Controlling Centrifugal Pumps

CONTROLLING CENTRIFUGAL PUMPS © Walter Driedger, P. Eng., 2000 May 20. walter(at)driedger(dot)ca

First published in Hydrocarbon Processing , July 1995. This Adobe® file is available for download. INTRODUCTION. The centrifugal pump is one of the simplest pieces of equipment from the controls and instrumentation point of view. It is a two port device with a well defined characteristic. Its purpose is to provide the necessary pressure to move liquid at the desired rate from point A to point B of the process. Figure 1-1 shows a 'generic' process with a centrifugal pump connected to deliver liquid from A to B. Figure 1-2 shows the characteristic curve of an actual pump (a single stage vertical turbine pump) together with the characteristic curve of the process, known as the system curve. The intersection of the two curves defines the operating point of both pump and process. It would be fortunate indeed if this operating point is the one actually specified for the process. It is impossible for one operating point to meet all desired operating conditions since the operating point is, by definition, exactly one of an infinity of possible operating points. In fact the entire point of controlling the pump is to modify its characteristic so that its actual operating point is the one that is required at every instance in time. Several definitions are presented in order to discuss the diagram:

Po = Differential pressure, or head, at the operating point of the pump and also of the process. Qo = Flow rate, at operating point, of the pump and also of the process. Ppm = Maximum differential pressure across the pump (at shutoff). Qpm = Maximum discharge flow of the pump. Plm = Static (Minimum) differential pressure between points B and A of the process.

The minimum static differential pressure of the process is frequently zero, as in a closed, circulating system. If the pump is in parallel with other pumps that are maintaining the system pressure, then P lm is greater than zero. It is clear from the outset that if P lm is greater than Ppm, no amount of process control can force the two curves to intersect. The pump is simply inadequate. How is process control like cutting off a rope? You can always cut off more, but you can't cut off less. Assuming the pump is more than adequate for the process requirements at the moment, what is the best way to trim it back to the desired operating point, P1, Q1? There are three possible locations to place a valve: At the discharge, at the suction, and as a recycle valve. Each will be discussed in turn. DISCHARGE THROTTLING. Since the pump exists to serve the requirements of the process, and one of the primary purposes of instrumentation is to adapt the equipment to the process, let us consider the pump from the point of view of the process. It can be viewed as a constant pressure device with an internal restriction. It is the restriction that gives it the "curve". It seems natural to put a valve on the discharge to further restrict the

pump. This has the effect of rotating the curve of the pump/valve system clockwise around Ppm, as can be seen in Figure 1-3. At this point I must warn the reader that we are about to encounter a paradigm shift. (!) The combination of pump and valve will be presented as a "black box" with a single characteristic curve which I shall term the "modified" pump curve. The more traditional way of looking at the situation is from the point of view of the pump. It sees the process system curve as having rotated counter clockwise around Plm. Figure 1-3 shows that the flow, Q1, is the same for both cases. The difference between the two pressures is the Delta P across the valve. Since the purpose of the pump is to serve the process requirements, and the purpose of the valve is to adapt the pump to the process, it makes sense to consider the valve to be part of the pump system and to use the modified pump curve rather than the modified system curve in our discussion. In any case it can be seen that a discharge valve can be used to achieve any operating point on the system curve so long as the point is below the pump curve. SUCTION THROTTLING. The second possibility for control using valves is to place the valve in the pump suction line. This would have an identical effect on the characteristic curve, but the method has a fatal flaw – cavitation. Cavitation is a phenomenon that occurs when the pressure of a liquid is reduced below its vapour pressure and brought back up above the vapour pressure again. Bubbles of vapour form in the liquid and then collapse upon arriving at the higher pressure region. The collapse occurs at sonic speed ejecting minute jets of extremely high velocity liquid. Wherever these jets impinge on a solid surface extreme erosion occurs. Over time even the hardest materials will be destroyed. Therefore it is of utmost importance that this pressure reduction never occurs. It is prevented by having sufficient pressure available at the pump suction so that the pressure drops that occur as the liquid is drawn into the eye of the impeller are at all times above the vapour pressure of the liquid at its current temperature.

An explanation of the term Net Positive Suction Head (NPSH) is in order. This is the pressure of the liquid at the pump suction in terms of feet or meters of liquid head above the vapour pressure of the liquid. The actual NPSH under operating conditions is called NPSHA and the minimum required by the pump to prevent cavitation is called NPSHR. Clearly NPSHA must be greater than NPSHR to avoid cavitation. It is safe to leave a margin of about one meter. These peculiar definitions are very reasonable in terms of the pumps actual characteristic but they cause some problems to the controls engineer. It means that the gauge pressure equivalent of a given NPSHA is proportional to the density of the liquid and is also affected by its temperature. The vapour pressure can rise dramatically as the temperature rises. This means that the NPSHA can fall without a noticeable change in pressure. Anything that would reduce the net positive pressure at the pump inlet below the NPSHR must be absolutely avoided. Thus suction throttling is never used to control pump flow. RECYCLE CONTROL. The third remaining possibility for pump control with valves is to bleed some of the discharge flow back to the pump suction or to some other point on the supply side. Once again we can view the result as a modified system curve or as a modified pump characteristic. Figure 1-4 shows both. Each curve is a rotation of the original: The modified system curve as a clockwise rotation around Plm. Note the little "tail" at the left of the modified system curve. This represents the flow through the recycle valve before the discharge check valve opens to the process. The modified pump curve has a counter clockwise rotation around the hypothetical intersection of the pump curve with the flow axis.

This family of curves shows several problems with recycle control. Firstly, the pump is not rated to discharge more than the flow rate at the end of the curve.

It is possible, of course, to run the pump with a wide open discharge, minimum  P, but it is unhealthy for this particular pump to run at such a high rate. Excessive flow may cause cavitation damage. (Excess flow cavitation is not caused by NPSH problems but by high velocity within the internal passages of the pump.) This restriction means that the minimum discharge pressure may not be lower than the one corresponding to the maximum flow. In other words, the modified pump curve cannot reach all points on the system curve. Secondly, although many pumps are capable of operating near zero discharge pressure, the very flat pressure vs. flow curve for much of the lower range for most pumps means a change of flow has very little effect on the discharge pressure. Thus it would take a very large amount of flow to produce a small drop in pressure. In control terms this means that control would be very 'sloppy'. Discharge throttling on the other hand, allows the pump to develop the head that 'suits' it. The unwanted pressure is dropped across the valve. (Note that the curve for this particular pump rises rather steeply. It will be more easily controlled than most.) Thirdly, this method is often inefficient. Figure 1-5 shows a system curve, a pump characteristic, a discharge modified characteristic, and a recycle modified characteristic. Above these is a pump power requirement curve. In the case of discharge control, the pump is adapted to the process by dropping its discharge pressure. If one follows the flow line vertically to the actual pump curve and then beyond to the power requirement curve one arrives at its power requirement. In the case of recycle control, the pump is adapted by reducing the discharge flow. Following the pressure line to the right to the actual pump curve and then upwards to the power requirement curve one arrives at the power requirement for recycle

control. Note that the power requirement curve tends to slope upward as flow increases. Therefore recycle control consumes more pump horsepower than discharge throttling when both achieve the same operating point. This is not always so. If the power requirement curve were flat, there would be no difference. Notice on the curve that there is a slight drop in horsepower near the right hand end. If circumstances were such that the operating point corresponded to a downward sloping power curve, recycle control would be more efficient. This is rare. SPEED CONTROL. There is, of course, one other means of adapting a pump to the changing demands of the process: Speed control. The virtue of this method is that it reduces the energy input to the system instead of dumping the excess. Figure 1-6 shows a system curve superimposed on a family of curves for a variable speed pump. The curves reach all parts of the system curve below the full speed curve. Therefore this is an effective means of control. Note, however, that these curves have one feature in common with recycle control: At the far left end of the system curve the pump curve and the system curve are almost parallel. (The particular pump chosen for this example has a rather steeply rising curve near shutoff. Most are considerably flatter.) In mathematical terms this means that the intersection is poorly defined. In practical terms this means that it is difficult to maintain a precise operating point and that control is 'loose' at high turndown. In practice, variable speed drives for centrifugal pumps are still relatively uncommon. For small pumps the power savings are not significant and for large pumps the associated electronics become very expensive. Also, they do not have the high reliability of valves. Variable speed steam turbine drives are quite common in the larger horsepower ranges. Electric variable speed drives are used in certain specialized applications such as pumps that are embedded inside a high pressure vessel. In such cases there are no alternatives.

RIDING ON THE CURVE. Last but not least: No control at all! The fact is that the majority of pumps in the world run with no control at all. The exact flows and pressures are not critical and the pump has been reasonably well selected. The discharge pressure will rise to partially compensate for increased back pressure. It falls as the back pressure decreases so that the flow does not increase as much as it otherwise might. The pump is allowed to "ride on its curve". When this situation is acceptable, leave well enough alone and don't try to fix what ain't broke. (Be careful though, the machine may still require minimum flow and other protections as detailed in the section on Machine Protection.) MEASUREMENT. The appropriate measurement for the controller depends on the demands of the process. Flow control is a frequent requirement. Two rules guide the location of the flow measurement: Make sure that side streams are included or not, as required, by the measurement and make the measurement at the highest convenient pressure. The latter requirement is to avoid any possibility of flashing or cavitation within the measuring device. In general the best place to measure flow from a centrifugal pump is between the recycle Tee and the discharge throttling valve. The exception is when the discharge is at an extremely high pressure and the suction has adequate NPSHA. In that case a suction measurement may be best. Level control of a vessel is one of the most common requirements1. The vessel may be either upstream or downstream. It is quite possible to connect the Level Controller directly to the discharge valve. Frequently, however, the vessel serves to buffer a downstream process from upstream flow variations. In that case it is not desirable for level control to be precise. Perfect level control implies that the flow out is exactly equal to flow in at all times. Often it is desired that the downstream flow remain as uniform as possible while keeping the level within bounds. In simple terms, it is desired that the flow out is the average of the flow in. The vessel absorbs the instantaneous differences. This simple requirement is more difficult to accomplish than it may seem and deserves a discussion entirely of its own. A simple arrangement that is often satisfactory and is widely used is to have the Level Controller cascade to a Flow Controller on the pump discharge. The flow loop keeps the discharge 'constant' while the Level Controller gradually raises or lowers the setpoint as the level in the vessel rises or falls. Another common requirement is to control the pressure of either upstream or downstream equipment. The tap for the pressure transmitter should be connected at the point where it is desired to control the pressure. Note that a pressure tap between the pump and a discharge throttling valve is probably

meaningless. A careful look at many pump curves will show that the characteristic near shutoff is quite flat and may even slope downward. Pressure control cannot be accomplished when the pressure curve is flat. If the slope is the 'wrong' way, control will work backwards and drive the valve away from the set point. In this case the minimum flow should be set so that the pump cannot operate in the positive slope region of the curve. (It is, of course, possible to reverse the action of the controller so that it can operate to the left of the peak. But in that case, what will happen if the operating point moves to the right? It is extremely difficult to design control systems that can operate continuously along a characteristic curve that has a local minimum or a maximum in it.) There is a second, more serious, problem with pressure control. Centrifugal pumps are essentially constant head machines. The discharge pressure for a given pump rotating at a fixed speed is proportional to the density of the liquid. This means that if the liquid has a constant density, the discharge pressure is constant. The "curve" of the pump curve is produced by losses and other affects caused by flow. Unless there is a flow through the system, there is only one pressure and that is the shutoff pressure. If it is desired to control the pressure of a vessel being charged by a pump, it is best to pressure control a valve at the outlet of the vessel and let the pump ride on its curve. If the vessel must be dead ended, only recycle flow at the pump can control pressure to a setpoint. ON / OFF CONTROL. On/off control is used in many situations where the object is simply to move a liquid from point A to point B and the exact pressure or flow rate is unimportant. A typical example is the sump pump. The simplest arrangement employs a level switch with a very broad deadband. This is used together with a Hand/Off/Auto switch to turn the pump on and off. The schematic is shown in Figure 1-7. The LSHL contact opens when the level is below its setpoints. "M" represents the motor contactor which energizes the motor whenever the contactor is energized. "M" also represents the auxiliary contact that is closed whenever the contactor is energized.

If it is important that the level never goes beyond the upper or lower setpoints, the Start/Stop arrangement is preferred. It is illustrated in Figure 1-8. The process sensing switch has a separate output for the upper setpoint (On) and the lower setpoint (Off). (Two switches may be required.) The manual switch consists of a Start and a Stop button or a combined Start/Run/Stop selector with a spring return to centre. The operator may start or stop the pump whenever the level is between the two setpoints. He cannot stop it when the level exceeds the high setpoint unless he locks it out. He cannot start the pump below the low setpoint. A variation of the circuit places the left connection of the start button to the left of the low level switch. With this arrangement it is possible to drain a vessel below the low set point by holding the start button on. The pump will stop as soon as the button is released. With both of these arrangements, there must be sufficient deadband between the high and low setpoints to make certain that the pump does not cycle on and off too rapidly. Excessive wear of both the motor and its starter will result if this occurs. Rapid cycling is a sign of an over-sized pump. MACHINE PROTECTION. Once the process requirements have been met, the attention of the process control engineer turns to protecting the equipment. Centrifugal pumps are fairly undemanding. In general they have only two requirements: that the NPSHR is met at all times and that a certain minimum flow is maintained. To meet the first requirement is generally a piping design problem. In cases of doubt, a low pressure shutdown switch may be added to the suction line. A second look at the explanations of NPSH, above, shows that determining the setpoint of the switch is not necessarily a simple matter if there is any possibility of the liquid density changing. Things get even more complicated if the vapour pressure is very sensitive to temperature. A rise in temperature that causes the liquid to boil will cause the net positive pressure to fall to zero even though there is an increase in actual pressure. LPG and LNG pumps are notorious for NPSHA problems. Fortunately most pumps can tolerate brief periods of cavitation without noticeable damage.

