Embed Size (px)
Citation preview
*The views in this paper are entirely the authors and do not necessarily reflect the views of BP America
Production Company or its affiliates.
MORE THAN MEETING SPEC: EXAMINATION OF RECENT
PROCESS SAFETY INCIDENTS IN GAS CONDITIONING SYSTEMS
SHOULD BE CAUSE FOR PAUSE
Brian Pack, P.E.
*
BP America Production Company
501 Westlake Park Blvd
281-366-1604
Aubry Shackelford, P.E.
Inglenook Engineering, Inc.
15306 Amesbury Lane
Sugar Land, TX 77478
713-805-8277
ABSTRACT
Review of several Upstream natural gas liquids (NGL) processing facilities, onshore gas
conditioning and dew point process facilities, booster compressor stations, and offshore
production platforms and FPSOs can offer designers of gas conditioning systems, such as
glycol dehydration systems and amine sweetening systems, lessons on process safety that
should be fundamental to any design of these systems. In particular, this paper evaluates four
industry process safety examples of possible inadequate overpressure protection design
related to amine sweetening, glycol dehydration, and molecular sieve dehydration systems.
The examples reflect systematic design issues in traditional gas sweetening overpressure
protection analysis and reveal opportunities for improvement in future designs. Further, this
paper provides an analysis of other design conditions that should be verified regarding
overpressure protection within typical gas conditioning systems based on prior weaknesses
identified in these designs by the Authors. It is the Authors’ goal to raise awareness that the
design intent of gas conditioning systems must be more than just meeting process
specification but must consider robust process safety features due to in-situ hazardous
materials and often harsh process conditions such as high operating pressures and
temperatures and corrosive environments.
SYNOPSIS
As illustrated by recent process safety related incidents and near-misses, designs of gas
conditioning systems must consider robust process safety features, including overpressure
protection.
323
MORE THAN MEETING SPEC: EXAMINATION OF RECENT
PROCESS SAFETY INCIDENTS IN GAS CONDITIONING SYSTEMS
SHOULD BE CAUSE FOR PAUSE
Brian Pack, P.E.; BP America Production Company; Houston, TX
Aubry Shackelford, P.E.; Inglenook Engineering, Inc.; Sugar Land, TX
Introduction
In 2006, the AIChE’s Center for Chemical Process Safety (CCPS) published the
second edition of an industry-wide study called “The Business Case for Process Safety” [1]
that identifies significant ways in which a business benefits from a vigorous process safety
program: as a means for enhancing the public’s perception of a company’s corporate
responsibility, as a useful element in ensuring a company’s business flexibility, as a direct
means to reducing risks to the company, and as a means for sustaining the value of a
company. These key items impress upon various industries the value of process safety, even
when a particular industry or operating facility is not specifically covered under the
Occupational Safety & Health Administration (OSHA) Process Safety Management (PSM)
standard 29 CFR 1910.119 Management of Highly Hazardous Chemicals, such as many gas
conditioning units. Despite some gas conditioning units not being covered under the PSM
standard, Owner/Operators in the United States are still accountable to act in accordance with
the “general duty” requirements of the Occupation Safety & Health Act of 1970.
One important element in a PSM program is the overpressure protection and effluent
handling systems that are designed to protect equipment and personnel from consequences
such as catastrophic failure or release of materials, due to abnormal pressures. In the U.S.
Chemical Safety and Hazard Investigation Board’s 1998 investigation into the explosion at
the Temple 22-1 Common Point Separation Facility in Pitkin, Louisiana [2], the final report
recommended that the oil and gas operator “institute a formal engineering design review
process for all oil and gas production facilities, following good engineering practices and
including analyses of process hazards; implement a program to ensure that all oil and gas
production equipment that is potentially subject to overpressurization is equipped with
adequate pressure-relief systems, and audit compliance with the program; and develop
written operating procedures for oil and gas production facilities and implement programs to
ensure that all workers, including contract employees, are trained in the use of the
procedures…” The findings of the investigation echo the importance the Owner/Operator
has in embedding the sound process safety design philosophy inherent in the PSM standard,
even if the processes in question are not specifically governed by the regulation.
Another important element in a PSM program, and for process safety in general, is
embedding the philosophy of inherently safer design (ISD), where a process is made safer as
part of the design itself, during the facility or process’s concept stage. In response to the U.S.
Chemical Safety and Hazard Investigation Board’s 2008 investigation into the explosion at
the Bayer CropScience facility in West Virginia [3], the United States Congress directed the
Chemical Safety Board (CSB) to commission the National Academy of Sciences to
investigate the application of ISD, and the CSB has subsequently called for Industry to apply
324
the principles of ISD. According to CSB Chair Rafael Moure-Eraso, “the principles of
inherently safer processing can be an effective way for chemical companies to eliminate or
reduce hazards, prevent accidents, and protect nearby communities.”
The CCPS, in its comprehensive book on the topic states that, “Inherent safety is a
concept, an approach to safety that focuses on eliminating or reducing the hazards associated
with a set of conditions…if it reduces or eliminates the hazards associated with materials and
operations used in the process and this reduction or elimination is permanent and
inseparable” [4]. Trevor Kletz has outlined the concept of minimizing process hazards as
opposed to simply controlling them in his work to identify and reduce process safety
incidents [5], and the technology and implementation of ISD continues to evolve and to
receive greater exposure. The four oft-cited tenets of ISD consistent with Kletz’ original
work and subsequent elaboration on the topic by the CCPS are: substitution (replacing one
material with another that is less hazardous), minimization (reducing the amount of
hazardous material in the process), moderation (using less hazardous process conditions such
as lower pressures or temperatures), and simplification (designing processes to be less
complicated and less prone to failure as a result). Application of these principles has led to
significant improvements not only in reducing the potential for process safety incidents, but
also in the design and operation of these processes. It is important, however, to recognize
that these principles are better incorporated during design as adding inherent safety features
to an existing facility may not always be justified from a risk and economic investment
standpoint [4].
