FOSHEE (Shell Global Solutions - US) 

Remotely operated isolation valves are used to isolate systems during loss of primary containment to prevent further leakage that can lead to pool fires or vapor cloud explosions. They are manual valves, which are activated by pushing a button on the local panel that is located at a safe distance from the valve. These valves can be motor-driven, pneumatically driven, or hydraulically driven. 

Shell has some standards, called the DEPs (Design and Engineering Practices), which help determine where ROVs (remote-operated valves) are needed for emergency shutdown services. These include inventories of large LPG (liquefied petroleum gas), as well as inventories of hydrocarbon that are above the auto-ignition temperature; or in very toxic services, such as hydrocarbon that contains H2S (hydrogen sulfide).  

ROVs are typically located in the suction piping of the pump to help prevent seal failures. Some typical examples would be in the upstream and slurry pumps in the main fractionator bottoms loop, in the upstream piping of the pump for the debutanizer accumulator, and in the upstream piping of the pump for the depropanizer accumulator. Spurious trips are not usually an issue for ROVs as they are not instrumented. Accidental trips can be an issue, and this is usually prevented via a button guard where you have to lift up the guard in order to push the button. Other types of isolation, such as safety instrumented systems, can have spurious trips which are usually prevented via redundant instrumentation and voting for trip activation, such as two-out-of-three voting.  

Within the last couple of years, Shell has started using remotely operated isolation valves in the reactor overhead line as a means of providing safer isolation at shutdown and startup. The overhead line is still needed for vessel entry but allows us to put in the blind under safer conditions. It is also helped us reduce our shutdown and startup time. Shell has two units with remotely operated valves in the reactor overhead line to the main fractionator. These are special types of double-disc gate valves that use an activated wedge in order to provide a seal in coking service. 

There are some special installation considerations. For instance, you need to have the valve stem in a vertical position, instead of the horizontal position, for these valves due to the size and weight of the valve. Also, there are some trip considerations. There is a locking pin that you have to put in place for these valves to make sure that the valve does not come down on its own weight and close. Permissives are put in place at the DCS (distributed control system) and local panel which prevent the isolation valve from being inadvertently unlocked. You energize the local panel from the DCS via a board operator which then allows the field operator to close the valve at a local panel.  

 

SINGH (Indian Oil Corporation Limited) 

The local regulations governing each site regarding the requirement of ROVs are different; therefore, licensors normally do not specify these ROVs. They are specified by the EPC (Engineering, Procurement, and Construction) contractor who is usually familiar with the specific regulations or requirements of the site. In our older plants, we have adopted a few changes to increase safety. We have done this by adding actuators to the existing block valves and converting to fire safe valves, as well as by relocating such isolation valves away from fire-prone areas to safer areas; e.g., away from the pump seals and not beneath the towers.  

In our newest FCC plant, in the 300,000-bpd refinery that is currently under commission, ROSOVs (remotely operated shutoff valves) have been installed in the FCC and other units. The consideration has been based on the flammability of the fluid, operating temperature being above the auto-ignition temperature, flammable fluid being handled above the flashpoint, and the extent of vapor generation in the event of flashing, as well as the volume of stored flammable liquid and pressure. 

The general guidelines we follow for our new units include the use of ROSOVs in pump suction lines for hydrocarbon liquids above flashpoint and if the flammable liquid inventory is more than 30 metric tons. For LPG, the limit is 4 metric tons. These ROVs are installed outside of the fire zone to allow access for maintenance. The closing time considered was typically 5 to 15 seconds, depending upon the valve size. For high pressure systems and services like LPG, faster closure of ROSOVs is desired.  

While installing ROSOVs, precautions should be taken to ensure that these valves are rated for pump shutoff pressure for parallel pumps. In our experience, spurious actuation of ROVs is not common. These valves are operated through an emergency shutdown system, which is different from the DCS (distributed control system). Manual activation using a double-push button is typically used to avoid spurious shutdown. A partial valve-stroke testing mechanism is provided in ESD valves, which has an intelligent diagnostic system to report any problems in advance. 