When a pump is taking suction from a vessel, a low level shutdown switch is essential. The switch, or transmitter, must be separate from any level control devices. To meet the second requirement, minimum flow, is somewhat more difficult. A centrifugal pump adds energy to the liquid that the moving liquid carries away. If flow is blocked, the temperature within the pump will rise steadily until the liquid boils (net positive pressure is now zero). Damage to the pump is quite likely. For this reason some form of minimum flow is almost always included on larger machines. The simplest arrangement is a fixed restriction orifice on a line leading back to the supply side of the pump. The preferred destination of the recycle flow is back to the vessel from which it came. This allows the heat to dissipate before it is recycled back into the machine. Restriction orifices have two drawbacks: They waste energy when the process demand is sufficiently high to meet all minimum flow requirements and also they limit the maximum pump output. A more efficient method of recycle control requires that the discharge flow of the pump itself is measured, and that a valve in the recycle line is opened when the process does not draw the required minimum flow. The most straightforward way to accomplish this is shown in Figure 1-9. Note that the recycle line tees off upstream of the control valve. It is precisely when the control valve is closed that the recycle is needed. There is a small problem with controlling the minimum flow in this way: The measurement orifice in the discharge consumes energy and also slightly reduces pump capacity. A second problem is that the actual signal being measured is the  P across the orifice plate. Since flow varies as the square root of  P, a minimum flow of 40% of maximum flow implies a controller whose set point is only 16% of the measurement range. A typical instrument accuracy is 1%. Therefore an error of 7% of the setpoint can be expected. Fortunately the minimum flow need not be held very accurately. Recycle control is sometimes accomplished using a

local pneumatic controller mounted directly on the valve. Note: Alwaysuse a fail-open valve. Various schemes have been devised to infer the required valve setting from the net discharge flow measurement. These require the flow downstream of the recycle Tee to be subtracted from the required minimum flow. The recycle valve is then opened in proportion to the difference, if it is positive. To do this accurately one must know the valve and actuator characteristics. There is no feedback to confirm that the correct flow is occurring. Since the flow is usually above the minimum flow, the valve is usually closed. This will cause the controller to wind up and be slow in responding when a low flow condition suddenly arises. Fortunately pumps can tolerate short periods of low flow so this is not a problem. One method of minimum flow control that is occasionally proposed is to put a flow control loop on the recycle line with the set point equal to the minimum flow. This solution is worse than a fixed restriction. When discharge flow is high, the discharge pressure falls. Flow through a fixed orifice will reduce somewhat. A flow control loop will open the valve further to maintain constant flow precisely when it is not needed. At this point the operator will be tempted to manually close the valve. Then, when a discharge blockage occurs, there will be no minimum flow at all! There are a number of devices available, called Automatic Recirculation Valves, or ARC valves, that combine the functions of net discharge measurement, recycle control, recycle valve and discharge check valve all in one device. These devices can be very effective but they suffer from one drawback: lack of flexibility. In cases where the pump and process characteristics are well known, they can be an ideal solution. Pipelines, for example, have many identical pumps operating under steady conditions. Once the correct components are known, application is routine. It must be kept in mind, however, that both the process and pump data provided to the controls engineer for a new facility are often tentative. ARC valves have very little margin for error when the reality turns out differently from the theory. One particular problem that can occur with the older style ARC valves that operate in an open/close mode, and even with some that modulate, is instability. It occurs as follows:  The discharge valve begins to close due to a reduced process demand.  The ARC valve senses the reduced flow and opens the recycle valve.

 The pump discharge pressure drops.  The discharge Flow Controller senses that it is being starved of flow and opens the discharge valve.  The ARC valve sense the increased flow and closes.  The pump pressure rises.  The discharge valve closes.  The cycle repeats itself. Note that ARC valves are not positioned by conventional actuators. They are positioned by the process liquid itself and are capable of very rapid action. Instability results in violent slamming of the recycle valve, scaring the operators and severely damaging the reputation of the controls engineer. Very little can be done at this stage other than to remove the ARC valve and to attempt to modify its characteristic by changing the spring or boring out the recycle ports. The latter spoils the hardened seats required in high pressure drop applications and leakage is inevitable. Boiler feed pumps seem to be especially prone to these problems. Note that ARC valves are quite expensive and often cost more that a complete flow control loop. They are, however, extremely effective, and simple, under the right circumstances. Their use often simplifies the piping arrangement and essentially eliminates routine valve maintenance. ARC valves are best bought as part of the pump package. In this way the responsibility for ensuring that they match the pump rests with the party that is most familiar with it. The pump curves used in this article represent an actual pump but are by no means typical of all pumps. Multistage pumps, in particular, may have little quirks in the curves that can complicate controls. If the characteristic curve droops as it approaches the zero flow axis, (the shutoff pressure is less than their peak pressure) the minimum flow setting must be well to the right of the peak or severe instability can result. Boiler feed pumps discharge into a compressible volume. If they have a reverse slope near shutoff, they may experience surge much like a centrifugal compressor does. Note that API STD 6102, the American Petroleum Institute standard for centrifugal pumps, explicitly bans a drooping characteristic. SEAL FLUSHING and COOLING. Pumps in certain special services require flushing and/or cooling fluids to be injected into the seals. The details are provided in API STD 6102, Appendix D. In general the instrumentation is rather simple, consisting of rotameters, pressure gauges and thermometers.

In certain hazardous services, sealing becomes a more complex issue. If the danger of a seal leak is sufficiently serious, specialized leak detection may be required. One simple method is the installation of a pressure switch, or better yet, a transmitter, between the tandem seals. This can then be connected to the plant alarm system. SAFETY. Centrifugal pumps are not generally hazardous pieces of equipment. However, there is one special safety consideration whenever a pump is drawing volatile hydrocarbons or other flammable liquids from a vessel with significant capacity. (API RP-7503, defines this as five tons.) Volatile liquids have a low viscosity and seal leaks are not uncommon. The leaked liquid often catches fire and it is absolutely essential that the pump be shut down to prevent feeding the flames further. In such situations it is desirable to have a remotely controlled block valve between the pump suction and the source vessel. This valve and its actuator should be fire safe. Since closing the valve can cause low flow damage to the pump, it must have a limit switch to shut down the pump whenever the valve is not fully open. It should also have both opened and closed status indication in the control room so the operator can be fully confident that the valve is open when the pump is running and that the valve is closed when a hazardous situation exists. If the block valve has an electric actuator, it is a good idea to have an alarm on the main panel to indicate if there is a power failure, if the local switch is not in the 'Remote' position, or if there is any other reason the valve might not work when called upon to do so. In extremely critical processes, one may wish to interlock the pump so that it cannot start unless the valve is in working condition. Any indoor pump in flammable service should have adequate fire detection in the building. Ultraviolet detectors are preferred because they are sensitive to flame. They are extremely fast acting since they do not depend on heat buildup or the generation of smoke. (There is an exception to this rule: If the flammable material produces a lot of smoke, it may obscure the vision of the UV detector. In such a case one might be advised to install both smoke and UV detectors.) A certain amount of care must be taken when UV detectors are installed. They are sensitive to sunlight and to welders. The sensitivity to welders is probably a good thing since it forces all welding to be co-ordinated with the control room. The sensitivity to sunlight means that they must be positioned so that they are unlikely to 'see' the sun. The usual position is high up under the eaves of the building in diagonally opposite corners. This is not always fool proof. The author is aware of one case where a pipeline compressor was shut down because a UV detector saw a welder working out

in the parking lot. The welder was directly in line with a gap around a pipe that went through the building wall. "Smart" combined UV/IR detectors are becoming available that are able discriminate between sunlight, welding arcs and fire. This type is also suitable for outdoor use. Fusible link sprinkler systems are extremely reliable and can contribute greatly in cooling down a fire that is too hot to approach. Their drawback is that they only become active once considerable heat has been developed. In critical applications they are best used together with a faster detection system. It may be worthwhile installing flammable vapour detectors near the base of large pumps if leakage is a possibility. Never overlook the placement of check valves. This is a safety related issue that should not be left to other disciplines as check valves are an integral part of the functioning of many control schemes. It is generally self-evident that parallel pumps need check valves on each individual discharge. This check is also needed downstream of the control valve on single pumps. When the pump is not running, the discharge valve will most probably go wide open. A reverse flow could have some peculiar effects on the upstream process. A check valve is also required downstream of the recycle valve if a fire safe valve is necessary. Any time the fire safe valve isolates the pump from the supply vessel, the recycle valve will open wide. ARC valves should be checked to make sure all necessary check functions are included. ACCESSORY INSTRUMENTS. Centrifugal pumps require few accessory instruments. Since the purpose of the pump is to develop pressure, it is a good idea to have a pressure gauge on the discharge. If the application requires a low suction pressure interlock, a pressure gauge should also be provided at the suction. It would be nice to have a local flow indicator but they are invariably expensive and inconvenient to install so they are rarely used. A thermometer on the suction may serve to warn of cavitation if the vapour pressure is temperature sensitive. PARALLEL PUMP INSTALLATIONS. Centrifugal pumps are frequently operated in parallel. Their smooth operating curve allows this to be done without complication. If it is intended that the pumps are usually operated individually and not simultaneously, it is sufficient to have a common discharge throttling valve and suction block fire safety valve. However it is essential that each have its own recycle arrangements. Do not be swayed by the argument that the two pumps will never be run simultaneously. The most obvious reason for simultaneous operation is to switch from one to the other

so that maintenance can be done without shutting down the process. In this case the pump that is being started will be operating against a blocked discharge check valve and is in no position to make use of a common recycle valve. Remember that the throttling valve is there to serve the process but the recycle is there to protect the machine. You don't share seat belts do you? Parallel variable speed pumps obviously have individual controls. The most effective arrangement is to provide constant flow controls to the majority of the pumps. The setpoints should be at the peak efficiency for each individual pump. The remaining pump should have its controller set to handle the swings. Actually this an example of the complex subject of Supply and Demand Control and deserves a discussion of its own. Note that is meaningless to have two pumps each on pressure control pumping into the same header. They will not share the load. SERIES PUMP INSTALLATIONS. Sometimes centrifugal pumps are operated in series. The usual situation is when a multistage pump has an NPSHR greater than what is available. In such a case, a single-stage pump with a low NPSHR is used as a booster. This is common with boiler feed pumps especially if the pump is drawing hot water whose vapour pressure is already elevated. Process demand control is applied to the high pressure pump. The booster pump should be on discharge pressure control. The author was involved in one situation where oil field injection water was drawn from a cistern connected directly to a river. In this case the booster pumps were pressure controlled by recycle back to the cistern. This allowed the recycle water to keep the water in the cistern agitated, preventing an accumulation of silt. It is not unusual for a group of booster pumps in parallel to supply a group of high pressure pumps in parallel. In such cases care must be taken to ensure that the various operating combinations are matched in capacity. Every individual pump in a series installation must have its own minimum flow arrangement. SUMMARY. Figure 1-10 shows a complete set of instrumentation for a typical centrifugal pump application. The drawing illustrates a pump drawing volatile hydrocarbons from a large surge vessel. The following features are illustrated:

 A level / flow cascade loop on the pump discharge to provide process control.  A check valve on the discharge downstream of the control valve to prevent reverse flow when the pump is shut down.  A fire safe motor operated valve (MOV) in case of seal leakage and fires.  An interlock from the MOV to stop the pump if the valve is not fully opened.  A low level interlock from the vessel to stop the pump if the vessel loses its liquid seal.  A pressure gauge on the suction to indicate adequate NPSHA.  A thermometer on the suction to indicate potentially high vapour pressure.  A minimum flow recycle loop back to the vessel.  A check valve on the recycle line to prevent reverse flow when the pump is shut down, especially when the fire valve is closed.  A pressure gauge on the pump discharge to indicate that the pump is working. REFERENCES 1. Driedger, W. C., "Controlling Vessels and Tanks"; Hydrocarbon Processing, March 2000.

http://www.driedger.ca/ce6_v&t/CE6_V&T.html

2. API STD 610, Centrifugal Pumps for General Refinery Service. http://www.cssinfo.com/apigate.html

3. API RP 750, Management of Process Hazards. http://www.cssinfo.com/apigate.html

CONTROLLING POSITIVE DISPLACEMENT PUMPS © Walter Driedger, P. Eng., 2000 May 20. walter(at)driedger(dot)ca

First published in Hydrocarbon Processing , May 1996.

This Adobe® file is available for download.

INTRODUCTION. The positive displacement pump is in some ways an even simpler device to control than the centrifugal pump discussed previously1. It has the same function, namely to provide the pressure necessary to move a liquid at the desired rate from point A to point B of the process. Figure 21 shows a 'generic' process with a positive displacement pump (in this case a gear pump) connected to deliver liquid from A to B. There is a great variety of positive displacement pumps. They are divided into two broad categories: Rotary and reciprocating. From the controls point of view, however, they are all similar. Their characteristic curve is so simple that it is rarely drawn. It is essentially a straight vertical line, as shown in Figure 2-2. (For some reason PD pump curves are usually shown with the pressure and flow axis exchanged. I will not follow that convention in this article.) All are constant flow machines whose pressure rises to whatever value is necessary to put out the flow

appropriate to the pump speed. If the discharge is blocked, the pressure will rise until something yields -- preferably a relief valve. Close examination of the curve shows a slight counter clockwise rotation. This is due to internal leakage. For positive displacement pumps the major cause of leakage is the small amount of reverse flow that occurs before a check valve closes and possibly past the check valve after it is closed. Leakage past the piston is negligible. Diaphragm operated PD pumps have no cylinder to leak past. Rotating PD pumps, such as gear pumps or progressing cavity pumps have internal clearances which permit a small reverse flow, called "slip" or "blowby". There is another reason why the curve may rotate to slightly lower flows at higher discharge pressures: The driver may slow down as the load increases. None of these have a significant affect in curving the slope of the characteristic enough that this slope can be used for control. For most practical purposes the slope is vertical. The system curve of the process is also shown on Figure 2-2. Its intersection with the pump characteristic defines the operating point. As always, the process controls engineer has the responsibility of matching the capacity of a specific piece of equipment to the demands of the process at every instant in time. Rarely does the actual system curve fall exactly on the one used for design and selection. As with any two port device, there are three locations in which a control valve can be placed: On the discharge, on the suction, and as a recycle valve. DISCHARGE THROTTLING. Discharge throttling does not work! Looking at the process from the point of view of the pump, discharge throttling rotates the system curve counter clockwise so that the modified system curve intersects the pump curve higher up. The additional pressure is dropped through the valve so that the pressure and flow to the process is (almost) exactly the same as before. The "almost" is due the small

increase in internal leakage that results in an equally small reduction in flow. An increased wear rate and a shortening of the life of the machine are the only results of this approach. If the pump is seen from the point of view of the process so that the valve is considered part of the pump, the same result is obtained. To obtain a modified pump characteristic curve, the pump curve must be rotated clockwise around the intersection with the pressure axis. The problem is that this hypothetical intersection is far off the top of the operating range. It is the point where the pressure is so high that 100% internal leakage occurs. The machine would self-destruct from excess pressure if one were stubborn enough to attempt to find this point. The rotation of the curve can still be performed on paper and it amounts to a slight shift to the left. Shown in Figure 2-3, it is virtually identical to the unmodified curve. To cut a long story short, you can't control a PD pump with discharge throttling.