In this article, several recent examples are reviewed to highlight specific instances of
issues related to overpressure protection and effluent handling systems as well as
opportunities for embedding the ISD concept in engineering molecular sieve dehydration,
glycol dehydration, and amine sweetening units. In addition, a general overview of
frequently encountered issues in the design of the protective systems for these gas
conditioning units is provided. It should be noted that each conditioning unit installation
may have unique aspects that are not considered in the general overview, that commonly
required aspects are not touched upon in this analysis, and that formal engineering design
reviews and effective hazard analyses are required when designing the protective systems for
these units; nonetheless, the intent is to provide some additional considerations, based on
experience and review of varying configurations for the aforementioned gas conditioning
units, for those conducting engineering design reviews and hazard analyses on these units.
These examples related to overpressure protection and effluent handling re-emphasize the
need to raise awareness that designs of gas conditioning systems must be more than just
meeting process specification – the designs must consider robust process safety features due
to in-situ hazardous materials and process conditions.
Molecular Sieve Dehydration
Introduction
Molecular sieve technology is common in Upstream processing facilities throughout
the world. Molecular sieve units are used to separate water from natural gas, separate
contaminates, such as mercaptans, from natural gas liquids (NGLs), and can be used in
325
cryogenic plants to separate small amounts of CO2 from N2-rich natural gas upstream of the
Cold Box. Molecular sieve technology is based on the fundamental separation principle of
adsorption. Adsorption requires design of a solid structure (sieve media) such that the
desired molecule (contaminant) to be adsorbed preferentially binds to the solid structure.
Unlike absorption where the molecule is dissolved into the solution of the absorbent,
adsorption does not physically alter the structure of the molecule but only serves as a
binding-agent while the other non-preferential material passes through. The adsorbed
molecule is then released (regenerated) by either increased heating (breaking the bond
established from the surface tension) or decreased pressure.
The molecular sieve process is carried out in a multi-bed packed-column arrangement
where one (or many) bed(s) operate(s) in adsorption while one (or many) bed(s)
simultaneously operate(s) in regeneration. Mole sieve separation is a batch process because
it takes time for the desired separation molecule to generate during the heating or
depressuring cycle. Typically, mole sieve cycle times are 8 to 12 hours. By using more than
one bed, the operation becomes continuous in principle since one bed is in adsorption and the
other bed is in regeneration. When the regeneration cycle is complete, either automatically
or manually, the cycles are reversed—the bed in adsorption goes into regeneration while the
newly regenerated bed receives the feed containing the molecule in need of adsorption.
Figure 1 below shows a typical mole sieve set-up, obtained from Figure 20-80 of GPSA
Engineering Data Book, 12th Edition [6], and will form the basis of the case study examined
in this section of the paper.
Figure 1 - General Representation of Molecular Sieve Process
In Figure 1, Bed 1 receives the wet feed gas from the feed gas separator, while Bed 2
is isolated from the feed. Bed 2 is receiving hot regenerated gas, usually feed gas that is
heated by a regeneration gas heater. The heat media for the regeneration gas heater may be
hot oil, glycol, or even direct fired-natural gas as depicted in the figure above. The
326
regenerated gas flows upward through the bed and departs the top of the bed where it is
cooled via an overhead condenser and the desorbed water is collected and disposed.
While this operation seems simple and straight forward, there are a number of issues
to consider when operating mole sieve units as cited in the literature. One textbook lists the
following to be aware of when using mole sieve technology.
“Under normal operating conditions, the usable life of desiccant ranges from one to
four years…Abnormally fast degradation occurs through blockage of small pores and
capillary openings from lubricating oils, amines, glycols, corrosion inhibitors, and other
contaminants, which cannot be removed during the regeneration cycle. Hydrogen sulphide
can also damage the desiccant and reduce its capacity.
“Operating problems with the solid-desiccant dehydration include:
• Space adsorbents degenerate with use and require replacement.
• Dehydrating tower must be regenerated and cooled for operation before another
tower approaches exhaustion. The maximum allowable time on dehydration
gradually shortens because desiccant loses capacity with use.
“Although this type of dehydrator has high adaptability to sudden load changes,
sudden pressure surges should be avoided because they may upset the desiccant bed and
channel the gas stream resulting in poor dehydration” [7].
The author does not mention safety issues that may be created by design, which can
sometimes lead to unintended consequences as a result of the nature of the process. The
author points out, and discusses at some length, the precision involved in the mole sieve
dehydration process. The timing of the regeneration and cooling cycles is precise and
changes as the sieve media becomes spent with age. He speaks of pressure control and how
it is important in preventing bed channeling, and where control is poor, how it contributes to
“clumping” of media in the column, which can drive additional pressure drop. These two
areas are just a couple of instances where “operational” concerns can reveal themselves as
design flaws where adequate overpressure protection was not provided, possibly leading to
compromising the integrity of the equipment.
Incident Description – Switching Valve Failure
This portion of the paper will focus specifically on the first operational consideration
mentioned, the precise nature of the switching valve behavior. An example will be described
in which the switching valves failed, resulting in the overpressure (but not loss of
containment or equipment integrity) of the downstream regeneration system.
The nature of the batch operation and the switching between adsorption, regeneration
or cooling cycles requires a level of reliability in the control scheme that may be overlooked.
If the overhead valve on the bed in regeneration sticks open during a change from adsorption,
high pressure gas is suddenly introduced into the bed intended for low pressure hot
regeneration gas. The adsorption and regeneration systems should be designed to
accommodate the failure of the switching valves during changeover from drying to
327
regeneration in order to alleviate this concern. The designs should consider the temperature,
volume, and pressure changes that may occur during this failure.
Three gas production facilities having a mole sieve arrangement similar to that shown
in Figure 1 were reviewed during a relief system design basis calculation revalidation
process. During the review, it was noted that two of the three facilities had regeneration
systems rated at pressures substantially lower than the mole sieve beds. The third facility’s
regeneration system was rated for the same pressure as the mole sieve beds, and so was less
likely to experience adverse pressures due to a failure of switching valves during the
adsorption/regeneration cycle. While it may be common to design the regeneration system at
a lower pressure than the drying section of the mole sieve unit, the overpressure protection
scheme should be designed to accommodate failures across this pressure boundary interface.
Design of the drying and regeneration sections to the same pressure is a result of putting ISD
concepts into practice.
At one of the facilities where the regeneration system was not rated to the same
pressure as the drying section a flaring event occurred. The downstream regeneration system
was protected by a single rupture disk located on the overhead piping of the regeneration gas
scrubber, and this rupture disk burst in response to the pressure spike produced as a result of
upstream switching valve failure. Pressure continued to rise in the flare header/knock-out
(KO) drum requiring Operations personnel to take action to cut the feed to the mole sieve
beds, stemming the overpressure event. While it is important that no physical or sustainable
adverse consequence resulted (outside of having to replace the burst disk), the event resulted
in mechanical equipment exceeding its specified operating design limits for a short duration.
