Emergency Shutdowns

Emergency shutdown capability is to be provided all petroleum facilities be it manual, remotely operated or automatic. Inherent safety practices rely on emergency shutdown capability as a prime facet in achieving a low risk facility. Without adequate shutdown capabilities a facility cannot be controlled during a major incident. 

The BSD can either shut down the entire facility, or it can be designed for two levels of shutdown. The first level shuts down equipment such as compressors, lean oil pumps, and direct fired heaters, and either shuts in the process or diverts flow around the process by closing inlet/outlet block valves and opening bypass valves. The second level shuts down the remaining utilities and support facilities, including generators and electrical feeds. 

---

In recent years much more attention has been given to pipeline isolation, after instances in which the contents of export pipelines fed platform fires, adding significantly to damage and loss of life. Many export and in field pipelines are now fitted with emergency shutdown valves (ESDV) close to the production platform, to isolate the pipeline in the event of an emergency. 

The RCCA s (32 to 52 assemblies in the core), regulate the neutron flux in the reactor, and are used for emergency shutdown of the reactor activity. In normal working conditions, the RCCA s are suspended above the fuel elements. 

The next step is to apply a number of loss control credit factors such as process control (emergency power, cooling, explosion control, emergency shutdown, computer control, inert gas, operating procedures, reactive chemical reviews), material isolation (remote control valves, blowdown, drainage, interlocks) and fire protection (leak detection, buried tanks, fire water supply, sprinkler systems, water curtains, foam, cable protection). The credit factors are combined and appHed to the fire and explosion index value to result in a net index. 

Shutdown. Written procedures for normal, as well as for emergency, shutdowns should be prepared, rehearsed, and kept up-to-date. Operating supervisors must be responsible for leaving the process equipment in a safe condition or preparing plant equipment for maintenance work. 

J. A. Wilkinson and B. W. Balls, "Microprocessor-Based Safety Systems Designed for Fine and Gas and Emergency Shutdown AppHcations,"... 

Emergency shutdowns often pose risks in themselves, and therefore they should be undertaken only when truly appropriate. The need to avoid extraneous shutdowns is not just to avoid disruption in production operations. 

Consider upset conditions that could exceed the test conditions at which the arrester was certified. These include the gas composition with regard to concentration of sensitive constituents such as ethylene or hydrogen, maximum system pressure during an emergency shutdown, and maximum temperature. Under certain upset conditions such as a high-pressure excursion, there may be no flame arrester available for the task. 

Emergency response On-site communications Emergency shutdown equipment and procedures Site evacuation Safe havens Personal protective equipment Medical treatment On-site emergency plans, procedures, training, aud drills... 

Emergency shutdown systems/valves not readily accessible. 

Emergency Shutdown Device A device that is designed to shutdown the system to a safe condition on command from the emergency shutdown system. 

Emergency Shutdown System The safety control system that overrides the action of the basic control system and shuts down the process when predetermined conditions are violated. 

Startup This includes procedures addressing pre-startup operations, initial startup, startup following turnaround and startup after emergency shutdown. 

Does the facility have written operating procedures for emergency shutdown ... 

Detecting transducers at the measuring points are electrical, pneumatic, or hydraulic. The resultant circuits and sequences can be seen from the typical functional diagram in Figure 4-34. An emergency shutdown immediately triggers the following operations ... 

Emergency shutdowns represent an exception, controlled or slow shutdowns are the normal mode. Slow shutdowns are triggered either... 

In a hot gas expander, the major problems associated with catalyst fines are centered on erosion of components and particulate plugging. Either problem can cause machine vibration and sometimes power train emergency shutdown. Because many failures have resulted from these factors, machinery manufacturers recommend that the maximum permissible solids concentration upstream of an expander not exceed 200 ppm. It is further stipulated that 97% of the particles be smaller than 10 p. Allowing concentrations of 160 ppm with 95% of the particle less than 10 p is considered reasonable. 

The use of appropriate instruments to monitor equipment operation and relevant process variables will detect, and provide warning of, undesirable excursions. Otherwise tliese can result in equipment failure or escape of chemicals, e.g. due to atmospheric venting, leakage or spillage. Instruments may facilitate automatic control, emergency action such as coolant or pressure relief or emergency shutdown, or the operation of water deluge systems. 

Operation includes nonual start-up, normal and emergency shutdown, and most activities performed by die production team. Whilst inlierently safe plant design limits inventories of hazardous substances, inherently safe operation ensures die number of individuals at risk are minimized. Access to die plant for non-essendal operational people such as maintenance engineers, post staff, administrators, quality control samplers, warehouse staff delivering raw material or plant items or collecting finished product, members of security, visitors etc., must be controlled. 

Operation at high or low rates Emergency shutdown, service failures etc. 

Check any cargo handling controls, emergency shutdown and alarms are working before commencing transfer. 

Most refinery process units and equipment are manifolded into a collection unit, called the blowdown system. Blowdown systems provide for the safe handling and disposal of liquids and gases that are either automatically vented from the process units through pressure relief valves, or that are manually drawn from units. Recirculated process streams and cooling water streams are often manually purged to prevent the continued buildup of contaminants in the stream. Part or all of the contents of equipment can also be purged to the blowdown system prior to shutdown before normal or emergency shutdowns. 

Safety valve releases are routed to blowdown drums when the presence of liquid, toxic properties or other factors would make discharge to the atmosphere hazardous. Product and intermediate process streams may need to be diverted to alternative disposal if they are off-specification (e.g., during startup) or in the event of emergency shutdown of downstream equipment. 

Streams which must be diverted because of emergency shutdown of downstream equipment (e.g., compressor failure). Diversion routes should be provided where such a contingency would otherwise require the immediate shutdown of the affected process unit, resulting in appreciable economic and operational debits. 

Active—Using controls, safety interlocks, and emergency shutdown systems to detect and correct process deviations e.g., a pump that is shut off by a high level switch in the downstream tank when the tank is 90% full. These systems are commonly referred to as engineering controls. 

A pressure sensor giving a continuous indication which is displayed on the control panel and can be observed by the operator. The sensor has a high pressure safety interlock set at a predetermined pressure that activates an emergency shutdown system. 

The same system, but with an on-off pressure switch set to activate the emergency shutdown system if the pressure reaches the predetermined point. The pressure switch remains inactive as long as the pressure is below its trip point. 

Use materials that are applicable over the full range of operating conditions such as normal, startup, routine shutdown, emergency shutdown, and draining the system. For example, carbon steel may be acceptable for normal operating conditions but may be subject to brittle fracture at low temperatures under abnormal conditions (as in the case of a liquefied gas). Cold water, of less than 60°F, during hydrotest may cause brittle fracture of carbon steel. 

---