 

LARSEN [Marathon Petroleum Corporation (MPC)] 

Marathon uses a similar kind of risk-based system to decide where to install EIVs (emergency isolation valve) in its FCC units as well. Our normal standard locations are in the main column bottoms at the slurry pumps and around the wet gas compressor. As with anything else, it is decided by the risk-based scoring system we use.  

I want to highlight a few of the spurious trip items. I looked in our incident investigation database, and a few of the items that turned up were ones you might not think of or consider in EIVs. A couple of problems were with the start/stop switches and occurred when the switch was full of water, shorted the circuit, and tripped an EIV. Another was a junction box on the valve which was not sealed properly and filled with water. A few others occurred when a limit switch was in the wrong position, which caused the EIV to trip. So pay a lot of attention to the entire EIV system. The interconnecting components and everything else need to be in just as good shape to prevent any of these spurious trips. Those were just some of the Marathon experiences I wanted to share. 

 

JAMES (JIM) PROROK (Husky Energy Inc.) 

Since they are not SISs, do you have a regular testing program, such as testing and inspection of the operability of the valve? Do you end up having to put bypasses in them? 

 

LARSEN [Marathon Petroleum Corporation (MPC)] 

I know that we do test our systems. If it fails the test, the frequency that you will have to test will get shorter to provide a positive, successful test. 

 

SANJIV SINGH [Indian Oil Corp Ltd. (IOCL)] 

The remote-operated isolation valves have different names like EIV (emergency isolation valve), EBV (emergency block valve), ESD, ROV, and ROSOV. They all refer to the same types of valves which can be remotely operated to arrest loss of containment from vessels, column bottoms, etc. Remote operated valves make the plant safer if installed and used correctly and if HAZOPs/safety review are completed to ensure that these reduce hazards rather than introducing hazards. Also, the local regulations governing each site regarding the requirement of ROVs are different; and therefore, licensors normally do not have a default design for them. They are specified by EPC (Engineering, Procurement, and Construction) who are familiar with site-specific regulations and requirements as a part of the detailed design. Inventory holdup, flash point, auto-ignition temperature, and LPG holdup (or similar volatile materials) are the basic criteria for deciding the requirement of remote-operated inventory isolation valves (mainly pump suction lines) inside FCC unit. The philosophy is adopted in various other units also. While a dedicated isolation valve is more dependable, many refiners use conventional process valves already provided with the following changes:  

1. Adding actuators, 

2. Converting to fire-safe valves, and 

3. Locating ROSOVs away from likely fire areas (e.g., away from pump seals, not beneath towers, etc.). 

At the latest 300,000 bpd refinery of IOCL (under commissioning), ROSOVs have been installed in the FCC and other units. In older refineries of IOCL, ROSOVs were not installed in process units from the initial stage but were added at a later stage, depending upon the hazard assessment. Design philosophy followed in this regard is developed based on Best Practices. The precautions to be considered are based upon flammability of fluid, operating temperature being above or below auto-ignition temperature, flammable fluid handled being above its flash point, extent of vapor generation in the event of liquid flashing, volume of stored flammable liquid, and storage pressure. 

Accordingly, the recommended precautions include the use of glandless pumps, tandem and double mechanical seals, remotely operated isolation valves, and equipment spacing to allow for higher risk pumping. 

General guidelines followed for our new process units include: 

• For hydrocarbons liquid above flash point, remote-operated isolation valves are installed at the pumps’ suctions if the inventory is more than 30 MT (metric tons) of flammable liquid. The limit is 4 MT for LPG or similar materials. 

• If inventory is between 5 and 30 MT, ROSOV is required if the fluid is above auto-ignition temperature. 

• Below 5 MT inventory, ROSOV is normally not used. 

• ROSOV should be located outside the fire zone to allow remote isolation. Its location should be accessible for maintenance. 

• Closing time is normally 5 to 15 seconds, depending upon valve size. For high pressure systems (like LPG), quicker closing is required. 

• Pump suction ROSOV should be rated for pump shut off when there is more than one pump and especially if there is warm up bypass. 

