September 2024Environment and Safety—Singh (Fluor Daniel India)

HP Tagline--Environment and SafetyAlarm management and operator training: Case studies for a sulfur recovery unit P. Singh and D. CHAUDHURI, Fluor Daniel India Pvt Ltd., Haryana, IndiaThere is a continuous growing demand for safer plant operations globally. Simultaneously, there is a mandate to reduce downtime to maximize plant productivity. Although modern plants are designed with automation, the human interface can never be entirely removed from the equation. Human error is still one of the major causes of unit upsets and hazards. Therefore, it has become more important than ever for operators to be completely versed in all aspects of a plant.An operator training simulator (OTS) provides a perfect platform to address this concern. This article will provide an in-depth insight of the OTS, as well as the basic features of creating a virtual plant in which the operators are allowed to train and test various operating scenarios. It will also highlight the inbuilt scenarios inside the model—most importantly, the startup, shutdown and specific upset scenarios [e.g., loss of utilities, power failure, local trip, verification of a particular process alarm in case of malfunction or error in reading the distributed control system (DCS) for a process value (e.g., pressure, temperature, flow, quality)]. The OTS helps operators become well-versed with the intrusion prevention system (IPS)/safety instrumented system (SIS) logic, the cause-and-effect matrix and the control loops of the process units, thereby increasing their awareness about the overall unit operation and process control. Alarm management provides further insights to operations personnel and explains how to minimize errors resulting from delayed response to reaction and plausible alarms in a process unit. Alarm priorities and rankings based on the criticality of the process plant operation cycle are also discussed.Alarm management includes the proper setting of the alarm and consists of defining the correct priority and operator actions for each respective alarm. To confirm these parameters, an alarm management study is typically conducted in the engineering, procurement and construction (EPC) phase of the project. A legitimate study provides the operator with an appropriate action plan after an alarm has been triggered. This includes steps like alarm verification and safeguarding actions to mitigate the possibility of any subsequent hazard.Various design practices are followed globally to determine and define process alarms for critical process parameters. The guidelines outlined in the design practices explain the various steps involved in defining a process alarm, detailing the specifications associated with the process alarm to enable plant operators to use them easily and to give operators a clear understanding of what to do when a process alarm is triggered. Once a process alarm is triggered, it is the operator’s responsibility to take corrective actions in a timely manner to mitigate any potential hazard. This requires well-coordinated synchronization between the panel and field operator to address the alarm without tripping the plant. Therefore, understanding an operator’s perspective is of utmost importance while developing an alarm management document during the detailed engineering phase. It is beneficial to organize an alarm management review meeting with plant operators to understand the operational and maintenance aspects of a particular unit. Such meetings may be conducted over a few weeks, depending on the number of alarms in the process unit.The lifecycle of an alarm begins by properly defining the alarm by the process and as it is outlined in the various design practices. All alarm requirements are defined in the initial design package of that process unit. In the case of a licensed unit, this is defined by the licensor in the process design package. For an open art unit, the front-end engineering and design (FEED) package should clearly define the basic process alarms needed. Further additions or deletions of alarms typically happen during safety reviews, such as a hazard and operability (HAZOP) study. Finally, all the alarms defined in the design phase are typically defined, reviewed and properly verified for design implementation. During the alarm review phase, the inputs provided by operators are of immense importance. Operators make an assessment and verify the alarms to ensure that the plant operates within safe limits in all possible operating conditions. This requires that operators participate in alarm rationalization and create a document capturing their viewpoints on the process aspect of the alarm.P-Singh-Fig-01ALARM MANAGEMENTThe following aspects are critical from an operator’s standpoint during the discussion of process alarms in an alarm management review meeting:

Process alarm ownership: Since plant operations in a refinery are run by different teams, it is essential to define the scope of ownership for a particular process alarm. For routine flow, pressure, level and temperature alarms, ownership is usually assigned to a refinery process team. For the alarms associated with rotating equipment, along with their auxiliary systems and machine monitoring systems, ownership is assigned to a mechanical team. Interface alarms are usually the shift supervisor’s responsibility. They must consult with the unit operators and make an informed decision with the refinery leader to overcome alarm management challenges.
The following example is a unique case of an alarm on a pressure transmitter. The pressure transmitter is located on the battery limit interface and measures the pressure of the incoming acid gas feed to the sulfur recovery units (SRUs) from the upstream amine regeneration units (ARUs). The pressure transmitter is a common instrument for all SRU trains and is provided with high and low alarms that report all abnormalities. Since the necessary and immediate operations modifications must be implemented at the SRU, the alarm is owned by the SRU’s operating team; therefore, the plant load is varied accordingly to compensate for the fluctuations in the upstream ARU (FIG. 1).