SUCTION THROTTLING. Suction throttling has the same effect on the characteristic curve as discharge throttling and doesn't work either. PD pumps have a Net Positive Suction Head Required (NPSHR) just as centrifugal pumps do. In fact their requirements are even more stringent. Therefore restrictions and pressure drops in the suction lines must be similarly avoided.

RECYCLE CONTROL. This leaves recycle control as the only means of using a valve to control a PD pump. The valve is installed in a line teeing off from the discharge and leading back to the source of the liquid, possibly a surge tank. It must be fail open , of course. Figure 2-5 shows its effects on the characteristic curves. Viewing the process from the point of view of the pump, its effect is to rotate the system curve clockwise around its intersection with the pressure axis. Note that the little "tail" at the bottom left of the modified system curve is due to the flow through the recycle valve before the discharge check valve has opened. The flow through the pump is essentially as before but the pressure to the process has been reduced. Process flow will, of course, also be reduced by the amount flowing through the recycle line. Viewing the pump from the process gives a different perspective on the same phenomenon. This time it is the pump curve that is rotated counter clockwise around its

intersection with the flow axis. This modified pump curve gives the effect of greatly increased internal leakage. From the point of view of the process, this is exactly what is happening. Note that I have not used the same operating points in Figure 2-3 as I did in Figure 2-5. It is simply impossible to show any significant reduction in flow on a curve representing the effects of discharge throttling. Recycle control is an efficient method of control for PD pumps. Since the flow rate is essentially constant, the power requirement is roughly proportional to discharge pressure. Since the effect of recycle is to drop the discharge pressure, it results in significant reductions in power requirement. Nevertheless there is still wasted power in proportion to discharge pressure times recycle flow. Recycle valves experience rather severe service if the pressure drop is high. Cavitation will destroy them if they are not appropriately selected. Two approaches exist to deal with this problem: The first solution is to drop the pressure in many small stages through the use of many twists and turns in the valve trim. The second is to tolerate the resulting cavitation by shooting the liquid as a jet through a small hole in the middle of a disk. The jet then blasts directly into the discharge piping. The line diameter is often increased immediately downstream of the valve and the wall thickness is also increased. In this way the jet cavitates down the middle of the pipe. It makes a terrific racket. In either case it may be necessary to put a fixed restriction downstream of the valve. It should be sized so that the ratio of the high to intermediate pressure is the same as the ratio of intermediate to low pressure. Keep in mind that the restriction will reduce the rangeability of the valve by making it act like a quick opening valve. This is because the restriction becomes the dominant factor in the line once the valve is about half way open. From that point on, the valve has little control. Recycle lines for PD pumps should be run back to the suction vessel. This allows any entrained bubbles to escape. If they do not, they can build up to the point where pump capacity is impaired. It may even vapour lock. SPEED CONTROL. Speed control is an obvious method of controlling the flow rate of PD pumps since flow is essentially proportional to speed. Pressure can also be controlled by sliding up and down the system curve. Any point on the system curve can, in theory, be reached. Most drivers, however, have low speed limits which limit the turndown of the system. Variable speed electric motors are somewhat modified versions of normal motors. They require special provision for cooling and lubrication at low speed. In addition, they require specialized electronic power

supplies called "invertors". These units provide power of the appropriate frequency and voltage. They are, unfortunately, still quite expensive and do not have the reliability of control valves. There is another reason why large variable speed electric drives are seldom used with reciprocating pumps. The large inertia of the system means that speed changes cannot be made quickly. If it is possible for a valve in the process side to close suddenly, a variable speed electric cannot reduce speed fast enough to prevent a severe pressure rise. A recycle valve will be required to protect the pump, as detailed below in the section on machine protection. A more simple type of electronic control is frequently used for small chemical injection pumps. OTHER MEANS OF CONTROL. The great variety of types of PD pumps results in a variety of specialized means of flow control. A pneumatic actuator may be used to vary the geometry of the crank arrangement of a reciprocating pump so that each cycle displaces a greater or lesser amount of cylinder volume. Direct acting diaphragm pumps driven by compressed air or some other gas can be controlled by regulating the gas supply. There is also a technique known as "lost motion" whereby the crank arrangement first compresses a spring or volume pocket before it begins to work on the piston or diaphragm. These specialized methods are usually integral parts of the equipment and the controls engineer simply connects a pneumatic or milliamp signal to the appropriate input port. None of these methods changes the essentially constant flow nature of the pump curve. (The flow is still "constant" but at a different value.) The efficiency of hydraulic or eddy current couplings is about the same as that of recycle control. This is because the torque on both sides of the coupling is proportional to  P. The power lost in the coupling will be proportional to torque times the reduction in speed. In other words, all unused power is being dumped. If the pressure does drop with a reduction in net discharge flow, then there will be a power savings. A valve is a cheaper way of accomplishing the same thing. "Stroke Counting" is a method used when fixed amounts of liquid must be injected at specific intervals such as in batch processes. An electronic device is used to count the number of revolutions of a PD pump. After a sufficient number has been counted, the pump is shut off. When this method is used for pH control, the correct number of strokes can be calculated from a titration curve. MEASUREMENT. The most common application for PD pumps is in high-pressure service. The flow rates vary from extremely small to moderately large. Pressure control is very common. Since the control valve tees off the discharge header, it is not significant where the sensing transmitter is placed. Keep in mind that the discharge will be pulsating. The pulsations may be relatively small for a rotary pump or they may be extremely large for a simplex (single cylinder) reciprocating pump. The degree of pulsation also depends on the effectiveness of the hydraulic pulsation dampeners that are often supplied with the pumps. If pressure or flow control is critical, the control systems engineer should encourage the biggest economical discharge dampeners. Small pulsation dampeners, called snubbers, should be installed on all instrumentation such as pressure gauges, switches and transmitters. This will extend their life as well as

improve the signal. Many transmitters have built-in adjustable electronic damping. These should be adjusted so that the time constant is approximately twice the period of the expected pulses at the lowest speed. The phenomenon known as "aliasing" makes digital control systems such as a distributed control system (DCS) especially sensitive to pulsations. Aliasing can be best explained with the help of a diagram as shown in Figure 2-7. The rippling curve shows the actual flow rate of the discharge as it varies with time. The Xs show the points at which the DCS samples the measurement. The DCS gets the totally misleading impression that the system flow is slowly rising even if the average is quite constant. The usual reading the DCS gets is one of totally random fluctuations. Analog damping, either hydraulic or electronic, is absolutely essential for digital control. It prevents aliasing by filtering out high frequency components before they are sampled. Flow control measurements have similar problems to pressure measurements. An additional problem arises in the case of an orifice plate or similar head type measuring system. Since the  P varies with the square of flow rate and it is the  P that is averaged, the resulting signal is not the average of the flow rate. Rather it is the square root of the average of the square of the flow rate. (Electrical engineers recognize this as the RMS -- root mean square.) As long as the shape of the pressure signal, over time, does not change, flow will be proportional to, but not equal to, root  P. The more cylinders in the pump, the smoother the waveform will be and the closer the measured to the actual reading. Discharge pulsation dampeners also help considerably. The measured flow on "ideal" (undamped, pure sinusoidal flow waveform) simplex and duplex pumps is 11% higher than the actual flow. An "ideal" triplex pump yields a measurement that is 1% high. Flow measurements on the discharge of high pressure pumps should be avoided. This may not be possible if the pump has a recycle loop that returns, as it should, to the suction vessel. In that case remember that the flow sensor will experience not only high pressure but also a high level of pulsation. Turbine meters are easily damaged. I am told that coriolis-type mass flow meters do well in this service. Certain classes of reciprocating pumps, known as metering pumps, have a very precise volume of liquid delivered with each stroke. The RPM of the pump can be used as an accurate flow measurement. However, individual calibration is required if this accuracy is to be realized. Note that even small amounts of entrained air or other bubbles can cause serious errors. Metering pumps are commonly applied for chemical injection. There is a simple way to calibrate them if extreme accuracy under varying conditions

isn't an issue. A large glass cylinder is teed into the suction piping. If a valve between the cylinder and the supply is closed, the time it takes the pump to draw down the level by a fixed volume can be used to calculate a flow rate. The cylinder also serves as a level gauge to a supply tank. In some applications the fact that the pump is capable of developing high pressure isn't even an issue. It may be metering directly into an open tank or a low pressure line. In such cases the pump may need a back pressure valve on the discharge to ensure that the check valves seat properly. This item is usually supplied by the vendor as part of the pump package. PD pumps are not generally used for level control in the process industries. The great variety of types of PD pumps invariably provides exceptions to every generalization. The direct acting, pneumatically powered diaphragm pump is one of these exceptions. It is ideal for sumps containing sludges. The pump can be controlled by an entirely pneumatic control system thus eliminating all electrical connections. This has the added advantage of being absolutely safe in hazardous locations. MACHINE PROTECTION. The greatest danger to positive displacement pumps is overpressure. The rigid, unyielding nature of the pump characteristic means that overpressure is certain if the discharge is blocked. Many smaller (non API) pumps 1, 2, 3, such as the gear pumps used to supply lube oil for larger equipment, have integral relief valves to release pressure from the discharge back to the suction. In the majority of cases, an external relief valve must be supplied by the user. It must be connected as closely to the pump discharge as possible and must not have any means of blocking either its inlet or its outlet. It should discharge back to the pump supply. If, for any reason, the discharge is blocked and the relief valve is not capable of relieving, the pressure will rise very rapidly until something busts. It may be connecting rods, the check valves or even the cylinder head. Don't count on the motor stalling because events unfold very rapidly and the inertia of the system is sufficient to cause major damage. The most likely point of failure is the bolting on the discharge flanges. Direct acting pumps, such as those driven by compressed air, may not need a discharge relief if it can be shown the maximum pressure of the driving fluid is incapable of causing excess pressure. It is often advisable to install a high discharge pressure shutdown switch or transmitter in addition to the relief valve. Good engineering practice dictates that operating controls be provided to avoid shutdowns or relief valve operation for normal operating situations. If it is possible for the pump discharge to be blocked under normal operating conditions, a pressure

control loop must be provided on the discharge. This consists of a pressure transmitter, a controller and a recycle valve. If there is already a flow control loop on the discharge, a pressure override controller must be added. A common arrangement is shown in Figure 2-8. A deviation alarm on the pressure controller provides the pre-alarm for the high pressure shutdown. Whenever the pressure is above the setpoint of the controller, the alarm is on. This has the advantage of having only one setpoint for the two functions. Since the valve is fail open and the lower of the two signals drives the valve to the safe state, a low selector is chosen to pass the correct signal to the valve. Once again it must be stressed that overpressure conditions can arise extremely quickly. All components of the system must be selected with speed in mind. DCS controls with a scan rate slower than ½ second may be too slow. In any case, the valve may be too slow. Despite your best efforts it may be impossible to limit the pressure rise. In such cases it may be necessary to eliminate the high-pressure shutdown and to accept occasional relief valve action. The suction side of the pump may also require protection. A relief valve is required unless all suction piping is rated for the full discharge pressure. Liquids, especially water, are quite incompressible. Even the smallest reverse leakage through a check valve can raise the pressure of a blocked suction sufficiently to rupture the line. This can happen even after the pump has been shut down! The discharge dampener will contain liquid at full pressure unless it has been relieved. The line rupture may occur minutes or even days after the pump has been shut down and isolated, depending on the relative sizes of the discharge and suction dampeners and the leakage rate. (Been there, seen it.) A low-pressure shutdown switch or transmitter is required on the suction side of larger pumps. The NPSHR of reciprocating pumps is further complicated by what is termed the "acceleration head". (See the previous article in this series, Controlling Centrifugal Pumps 1, page 7, for a more detailed discussion of NPSHR and NPSHA. Note that there is one difference between NPSH for centrifugal and PD pumps: For a PD pump NPSH is specified in pressure units instead of elevation. This is because the operation of PD pump is not dependent on liquid density. ) When the piston of a simplex pump begins its intake stroke, the liquid in the suction line is essentially stationary. The entire line contents must be accelerated rapidly to its maximum velocity, approximately three times the average velocity. There are two reasons for this three to one ratio: Firstly, the liquid isn't moving at all for half the cycle. Secondly, even when it is moving the velocity starts at zero and builds up to a maximum at mid stroke before reducing to zero again at the end of the stroke. The "suction" required to draw the liquid into the cylinder reduces the pressure sufficiently that air or vapour bubbles may develop. When these collapse during the discharge stroke, if not sooner, cavitation occurs. If the bubbles do not collapse, as in the case of air dissolved in water, serious hammering can occur in the cylinder. The air may accumulate to the point that the pump becomes vapour locked. Remember that air can compress into the internal clearances of the cylinder and then expand again on the intake stroke without ever being forced out of the discharge check valve. The low suction pressure shutdown device should be accompanied by some sort