One of the overhead switching valves spuriously tripped open, allowing 600 psig
inlet gas to flow into the regeneration system operating at 65 psig. The regeneration system
itself pressured up rapidly from 65 psig to the burst pressure of the rupture disk at 200 psig.
Figure 2 below shows a representation of the process.
Figure 2 - Representation of Mole Sieve Process for Switching Valve Failure Incident
328
The relief basis indicated that the downstream rupture disk protecting the
regeneration system is sized for blocked flow from the inlet gas. Because the switching
valve misalignment does not appear to have been considered in design, the relief header was
not suited to handle the initial transient flow across the open valve at upstream operating
pressure. In the event a switching valve fails open at normal upstream operating conditions
the relief capacity is approximately four times the rate determined for the blocked flow case.
The flare header is rated (limited by the pressure rating of the KO drum) to a capacity less
than the rate produced by the switching valve failure. Figure 3 shows a more detailed
representation of this switching valve failure case.
Figure 3 - Regeneration Process at Incident Conditions
The design data obtained during the review did not consider the failure of the
switching valve during normal operations. Because the documentation for the justification
behind not considering this a valid case for overpressure was not found during the review,
any reason suggested here is conjecture. However, one of three reasons is likely possible:
1) The designers did not believe the failure of the switching valves was very likely.
2) Only a consideration was made for steady state rate during the failure as opposed
to the initial transient flow (more on this in a minute).
3) Transient flow was considered and it was decided that the design would not be
based on a condition that resulted in possible hazardous conditions for a short period
of time (more on this as well).
Whatever the actual reason, it does highlight the fact that overpressure protection is
not necessarily a black and white science, as there can be subjectivity and judgment that
informs the basis for the relief protection philosophy. If the reasons were either (2) or (3)
this would be a decision the original designers took from a risk position. Not considering the
higher transient flows resulting from switching valve failure involves an acceptance of the
notion a deviation from design can occur, but the likelihood and duration are sufficiently low
that it should not govern the basis for design of the flare. While this may be acceptable to a
given Owner/Operator, the lack of documentation does not help when a revalidation of
design may occur many years later.
329
The main drivers resulting in the higher transient relief load from switching valve
failure are the volumetric imbalance and pressure imbalance (driving a difference in fluid
density). The volume upstream of the switching valve is approximately 1.3 times greater
than the gas expansion volume available in the regeneration section (including the flare
header). The depressuring of this volume at operating pressure to relief conditions across the
fixed flow area of the failed-open switching valve is a much larger rate than the steady state
flow rate into the plant. Once the upstream stored volume is exhausted from the higher
depressuring rate, the relief requirement becomes the steady state rate. These two factors
explain why the pressure continued to rise when the rupture disk burst in the example
discussed here.
So summarizing the relief scenario:
1) One dryer is in regeneration mode.
2) Gas flow from the inlet and through the regeneration system is at normal inlet
conditions.
3) Switching valve on the dryer in adsorption fails open.
4) High pressure inlet gas from the dryer in adsorption and the resident regeneration
gas flowing through the bed in regeneration begin to fill up the regeneration system
(cooler and scrubber).
5) The higher transient flow of approximately four times steady-state inlet rate flows
across the failed switching valve and into the regeneration system.
6) Pressure in the regeneration system increases causing the rupture disk to burst and
the pressure in the flare system to continue to rise.
7) Inlet flow is stopped, stemming the rising pressure in the flare system.
Modeling performed later supported the bottleneck existing in the relief system
during a switching valve failure. A HYSYS depressuring model was built to simulate the
transient conditions described above. The results of the model are summarized in Figure 4
below. When a switching valve fails open, there is a period of less than two minutes where
rates and pressures exceed the capacity of the flare system before steady state conditions are
returned. It is during this transient period the integrity of the relief system may be subject to
compromise. While each Owner/Operator needs to consider its philosophy for handling
transient conditions, it was deemed unacceptable for this facility not to provide overpressure
protection for this case, and a team was formed to resolve the issue. Though it likely would
not have altered the decision to modify or accept this original design, the inability to find
documentation supporting the decision to not consider switching valve failure a credible
overpressure case is important and stresses the need for the development and lifecycle
maintenance of thorough documentation for the basis of overpressure protection. Much care
was taken to maintain the basis for the operational design of the mole sieve (original
operations and maintenance manuals are existent and in continued use), and the relief design
basis must be treated in like manner such that it stays evergreen for the full facility lifecycle.
330
Figure 4 - Simulated Flow Rate (lb/hr) Profile vs Time (sec) under Relief Conditions
A number of proposed solutions were considered and though much could be learned
from this process, this paper does not allow for the time to delve into these options. A few of
the more salient proposed solutions that were investigated are listed below with the last
option being that which was selected for design and installation:
1) Replacement or addition of smaller trim in the switching valves.
2) Installation of a high integrity pressure protection system (HIPPS) on the
regeneration overhead.
3) Replacement of existing switching valves with valves rated for the identified safety
integrity level (SIL) as determined by a layer of protection analysis (LOPA).
4) Replacement of the flare KO drum and debottleneck a section of the flare header.
5) Addition of a restriction orifice to reduce the flow through the switching valve and
addition of a new rupture disk to protect the regeneration system.
As mentioned earlier, a second facility’s mole sieve unit had a similar arrangement to
the one discussed in this section of the paper. Further investigation of the relief design basis
for this unit revealed the same problem. Modeling further supported the hypothesis that
during full-open failure of the overhead switching valve at normal operating pressures, the
regeneration system would experience pressures in excess of its MAWP. The solution at this
facility was a little different because the flare capacity was not constrained by the
overpressure event, as was the case in the facility reviewed here. The resulting design
solution was simply replacing the existing relief valve protecting the regeneration system to
an appropriately sized relief valve for the switching valve failure case.
331
This evaluation revealed an issue in the fundamental design of the mole sieve system
and regeneration system and serves as a good reminder that all credible overpressure
situations should be considered and documented during design of the process unit and that a
facility must consider due diligence in full lifecycle maintenance of these records. Where
possible, ISD features should be considered (i.e., providing the same pressure rating for
drying and regeneration sections) or, at a minimum, the design should allow for the provision
of appropriate overpressure protection systems.
