Failure mode, control valves

Although there are limited common control valve failure modes, the dominant problems are usually related to leakage, speed of operation, or complete valve failure. Table 9-1 lists the more common causes of these failures. 

Mode of operation Although the SIF operates as part of normal operation 4 times per day, the SIF is not operating in continuous mode. The SIF dangerous failure is not the initiating cause of the hazardous event. The operating mode is determined by the process demand from a hazards standpoint. The hazardous event caused by misoperation of the control valve failure is estimated at 1/10 years. The SIF operates in demand mode with regard to the hazard. 

In.strument air failure. The consequences of the loss of instrument air should be evaluated in coujuuc tiou with the failure mode of the control valve ac tuators. It should not be assumed that the correct air failure response will occur on these control valves, as some valves may stick in their last operating position. 

Failure of power or controls to the valve (generally related to the seismic capacity of the cable trays, control room, and emergency power). These failure modes are analyzed as failures of separate systems linked to the equipment since they are not related to the specific piece of equipment (i.e., a motor-operated valve) and are common to all active equipment. 

Another, perhaps the most important, controller parameter is the control action, which is set as either direct or reverse. By convention, if the valve position is to increase as the measurement increases, then the controller is considered direct acting. The actual output signal from the controller will further depend on the specified failure mode of the valve. For example, a fail-closed valve will require an increase-to-open signal, whereas a fail-open valve will require an increase-to-close signal. In order to minimize confusion, rather than displaying actual output, most controllers display an implied valve position, which indicates the desired position of the valve. 

An important issue to be considered at an early stage is whether there are any common oause failures between redundant parts within each layer (for example, between 2 pressure relief valves on the same vessel), between safety layers or between safety layers and the BPCS. An example of this could be where failure of a basic process control system measurement could oause a demand on the safety instrumented system and a device with the same characteristics is used within the safety instrumented system. In such cases it will be necessary to establish if there are oredible failure modes that could cause failure of both devices at the same time. Where a common cause of failure is identified then the following actions can be taken. 

Although the FMEDA technique was developed for electronic circuits, the analysis can be adopted to mechanical instruments (Ref. 14). This technique has been used successfully to estimate the failure rates for various failure mode solenoids, ball valves, control valves, various t)rpes of pneumatic and hydraulic actuators, and the mechanical portion of smart valve positioners. Many of the parts must be characterized for the mechanical stress of the particular application but when that is done, the results can be realistic. 

Failure mode The different modes of failure of a component, e.g. control valve stuck or restrictions in movement, are called failure modes. 

A typical control loop contains three components — sensor, controller and final control element — and failure of any one component can cause the loop to fail in a particular mode, for instance with a control valve fully open. Thus the failure rates of the three components combine through OR gates and the failure rate for the whole loop is the sum of the component failure rates. 

Failures modes are considered for all the components. The pipe work sections, for example, have 4 failure modes blocked, fractured, partially blocked and leaking. Considered that each tank has 35 components, that the pipes, the valves and the pumps have 3/4 failure modes while controllers have 2 failure modes, there are in total 396 component failures in the system. 

Reactor A process hazards analysis identifies a hazard associated with a reactor dump valve. If the dump valve opens when the reactor is not depressurized, downstream equipment is overpressured. An SIF is implemented to prevent the reactor dump valve from opening when the pressure is high, using a solenoid-operated valve that controls the instrument air supply to the dump valve actuator. To support batch operation, the SIF energizes the solenoid-operated valve for each batch when the reactor pressure is low. However, from a safety perspective, the SIF prevents a hazardous event only when the control system fails and tries to open the control valve when the reactor is under pressure. This failure is estimated to be approximately 1 in 10 years. The SIF is operating in demand mode with regard to the hazard. 

Mode of operation The scenario is caused by failure of the BPCS control valves. Since the SIF also uses these valves, the SIF would also fail if the control valves failed to seat. The SIF operates in demand mode, but it is not independent of the process control system. 

A block valve will be closed by the SIF if the BPCS control valves are determined to be open by limit switches, and the pressure in the vent line is too high. The required response time could be met using quick vents (fast-acting solenoids) to rapidly close the isolation valves. The presence of 2 conditions is necessary for the SIF to operate, increasing the SIF complexity. The 2 conditions and the response are independent of the initiating cause. However, the use of the limit switch addresses the failure mode that the valve opens completely, but does not address the failure mode that the control valve may not seat properly (partial failure). 

Outputs - Typically the outputs are either relays (motor controls) or solenoid-operated valves (SOV). In DTT SIS, the predominant failure mode for these devices is coil "burnout. Redundancy, such as 2oo2 or 2oo3, can be employed on the outputs to prevent a single safe failure of a device or circuit from causing a spurious shutdown. The outputs can also be connected to separate output modules on the logic solver to increase reliability even more. 

Analyze the failure modes of each final controller, valve, solenoid, relay, etc. 

Table 9.1 Common failure modes of control valves...

For each hazardous event it is necessary to understand what failure modes will lead to it. In this way the various elements of protection (e.g. control valve AND relief valve AND slamshut valve) can be identified. The safety protection system for which a SIL is needed can then be identified. 

This technique is based on identifying the possible failure modes of each component of a system and predicting the consequences of that failure. For example, if a control valve falls it could result in too much flow in the system, too much pressure, or the production of an undesired chemical reaction. As a result attention is paid to these consequences at the design stage of a project and in the preparation of planned maintenance systems. 

The reason for the difference is the effect of redundancy for actuators. Whereas redundancy for sensors and controllers is always realized by parallel configurations, the adequate configuration of actuators depends on the failure mode. For instance, a blocked valve in the closed position can be tolerated by means of a redundant valve in parallel, but a blocked valve in the open position by means of a redundant valve in series. Therefore, networks of redundant actuators with respect to their specific faults and failure modes have to investigated. 

Failure Mode and Effect Analysis (FMEA). The FMEA is a methodical study of component failures. This review starts with a diagram of the operations and includes all components that could fail and conceivably affect the safety of the operation. Typical examples are instrument transmitters, controllers, valves, pumps, and rotometers. These components are listed on a data tabulation sheet and individually analyzed for the following ... 

Check valves are required in the piping system at any point where backflow of gas after a shutdown has the ability to restart the compressor, running it backwards or, for that matter, even in the normal direction. Reverse rotation is totally bad, as many components of the various compressor types are not designed for reverse rotation, and there is some possibility, generally remote, that the compressor could reach a destructive over speed. Forward rotation is bad primarily because the intent was to stop the compressor, and it is now operating out of control. This is a problem, particularly if the shutdown was caused by a compressor failure indication, and the need to stop was to prevent further damage. In this mode, it is unlikely that the compressor can attain an overspeed condition. An application with a high potential for backflow is the parallel operation of two or more compressors. 

---