of pre-alarm. Acceleration head problems are greatly reduced for multi-cylinder pumps. Suction dampeners also contribute to making the flow rate more even. Minor mechanical failure in PD pumps can cause significant vibration and subsequent serious damage to the entire machine. For this reason it is the rule to include a vibration switch on larger equipment. This switch need not be the extremely sensitive, multichannel system used on high-speed machinery. We are not monitoring the gradual deterioration of delicate bearings. What we are looking for is an abrupt event of considerable magnitude. Even the simplest switch will suffice. The usual type of switch is termed a "seismic" switch. It works by having a small weight held in place by a magnet against the force of a spring. A "bump" dislodges the weight from the magnet and allows it to open the shutdown contact. The usual means of "calibration" is a light whack with a hammer. A pre-alarm is not possible. Larger PD pumps may have special lubricating requirements for the cylinders. The oil is supplied by small reciprocating injectors (miniature PD pumps) drawing from a small reservoir. The reservoir needs a low-level alarm which should also inhibit startup. A shutdown may not be necessary since damage from low oil level is not immediate. The reservoir is supplied from a larger lube oil tank through an integral float valve. The tank requires a low and a high level alarm. These can be provided by a single transmitter. Variable speed pumps, especially those driven by engines, may require an overspeed trip. This should come from a separate sensor from the governor since it may be a governor failure that has caused the overspeed. A simple method is a small bolt mounted in a hole in the rim of the flywheel and held in place by a spring. Centrifugal force causes the bolt to project from the rim and trip a limit switch mounted on the frame. SAFETY. There are no inherent dangers associated with PD pumps other than extremely high pressure or leakage of toxic or hazardous materials. Actually diaphragm pumps are especially suitable for toxic service since they have no rotating or sliding seals. The possibility of leakage or even rupture and a subsequent fire must be considered whenever flammable materials are being handled. Fire detection methods similar to those discussed in Controlling Centrifugal Pumps 4, page 10, may be necessary. It is possible that a diaphragm may rupture during service. If the liquid is particularly hazardous, a double diaphragm may be used. In that case a tap will be provided by the manufacturer to install a pressure sensor for alarm or shutdown. A fire safe block valve is needed on the suction whenever flammable liquids are being drawn from a reservoir with significant capacity5. Its interlocking must be handled slightly differently from that associated with a centrifugal pump. It is not advisable to slam shut the suction valve even if the pump is stopped simultaneously. Full vacuum may be induced during the rundown. If this causes air to be drawn into the piping an

extremely hazardous situation is created. It is best to use a time delay circuit so that the suction valve is not closed until several seconds after the pump has been tripped. It may also be desirable to have a fire safe block valve on the discharge. Since most PD pumps are in high-pressure service, there may be the potential of pressurized fluid forcing its way backward past the discharge check valve into a fire. Automatic closure should also be interlocked to occur at least several seconds after the pump has been turned off. ACCESSORY INSTRUMENTS. Any instrument used to control the process or to provide some safety or machine protection function should, if possible, have a simple local device to verify its operation. In the case of PD pumps that means pressure gauges at both the suction and the discharge. Pressurized pulsation dampeners require pressure gauges to ensure that they are properly charged. Large reciprocating pumps have oil filled crankcases. A gauge glass (by vendor) and a thermometer should be provided. The cylinder lube reservoir requires a sight glass. This is supplied by the vendor on API pumps1, 2, 3 . The tank needs a level gauge glass whose span is broad enough to cover both alarm settings. If the machine is equipped with cooling water jackets, there should be a thermometer on the outlet of every jacket. A single thermometer on the supply is a good idea. High outlet temperatures may not mean the pump is overheating! The variety of PD pumps implies a variety of special requirements. Be sure to discuss these with the pump vendor to make certain that nothing "obvious" has been overlooked. PARALLEL PUMP INSTALLATIONS. PD pumps are quite suitable for parallel operation. Since the discharge pressure of each pump rises as necessary, all pumps will discharge into the common header. A common recycle valve is sufficient for flow or pressure control. Starting up a pump that is discharging into a header that is already pressurized by other pumps may overload its driver. To prevent this it is necessary to have an individual recycle valve on each pump. This may be a slow acting ball valve. Starting the pump then becomes a simple timed sequence in which the valve is first opened, then the pump is started, and finally the valve is closed again. The pump should also be shut down in the same sequence. Remember that the ball valve will be opening against the full discharge head and may need a large actuator. In water service it is extremely important that the appropriate water resistant grease is used. If variable speed pumps are used, the majority should be placed on fixed speed. One pump is then selected for process control to take the swings in demand.

SERIES PUMP INSTALLATIONS. PD pumps are not generally installed in series. Since series pumps must both discharge an identical flow and both are discharging a "constant" flow, it is extremely unlikely that the two can be matched without complex controls. It is common, however, to have one or more parallel centrifugal pumps servings as boosters to one or more parallel PD pumps. The centrifugal pumps serve to provide the NPSH that the PD pumps require. The PD pumps in turn can provide a very high discharge pressure. The centrifugal boosters should have sufficient flow capacity to supply the pulsating requirements to the PD pumps. This means the full peak flow, not the average. If they need controls they should be on pressure control by way of a recycle valve since there should be no interference in the suction to the PD pumps. A warning: It may happen that the PD pump has a very low discharge pressure for some reason -- perhaps the piping has been removed for maintenance. It is then possible for the booster pump to push liquid through the various check valves and out the discharge without the PD pump being turned on at all. In fact, the flow may be even greater than if the PD pump were running! SUMMARY. Figure 2-9 shows a typical arrangement for a positive displacement pump application. The following features are illustrated:

- Centrifugal booster pump with recycle pressure control and a minimum flow restriction orifice.

- Low suction pressure shutdown with alarm. - Pressure gauge on the suction. - High vibration shutdown and alarm on the crankcase. - Thermometer and a sight glass in the crankcase. - Discharge pressure controller with an alarm. The controller works through a recycle valve.

- Discharge pressure relief valve. - High discharge pressure shutdown with an alarm. - Discharge pressure gauge.

A thermal relief valve must be around any isolation valve on the PD pump suction so that internal leakage does not over-pressure the piping.

REFERENCES 1. API STD-674, Positive Displacement Pumps -- Reciprocating. http://www.cssinfo.com/apigate.html

2. API STD-675, Positive Displacement Pumps -- Controlled Volume. http://www.cssinfo.com/apigate.html

3. API STD-676, Positive Displacement Pumps -- Rotary. http://www.cssinfo.com/apigate.html

4. Driedger, W. C., "Controlling Centrifugal Pumps"; Hydrocarbon Processing, July 1995. http://www.driedger.ca

5. API RP 750, Management of Process Hazards. http://www.cssinfo.com/apigate.html

CONTROLLING SHELL AND TUBE EXCHANGERS © Walter Driedger, P. Eng., 2000 May 20. walter(at)driedger(dot)ca

First published in Hydrocarbon Processing , March 1998.

This Adobe® file is available for download.

INTRODUCTION. Shell and tube heat exchangers are among the more confusing pieces of equipment for the process control engineer. The principle of operation is simple enough: Two fluids of different temperatures are brought into close contact but are prevented from mixing by a physical barrier. The temperature of the two fluids will tend to equalize. By arranging counter-current flow it is possible for the temperature at the outlet of each fluid to approach the temperature at the inlet of the other. The heat contents are simply exchanged from one fluid to the other and vice versa. No energy is added or removed. Since the heat demands of the process are not constant, and the heat content of the two fluids is not constant either, the heat exchanger must be designed for the worst case and must be controlled to make it operate at the particular rate required by the process at every moment in time. The heat exchanger itself is not constant. Its characteristic changes with time. The most common change is a reduction in the heat transfer rate due to fouling of the surfaces. Exchangers are initially oversized to allow for the fouling which gradually builds up during use until the exchanger is no longer capable of performing its duty. Once it has been cleaned it is again oversized. WHERE DO WE MEASURE? At the fundamental level, there is only one variable that can be controlled -- the amount of heat being exchanged. In practical situations it is not possible to measure heat flux. It is always the temperature of one fluid or the other which is being measured and controlled. It is not possible to control both since the heat added from one is taken from the other. Therefore the first consideration is to specify the place at which the temperature is to be kept constant. This is usually within a piece of equipment somewhere downstream of the outlet of one of the fluids. Assuming there is not much temperature change along the piping, the measurement may be anywhere between the outlet itself and the point of interest, perhaps at the base of a distillation tower. In cases where the measurement is being made downstream of a bypass valve, the further downstream, the better the mixing will be, and the more representative the measurement. On the other hand, too far down-stream may result in process dead time that can make control difficult. In cases where the "other" fluid is the one being manipulated, it is often quite sufficient to make the measurement directly downstream of the outlet nozzle of the exchanger. WHICH STREAM DO WE MANIPULATE? The second consideration is which stream to manipulate. The complications arise from the fact that exchangers have four ports and involve two different fluids, either of which may change phase. The former feature alone allows eight different valve arrangements. Figure 3-1 allows the reader to figure them all out. The diagram assumes that it is the fluid on the shell side whose

temperature is being controlled. As likely as not, it is the one on the tube side. It doesn't really make any difference to the control strategy. The real issue is which fluid is to be manipulated by the valves. For the sake of discussion we will term the two streams the "process" side and the "heat exchange medium" side. A complete tabulation of all the possibilities is: a - Process side, outlet throttling.

b - Process side, inlet throttling. c - Process side, bypass with outlet restriction. d - Process side, bypass with inlet restriction. e - Medium side, outlet throttling. f - Medium side, inlet throttling. g - Medium side, bypass with outlet restriction. h - Medium side, bypass with inlet restriction. Among this profusion of alternatives, some must be better than others. The preferred choice depends, as always, on the particular situation.

There are a number of varieties of the basic shell and tube exchanger that can be controlled along similar lines. Plate exchangers consist of thin sheets of corrugated metal. The corrugations are formed to produce passages so that the two fluids pass in opposite directions on opposite sides of each sheet. The "shell" side and the "tube" side are essentially interchangeable. Aerial coolers, sometimes called fin fan coolers, are similar to shell and tube exchangers except that they are all tube. The air blowing past the tubes can be considered to be in an extremely large shell. THROTTLING THE PROCESS FLUID. It is quite meaningless to attempt to control the process temperature by throttling either the inlet or the outlet of the process fluid. The desired process flow rate is set by other requirements and these would be interfered with by manipulating the process flow. Temperature will change somewhat since flow

reduction increases the residence time of the fluid and the outlet temperature will more closely approach the inlet temperature of the medium. On the other hand, variations in process flow, caused by some external influence, is one of the major causes of temperature variation. It is often the reason why we must manipulate some other parameter to maintain constant temperature. BYPASSING THE PROCESS FLUID. Process temperature can be controlled by manipulating process flow if a bypass is installed. As the outlet temperature rises (assume this is a heater), more fluid is bypassed around the ex-changer without being heated. As the two streams are blended together again, the correct temperature is achieved. SPLIT RANGE. Bypass manipulation sounds simple but there are a few tricks to it. Firstly, there are two ways of arranging the valve controls: We can attempt to minimize pressure drop at all times, or we can attempt to keep the pressure drop constant. In neither case do we want to interrupt the total flow. If we wish to minimize pressure drop, a butterfly valve is the likeliest choice. However, even a wide open butterfly has some pressure drop. It may be greater than that of the heat exchanger itself. This means that even when the valve is wide open only half the flow, or less, will bypass the exchanger. To accomplish a greater degree of bypass, a restriction must be placed on the flow through the exchanger. The restriction should be adjustable since conditions change and we do not want more restriction than necessary. The easiest way to do this is with a hand valve. Since these valves are often in relatively inaccessible places, remote actuators may be added. Once that is done it becomes an obvious matter to arrange automatic controls so that once the bypass is fully open, the restriction valve starts to close, and vice versa. This is, of course, a split range. The valve positioners, or I/Ps, are calibrated so that 0  50% signal opens the outlet and 50  100% signal closes the bypass valve. With this arrangement, at least one of the valves is fully open at

all times and the effective Cv ranges from 100% to 200% of that of a single valve. It should be noted that by arranging for minimum pressure drop we must accept that the pressure drop, and consequently the flow, will vary as the valve positions change. Note also that there must be either a single I/P tubed to both valves, or two I/Ps (or positioners) must be wired in series. Either way, special care must be taken during construction and maintenance. The example shown in Figure 3-2 shows the Fail Open valve to be the one in the bypass. Let us assume that the process stream is being heated. The failure modes of the two valves is such that a signal failure to either, or both, valves will result in less heat being delivered to the process stream. Failure also means that the medium will not be cooled. The opposite failure response is easily arranged. It is a matter of choice. Once the choice has been made, the control action of the controller becomes a matter of deduction: a) Assume that the process stream outlet is too hot. That is, it is above the setpoint.

b) Then the deviation of the controller is positive. c) Assume the controller action is positive. This produces a rising valve output signal that will tend to open the outlet and close the bypass. d) That would raise the temperature of the process steam. Wrong! The situation is getting worse. e) This controller must be configured to be reverse acting. f) Now a rising outlet temperature will cause a falling valve signal. g) That will open the bypass and close the outlet. h) This will lower the temperature of the process stream thus bringing the measurement back to the setpoint. The simplest way to carry out such a control action analysis is to trace around the loop from the measurement to the controller, to the valve, and back to the measurement. Assume the control action is positive. If the measurement is brought back to the setpoint, everything is OK. If things get worse, reverse the controller action.

Modern distributed control systems (DCS) have a built-in option for reversing the signal to the valve. If this is used, it is not necessary to take the failure mode of the valve into account when doing a control action analysis. First think positive then select a reverse output (not control action) if the valve is Fail Open.