General Awareness Considerations
Figure 5 below shows an example process flow diagram for a solid desiccant
dehydrator twin tower system adapted from Figure 20-80 of GPSA Engineering Data Book,
12th Edition [6]. The process flow diagram shows several areas of additional emphasis.
Figure 5 - Example Solid Desiccant Dehydrator Twin Tower System
Valve misalignment – As described in the case study above, valve misalignment can
cause flow from the adsorbing beds into the regenerating beds with a potentially high initial
transient flow. Depending on the design and state of the systems, overpressure of the
downstream regeneration system may occur. In addition, other effects may need to be
considered, including those associated with rapid pressure and/or temperature changes.
Equivalent design pressure for the regeneration system – When feasible, the design
pressure for the mole sieve towers is specified at or above the maximum inlet gas pressure
achievable. As suggested in the case study above, the equipment in the regeneration system
should also be specified at or above the maximum inlet gas pressure, despite its operation at
lower pressures. This ISD may prevent blocked outlets or inadvertent lineups of the
regeneration system from overpressuring the equipment by the inlet gas.
Regeneration compressor suction pressure – In the event of a blocked outlet on the
regeneration gas compressor, the flow to the compressor and the pressure drop in the
upstream mole sieve towers will decrease. This results in a potential increase in the suction
pressure on the compressor, which directly translates into a higher discharge pressure. If ISD
332
tactics are employed, the equipment between the compressor and potential sources of
blockage need to be designed to handle this potentially higher shut-in pressure.
Proximity of fired heater – The proximity of the fired heater to discharges to
atmosphere that may contain flammable gas should be considered. The fired heater may act
as an ignition source, and the dispersion of the relief effluent should be sufficient to prevent a
flammable atmosphere from developing near the fired heater. This design consideration is
discussed in more detail below.
Hydrate formation – The potential for hydrate formation, especially at cooling
locations with high water content such as the regeneration gas cooler, should be considered
as a potential mechanism for blockage.
Low temperature discharge – The pressure relief or depressuring of product from the
mole sieves can result in low temperature discharges into the effluent handling system.
Glycol Dehydration
Introduction
Glycol dehydration is a separation technique used in Upstream and Downstream
operations. It is the most popular form of drying technique within Industry for removal of
water from natural gas and NGLs. Glycol dehydration is a form of drying carried out based
on the principle of absorption, unlike the mole sieve process already discussed. As opposed
to adsorption where impurities preferentially attach to a solid media, absorption is a chemical
process where impurities are chemically saturated into the transport medium (glycol in this
case). In glycol dehydration water is removed from natural gas by maximizing contact time
for mass transfer in packed or trayed columns. Typically triethylene glycol (TEG) is used for
dehydrating natural gases, though other glycols such as ethylene glycol or diethylene glycol
(DEG) have been used. It remains the most common form of drying technique in gas
conditioning processes within Upstream and Downstream operations because it is
economically more attractive than adsorption processes and usually capable of meeting the
required product specification (water dew point for pipeline transport) [7].
Figure 6 shows a typical representation of a glycol dehydration system. The
following process description is based on the equipment shown in Figure 6 as taken from the
Natural Gas Engineering Handbook [7]. Gas enters the dehydration contactor through a two-
phase (or three-phase) inlet gas scrubber, or additionally a coalescer may be provided, to
remove as much entrained liquid hydrocarbons as possible. The gas enters the contactor at
the bottom of the column and flows upward where it contacts the falling glycol on the trayed
or in the packed sections of the column. The gas flows down through the vertical cooler on
the side of the contactor where it is cross exchanged with the hot regenerated glycol before it
enters the contactor. The dry glycol (often described as the “lean glycol” stream because the
absorbed water has been liberated in the still or regenerator column) enters the top of the
contactor and flows down each tray where it contacts the feed gas. The wet glycol (often
described as the “rich glycol” stream because it contains the absorbed water from the feed
gas) exits the bottom of the column, passing through a particulate filter before being pumped
333
into the low pressure flash separator where entrained feed gas is liberated. The rich glycol
continues through to the tube side of the heat exchanger surge tank and enters the top of the
stripping still of the glycol regenerator. As the rich glycol flows down the stripping still (also
known as a stall column) it contacts hot rising glycol and water vapors exiting the reboiler.
The glycol flows through the reboiler and is heated to approximately 350 °F to 400 °F to
remove the absorbed water vapor. The now lean glycol exits the reboiler into the shell side
of the heat exchanger surge tank and is pumped back to the bottom of the glycol cooler
before entering the top of the contactor to begin the drying process again.
Figure 6 - General Glycol Dehydration System
The aforementioned text book discusses a number of issues with the design and
operation of the glycol dehydration system shown in Figure 6; however, as was the case with
the mole sieve operations book discussed already, there is no discussion of safety related
concerns. Most of the discussion centers on how to prevent operational issues such as
particulate contamination through high temperature deposition from degraded glycol,
foaming from liquid hydrocarbon, glycol losses, or freezing. Two areas that can drive
process safety incidents discussed are overtemperature of the glycol in the reboiler and
corrosion due to deposition from degraded glycol. However, the author discusses these
issues based on how they drive operational concerns and not safety concerns [7].
Like the previous discussion on molecular sieves, there are safety related elements in
glycol design, especially in regard to overpressure protection and facility siting issues that
should be addressed in the design and operation of these systems. The following sections
discuss an example related to an offshore glycol plant and then general process safety related
problems, as observed from the review of a number of glycol plants.
Incident Description – Proximity to Fired Heater
In a typical glycol dehydration unit, the water is separated from the glycol in a Still
that is open to the atmosphere, where the water vapor exits the system, and the heat supply to
the reboiler is commonly a direct fired gas heater, having an exhaust flue stack that may be in
334
close proximity to the atmospheric discharge from the Still. During various process upsets,
the effluent leaving the Still may not be all water vapor, and instead may contain flammable
materials, and the flue stack can provide an ignition source for that flammable material. In
an example from 2006, a level alarm on a flash separator prompted a shutdown and
subsequent drainage of the flash separator. Unfortunately, this drainage was not complete as
condensate was present in the separator during restart of the unit, and this condensate was fed
into the glycol recovery Still. Upon contact with the heated glycol/water system, the
condensate started boiling and exited into the atmosphere via the normal vent on the Still.