Alarm verification: It is common for a refinery to contain low-quality alarms. It is always useful if the alarm can be verified with the help of another independent instrument reading. It is advisable to consider realistic alarm verification (e.g., a pressure alarm in a process stream should be verified against another independent pressure instrument, such as a pressure gauge, and an indirect verification, such as flowrate, should be avoided). However, there may be instances where an indirect verification cannot be avoided. The following example from a tail gas treatment unit (TGTU) explains the difference between direct and indirect verifications.
There is sometimes an analyzer on the quench column to measure the pH. The pH typically in the circulating quench water is slightly basic, and the water starts to turn slightly acidic whenever there may be a sulfur dioxide (SO₂) slip from the TGTU reactor; therefore, a low pH alarm is provided with the analyzer reading. However, a low alarm may also be initiated in case the analyzer malfunctions. Therefore, an indirect and direct verification of that alarm are generally recommended before any corrective action is taken. A direct verification entails physically checking the quench water quality with SO₂ slippages (known to become milky). A more direct verification would be a laboratory test of the quench water; however, this method is time consuming. An immediate verification of the situation may be done via indirect verification. SO₂ slippage will be accompanied by one of the following:

Low hydrogen (H₂) content on the vapor from the quench column: There is not enough H₂ or reducing agent available to convert SO₂.

Very low exotherm in the TGTU reactor: Catalyst deactivation in the TGTU reactor, leading to an incomplete conversion of SO₂.

Very high exotherm in the TGTU reactor: Excessive firing in the upstream Claus section, leading to SO₂ slippage from the TGTU reactor (FIG. 2).

P-Singh-Fig-02

Prioritizing the process alarms: In simple words, prioritizing a process alarm means assessing a risk associated with a process alarm and advising the operator about the magnitude of its impact on plant operations, especially with respect to process safety if the alarm goes unattended. Great emphasis should be given to defining the priority for an alarm. There can be cases where some process alarms are initially labeled as high priority but after a detailed analysis and discussion, the priority is reduced. Likewise, low-priority alarms can be moved up in priority as needed. Excess conservatism should be avoided when defining alarm priorities. The number of high-priority alarms should be optimized to ensure that the operator is not overburdened in the case of an emergency. Alarms are broadly categorized into high-, medium- and low-priority alarms, although the exact nomenclature may vary as defined by the specific design practice applicable for the project.
For this, look again at FIG. 2. The H₂ analyzer on the vapor line from the quench water column has a high and low alarm. A high alarm is typically indicative of a high H₂ flow (and possible H₂ waste) and is typically made a low-priority alarm. However, a low H₂ alarm is categorized as either medium or high priority as it is indicative of possible SO₂ slippage and can demand greater attention from operators.

Time for the operator to act on an alarm: This is an important aspect that requires close attention. The primary objective of a process alarm is to alert the operator about any possible deviation from the normal operating range, enabling the operator to take pre-defined corrective actions to mitigate a potential trip scenario. The emergency shutdown of a process unit can lead to production losses and negatively impact plant life due to the sudden fluctuation in the operating conditions caused by an abrupt shutdown. Careful attention should be given to ensure a sufficient response time is available for the operator during the design phase in case of an alarm. Alarms with very little operator response time are seldom useful and contribute to the overall alarm count without adding much value. Consideration should be given to categorizing such alarms with a lower priority. The high alarm on the H₂ analyzer indicating potential SO₂ slippage provides an operator enough time to react and rectify the condition, as the immediate impact of SO₂ slippage in the quench column enhances corrosion.