An astute observer will realize that there is a possibility for both valves to be closed. If the outlet valve fails closed, the controller will sense a low temperature. Its output will then rise and close the bypass. It is very unlikely for the valve itself to fail when the signal is still good. Nevertheless, if this remote possibility is unacceptable, both valves must be made Fail Open. How can this be done? It can't! As long as both valves are driven by the same signal, their failure modes must be opposite because their effect on the process is opposite. The only way to solve this dilemma is to have two separate outputs from the controller, one direct, the other reverse. This is not a standard feature, but it can be easily arranged with a DCS. Here is the way to do it: Send the controller output to two calculation blocks. The first doubles the signal so that the range 0  50% becomes 0  100%. Any signal beyond 50% is ignored as the output of the calculation block cannot exceed 100%. The second block subtracts the signal from 100% and then doubles it. The range 50  100% then becomes 100  0%. Any signal below 50% is ignored as the output of the calculation block cannot fall below 0%. The two outputs are then send to their respective valves. Which output goes to which valve depends on the failure mode of the valves. Note that both valves now operate on 0 100% signals. Some models of DCS provide for scaling and linearization in the output modules. If this feature is available, separate calculation blocks are not required. This method of achieving split range action has additional advantages besides allowing the two valves to have the same failure mode. It costs an additional output slot, a pair of wires and an I/P but the advantage is that the two valves are "self-contained" and do not require any special treatment with respect to wiring in series, mounting of I/Ps, or split range calibration. OPPOSITE ACTION. The second arrangement attempts to keep the pressure drop, and hence the flow, as constant as possible across the entire stroking range of the valves. To accomplish this, we would like the outlet valve to begin to close the moment the bypass begins to open. It will be fully closed the moment the bypass is fully open. This is an "opposite action" arrangement. A three-way "flow splitter" or "diverter" valve is frequently used to combine the functions of the two valves into one body. For butterfly valves a mechanical link may be installed to join two valves to one actuator so that when one opens, the other closes. It is also possible to use two separate valves with either a single I/P, two I/Ps in series, or two separate output signals. The description in the previous section on using calculation blocks to provide opposite control action for the two valves is valid, with one difference. The signal is not doubled and only one block is needed to reverse the signal. Some comments on three-way valves are in order. Figure 3-4 shows a typical characteristic. The flow on one side decreases gradually as the flow through the other increases. Ideally the flow through the inlet port is constant throughout the

entire stroking range of the valve. Some three-way valves have a rather large gap between the two exit ports where both sides have more than 50% flow. Such valves should be avoided as they result in sloppy control because the loop gain near the midpoint is too small. The same consideration applies to the two-valve arrangement. The two valves should be chosen to have fairly linear characteristics so that the combined flow is approximately constant. It may be useful to plot the two characteristics on a piece of graph paper and add them up to see if the valve combination is satisfactory. A close look at Figure 3-4 shows that the Cv of the two ports is not equal. This is almost always the case as the valve stem interferes with the flow through one of the ports. The port with the greater C v should be open to the heat exchanger. Then the flow restriction caused by the exchanger will help to cancel out the difference. MEDIUM SIDE THROTTLING. Avoid using a process side bypass valve with fluids that are being heated and have a tendency to break down or scorch. These include many food products and also petroleum products or other chemicals that may polymerize or coke at high temperatures. The problem is that the outlet temperature is a blend of the bypass stream and the stream through the heater. The peak temperature to which any part of the stream is exposed may considerably exceed that of the combined outlet. Over-done and half-baked don't average out! The extreme case is when the exchanger is on full bypass. The fluid trapped inside the heater will then be at the temperature of the heating medium. The solution is to control the process temperature by throttling the heat exchange medium. In this case the heat available to the process is manipulated. The example is a simple and rather straightforward application. Hot oil is being supplied to heat a process stream. It is desired to keep the process stream at a constant temperature. There is no reason to maintain the flow of oil in excess of what is needed -- it can be throttled to control the temperature. In this case the valve is placed on the outlet of the exchanger. The valve is not expected to handle a large pressure drop nor is tight shutoff of any particular value. Therefore a butterfly valve is quite acceptable. Furthermore its low pressure drop (high Cv) when wide open is an advantage. The effects of inlet and outlet throttling are about the same, so secondary considerations come into play. In general it is a good idea to keep the pressure on a hot

fluid to reduce any chance of dissolved gases bubbling out. A valve on the cooler end may be cheaper and will probably last longer. Leaks are less likely as the fluid will be more viscous than on the hot side. Thus it is best to throttle a heating medium on the outlet side. It is rare that a heat exchanger cooling the process should have a reason not to use bypass control on the process side. Also, it is usually undesirable to throttle cooling water since it is at least mildly corrosive and is seldom clean. For this reason it is usually put through the tubes. In order to improve heat exchange and also to avoid the build-up of deposits and fouling, it is best to maintain its velocity. If it should be necessary to throttle the cooling medium, consideration must be given to the possibility of boiling. (Remember that the cooling medium is the one being heated.) Assuming that boiling is not intended, but that the possibility exists, the valve should be placed on the outlet in order to maintain pressure on the fluid. In other words, inlet throttling is rarely used with single phase fluids. CROSS EXCHANGERS. When the heat in one process stream is to be exchanged with another process stream, the flow on neither side may be interfered with while controlling the temperature. An example is when distillation tower bottoms are cross exchanged with the tower feed. The tower requires a high temperature at the bottom in order to function but the heat is not "consumed" by the process nor is it needed in the product. It is returned from the bottom product back to the feed. This is a common and extremely effective energy conservation measure. As with all energy recovery arrangements, the key to success is to control the heat recovery without disturbing the process. That is, the flow of neither of the two process streams may be interfered with. The solution is to manipulate the heat transfer by bypassing one of the two streams around the exchanger. Most often control is exercised on the tube side. The failure modes of the valves are chosen to prevent overheating and flow blockage. An interesting aside not directly related to process control: Counter-current crossexchangers are widely applied in nature to prevent heat loss. One of these systems was first described by Herophilus in 300 BC. Arteries and veins pass very close to each other for some distance along the way to the extremities. In this way the heat in the warm blood on its way out is cross-exchanged to the returning cold blood. Biologists name this anatomical feature "rete mirabile" which means "magic net". UNCONTROLLED HEAT EXCHANGE. In some cross exchange applications it is desired to recover all the heat (or cold) content of the product stream and to transfer it to the feed. In such cases the exchanger needs no controls at all. The feed stream usually has a second exchanger downstream of the first to boost the temperature to the required level. This exchanger is the one that is manipulated.

AERIAL COOLERS. As mentioned earlier, aerial coolers can be considered a special type of shell and tube exchanger in which the shell is the shell of the cooler. A large fan is used to blow air, usually from below, past the tubes. As with other exchangers it is possible to control the temperature by manipulating the process or the medium flows. The normal way to provide accurate temperature control is to use process flow bypass valves. In addition there are three means of manipulating the medium: Louver or damper control, fan pitch control and variable speed. FAN PITCH CONTROL. This is an obvious means of controlling the temperature. It has the advantage of reducing horsepower as the cooling demand is reduced. As with every control technique, there are limitations. Firstly, the turndown is rather poor. This is especially important in a northern climate where it may not be possible to turn down the fans sufficiently in winter. The spinning blades still stir up the air even when the pitch is zero. Natural draft alone may provide more cooling than is required. Secondly, the pitch control mechanism can be a maintenance headache. The control system engineer must examine the equipment drawings to be sure that the mechanisms allow easy access for lubrication and repair. It is a wise idea to put separate I/Ps on each fan. Long strings of tubing with many tees make leak detection a nightmare. Each I/P requires a separate output from the control system as the current loop will not work if there are more than two in series. Note that if a single controller drives multiple fan pitch controls, the process gain of the loop is proportional to the number of fans in service. If the controller is tuned with only half the fans running, it may go unstable when the rest are turned on. A controller that is tuned with all fans running will be sloppy if some are turned off. It is, of course, possible to configure automatic gain compensation within a DCS. (Remember to check for divide by zero when no fans are running.) VARIABLE SPEED. Fully variable fan speed control is becoming more common on aerial coolers. The fan motors are often quite numerous but not extremely large. This means there has not been much payback in the past, but the cost of the electronics has come down considerably in recent years. One way to cut costs is to connect both fans of one bay to the same set of VFD electronics. On the other hand, two-speed fans have always been quite common. This is especially true in climates with extreme seasonal temperature swings. Reducing the fan to half speed results in an 85% reduction in electric power demand. (Remember that electrical power varies as the cube of fan speed.) Cutting the speed of an electric motor in half requires only a reconnection of the wiring to a multipole stator. This can be accomplished by having two electrical starters wired in different ways. The increase in cost is not very large. A variation of the two-speed motor is to arrange for reverse flow. This can be extremely useful in climates where icing is a problem. Reversing the flow blows warm air through the inlet louvers and serves to melt any accumulated ice. This should be done before ice build-up is too large or large chunks of ice may be sent crashing down onto other pieces of equipment or even personnel. LOUVER CONTROL. Automatic louver control has similar problems as fan pitch control. There is an additional problem of hysteresis. The louvers seldom move

smoothly for long and it becomes very difficult to maintain stable control as dirt and wear accumulate over time, especially in sandy or dusty environments. In climates with strong seasonal temperature swings, it is possible to stabilise the air temperature by controlling internal recirculation. The exchanger is fitted with a duct leading from the top outlet to the bottom inlet of the unit. Dampers are placed in this duct and at the air intake. A temperature controller senses the air above the fan and controls it by opening the recirculation duct and simultaneously closing the intake. Note that an opposite action arrangement, as described above, is appropriate. Figure 3-6 shows a possible arrangement using both outlet louver control from the process and recirculation control off the internal air temperature.

ADVANCED TRICKS – FEEDFORWARD. Large heat exchangers have both dead time and considerable thermal inertia. These two factors can make control difficult. Feedforward can be usefully applied if load changes are a problem. Since the heat demand is proportional to the process flow rate, other things being equal, a flow rate measurement can be used. Figure 3-7 shows a typical arrangement. Note that the output of the TC is multiplied by the flow signal.

That is because the heating medium flow rate must be roughly proportional to the feed flow. This works best if the installed characteristic of the valve is linear. If the exchanger is very large, it may be necessary to insert a lag or some other form of delay into the flow signal to prevent it from acting too soon and causing a reverse spike to appear in the temperature. Note that the dead time is inversely proportional to the flow rate and some "typical" value must be used. Some brands of DCS have the option of a variable delay time. This allows delay to be inversely proportional to flow rate. TEMPERATURE OPTIMIZATION. Another "Advanced Trick" involves optimization of a fired heater. Heat is being supplied to the reboiler of a deethanizer as shown in Figure 3-8. It is required to keep the temperature at the bottom of the tower constant. The heating medium is hot oil which is being heated by a fired heater and circulated by a pair of pumps. Since the tower bottoms is being boiled, and is also very clean, it goes on the shell side. The oil goes through the tube side where the outlet is throttled by a butterfly valve. A position transmitter has been added to the valve. Its output goes to a Position Controller with a setpoint of about 80% open. The output of the Position Controller is cascaded to the setpoint of the Temperature Controller of the furnace. The effect is to maintain the furnace, and the hot oil, at the lowest temperature consistent with the heat demand of the tower. It works as follows: a) As the heat demand rises, the valve opens further.

b) When the valve is open beyond 80%, the setpoint to the furnace Temperature Controller is raised. c) As the temperature of the hot oil rises, the valve closes to near the 80% value. d) As the heat demand of the tower falls, the valve closes below 80%. e) As the valve closes, the setpoint to the furnace is lowered until the valve is once again at its 80% target.

In this way the temperature of the hot oil system is kept at its lowest acceptable value and a minimum of heat is lost by the furnace or the piping. COMBINATION CONTROL. Sometimes a heat exchanger is used to heat, or cool, a fluid whose total flow is being controlled by some other parameter. The most straightforward way of controlling this is to use a three-way valve, or two butterflies, to control the heat exchange and to use another valve to control the total flow. The flow control valve must be on the common line either upstream or downstream of the exchanger. This arrangement has two valves in series and cries out for a way of eliminating one of them. If the positions of the inlet and bypass valves are controlled separately so that the total Cv is controlled by the Flow Controller and the difference between the Cvs is controlled by the Temperature Controller, complete control can be achieved with only two valves. Figure 3-9 shows how this can be done. The example uses boiler feedwater to cool a sulphur condenser at the same time the water is being preheated. The sulphur vapour, being the more difficult fluid, is in the tubes. The water is in the shell. Since we want to make certain that the water does not

boil, we will put the valves on the outlet side. The valve controlling the outlet of the exchanger receives a signal equal to half the sum of the two controller outputs. The valve controlling the bypass receives half of the differencebetween the two controller outputs. Assuming that the installed characteristic of both valves is linear, the combined flow of the two valves is then dependent entirely on the Flow Controller. The difference between the two flows is dependent on the Temperature Controller. In this particular situation it is desirable that both valves are fail open. If the failure mode of either, or both, valves is fail closed, the signs of the summing/scalers UY-A and UY-B will have to be changed to give the proper result. EQUIPMENT PROTECTION. The usual shell and tube exchanger has no moving parts nor any in-put of external energy. There are few machinery protection issues. Severe corrosion is sometimes a problem. If so, corrosion detection devices may be installed. These consist of a thin wire or film of the same material as the exchanger. The wire is held in a holder that is inserted through a nozzle into the exchanger. Two electrical contacts are accessible from the outside. When the resistance is measured, the extent of corrosion can be determined directly. These devices are not normally connected into a data logging network. The usual practice is to make the measurements with a portable monitor on a regular basis. Intrinsically safe monitors are available for hazardous locations. Aerial coolers require protection from the energy introduced by the electric motors. The most serious hazard is a thrown blade. The resulting vibration is quite severe and can cause extensive damage. A simple seismic vibration switch mounted on the structure that holds the lower bearing of each fan is quite sufficient. It works by having a small weight held in place by a magnet against the force of a spring. A "bump" dislodges the weight from the magnet and allows it to open the shutdown contact. The usual method of "calibration" is a light whack with a hammer. A button allows the operator to reset the switch by pushing the weight back against the magnet. Switches with remote electrical reset can be bought but it is always best for an operator to look at the machine and determine the cause of the shutdown before restarting the equipment. Precautions must be taken when reversing a motor that has been running. Such a change is a considerable shock to the machinery. The usual approach is to provide a time delay interlock so that sufficient time has elapsed to be certain that the fan has stopped rotating before the motor can be started in the opposite direction. If this is not done the fan will most likely trip on vibration. The nuisance of resetting locally mounted vibration switches will encourage the operators to be more careful in the future. SAFETY. Overpressure is the only common safety issue affecting shell and tube heat exchangers. They are pressure vessels and as such are subject to the same codes and practices as other pressure vessels. That means the ASME Boiler and Pressure Vessel Code, Section VIII, Pressure Vessels, Parts UG-125 to 1361 dealing with pressure relief devices. This specification gives very clear guidelines concerning all aspects of pressure relief requirements and application.