The condensate discharge contacted the nearby uninsulated flue stack, which served as an
ignition source, and a fire occurred.
Figure 7 – Representation of Glycol Dehydration System for Fired Heater Ignition Incident
This example illustrates a common approach to design where the hazard analysis is
limited to considerations based solely on the normal mode of operation. In the typical design
for a glycol reconcentration system having a direct fired gas heater, having the exhaust flue
stack from the heater in close proximity to the atmospheric vent from the Still is not even
considered as a potential hazard in relation to the effluent from that vent because the normal
vented material is water vapor. As seen in this example, various process upsets can cause
flammable materials to exit from the vent, and the flue stack can then be an ignition source.
The example reinforces the need for the design to consider ISD elements. While
physical separation is not always achievable in an offshore environment, the proper modeling
must be considered up-front to determine safe design distance for equipment where
interaction (such as the release of the flammable vapor) of hazardous conditions between the
equipment is minimized. Where the hazard cannot be eliminated due to spacing constraints
offshore, for example, the design should move to the next path in the ISD model which is
minimization. For this example, the effects of the hazardous condition may have been
prevented by installation of a shielding wall. If such a wall was prohibitive due to its weight,
335
often a siting issue for offshore platforms, then control elements may need to be considered
(such as more robust gas or fire detection).
No matter the situation following the ISD methodology early in project development
helps the design provide support through documented rationale for design features related to
safety that are invaluable to the lifecycle operation of the facility. This example further
emphasizes the importance of the initial design hazards identification review. As stated,
abnormal operations were not considered in the design. Whether it was considered and
rejected is not apparent from the review of the incident. The investigation notes at a
minimum do not mention such documentation. The right people—such as operations,
engineering, process safety, and/or maintenance staff—must be involved during the early
hazards reviews in projects, even in the installation of somewhat simple gas conditioning
units such as glycol dehydration.
General Awareness Considerations
Figure 8 below shows an example process flow diagram for a glycol dehydration
system adapted from Figure 20-67 of GPSA Engineering Data Book, 12th Edition [6]. The
process flow diagram shows several areas of additional emphasis.
Figure 8 - Example Process Flow Diagram for Typical Glycol Dehydration Unit
Proximity of fired heater – As illustrated by the figure above, the proximity of a
fired heater to atmospheric discharges that may contain flammable materials should be
considered. This is particularly pertinent to the product breakthrough case discussed below
where the normal water vapor discharge may instead be a flammable material.
336
Ice/hydrate formation in effluent – The rich glycol can contain a significant amount
of water, which may be present in the flash gas. In the event the discharge from the separator
is opened to a collection system (e.g. flare system), the conditions for ice and/or hydrate
formation may be present with the flow of free water, low molecular weight hydrocarbons,
and low temperature brought about by means of the Joule-Thompson cooling or auto-
refrigeration of the discharged fluid from higher pressure within the separator to lower
pressure in the collection system. Ice and/or hydrate formation is a mechanism for blockage
of the collection system piping, which may compromise the integrity of the system and
associated equipment. In addition, the blockage is likely to be common with the pressure
relief devices on equipment nearby the separator, thus compromising the overpressure
protection for that equipment as well. With a common blocked outlet, multiple pieces of
process equipment can experience overpressure for which there may be no appropriate relief
path.
Product breakthrough – As described in more detail in an example below, there is
the potential for the level of rich glycol to be lost, either by insufficient supply of lean glycol
to the Contactor or, more commonly, excessive withdrawal of rich glycol (e.g., level control
valve failure open), with subsequent flow of the product (“breakthrough”) into the glycol
regeneration system. If there is a Flash Tank (as shown in Figure 8) then the description
above is a scenario that affects the Flash Tank, and an additional breakthrough scenario may
need to be considered from the Flash Tank to the Reconcentrator (Reboiler / Still system).
Liquid overfilling – As described in more detail in an example below, there is the
potential for the level of rich glycol to exceed the top of the Flash Tank, depending on the
total glycol inventory and available volume within the Flash Tank.
Direct discharge to atmosphere does not automatically equate to adequate
overpressure protection – The water vapor outlet on the Still is commonly routed directly to
atmosphere, and the common presumption is that there is no need to provide overpressure
protection; however, depending on situations in which additional gas is supplied to the Still,
it is conceivable for the pressure to accumulate within the Still. For example, in the event of
a gas breakthrough from the Flash Tank, there is excess non-condensable gas introduced to
the Still at the same time some condensation of reboiled vapors provided by the direct
injection of the rich glycol is lost. The combination of this material accumulation may be
more than the discharge line can pass, thus causing the pressure within the Still to climb
above its pressure rating.
Low temperature discharge – The pressure relief or depressuring of gas from the
Contactor can result in low temperature discharges into the effluent handling system.
Amine Sweetening
Introduction
Amine is a solvent commonly used in Upstream and Downstream operations in the
Oil & Gas Industry to absorb contaminants in natural gas or NGLs. It is commonly used in
the Upstream environment to preferentially absorb CO2 or H2S in order to meet pipeline
337
specifications. There are many types of amines used in the industry. Some common amines
are monoethanolamine (MEA), diethanolamine (DEA), and methyldiethanolamine (MDEA).
These are described as Primary, Secondary, and Tertiary amines, respectively. The nature of
this description is based on these amines’ atomic structure. Amines are derivatives of
Ammonia (NH3) and a primary amine, for example, only has one of the hydrogen atoms
replaced by another compound (like an alcohol (OH), for instance). The secondary amine
has two of the hydrogen atoms substituted by another compound and a tertiary amine has all
three hydrogen atoms substituted. The substitution of the positive hydrogen atoms with
another group makes the amine progressively less reactive; hence, a primary amine has more
favorable kinetics for reaction with contaminants such as CO2 or H2S than a tertiary amine.
The structures for these three types, and a common amine representing that type, are shown
below.
MEA DEA MDEA
There are many great papers (and Laurance Reid Gas Conditioning Conference
Fundamentals topics) presented on the subject of amine sweetening processes and
technology. The reader is referred to the following references for further guidance: [8] & [9].
As a result, no attempt is made here to provide the theoretical basis behind the process, but
only a short summary of the intended purpose of the process is described.
