (F), Possibility of escape (P) and Likelihood of event (W).

Figure 2: Risk graph for assessing safety risks

Cs1 F1 F2

Cs2 F1 F2

Cs3 F1 F2

Cs4 F1 F2

P1 P2 P1 P2 P1 P2 P1 P2 P1 P2

Ws3

Ws2

Ws1

The analysis proceeds with a determination of each of the parameters, in terms of levels shown as numbers. The risk graph as shown in Fig. 2 has four consequence levels, two frequency levels, two levels for possibility of escape, and three likelihood levels. As the numbers increase, the perceived hazard is higher. It should be understood that SIL and availability are simply statistical representations of the integrity of a “Safety Instrumented System” (SIS) when a process demand occurs. There are no regulations to follow that recommend specific SIL classifications for certain hazards. The present assignment of a SIL classification is a company decision based on risk management and risk tolerance philosophy. Risk graphs are very useful but imprecise tools for assessing SIL requirements. A limitation of the risk graph method is that assessing the parameters contains some subjective elements. In our first attempts at classifying scenarios, a large spread in results was found for similar events. The feeling was that scenarios in general were over estimated! It is inevitable that a method with 5 parameters – C, F, P, W and SIL – each with a range of an order of

magnitude, might produce a result with a range of 5 orders of magnitude. It became clear we had to develop procedures, tools and guidelines to ensure that the method is used effectively and consistently.

Urea process peculiarities Prior on developing tools assuring consistent SIL classification, we evaluated older HAZOP reports, and concluded that “too high pressure” is the main key word combination contributing to LOC. Since the urea processes operates with boiling liquids, there is a lot of duplication with other key words combinations. Some examples are as follows: a) High Temperature will obviously give an increase in pressure because of boiling systems. In general, the relative temperature increase is small compared to the pressure increase. b) Cooling water failure results in a high pressure in the system concerned. c) Steam failure results in high pressure in the downstream sections. d) Low conversion causes high pressure because the vapor pressure of urea is low increasing the total pressure e) No or high flow, results in different compositions. f) Low liquid level can result in vapor slip through downstream sections resulting in high pressure. As such, high pressure scenarios are the main consequence identified in a urea plant HAZOP. Thus, high pressure will be the main topic in the remainder of this paper.

Equipment failure due to exceeding the design pressure Exceeding the design pressure may not result in LOC, as it may only lead to deformation without crack formation. Such incidents are not classified with the SIL system. After such

excess has been detected, the equipment concerned must be re-assessed. Recurrence of such a pressure rise beyond the design pressure is undesirable and must be avoided. Table 1 lists the multipliers that may be used for operating pressures exceeding the design pressure, which may involve a failure effect. These multipliers may be used provided that all requirements are met with respect to the use, maintenance, material and structural design of the equipment. In case of doubt, it is recommended to consult a specialist or adhere to the design pressure. Table 1: Typical values for leakage and failure of pressure vessels

Table 2: Consequence defaults Synthesis section C-parameter Severity description Leakage (1.5*Pd<Po<2.0*Pd) C2 1) Vessel rupture (Po> 2.0*Pd) C4 2) Explosion H2/O2 mixtures C3 Tube rupture HP-Heat C3 Exchangers Other sections containing ammonia 3) Leakage (1.5*Pd<Po<2.0*Pd) C1 Vessel rupture (Po> 2.0*Pd) C2 1) Vessel rupture due to corrosion is not part of the HAZOP study, but should be covered by maintenance and inspection programs 2) C3 is selected because such mixtures are generally created at high elevation. 3) No liquid ammonia drum assumed inside the urea plant.

b) The presence of people parameter F The probability of any persons being present in the effect radius of a LOC will depend on the extent of the effected area and the elevation. Stamicarbon used the defaults shown in Table 3. [1] See the boundary conditions for other design codes. [2] RToD = “Regels voor toestellen onder Druk” (Dutch; = Rules for Pressure Vessels), ADM = AD Merkblätter. Pd = design pressure Po = pressure occurring during the process.

Defining default SIL parameters a) The severity parameter C Stamicarbon owns a database that documents “major accidents” in urea plants (including plants by other licensors) over the last 40 years. A cross-section was taken from the database, and the results were ranked with respect to the severity of the consequences. The focus was on the synthesis section and the other sections containing ammonia. The results are listed in Table 2.

Table 3: Presence of people defaults Frequency (F) F1

Description Presence of people < 3 hours/day Presence of people > 3 hours/day

Plant elevation All floors except grade Grade level

c) The frequency of occurrence The frequency of occurrence (the Wparameter) of a scenario will depend primarily on the initial failure mechanism. Common initiating events are problems in control loops or valves and human errors in recurring operations, measurements, etc. The frequency of occurrence of these initiating events will in many cases be W2. In case of all other W

Based on long experience in operating urea plants, it is known that heat-exchanger tube failures don’t occur frequently in urea plants. Therefore a W1 frequency of occurrence for such heat exchanger tube failures can be used. d) Possibility of escape or preventing the scenario. The general basic assumption for assessing the effect in terms of the C-parameter is that there is insufficient time to prevent the scenario, resulting in P2. However, as the urea process is dynamically slow, many scenarios leave sufficient time to anticipate. No defaults for the P-parameter are given; they should be evaluated based on the scenarios considered.