Pressure relief must be provided for both the shell and tube sides. If the source of overpressure is from upstream, the relief valve for that stream is best placed on the inlet. Otherwise it does not matter much whether it is on the inlet or outlet so long as they are inside any control or isolation valves. It is not sufficient to put minimum stops on the valves as these are easily altered. Even if the stops are welded in place, the valve may be replaced at some future date and the modification forgotten. If careful analysis shows that there are no process, fire, or failure conditions that could possibly require relief valves, it is still strongly advised to install thermal reliefs on both sides of any exchanger that is capable of being blocked in. It may be argued that the fluid is gas or that the process is not capable of adding heat to the blocked in exchanger. This argument overlooks the various unanticipated conditions that may arise during testing and maintenance. A worst case scenario: A cooler was taken out of service and steam cleaned. No one had drained the cooling water which expanded in the tubes and ruptured the joints. True, good maintenance practice would have prevented this incident. But then an NPS ¾ relief valve would have provided a permanent solution and would have cost a lot less than the damage caused by its absence. ACCESSORY INSTRUMENTS. Since the purpose of a heat exchanger is to transfer heat from one fluid to another, instrumentation must be provided to check that this is happening. A thermometer is required at each inlet and outlet. TEMA2 recommends NPS ½ nozzles on each of the four major nozzles. In practice they are not always useful. Firstly, in the process industries, a NPS 1 threaded connection, or even an NPS 1½ flange is the minimum allowed for thermowell connections to piping or vessels. Secondly, exchangers are often installed in such a way that thermometers on the nozzles are inaccessible without ladders or platforms. This is especially true if they are stacked. A more useful approach is to cancel the TEMA connections and to provide appropriate connections in the piping. (I almost broke my neck once trying to read a thermometer at the top of a stacked heat exchanger. My own fault, of course. I should have put it in a better place, I should have insisted on a platform, I should have used a proper ladder, I should not have crawled around on equipment with snow on it.) "Every angle" thermometers are the only kind to get. You never know exactly where they are going to end up. It is not unusual to have a slip-in butterfly valve installed directly on an exchanger nozzle. A thermowell located in the nozzle may jam the valve. On every job there is someone trying to save money. Eliminating the thermometers from the thermowells is often a candidate for dubious cost cutting. Consider the installed cost of the piping connection and the thermowell along with all their associated documentation. Then consider the cost of a thermometer. Remember that a plug must be provided for the empty well. The savings are negligible. Readily accessible temperature readings can eliminate long discussions, hypothesizing and delays when a process mysteriously doesn't work right. The primary ailment of heat exchangers is plugging and fouling. The diagnosis is based on differential pressure. For this reason TEMA2 recommends an NPS ½ pressure

connection on all four nozzles. These connections suffer from the same deficiencies as the ones for thermometers. The solution is the same: Put the right connections in the best place in the piping. A shutoff manifold should be used which has a spare port that can be used for a differential pressure indicator. The problem is that the differential pressure may be only a small fraction of the static pressure. A 10 psi difference cannot be read from two pressure gauges with 1000 psi scales. (War story: During commissioning, a cooler was found to have an inlet pressure of 595 psi and an outlet pressure of 586 psi. The solution to this strange violation of the pressure/flow relationship was to switch the two gauges.) As with thermometers, it is poor economy to eliminate pressure gauges in favour of pressure connections only. Just see how long it takes to find two pressure gauges of the right range when you need them. When two exchangers are stacked in series, they are often connected flange to flange. In this case, it is not necessary to have PIs and TIs on both mating nozzles. A single set is quite sufficient. Unfortunately, it may not be possible to put them in an easily accessible location. It may also be necessary to modify the nozzles to conform to project standards. PARALLEL HEAT EXCHANGERS. Aerial coolers may be viewed as a number of coolers in parallel. A single thermometer at the inlet is sufficient but a separate one at each outlet to the header is essential. There is absolutely no other way to identify individual plugged or fouled sections without taking the whole thing apart. Heat exchangers in parallel do not share the flow equally. Symmetrical piping is like the perfect life: at best a pious intention. (Some people think it is more like Santa Claus.) The problem is that an initial flow imbalance can grow. If a reduction in flow causes fouling which further restricts the flow, a positive feed-back loop is set up which can cut one exchanger entirely out of circulation. Some way must be found to force the flows to balance. Unfortunately, it is meaningless to attempt to control any variable without measurement, and flow measurement is expensive. Not only are the instruments expensive in terms of installed cost and maintenance, the required piping arrangement is also expensive. Thus automatic flow balancing is rarely installed except in extremely critical service such as a furnace with multiple tube passes. If a bank of parallel exchangers is controlled using a bypass it is only meaningful to have a single bypass for the entire bank. If the temperature of stream A is being controlled by throttling stream B, every exchanger must have its own valve or imbalance is sure to result. In fact, a separate control loop on every exchanger is probably a good idea. Care must be taken in the location of the temperature sensors so that each senses only the contribution of the exchanger it is controlling. An example is a pair of reboilers at the bottom of a tower. REFERENCES

1. ASME Boilers and Pressure Vessels Code, Section VIII, Pressure Vessels, Division 1, Unfired Pressure Vessels, Parts UG-125 to 136, Pressure Relief Devices. http://www.asme.org/catalog/

2. Standards of the Tubular Exchanger Manufacturers Association. http://www.tema.org/

3. API STD 661, Air-Cooled Heat Exchangers for General Refinery Service. http://www.cssinfo.com/apigate.html

4. API STD 660, Heat Exchangers for General Refinery Service. http://www.cssinfo.com/apigate.html

CONTROLLING STEAM HEATERS © Walter Driedger, P. Eng., 2000 May 20. walter(at)driedger(dot)ca

First published in Hydrocarbon Processing , November 1996.

This Adobe® file is available for download.

INTRODUCTION. Steam Heaters are simply heat exchangers in which one of the media is steam being condensed while the other is a process fluid being heated. In doing this, there is a phase change which puts special demands on the process control system. It is difficult to generalize about the various options for control. Special system requirements often put unexpected constraints on the process. Even the orientation of the exchanger can have peculiar and unexpected results.

A SIMPLE STEAM SPACE HEATER. Figure 4-1 shows a steam heater such as those used to heat a warehouse. This simple example demonstrates many of the characteristics of steam heaters of all sizes and applications. Steam enters the heater at the top. As the moving air draws away the heat, the steam condenses. The condensate flows down the tubes, through the steam trap, and into the condensate drain header. The function of the steam trap is to prevent steam from blowing through into the condensate system. It is the one essential part of any steam heater and will receive further attention later. For now it is sufficient to say only that it passes condensate and blocks steam. This system tends to be rather self-regulating. The moving air rises to some temperature approaching that of the steam and draws away as much heat as it can. Colder air will draw more heat, and warm air will draw less. The steam trap is essentially a level controller with a set point of zero. This arrangement can be compared to a shell and tube exchanger where the room itself is the shell and the air is the process stream. The fan draws some of the air through the heater and then blends it with the remaining air in the room. The first level of control complexity is to add a thermostatic switch to control the fan. As with any exchanger on bypass control, the sensing element must be placed at a point where the two stream has mixed sufficiently to provide an representative temperature (not directly in front of the fan, as the drawing shows). When the temperature in the room reaches the setpoint, the fan will stop and the air immediately around the tubes will rise to the steam temperature. The heat withdrawn will be reduced until only a small amount of steam is condensed. If it were practical to stop all air circulation and to fully insulate the heater so that no heat is transferred out of it, steam condensation would cease and no condensate would flow through the steam trap. This is not practical, so on a hot day any amount of steam

that still is condensed by air convection is a complete waste. Furthermore it adds to the heat in the room. Thus the next level of complexity is to block the steam to the heater. When this is done, the steam already in the heater condenses, the temperature drops to room temperature and the pressure drops to the corresponding vapour pressure. Condensate will not flow through the trap once the pressure drops below that of the condensate header. Because of the higher density of water, a given volume of steam condenses to a much smaller volume of condensate. The final equilibrium is reached with a pressure of about 2.8 kPaabs (0.4 psia), essentially full vacuum, and with the tubes about 0.15% full of water. (The steam supply in this example is assumed to be at 170 kPaga (25 psig), fully saturated.) The simple system described above, minus the fan, is used for many non-process heating applications such as steam tracing or open tank heating. STEAM TRAPS. As steam condenses, the resulting water drains downward. A steam trap is placed at the low point of the system. It is a valve that opens to allow the water to drain out into the condensate system but closes when all the water has been drained and steam tries to pass through. There are numerous varieties of steam traps operating on various principles. A detailed discussion of various types can be found in the article Steam Traps, Key to Process Heating1 by Haas. CONTROLLING A PROCESS HEATER. The parameter of interest in any process heater is the temperature of the process stream at some particular point in the process. There are essentially only three means of control:  Bypass a fraction of the process stream around the exchanger and blend it with the fraction that has passed through.

 Vary the effective surface area of heat exchange. This is accomplished by restricting the outlet and partially flooding the exchanger with condensate.  Vary the temperature of the heating medium. This is accomplished by throttling the steam and dropping the pressure of the steam in the exchanger. Each of these is discussed in turn below.

BYPASS CONTROL. Bypass control on a steam heater is similar to bypass control on any other type of heat exchanger 2. The only difference is the addition of a steam trap at the outlet of the steam side where the condensate exits at the bottom of the exchanger. Simple steam traps do not come in large sizes, so a more explicit way of separating condensate from steam may be needed. A condensate receiver is a vessel placed below the heat exchanger to receive the condensate that drains from the bottom. A level controller is used to control the outlet valve. The entire arrangement is simply a steam trap on a large scale. The only additional component is the equalizing line from the

receiver. This is needed so that air in the receiver does not block the inflow of condensate. It may not be needed if the line into the receiver is large and free draining. The full story is shown in Figure 4-2. There are many situations where bypass control cannot be used. Note that the process fluid that passes through the exchanger will experience the full temperatur e of the steam. If the fluid is liable to coking, polymerization or other damage at the maximum steam temperature, some other form of control must be employed. Over done and half-baked do not average out! If the process fluid is being boiled, as in a reboiler on a distillation column, the bypass simply will not work at all. Consider a reboiler where the exchanger shell is half full of liquid. The bypass line will also be half full. Vapour from the exchanger will exit at the top but nothing will pass through the bypass line. There is another problem with the arrangement shown in Figure 4-2, if it is to be applied to a reboiler. The temperature at the exit bears no relation to the total quantity of liquid being boiled. If the set point is slightly below the boiling point, only enough boiling to heat the outlet pipe will occur. If the setpoint is even slightly above the boiling point, the controller will open the valve wide. To put the set point exactly at the boiling point is meaningless; exactly does not exist in the real world. LEVEL CONTROL. The total heat transfer rate (heat flux) can be controlled by throttling the condensate leaving the bottom of the exchanger. This causes it to blank off more of the tube surface, reducing the heat transfer area. Figure 4-3 shows a typical arrangement. Orientation is important to the success of this method. In the diagram, the exchanger is placed vertically and has the steam on the shell side. The exchanger can then act as its own condensate receiver.

Figure 4-3 shows one simple arrangement. Note that the steam must be in the shell. If the steam were in the tubes, the condensate would have to be blown upwards out of the tubes. The resulting water hammer would be totally unacceptable. Secondly, there must be no baffle down the middle of the exchanger. If there were, the level could not equalize on the two sides. The side opposite the steam inlet would fill to the top with condensate and effectively blank off half the exchanger. In any case, the condensate must flow out of the bottom. The temperature controller is shown working directly on the condensate valve. The valve must be fail-closed to prevent steam from blowing into the condensate header during an air failure. The controller must be reverse acting so that a rise in the outlet temperature will cause the controller to close the valve. This raises the condensate level and blanks off some of the tube surface. Reduced tube surface area exposed to steam reduces the heat flux in direct proportion. This arrangement works quite well but it has several characteristics that must be kept in mind. The first of these is the transient response. The controller reacts to a sudden increase in process flow by opening the valve. This rapidly dumps condensate so that the exchanger can fill with fresh steam. If the process flow abruptly drops, the response is not so rapid. A valve cannot work backwards; it can stop the flow but it can never cause it to reverse direction. Until the process has absorbed sufficient heat to fill the exchanger with condensate, the heat flux will not go down. An extreme case is when the flow stops entirely. The temperature of fluid remaining in the tubes will rise to that of the steam and will not cool down until enough heat has been lost through the insulation to condense enough water to fill the exchanger. This may take some time. An exchanger being controlled by controlling condensate level is a little like a car with excellent acceleration but bad brakes. (We seem to have quite a few of these in our town.)

The above example also illustrates a problem common to all heat exchanger controls: What happens when the flow stops entirely? If the temperature element is located some distance downstream of the heater, the section of line in which it is located gradually cools off and the controller asks for more heat. Eventually steam will blow out the bottom and into the condensate system. Interlocks may be required to prevent this. A second controls problem occurs during situations of extreme turndown. Consider the following scenario: Plant feed is taken from tankage and heated to approximately 25 C (77 F). The plant is located in a far northern location so the heater is sized large enough to provide sufficient heat even on the coldest days. In the summer the situation is quite different. Little or no heat is required and the exchanger fills with condensate nearly to the top. Once the level rises above the steam inlet, severe hammering occurs as the condensate backs up into the steam line and the steam blows through it into the space at the top where some condensation is still occurring. Persistent gasket leaks are one result. The operators try to remedy this by partially closing the manual block valve at the steam inlet. This does not help as it is the low rate of condensation that controls the steam flow. Eventually the hammering stops when the manual bypass on the condensate valve is opened. At this point the operators are convinced that the condensate valve is undersized since opening the bypass "cured" the problem. They do not observe that the process is being overheated and that the control valve is actually tightly closed. The actual source of the difficulty is that it is not possible to blank off the entire heat exchange surface without raising the level above the steam inlet. A short-term fix may be to inject air or other appropriate non-condensable into the shell. The proper solution is to use a horizontal exchanger. The steam will then enter at the top. Once the condensate has risen above the highest tubes, heat transfer stops and the condensate rises no further. IMPROVED LEVEL CONTROL. There are essentially three forms of disturbance that can affect a steam heater:  The process load can change as a result of changes in either the flow rate or the feed temperature. A change in the setpoint of the temperature controller is equivalent to a change in load.