Figure 9 - Typical Amine Unit
338
Amines remove contaminants based on the chemical absorption process. The rate of
absorption of the contaminant is dependent on the “reactivity” of the amine with the
contaminant. The amine reacts with the contaminant to form a salt. Figure 9 shows a typical
Amine Sweetening process adapted from Figure 21-4 of GPSA Engineering Data Book, 12th
Edition [6]. The raw feed gas (containing the contaminant) enters the contactor (absorber)
where it is flows toward the overhead and mixes in the column with amine fed from the top
of the column. The contactor may be either a trayed or packed column depending on the type
of processing required. The amine exiting the bottom of the column is known as “rich
amine” because it contains the chemically absorbed contaminant in solution. The gas
overhead, now free of the contaminant, goes to sales or to other parts of the plant for further
processing (such as NGL extraction). The rich amine enters a flash tank where pressure is
reduced to release any entrained natural gas or other hydrocarbons from the solution. The
contaminants will not flash in this case because the pressure is not sufficiently low and
additional heating is required to release the chemical bonding that occurs as a result of the
absorption. The rich amine enters a charcoal filter(s) where solid deposits (such as entrained
salts) are removed. From the charcoal filter(s) the rich amine is pre-heated by cross-
exchange as it enters the regeneration (still) column. The regeneration column is operated at
very low pressure (15-25 psig typically) and high temperatures (usually in excess of 250°F
depending on the type of amine used). The amine exiting the bottom of the column is known
as lean amine because it is now free of the contaminant, which exits the overhead in vapor
form where it is either incinerated, vented (if CO2 only) or sent on to a sulfur treating facility
for further processing. The lean amine is cross-exchanged with the rich amine entering the
regenerator and is pressured up so that it can be recirculated to the overhead of the contactor
where the absorption cycle continues.
With a basic understanding of the intent of amine sweetening and a representative
drawing a brief discussion of some of the major troubleshooting problems associated with
amine plants ensues. What one quickly discovers from a list of references, such as those
provided here, is that there is little discussion on problems with amine design, outside of
those that are operational related (i.e., issues that inhibit treating). One article acknowledges
that troubleshooting “usually falls into four categories for amine plants: 1) Failure to meet
spec; 2) Foaming; 3) Amine losses; and, 4) Corrosion” [8]. Though one could argue there
are seeds of “safety related” issues that could sprout from each of these, the one evident
where safety is concerned is corrosion, due to the possible loss of containment from the
weakness in metallurgy due to thinning or through-wall pin holes resulting in leakage or
rupture of the piping/vessels. Corrosion tends to be addressed either through ISD principles
by the use of corrosion resistant materials or operationally treated via corrosion inhibition
from chemical injection with monitoring.
While the above areas of concern (or minor variations/additions) are described in the
literature on amine plants, there are other ISD principles that should be considered critical
design elements for amine plants. It may be the literature takes for granted these principles
are already incorporated or part of the stock design, but while evaluating the overpressure
protection scheme for amine plants some opportunities for change may be noticed and should
be highlighted. A purpose of this paper is to heighten awareness on practical design and
operational considerations for overpressure protection among designers and operators of
amine plants. A couple of examples involving inadequate or lower reliability design are
339
discussed followed by a discussion of some other common overpressure protection issues
that can occur.
Incident Description – Overfilling
The first example reviewed resulted in carryover of amine to the flare. The cause,
design problem, and corrective actions are discussed here. Figure 10 below is a sketch of the
pertinent equipment of the amine plant in question. A sequence of the events leading up to
the carryover to the flare can be summarized as follows:
1) It is night and the facility is unmanned.
2) Contactor pressure raises ~ 0.8 psi.
3) A high level alarm on the Flare KO drum occurs.
4) A high CO2 alarm in NGL product stream results in an operator callout.
5) Operator #1 arrives on-site.
6) Operator #1 turns off one fan in discharge cooler and waits to verify if NGL spec
improves.
7) Operator #1 acknowledges both alarms in the controls system.
8) Operator #2 arrives onsite in the morning to start his shift.
9) Operator #1 debriefs Operator #2 and they decide to check the amine system
because NGL continues out-of-spec.
10) The Flash Tank pressure is observed at 85 psig (normal ~ 70 psig) and the
Charcoal Filter bypass valve is opened to drop level and pressure in flash tank.
11) Liquids in the flare are noticed and the fluid is identified as Water/Amine (97 gal
H2O / 53 gal DEA).
340
Figure 10 - Amine Plant Schematic from Liquid Carryover Incident
While a detailed analysis of the root cause of the occurrence and detailed corrective
actions were developed, there is not space in this paper to address these. However, a brief
summary of the cause and corrective actions taken is here discussed. What is discussed in
more detail is the impact of this example on the integrity of the overpressure protection
system, the decisions taken by the facility that affected the overpressure protection design
basis, and some fundamental design considerations to better improve the overpressure
protection design.
The above chronology spanned a period of around 6 hours. During this time amine
mixture continued to build in the flare system until the bypass valve around the charcoal
filter was opened. There was a plug in the filter element resulting from “dirty” amine. Field
deposits, heat stable salts, and corrosion particulates had built-up over a period of time to the
point where the outlet of the charcoal filter was restricted. With the inflow to the flash tank
greater than the outflow from the charcoal filter, the flash tank began overfilling with rich
amine and the pressure rose. There were no high level or high pressure alarms on the flash
tank, only local gauge indication. The rich amine overfilled the flash tank and began spilling
into the flare header where the problem was transferred to the flare KO drum. Though the
flare KO drum was fitted with a high level alarm, it did not initiate an operator call-out but
only alarmed locally within the control room. The flooded flash tank caused poor gas
treatment triggering a high CO2 alarm from off-spec NGL in the pipeline, resulting in an
operator call-out. Though the flare header filled with amine the operator was able to stem its
flow prior to overfilling the flare stack, averting the potential loss of primary containment.
As previously stated a number of causes led to the event with the immediate cause
determined as plugging in the charcoal filter from the dirty amine. First, for weeks the amine
was dirty based on the increased frequency in cycle time for filter element change-outs.