Avoid nuisance alarms: Frequently during the FEED stage, the team develops the alarm documentation, considering every single possibility where process alarms are needed to monitor the behavior of a particular process unit. During the detailed engineering phase, client operations teams recommend that the nuisance alarms are removed from the list of process alarms that are redundant or insignificant for the operator to monitor during plant operations. A typical example would be a pressure alarm on a potable water line inside the unit. Operation’s management typically advises that the interconnecting units should have alarms on their headers to avoid multiple monitoring within the process unit.
In a nutshell, the rationalization of alarms takes place under the guidance of the client operations team and is streamlined to only keep process alarms that are vital for proper plant operation.

Mode-dependent alarms (alarms during normal operations, startup or shutdown): Mode dependency is another vital aspect during an alarm management study. Client operations advise operators to clearly define the alarms that are mode dependent (i.e., to categorize based upon startup, shutdown and normal operations). This provides operators with deep insight into the applicability of the alarm during a particular phase of the process unit’s operation.
The high-temperature alarm on the TGTU reactor should be inactive during the pre-sulfiding process of the catalyst, as the reactor temperature is expected to reach higher than normal operating conditions (typically up to 320°C during pre-sulfiding), while the normal temperature is in the range of 250°C (for low-temperature TGTU catalyst). For the ultra-low-temperature TGTU catalyst, it may be even lower.

Alarm suppression: Provisions for alarm suppression may be required for some alarms, such as during unit startup or equipment maintenance. Alarms with suppression requirements will be identified and documented to inform the unit operator of the suppression aspect of a process alarm. The automation contractor will devise a methodology to suppress alarms that will go off during a particular mode of operation. For example, in a typical process unit, when the feed is cut in, the low-level alarms will go off in most vessels or columns in the unit, leading to confusion during startup. Such alarms are suppressed until operations reach a steady state. The operator can change the status of such alarms from a suppressed state to a normal state in the DCS once the unit is stabilized and normal liquid levels are achieved.

Clearly defined operator actions: The corrective actions that operators must perform in case of alarm activation should be clear, specific and realistic in nature. The actions for the panel and field operator should be segregated and documented. If possible, actions may be outlined in a sequential manner, in the order of importance. The response time available for the operator is usually very short; therefore, it is important to avoid assigning any unnecessary and irrelevant actions. Clearly defined actions provide a clear path forward for operators, allowing them to revive the process to avoid a plant upset or trip with every alarm. For this step especially, a clear understanding and agreement from operators are essential.
To further assist operators, manage alarms, understand process controls, comprehend shutdown logic and accomplish startup and shutdown operations, operators need proper training. For this purpose, the OTS provides the best platform, as it covers a complete overview of features that give operators total comprehension of plant operations. The following section describes the basic features of the OTS (FIG. 3).

P-Singh-Fig-03OPERATOR TRAININGThe lifecycle of an OTS project. Once the pre-kick-off meeting is held with the clients, it is followed by a workshop and an overall functional design specification (FDS) review meeting. Meetings are also conducted for the hardware infrastructure and how it will be standardized for various process units. Then, for each process unit and depending on the client’s requirements, a detailed design review meeting is conducted followed by a model acceptance test and factory acceptance test. Once all the process models are evaluated, they are ready to be shipped to the site. All the process models are checked again via a site acceptance test and handed over to the client (FIG. 4).P-Singh-Fig-04The OTS infrastructure. FIG. 5 demonstrates the basic infrastructure required for setting up a training room for plant operators to run tests. A typical OTS training room has two operator stations where the inside operators can get a real feel for performing tests virtually. In addition, there is an instructor station where the trainers can use the machine to carry out process upsets in the model and evaluate the trainees’ understanding of the unit. There are two field stations operators can use to line up the equipment virtually. This room also provides the inside and outside operators an opportunity to practice, enabling fast action if an upset in the plant occurs. There is a colored and a black and white printer for the operator’s convenience so they can check the results offline and discuss them with the plant operations team, as needed. These systems are all connected to standalone OTS servers, and there are no direct interactions with the main plant servers.P-Singh-Fig-05Different applications of OTS. There are a host of scenarios where the OTS can be useful for effective overall plant operations (FIG. 6). A brief description and tools for implication of FIG. 6 are included below.