 The steam pressure and temperature can change.  The condensate back pressure can change. If the condensate valve starts out in manual with a fixed position, the system response to an increase in load will be an increase in condensation followed by rise in level. The end result will be a lower outlet temperature. Since neither the steam nor the condensate pressure change in this example, the flow through the valve is constant. Therefore the heat flux is constant. The same heat flux into a greater process load results in a lower temperature. If the valve is placed

under automatic temperature control, it will be opened and a new equilibrium established at a somewhat lower level and the appropriate higher heat flux, after the initial drop in temperature.

The response of manual control to an increase in steam pressure is an increase in heat flux followed by a rise in level. Since the level has no significant bearing on the flow of condensate through the valve, the level will continue to rise until the amount of steam condensed is equal to amount of condensate flowing out through the valve. The final process outlet temperature will be slightly higher than before due to the slightly higher heat content of the higher pressure steam. If the loop is in automatic, the controller will restrict the condensate flow until the correct operating point is found. Assuming that the pressure of the steam is not significantly higher than that of the condensate, a rise in condensate header pressure will reduce the flow and cause the level to rise. If the valve is in manual, the outlet temperature will drop until the heat flux corresponds to the reduced condensate flow. If the valve is under temperature control, the controller will open it until the correct level is again achieved. This assumes, of course, that there is sufficient steam pressure to force out all the condensate being produced. The three scenarios played out in the previous paragraphs all result in some transient disturbance to the process temperature. Is there a method by which these transients can be reduced? Cascaded controls come to mind. One common arrangement is to cascade the temperature controller to a level controller, as shown in Figure 4-4. The level controller senses the rise in level resulting from an increase in process load by opening the valve. This provides a correction in the right direction but it is uncertain whether this would be any faster than the response of the temperature controller alone. The temperature/level cascade provides similar limited assistance if the disturbance is due to an increase in steam pressure. A rise in outlet temperature must precede a rise in level. Therefore a temperature controller alone would be faster in eliminating transients.

If the disturbance is caused by a rise in pressure of the condensate header, the first result will be a rise in the liquid level. A level controller would sense this immediately and respond by opening the valve. This would greatly reduce the effect on the process. In conclusion: A temperature/level cascade is helpful if the expected disturbance is caused by the condensate header. It is important to realize that any form of cascading or feed forward must always be addressed at a particular disturbance. The issue is not whether or not the system works but rather against what type of disturbance it is effective. A temperature/flow cascade loop is sometimes employed in an attempt to improve control precision. Steam flow is the measured variable, as shown in Figure 4-5. Unfortunately the configuration has an inverse transient response to load changes. As the load goes up, more steam is condensed causing an increased flow into the exchanger. The flow controller will close the condensate valve at the same time as the level is rising. This causes a further increase in level. Eventually, a new equilibrium is reached but the short-term result is a worsening in response. If the disturbance is in the form of an increase in steam pressure, the T/F cascade responds correctly and improves the situation. If the disturbance is an increase in condensate header pressure, the flow controller will notice that the steam flow rate drops due to the reduced surface area and act to lower the level. Thus the T/F cascade is effective against steam and condensate disturbances but not against disturbances originating in the process.

The only way to improve response to load changes is through the use of feed forward. This technique measures the disturbance itself and applies a correction before the effect of the disturbance is even felt. If the correction is too early, a transient in the output will be seen that is in the opposite direction of what would otherwise occur. In such cases a signal delay is needed. Every possible disturbance has its own measurement and it is impossible to compensate for all of them. A load disturbance to the heat exchanger could be caused by a change in flow rate, a change in feed temperature or even a change in specific heat. The controls engineer must decide which of these is significant for each particular case. The example in Figure 4-6 shows a system in which it was concluded that process flow is a significant variable. The output of the temperature controller is multiplied by the flow rate to produce the signal that controls the valve. Both signals being multiplied must be linear and in units of percent. A common question is whether to apply the feed forward signal through a multiplier or an adder. In this example it is clear that the steam rate, and therefore the valve position, should be proportional to process flow rate therefore the signal must be multiplied. Note that the installed valve characteristic must be linear for this to work perfectly. STEAM CONTROL. A common method of controlling a steam heater is to throttle the steam at the inlet. Since water boils at a lower temperature when the pressure is reduced, the condensate temperature goes down with pressure. It is fairly accurate to assume that the conditions inside the exchanger are isothermal. That is, there is no significant counter-current flow and the maximum temperature to which the process fluid can rise is the temperature of the condensate. Table 1 gives a number of pertinent parameters for a sample case. The steam header is at 600 kPaga (87 psig). It is throttled down to 300 kPaga (44 psig). This corresponds to a drop in condensate temperature from 165 C to 155 C (329 to 311 F). Therefore the process outlet temperature must also drop approximately 10 C (18 F).

Table 1 points out a few other effects of throttling. Firstly, the density of the steam is reduced. This reduces the effective rate of heat transfer. Secondly, throttling saturated steam does not drop its temperature sufficiently to keep it at saturation at the lower pressure. Thus there is a certain amount of superheat. Superheated steam is less effective in transferring heat than saturated steam because the sensible heat released as it cools to saturation is considerably less than the latent heat released by condensation.

Header conditions

Exchanger conditions

Pressure - absolute

700

400

kPaabs

- gauge

600

300

kPaga

Enthalpy

2764

2764

kJ/kg

Temperature

165

155

C

Density

3.66

2.10

kg/m3

Superheat

0

11

C

Condensate Enthalpy

697

605

kJ/kg

Condensate Temperature

165

144

C

TABLE 1 - THERMODYNAMIC PROPERTIES Thirdly, the condensate is released to the header at a lower pressure. This condensate has a slightly lower enthalpy, therefore there has been a slightly higher amount of heat recovered to the process. It also means that there is less flashing or other disturbance to the condensate header. All these secondary effects, except the last, reduce the efficiency of the heater. The result is to increase the approach temperature of the outlet

stream (the difference between the actual outlet and the maximum achievable). This causes a further, minor reduction in outlet temperature. Figure 4-7 shows a typical steam heater being controlled by a valve on the steam inlet. The valve on the condensate outlet is still needed to keep steam out of the condensate system. This brings attention to a major problem with steam control in a heater requiring low-pressure steam: After passing through two valves, there may not be enough pressure left to return the condensate to the header. The obvious solution is to raise the steam pressure. This will not help because the purpose of the steam valve is to drop the pressure to a specific value, that corresponding to the desired steam temperature. There are three possible solutions:

1 - The best solution is to reduce the back pressure in the condensate header. This cannot always be done. Perhaps the condensate lines must run in pipe racks that are elevated above the heater. Long return lines may add further to the back pressure. 2 - Using level control, as explained in previous sections, may be a useful alternative. 3 - When faced with an existing installation in which the steam header pressure has dropped and the condensate header pressure has risen, both because of increasing demand, the only alternative may be to add a condensate return pump. The purpose of this pump is to force low-pressure condensate into a header at a higher pressure. The control valve must, of course, be on the discharge of the pump to prevent flashing or cavitation.

SAFETY. The safety requirements of steam heaters are like those of any other heat exchanger2. In particular, relief valves must be provided on both sides as with any pressure vessel3.

There is one additional hazard associated with steam heaters: Blowing steam into the condensate header. The level control valve or steam trap drops the pressure as the condensate enters the header. If the header is not rated to take the full pressure of the steam, a relief valve must be provided to guard against valve failure. Additional precautions may be warranted. One possibility is an independent low low level switch to block in the valve via a solenoid. A second method, illustrated in Figure 4-8, is a low level override. It consists of a level controller whose output goes to a low selector together with that of the temperature controller. The level setpoint is approximately at the bottom of the tubes. A level below this will cause a direct acting controller to reduce its output. Once the output is less than that of the temperature controller, the level controller has control of the valve and will prevent the level from falling below the bottom of the exchanger. This form of override will work equally well on a condensate receiver vessel and also in conjunction with a T/F cascade or feedforward. It is most likely during a period of maximum production that maximum heat demand is required. In other words, a low level switch is most likely to shut down the heater at precisely the time when the plant is making the most money. The use a low-level override will prevent this very undesirable occurrence by effectively switching the heater to capacity limit control. That is the heater will run at the limit of its capacity (lowest level) without the risk of a shutdown. A simple rule helps to remind us whether a high or a low selector is needed. A valve is always selected so that the lowest value of its input signal corresponds to the safest valve position. Thus a safety related override will always act through a low selector to provide fail-safe action. In cases where a fail open valve is appropriate, such as pump recycle, a low selector is still the appropriate choice.

Note that a PI or PID controller will wind up if its output is not selected to control the valve. (When it is ignored, it yells louder!) A special type of selector called an "override selector" must be used for override applications. This module or software function block suppresses the integral action of any controller(s) whose output is not selected for control. If the pressure of the inlet steam is sufficiently high that it poses a serious danger to the condensate system, it may be necessary to apply both a low level override and an independent low low level switch to block in the valve via a solenoid. Since the solenoid would only act during a failure, it should be latched in the closed position. ACCESSORY INSTRUMENTS. A steam heater has essentially the same needs for accessory instrumentation as any other heat exchanger. Since its purpose is to heat the process stream, some means must be provided to verify how well it is doing this. Therefore thermometers are installed at the inlet and outlet. To warn of plugging, pressure gauges are also required2 . Thermometers and pressure gauges should also be installed on the steam side inlet. This is especially true if steam throttling is being used, otherwise it is not possible to know what conditions are after the valve. There is generally no need for a measurement at the outlet. A level gauge glass should, as always, be installed to cover the span of any level controlling device to verify its operation and to provide coverage during its maintenance. PARALLEL STEAM HEATERS. Steam heated reboilers are frequently twinned on large distillation columns. These must have individual controls, either on the steam side or the condensate side. There is absolutely no way of ensuring an even distribution of load if this is not done. One common solution is to have the output of a single temperature controller split to two separate flow controllers. A simple subtraction unit can be used so that the operator may enter a value between 0 and 100% to establish the proportion of the flow to one controller with the remainder going to the other. REFERENCES 1. Haas, John H., "Steam Traps, Key to Process Heating", Chemical Engineering, January, 1990.

2. Driedger, W. C., "Controlling Shell and Tube Exchangers"; Hydrocarbon Processing, March 1998. http://www.driedger.ca/ce3_stx/CE3_STX.HTML

3. ASME Boiler and Pressure Vessel Code, Section VIII, Pressure

Vessels, Division 1, Unfired Pressure Vessels, Parts UG-125 to 136, Pressure Relief Devices. http://www.asme.org/catalog/

4. Standards of the Tubular Exchanger Manufacturers Association. http://www.tema.org/

5. API STD 660, Heat Exchangers for General Refinery Service. http://www.cssinfo.com/apigate.html

CONTROLLING FIRED HEATERS © Walter Driedger, P. Eng., 2000 May 20. walter(at)driedger(dot)ca

First published in Hydrocarbon Processing , April 1997.

This Adobe® file is available for download.

INTRODUCTION. The purpose of a fired heater is very simple: To add heat to a process fluid. Its representation on a process flow diagram is also very simple. But, of course, fired heaters are among the most complex pieces of process control equipment. Each furnace is, after all, at least two pieces of equipment in one. Firstly, it is a special variant of the shell and tube heat exchanger since its purpose is

to exchange heat. Secondly, it is a chemical reactor in which fuel and air undergo extremely exothermic reactions to produce the required heat. In previous articles of this series1, 2, 3, 4, the process aspects of controlling a piece of equipment were presented before dealing with protection and safety. This time the topics will be reversed: In the case of fired heaters, it must be safety first! SAFETY. If fired heaters had not been invented and were being proposed for the first time, I would probably say, "You've got to be kidding. That thing will blow up in your face the first time you throw a match in it." However, at least a half a billion gas fired heaters are in service around the world (according to the American Gas Association). Most of them are operated by people with no technical experience whatsoever; few heaters blow up. Still, the average domestic water heater is not in the same league as a hydrogen reformer furnace. The fact that accidents and disasters are as few as they are, is due to the long experience the human race has in dealing with fire. A million years, I'm told. For the last century, this experience has been embodied in various codes and standards that have been written into law and are en-forced by inspectors around the world. THE CODE. The most popular, or notorious, of these codes in North America is NFPA 855 and 866 issued by the National Fire Protection Association. These have been considerably updated in recent years, especially in terms of clarity. Nevertheless, there is still the problem of interpretation. The code is not at all easy to read as it combines many facets of construction, instrumentation and operation in a single document. Not only that, but the code5 contains the following disclaimers: It is not possible for these standards to encompass specific hardware applications, nor should these be considered a "cookbook" for the design of safety systems. and: This standard applies to boilers with a fuel input of 12,500,000 Btu/hr (3663 kW) or greater. This standard applies only to boiler-furnaces using single burners firing: a) Natural gas only as defined in Chapter 3. b) Other gas with a BTU value and characteristics similar to natural gas. c) Fuel oil of No. 2.... and: Furnaces such as those of process heaters used in chemical and petroleum manufacture, wherein steam generation is incidental to the operation of a processing system, are not covered in this standard.

What is an engineer to use for a guide when the furnace is not a boiler, but a feed heater; does not exceed 12½ million Btu/hr, but is only four million; does not burn natural gas as defined in Chapter 3; but refinery off-gas with a high hydrogen content? Despite the disclaimers, the NFPA series is still an excellent guide to the instrumentation and control of any furnace.

FUEL GAS FIRED, SINGLE BURNER FURNACES. The NFPA standard deals with a variety of fuels, both oil and gas. The discussion that follows restricts itself to fuel gas fired, single burners. NFPA standards have been followed as much as possible and have sometimes been exceeded by adding components and control functions where the special requirements of process control make it advisable. Figure 5-2, shows the in-line instruments typically installed on a burner fuel gas train. Diamond symbols with an "I" in them refer to I/O of the Burner Management System (BMS).