Almost three months prior, the filters completely plugged during the day shift. Operations
took corrective actions at the time and no adverse consequences resulted. At the time of this
incident, the filter elements were being replaced on a daily basis. Second, while the plant
341
was originally designed as a fully manned facility, in recent years due to declining rates and
reduced facility complexity, it was manned for a single 12-hour shift during the day. While
moving to a non-continuous manned operation is a characteristic of the ISD philosophy, the
necessary changes were not made to the design or control scheme to support this operational
mode—where increased remote monitoring or active automated control may be required.
Third, a similar liquid carryover event to the flare (from a different process system) occurred
just 2 years prior from lack of automated controls. While active mechanical protection or
active instrumented protection are preferred protection layers to operator’s response to an
alarm, it is important to recognize that changes to operating philosophy may impact the
effectiveness of safeguards. Though reduction of workforce at the facility promoted the ISD
philosophies of minimization and separation, consideration must be given for how such a
change impacts the effectiveness of mechanical and instrumented safeguards at the facility.
A key takeaway for existing operations is that operating philosophy informs the
interdependencies of ISD features and any change to that philosophy not only affects
operations of the equipment, but also may adversely impact the effectiveness of safety
barriers, thereby reducing the overall process safety of the equipment.
While there were no adverse safety concerns as a result of this example (or the one
other prior liquid carryover situation), a few major concerns from carrying excessive liquids
into a flare system to consider are:
1) Quenching the flame.
2) Possible mixing of incompatible fluids.
3) Insufficient structural support of piping and effluent handling equipment.
Where excessive liquids can carryover from the KO drum and extinguish the flame,
environmental or safety hazards may result. During carryover, burning efficiency is likely
reduced and possible hazardous (flammable, toxic, or corrosive) fluid may be left uninhibited
to spray from the stack. The former can result in exceeding environmental permitting
constraints while the latter can result in fire, flammable or toxic vapor cloud, or other adverse
safety consequences such as personnel burns from hot liquid or acidic solution or damage to
the environment. Further, this situation could be compounded by a release from another part
of the facility involving a flammable or heavier than air vapor that could result in a major
explosion. In gas plants, amine systems may carry some of the largest liquid inventories in
the facility. If the flare KO drum is not sized to accommodate the overfilling that could
occur from this system, the overpressure protection of the facility may be compromised. It is
worthy to note at this point, that on more than one occasion the authors have come across
flare designs that speak of “THE design basis”; however, the facility designer must
understand how each piece of engineered equipment fits into the overall design scheme.
Amine systems carry the largest potential liquid inventories that may enter the flare system at
some facilities, and while the design of the flare may be said to be based on blocked outlet of
the inlet gas stream, this overpressure case may only be the design basis for the flare tip
itself. In reality, little liquids may result from blocked outlet of the inlet gas stream, and
therefore, it should not inform the basis of design of the flare KO drum liquid retention
capacity. As a result, each individual piece of equipment in the flare system must be
designed for the largest design overpressure load (or overfilling) case. For this plant, the
342
amine flash tank carryover was the design case for the flare KO drum retention time, and it is
clear the installed equipment did not reflect that.
Where liquids can be released into a flare, the design of the header must be able to
accommodate the hazards of the liquids it receives. For this facility, there was not a “wet”
and “dry” flare system. Overpressure (and overfilling) cases from both vapor and liquid
sources were handled in a single flare system. In situations such as this, the designer must
understand the impact of possible simultaneous mixing of both wet and dry streams to
determine whether a negative outcome could occur. In some cases, the review of several
facilities using a common header system for wet and dry releases demonstrated the potential
of mixing “water-wet” streams (such as amine) and very cold gas (such as flashed NGLs).
This situation could result in freezing during the release. The releases do not have to be
simultaneous, however. A number of cases were noticed where pocketing existed in flare
headers. In these low points, the wet sources may build-up over time and the resident liquid
may freeze from a release from a cold source into the header. While the ISD principle of
segregation drives many facility designers today to build devoted flare headers for wet and
dry processes, it is recognized many designs in Upstream gas processing are not currently
configured in this manner. It is therefore incumbent on the engineering and operations staff
for these facilities to first understand whether the risk of freezing-off the header exists and
whether adequate measures are in place to eliminate or mitigate the potential consequences.
Before leaving this topic one should also note that “water-wet” solutions are not the only
source subject to freeze, creating a blockage in the header. Liquid hydrocarbon releases can
in fact be an even greater concern because of potential hydrate formation. Many hydrates
form at higher temperatures and therefore do not require cryogenic-type conditions to be
present for freezing and possible plugging to occur. Other possible hazards exist for mixing
of incompatible fluids but to a lesser extent in Upstream processing. These could include
situations such as mixing of volatiles or reactive fluids. It is important the designer and
operator understand the elements that inform all aspects of the flare header design.
It is uncommon that the piping supports and equipment supports (such as that for the
flare stack) in the flare header are designed for the weight imposed by a liquid filled system.
As a result, mechanical fatigue could compromise the integrity of the piping, equipment, and
supports. The result could be a loss of primary containment from failure of the support
system within the flare header. While it is not suggested here that the flare header be
designed based on a liquid filled system, it is important to understand that, if the liquid
handling part of the flare system has not been adequately addressed, it is a credible adverse
process condition that may arise.
As a result of the event, the site cleaned the amine solution and implemented better
monitoring of the health of the amine system. The design called for installation of high
pressure and level alarms and the addition to the safety logic of a plant shutdown on pressure
high-high and level high-high at both the flash tank and KO drum. These measures should
go a long way toward improving the overpressure protection system at the facility, but are
subject to issues as already discussed.
It is important to recognize that ISD is a philosophy. A balance of risk, design
feasibility, and business drivers ultimately inform the decisions on ISD features in the design
and evolution of safety barriers at a facility over time, and will vary from Owner/Operator to
343
Owner/Operator. Further, and more importantly for existing facilities, it is crucial to
understand where interdependencies exist between safeguards within the ISD framework.
The decisions on how and when to incorporate the ISD principles must be made considering
the full lifecycle of the ISD tenets in practice at the facility. Without recognizing these
interdependencies, decisions that are made to promote continuous risk reduction by use of
ISD may in fact result in compromising other safeguards within the ISD lifecycle, diluting or
eliminating the desired risk reduction achieved at the facility.