Reduction factors for safety valves Pressure relief valves (PSV’s) are the primary source of over-pressure protection for equipment in urea plants. One issue that arises when applying typical risk graph cases like high pressure scenarios is how to account for the relief valve that protects the vessel from over-pressure. Design of safety systems following SIL classification requires the calculation of Probability of Failure on Demand (PFD) or number of dangerous failures per year depending on the demand rate. In order to properly assess the reliability of a PSV system in urea plants, we must first define what constitutes a failure: a) Fouling of the PSV In urea plants there are a number of PSV’s that are sensitive to fouling, especially for those that are in contact with gaseous fluids containing both CO2 and NH3. In this situations the risk of solid formation (e.g. ammonium carbamate) upon cooling must be considered. The following methods have been suggested to prevent fouling of such a safety valve system:

Heating of the inlet part by means of tracing Body heating by steam jacket Live steam to wash the disc and exhaust piping

b) Corrosive environment The performance of a PSV in a corrosive environment can be severely impaired. All parts of the valve are likely to experience the corrosive environment so each part must be manufactured in corrosion-resistant material. Today safety valves can be constructed from Safurex® making the possibility for corrosion very remote. Provided that suitable construction materials are selected, it is assumed that the safety valves fail in absence of one of the heat sources. It may be clear that this assumption is somewhat conservative, as failure of one of the heat sources will certainly not immediately result in unavailability of the PSV. The probability of failure on demand for a safety valve is stated at 0.005 y-1 (1,2). Assuming a demand frequency of once a year, the base PFD becomes 0.005 failures per demand. The base PFD does not take into account any possible failure on the heating system. Two typical configurations are illustrated in Figures 3 and 4. Figure 3: Heated PSV, traditional design PSV

MIN.

values the arguments must be presented and recorded in the HAZOP report.

STEAM

A safety valve that does not lift at a pressure > 1.5 times the set pressure. 2) Reliability Data Process SHE Guide 14, DW, Heckle ICI Engineering September 1992.

Figure 4: Heated PSV, improved design PSV

FI FAL

MIN.

STEAM

Fault Tree Analysis (FTA) has been used as a quantitative method to calculate SILequivalents for safety valves. By inputting default failures for steam traps, vortex flow meter etc. the calculated PFD’s were determined as shown in Table 4: Table 4: Equivalent SIL for heated safety valves Configuration

PFD

Equivalent SIL

0.03

SIL-1

0.006

SIL-2

Failure of the steam traps has a large impact on the PFD of the safety valve. It is less common to express PFD’s of safety valves in equivalent SIL, because SIL is dedicated to SIS. It does however allow for a quick estimation of the required SIL of the safety instrumented system (SILSIS). For those scenarios where proper functioning of the PSV will prevent the LOC, then the required SIL can be calculated as follows: SILscenario – SILsafety_valve ≤ SILSIS Looking at the P&ID’s and logic diagrams, a first judgment can already be made whether additional SIS is required or not!

Some statistics The most important process features for this study of the urea process can be summarized as follows: - Grass root urea plant - Large scale (3200 MTD) - Stamicarbon CO2 stripping process. - Synthesis configuration including HP stripping / condensing / reaction / scrubbing. - HP scrubbing in explosion proof design. - H2 removal from CO2 by catalytic combustion. - Low pressure recirculation, evaporation and waste water treatment dedicated to a Stamicarbon granulation. - Centrifugal type compression for ammonia and carbon dioxide. The study did not include the CO2-compressor and auxiliaries for HP-pumps. Although strictly the results of this study would apply to the above described plant, many of the conclusions are of a more generic nature, making it useful for other processes. In case of doubt with any particular urea process design, Stamicarbon can be consulted. The urea plant was divided in 24 study nodes. It took about 40 sessions (each session 4 hours) to complete the HAZOP study. In total, 89 LOC scenarios were identified during the HAZOP sessions. A breakdown by SIL classification is given in Table 5. Table 5: Scenario breakdown in SIL SILa LOC

SIL-1 24

SIL-2

SIL-3

scenario’s More than 90% of the LOC scenarios were identified by the “high pressure” key word combination.

SIL-3 scenarios

Conclusions & recommendations

The two SIL-3 scenarios mentioned in the previous table are further explained.

Stamicarbon concluded the following based on this study:  SIL classification is a systematic, transparent and verifiable way of reducing risks to an acceptable level.  Combining HAZOP, SIL assessment and SIL-validation is an effective way to evaluate urea plant safety.  High pressure scenarios are the main potential hazards in urea plants.  The outcome depends on the skills and insight of the team. Changes to the team performing a HAZOP should be avoided.  There is a strong tendency for engineers to design solutions as soon as new problems come to light. This practice should be avoided as the primary purpose is hazard identification and classification.

a) Steam supply to the HP-stripper while blocking in the synthesis: During or after blocking in the synthesis, it is possible that the HP stripper gets filled with liquid. When keeping a high pressure in the HP steam drum, the temperature in the synthesis will gradually rise. Based on equilibrium calculations, the synthesis pressure might increase to 300-350 bar in absence of pressure relief. b) High pressure in the suction of the HPammonia pump at pump failure: In case of a HP-ammonia pump failure, the pressure in the suction of the pump might increase to synthesis pressure despite the presence of check valves and isolation valves. This might lead to a rupture of the suction line, while the booster pump in the ammonia keeps on delivering liquid ammonia to the urea plant.

In only a few instances the default SIL parameters as proposed in this paper were adjusted; the arguments were presented and recorded in the HAZOP report.