Spurious actuation of ROVs is not envisaged as they are operated through the emergency shutdown system (separate from the DCS). Manual actuation using double push buttons also avoids spurious actuation. Partial valve stroke testing mechanism is provided in ESD valves which has an intelligent diagnostic system to report problems. Partial stroke initiation is from the DCS and is capable of transmitting full valve diagnostics and predictive maintenance data to the DCS Asset Management System. Various other features are built in these valves for more fail-safe condition. 

 

NIKOLAS LARSEN [Marathon Petroleum Company (MPC)] 

Valves used for emergency isolation might include standard gate, globe, and check valves, as well as remotely actuated valves such as process control valves, safety instrumented system (SIS) valves, etc. Emergency isolation valves provide the means to quickly isolate these large quantities of toxic or flammable materials (Note: It is impractical to install EIVs to isolate every piece of equipment that might leak.) and are installed only when the chance of a leak is significant, or the consequences are serious. Inventory is an important factor, but industry experience and good engineering judgment are vital. 

When adding an EIV, it is important to also keep in mind that the impacts of failure or activation of the EIV on the relief system design and overpressure protection must be evaluated. MPC considers technology licensor design practices involving EIV application and also uses a combination of decision tree, qualitative, and quantitative risk assessments for EIV evaluation. Decision trees are used to recommend further risk analyses or exclude EIV locations. Our Qualitative Risk Assessment process uses a point system where risk is assessed by determining which factors to consider. It then assigns a point value rank to each factor, determines a screening analysis subtotal, applies credit for any mitigation systems that reduce risk, and calculates the point total to compare with risk tolerance. An example is shown in the table. 

 

 

FACTOR	DESCRIPTION
Quantity	The mass of material the EIV will isolate in the event of a component failure.  Example: Vessel liquid bottoms inventory and piping to pump, etc.
Material	Type of material in process section to be isolated.
Pressure	The maximum normal operating pressure for the section to be isolated.
Equipment History	Past problems of the equipment being evaluated will increase the risk. New equipment will have zero risk factor.  Requirement: Use operating data and maintenance work order history.
Onsite and Offsite Impact	The potential to affect the health, safety, and environment outside the refinery. HAZOPs have addressed these issues and should be used.

 

MPC tests all remotely and manually (globes, gates, etc.) operated isolation valves with a frequency sufficient to assure reliable operation. We also document test procedures and test frequency in each refinery’s Mechanical Integrity program. The test frequency may be reduced if warranted by continued successful operation, but it must be increased with the appropriate mechanical integrity steps taken if misoperation occurs. Below is a typical process flow diagram with recommended minimum EIVs for MPC FCCs. 

 

 

MPC has encountered spurious trips/activations of EIVs. Below is some information related to each event and corrective actions that were taken to attain a resolution: 

• Sudden loss of pilot gas to pass #1; EIV shut due to an electrical malfunction which was caused by an accumulation of rainwater in the valve's electronic connections. The junction box was missing the O-ring for sealing water out of the valve. 

• EIV on discharge to pumps closed causing the bottoms flow to the heater to stop causing the heater to trip. When prompted, the positioner (analog feedback) did not work; positioner was replaced. 

• The suction EIV for the recycle H2 cylinder on 8-C-1 showed a false closed position. This caused the 8-C-1 to shut down. The limit switch was not in the correct position. The Instrument mechanics made a routine adjustment to the switch in a couple of minutes and returned the instrument to service. This was the first failure after eight years of operation. 

• EIV failed closed on propylene rundown due to faulty level instruments. The underlying issue with the poor performance of the level transmitters stems from the installation. These instruments were not installed in compliance with the manufacturer recommendations. The tank was drained and decontaminated. Construction removed and reinstalled the level transmitters to meet the manufacturer's installation requirements.  

• Outside operators discovered that the acid recontactor acid boot EIV MOV had closed, confining the acid in the recontactor and not allowing the recycled acid to return to the acid settler. After reviewing the data log history, the valve software indicated a defective main PC board. The main board was replaced and function-tested, and the actuator was turned back over to Operations. 

• Off gas compressor suction EIV closed resulting in an ESD activation. The EIV Start/Stop switch was filled with rainwater. The wiring conduit for this switch is pointing upward with an open end, and the ½” drain at the lower end was clogged up; therefore, rainwater filled up the conduit and shorted out the circuit.