Incident Description – Product Breakthrough (Gas Blowby)
In a typical amine unit operation, the rich amine from a contactor column is sent, via
a level control valve, to a flash tank operating at much lower pressures, allowing some of the
dissolved gases to flash off. As described in API Standard 521, 5th Edition §5.10.3 [10], a
credible cause of overpressure for the flash tank is failure of the level control valve or loss of
liquid upstream, with subsequent flow of the high pressure gas (known as “breakthrough” or
“blowby”) into the flash tank. In a recent incident in the Red River Parish in Louisiana that
occurred during the start-up of a facility, an amine flash tank overpressured when an operator
manually set the level control valve fully open and left it unattended. The flash tank did have
a pressure relief device; however, the isolation block valves downstream of the pressure
relief device were closed and not opened prior to the start-up. Without a means to relieve the
pressure, the amine flash tank subsequently ruptured.
Figure 11 – Representation of Amine Flash Tank System for Product Breakthrough Incident
While the initial reaction may be to point to the isolated pressure relief device as the
ultimate problem in this example, a closer look reveals several areas for improvement. The
lack of sufficient isolation/bypass controls was apparent not only with the pressure relief
device remaining isolated during start-up but also with the operation of the level control
valve. In addition, the pressure relief device was likely inappropriately sized to limit the
pressure during the event to the maximum allowable accumulation pressure—the flow rate of
a gas through a level control valve that is normally passing liquid is substantially greater than
344
the normal liquid flow, and should be considered fully in the design basis for the
overpressure protection. This is yet another example of where the hazard analysis may be
limited to considerations based solely on the normal mode of operation, and the potential for
high pressure gas to flow through the control valve may not have been considered.
General Awareness Considerations
Figure 12 below shows an example process flow diagram for a typical chemical
reaction gas sweetening system adapted from Figure 21-4 of GPSA Engineering Data Book,
12th Edition [6]. The process flow diagram shows several areas of additional emphasis.
Figure 12 - Typical Gas Sweetening by Chemical Reaction
Liquid overfilling – As described above, some of the equipment in the amine system
can be subject to overfilling depending on relative volumes and supply pressures, and the
liquid amine volume may very well dictate the design of the KO drum in the effluent
handling system. ISD approaches to prevent overfilling can include limiting liquid volumes,
maximizing available processing volumes, and minimizing the difference between supply
pressures and design pressures of the regeneration equipment.
Product breakthrough – As described above, the potential exists for a breakthrough
of the product from the contactor into downstream equipment that is normally processing the
amine. It is very common for the product pressures to exceed the design pressures of the
downstream equipment, thus creating the potential for overpressure to occur. The product
breakthrough may not have been considered in the design because of the commonly
overlooked aspects related to process upsets involving fluids that are not normally being
handled.
Approach temperature at stripper reboiler – Ideally, the temperature of the heating
medium in the stripper reboiler will be less than the bubblepoint temperature of the stripper
345
bottoms at the MAWP of the system. This may result in a large difference between the
operating pressure and the design pressure, yet is an inherently safer solution.
Stripper rated for full vacuum – Ideally, the stripper system (including trays if
provided) would also be rated for full vacuum. Condensable fluid collapse in the event of a
significant rain storm can pull some vacuum within the tower.
Low temperature discharge – The pressure relief or depressuring of gas in the
contactor can result in low temperature discharges into the effluent handling system.
Conclusions
It is the authors’ purpose that the reader gains a deeper understanding of how the
design and operation intent of gas conditioning systems should be more than meeting product
specifications. Though often viewed as simple processes that aid in a facility producing a
quality product, these gas conditioning units also play an important role in the overall process
safety of the facility. By applying the principles of ISD early in concept design, gas
conditioning systems can operate safer and more reliably for the lifecycle of the facility,
ultimately achieving greater plant availability. In summary, the key takeaways from the
examples discussed in this paper and some elements to consider for ensuring an inherently
safer overpressure protection scheme in gas conditioning plants are the following:
• Consider ISD principles even in the most simple of gas conditioning applications.
• Incorporate ISD features in the overpressure protection scheme in DESIGN and do not
shift the burden to OPERATIONS.
• Consider the full suite of possible overpressure causes.
• Understand the importance of repeated signals that there may be problems (e.g.,
increased filter change frequency, as discussed).
• Follow-through on actions from prior incidents.
• Recognize the facility operating philosophy’s impact (and certainly changes to that
philosophy) on the overpressure protection scheme.
• Recognize that a process upset from even the simplest gas conditioning systems can
result in the overpressure (or overfilling) design case for equipment within the relief and
flare system.
• Understand the basis of the overpressure protection design, and understand how changes
to operating philosophy may impact that basis, and maintain the documented basis for the
facility lifecycle.
• When problems in the design, control, or operations of the facility are identified, take
action to mitigate them.
346
• For existing operations it is critically important to recognize the interdependencies that
exist between ISD tenets and balance implementation of these tenets against operational
flexibility, process safety risk, and economic constraints.
Gas conditioning processes are key systems in the delivery of reliable energy
products to the world. Recognizing the design and operating issues that can result in
negative consequences from inadequate process safety assessments and accounting for these
deviations in the overpressure protection design should minimize facility downtime resulting
from of a reduction in frequency of incidents. The reduced downtime should drive higher
facility availability, providing for the delivery of consistent, on-spec product safely and
reliably to the market.
References
1. http://www.aiche.org/ccps/about/business-case-process-safety-pdf
2. http://www.csb.gov/investigations/detail.aspx?SID=73&Type=2&pg=1&F_All=y
3. http://www.csb.gov/investigations/detail.aspx?SID=3&Type=2&pg=1&F_All=y
4. Center for Chemical Process Safety (2009) Inherently Safer Chemical Processes (2nd
Edition) - A Lifecycle Approach. New York, New York: John Wiley & Sons, pp., 11, 19,
27, 28.
5. Kletz, T.A. (1998) Process Plants: A Handbook for Inherently Safer Design.
Philadelphia, PA: Taylor & Francis.
6. GPSA Engineering Data Book, 12th Edition.
7. Natural Gas Engineering Handbook, Ch. 8 Dehydration, 2005.
8. Amine Plant Troubleshooting and Optimization, Hydrocarbon Processing, April 1995,
pp. 41-50.
9. Fundamentals - Gas Sweetening. Fundamentals Proceedings Presented on February 26,
2006 at the Laurance Reid Gas Conditioning Conference, Norman, OK.
10. API Standard 521:2010.
347
348