Start and shutdown, including emergency procedures: Major accidents in refineries seem to happen during startup or shutdown periods or when an emergency situation arises. A major cause is that startup and shutdown procedures are unique and do not follow the normal daily plant operations routine. This induces human errors that can lead to accidents. An OTS platform allows operators to test and practice plant startups, shutdowns and emergency procedures for specific units multiple times to reduce the likelihood of human error.

Advanced process control (APC) optimization: Many process units implement APC loops or systems to optimize plant operations. Operators can test APC systems in the OTS to ensure the proper optimization is done, while simultaneously ensuring safety protocols are not breached.

DCS control and logic check out: Normal plant control and logic systems can easily be tested in the OTS with different operating parameters to assess the reactions of the control loops at various operating conditions. This allows operators to better tune in the control loops leading to an improved response when dealing with actual plant operating conditions.

Improvement of operating procedures: The OTS platform provides options for plant operators to test and check normal and abnormal operating procedures. Testing these procedures virtually allows for optimization techniques and improvements.

What if analysis: The OTS platform also allows operators to perform root cause analysis (RCA) of major/minor issues throughout the plant that might impact the safe and continuous operation of the unit. As a problem-solving tool for operators, the OTS environment allows operators to look for all probable causes and potential solutions.

Testing new operations and control: Another interesting use of the OTS environment is the ability to test existing designs for newer operations and control, providing the path for a smoother revamp. All operational and safety aspects can easily be tested in the OTS before a revamp is planned and implemented. This gives the operator the confidence to operate the plant with its new parameters.

P-Singh-Fig-06Takeaways. With industry pivoting towards the energy transition and more advanced technologies being utilized for safer process plant operations, alarm management and operator training are more significant than ever. Investment in these technologies is a step toward ensuring new plants are safe and that effective plant operations bring more profits to clients worldwide. Conventional training is not enough to train an operator for seldom-occurring dangerous situations or daily routine operations. Therefore, the OTS must be considered an essential part of training so operators can learn without any negative impact to plant operations and personnel. The prime objective of operator training simulators is to improve safety by allowing operators to learn and practice new skills in a controlled environment without the risk of accidents or injuries. An OTS should be a mainstay in refineries for operators to practice procedures as a daily task. Refresher training scenarios must be created, and operators should get hands-on virtual experience at regular intervals or whenever a plant, control or safety system modification is implemented. HPFirst Author Rule LineAuthor-pic-P-SinghPRANAY VEER SINGH is a process engineer for Fluor New Delhi with 15 yr of experience in petroleum refining, petrochemicals and fertilizer projects. Singh earned an MS degree in chemical engineering from the Indian Institute of Technology in Kharagpur, India.Author-pic-D-ChaudhuriDEBOPAM CHAUDHURI is a process engineer for Fluor New Delhi with more than 23 yr of experience in petroleum refining, petrochemicals and upstream projects. Chaudhuri earned BS degrees in chemistry and chemical engineering from the University of Calcutta.CoverAd—APIContentsAd—Saint-Gobain NorproMastheadAd—Roto FlowPodcastsAd—Shell revampInnovationsAd—GraceBusiness Trends—Genzel (McKinsey & Company)Ad—HoneywellSpecial Focus OpeningAd—SulzerSPECIAL FOCUS—Das (Chevron Energy Technology Co.)Ad—Atlas CopcoSPECIAL FOCUS—Bazuher (Saudi Aramco)Ad—TotalEnergies LubrifiantsSPECIAL FOCUS—Larraz (CEPSA)Ad—Omega FlexPlant Turnarounds—Aughenbaugh (Swagelok)Ad—MetalTekMaintenance, Reliability and Inspection—Gellaboina (Honeywell UOP)Ad—Catalyst Trading CompanyMaintenance, Reliability and Inspection—Kleinubing (Emerson)Ad—IRPCEnvironment and Safety—Khan (Contributing Editor)Ad—GEIAwardsEnvironment and Safety—Singh (Fluor Daniel India)Ad—WGLCHydrogen—Smith (Honeywell)Ad—AFPM SummitCarbon Capture—Singh (Bechtel India)Ad—InstruCalcWater Management—Kumar (Fluor New Delhi)Ad—BoxscoreWater Management—Buecker (Buecker & Associates)Ad—H2T CircSales OfficeAd—HP Circ (Back Cover)