FUEL GAS SUPPLY INSTRUMENTS PCV-1 The fuel gas supply regulator is only required when the fuel gas pressure must be reduced in two stages. This is often the case in refinery service. See Figure 5-3 for typical regulator settings.

PI-1 Every regulator should have a gauge so that the operator can set the regulator properly and so that he can know that it is doing its job. PSV-1 Many standard fuel gas train components have an upper pressure limit of approximately 100 psig (700 kPag). Failure of both PCV-1 and PCV-21 would overpressure the fuel gas train if the supply pressure exceeds the rating of any downstream component. In such cases provision for pressure relief is required. Note that it is not unusual to consider double jeopardy in burner safety analysis. FE-3 This is the place to put fuel gas metering, if required. NFPA puts the fuel gas meter on the main gas line down-stream of the main gas regulator. But when using accurate fuel/air ratio control it makes sense to include the pilot as part of the total fuel supply as it may supply as much as 10% of the total fuel.

PT-3 Large burners with a variable fuel gas supply pressure may require pressure, and possibly even temperature, compensation for the fuel gas measurement.

PILOT GAS LINE INSTRUMENTS

PCV-11 The pilot gas regulator is set for the actual required pilot gas pressure.

PI-11 Of course the regulator has a gauge! BV-14 On small burners, the first pilot shutoff valve may be a standard industrial, two port, solenoid valve. Limit switches can be considered optional on solenoid valves. On large burners, a burner safety shutoff valve is generally the preferred choice. These valves have an internal spring to force the valve shut, a solenoid to hold them open, and a small motor to re-open the valve. Item BV-24, following, provides more detail concerning this type of valve. Some installations use a standard, industrial, diaphragm operated control valve. In either case, the valve must be fail-closed. ZSC/O-14 At least one limit switch is required on BV-14 if it is anything more than a simple solenoid valve. This is needed to prove that the valve is shut during the purge phase. For failsafe operation it is best to have a limit switch at each end of travel. The upper limit switch proves that the valve is fully open at all times when the pilot flame is supposed to be on. The article, "Limit Switches Key to Valve Reliability"8 , explains exactly how to connect double, failsafe, limit switches. BV-15 The pilot vent valve makes certain that there is never any gas pressure on the second shutoff valve despite any leakage through the first one. Since its only purpose is to vent leakage, the vent line has a smaller bore than the supply line. It must be fail-open. The Canadian Gas Association code CAN/CGA-3.9-M879 repeats the following table from NFPA 86A 7 for determining vent line sizes: Gas Supply Line Size

Gas Vent Line Size

NPS

mm

NPS

mm

1½

( 40 )

¾

( 20 )

2

( 50 )

1

( 25 )

2½

( 65 )

1¼

( 32 )

3

( 80 )

1¼

( 32 )

3½

( 90 )

1½

( 40 )

4

(100)

2

( 50 )

5

(120)

2

( 50 )

6

(150)

2½

( 40 )

8

(200)

3½

( 90 )

>8

(>200)

>15 % line crosssectional area

For low molecular weight fuels such as hydrogen (Mol. Wt. = 2) or methane (Mol. Wt. = 16) it is sufficient to vent the valve to atmosphere outside the building. For fuels heavier than air, such as ethane, propane and butane (Mol. Wt. = 30, 44, 58 respectively), the vent should be piped to a flare header.

Using the table above, it may be determined that a ¾" or 1", simple solenoid valve is sufficient. If not, a fail-open burner safety valve should be used. It operates in a similar, but opposite, manner to BV-14. ZSC/O-15 Limit switches should be included and incorporated in the BMS logic, if a full-sized vent valve is required. BV-16 The second pilot shutoff valve is identical to the first, BV-14. ZSC/O-16 Limit switches should be included and incorporated in the BMS logic, if a full-sized, second pilot valve is required. PI-18 The final pressure gauge confirms that all valves are in their correct position and that the appropriate pressure is available for the pilot flame. BY-18 The igniter itself is essentially a spark plug powered by a high voltage transformer. It is capable of sparking continuously as required by the BMS.

BSLL-19 The pilot flame detector is used to confirm that the pilot light has ignited and is burning in a stable manner. A variety of types exist depending on the size of the burner and the type of fuel. A flame rod is a simple electrode that projects into the flame. An electric current passes through the flame to the pilot gas nozzle and energizes a sensitive relay or electronic circuit. Since it only senses flame at a point, it will not detect the main flame. A disadvantage is that the tips burn off after a period of time and a nuisance trip of the furnace will result. An ultra-violet (UV) flame detector is probably the most popular on process heaters. It is, however, a rather complex device that requires certain precautions for reliable operation. UV detectors are optical devices. A lens in front must be aimed directly at the flame. Depending on the particular arrangement used, it may or may not be desirable for the detector to "see" only the pilot flame or the main flame as well. One or more viewing windows, BG-45A to X, must be provided by the furnace fabricator to assist in aligning the detector. UV detectors are mounted on ball swivels to permit accurate alignment. An instrument air purge complete with a rotameter and a needle valve should be connected to the tube between the lens and the flame in order to prevent dust from accumulating on the lens and to cool it. Some units also require a supply of cooling water. FUEL GAS LINE INSTRUMENTS PCV-21 The main gas regulator is set to the maximum allowable fuel gas pressure for the main burner.

PI-21 Every regulator requires a pressure gauge. This gauge is also used to adjust the setpoints of PSLL-22 and PSHH-27. PSLL-22 The fuel gas low pressure switch prevents the operator from attempting ignition when there is insufficient pressure to complete it. The upstream location is so that it is not necessary to bypass its function during the ignition sequence. BV-24 The first fuel gas safety shutoff valve is one of the "safety shutoff valves". It must be especially certified for fired heater use. The first of the three valves in the main gas train has a manual reset and a solenoid that function as follows: - When the solenoid is de-energized the valve is shut and the manual reset has no function whatsoever.

- When the solenoid is energized, the valve remains shut until the manual reset is lifted. - Lifting the manual reset opens the valve. The valve then remains open as long as the solenoid is energized. A valve with this function is sometimes termed a "free handle" valve. Once a trip has occurred, the manual reset on the first safety shutoff valve will prevent the burner from reigniting. This is an extremely important safety feature. Even if there is insufficient pressure to maintain a flame, unburned gas may still collect in the firebox and ignite with explosive force once a large quantity has accumulated

ZSC/O-24 In addition, BV-24 requires a limit switch to prove that it is shut during the purge and ignition phases. Item ZSC/O-14, above, details the requirements of fail-safe limit switch arrangements. BV-25 The fuel gas vent valve has similar criteria to those of BV-15. The same sizing table applies. ZSC/O-25 These limit switches are optional, depending on the size of the vent valve. BV-26 The second main gas safety shutoff valve is a little different from the first in that it does not require a manual reset. The automatic reset feature is accomplished by a small electric motor that opens the valve as soon as it is energized. The valve fails closed upon de-energization. Automatic reset valves are identified by the little "M" instead of the "S" in the symbols on Figure 5-2. The valve may incorporate a slow opening feature. Power to the reset motor should be disconnected as soon as the valve is open so that a momentary power loss to the solenoid does not cause the valve to cycle. ZSC/O-26 BV-26 should also have limit switches whose status is incorporated into the BMS logic. PSHH-27 The fuel gas high pressure switch shuts down the main furnace when the fuel gas pressure exceeds the maximum allowable for a stable flame. Excessively high pressure can blow the flame out only to have it reignite, perhaps explosively, higher up in the furnace. There is a trend toward the use of analog transmitters instead of switches for sensing process values, even for shutdown purposes. The trip value is then programmed into the control system instead of being adjusted at the switch. Transmitters have become more reliable than switches and also provide much more information10 . If this is the policy at your installation, the functions of PSLL-22 and PSHH-27 can be combined in a single

transmitter located at PSLL-22. A second transmitter can then be used to provide pre-alarms or an automatic redundancy scheme. FV-3 Most large industrial furnaces have a gas flow control valve to modulate the heat input. Details of the control system are discussed in the sections on fuel control. The gas flow control valve must be fail-closed but must also have some means of ensuring that it does not shut too closely to the seat or an unstable flame will result. Approximately 35% of full flow is a typical minimum. Some engineers program a minimum output into the control system. Others weld a small stop onto the shaft. Software blocks can be easily altered and welded stops may not be re-installed when the valve is replaced. I use both. The software limit has the advantage that it can be raised if the original setting is too low. It should be set slightly higher than the welded stop in order to inhibit reset windup before the 0% controller output is reached. Furnaces with cyclical service, such as those used in dryer regeneration service, may have the main flame turned on and off on a regular basis. In such cases, there cannot be a minimum stop on the control valve. Instead, logic should be provided that shuts the valve fully whenever the controller tries to position it below the minimum flame setting. The controller must also be switched to manual to prevent reset windup whenever this is done. ZSC-3 The gas flow control valve requires a limit switch to confirm that it is at the minimum flow position before lightoff. The switch should be set slightly above the minimum stop. PI-28 A pressure gauge should be placed last before the fuel nozzle itself to provide assistance in diagnosing mysterious problems. Dirt does collect in valves and other places! BSLL-29 The main flame detector is generally of the combination ultraviolet and infra-red (UV/IR) type. The same requirements apply as to the UV detector for the pilot. Burners in cyclical service do not require a main flame detector. They rely entirely on the pilot flame detector, which may be adjusted so that it can see both flames. AIR SUPPLY INSTRUMENTS. There is considerable variation in the air supply system among furnaces of different sizes. Small heaters, and some not so small, may be entirely natural draft and are controlled only with a manually set air damper. For furnaces with forced draft (FD) fans some, or all, of the following instruments are required.

PDSH-31 If the air intake has a filter, it must be fitted with a differential pressure switch or transmitter connected to an alarm to warn of plugging.

FE-32 If the FD fan is large, a flow measurement device is needed at the intake to measure flow through the fan so that surge can be prevented. A simple averaging pitot tube (Annubar) or a thermal device provides sufficient accuracy without significant loss of head. FV-32 Large fans require a minimum flow blow-off valve to prevent surge. FE-33 The actual air flow to the burner must be measured if an accurate fuel/air ratio is to be maintained. This is generally done for large furnaces. Smaller packaged units have the fuel and the air linked with cams and no air measurement is done. A previous article1, explains why it is not possible to use same flow element for both minimum flow and throughput flow control. It may be required to use a venturi to achieve both high accuracy and low head loss. On very large burners, arrays of pitot tubes or thermal flow meters distributed across the duct, are the preferred method. However, these can be somewhat time-consuming to install and maintain. The associated transmitter is also used to provide the pre-alarm for FSLL36. FV-33 A fail-open combustion air control valve is placed at the inlet to the wind box for those burners requiring external air control. A butterfly valve is a popular choice. Very large fans may have provision for inlet guide vanes which provide a more efficient means of doing the same thing. The valve requires a minimum stop to prevent complete closure. ZSO-33 FV-33 has a limit switch to confirm that it is fully open during purging. VSHH-34 Large fans should be provided with a seismic type vibration switch. A previous article3 discusses these devices. The switch should be connected to shut down the entire system as the heater cannot be operated without the fan. Very large fans may even include an entire bearing vibration monitoring package. YS-34 The FD fan motor status contact is used to provide information to the BMS. FSH-35 The purge air switch is used to indicate adequate purge flow. It is usually a differential pressure switch across the wind box, if any, of the furnace or it may be a signal from the flow transmitter, FT-33. As can be

seen in Table 5-1, there is a variety of opinions concerning minimum purge requirements. Specification

Time

Volume

Flow

ASME Section VII11

> 5 minutes

> 5 volumes

> 25% full flow

API(RP 550 – Part 4)12

> 5 minutes

> 5 volumes

> 25% full flow

NFPA 85015

not specified

> 8 volumes

> 70% full flow

CGA B149.39

not specified

> 4 volumes

> 60% full flow

Table 5-1 Minimum Purge Requirements FSLL-36 The combustion air low flow shutdown switch shuts down the burner if there is insufficient flow for safe combustion. FURNACE INSTRUMENTS TE-41 One or more skin thermocouples should be provided on the tubes of the furnace. The thermocouple element is welded directly to the tubes. Note that the device that receives the T/C signal must be capable of accepting grounded signals.

TSHH-42 High stack gas temperature is cause for shutdown. The furnace should also be isolated from the process feed if the feed is flammable. Tube rupture may be the cause for the high stack temperature. AE-43 For a burner to operate at peak efficiency, stack oxygen and combustibles must be measured and controlled. However, the additional cost and maintenance of stack analyzers limit their use to large burners. High and low alarms should be programmed. PI-44 A draft gauge must be provided to give a grade level indication of the pressure in the furnace. This is a special type of pressure gauge sensitive to inches of water pressure. BG-45 A to X FG-45 A to X Viewing windows were mentioned previously with respect to

aligning the flame detectors. Other windows may be needed as well. These are usually made of glass and require a small air purge to keep them cool and clean. Regulators are often used control the air flow. This is rather pointless since it is flow control that is required. The presence of pressure may only mean that the line is plugged. The absence of pressure may mean that the purge is flowing freely at a rate beyond the capacity of the regulator. Pressure alone proves nothing. The appropriate instrument is a rotameter with a needle valve. 15 SCFH is a common flow setting. The rotameter provides proof that purge is actually occurring. A number of purge rotameters can be mounted on a plate and pre-tubed to a small instrument air header. This greatly reduces field labour and provides a convenient way of checking all purge rates from a single location. PROCESS RELATED SAFETY INSTRUMENTS. The details of process related safety instrumentation depend very much on the individual process. It is hard to generalize. The majority of furnace incidents occur during light-off. Therefore, it is not necessarily a good idea to add every automatic shutdown function that might suggest itself. The safety value of each interlock must be weighed against the risk of unnecessary shutdown and relight cycles. At least one nuisance trip is bound to occur during the life of the equipment for every shutdown device installed. Furnace isolation valves are especially problematical.

XV-51 It may sound desirable to automatically shut isolation valves if it appears that a tube rupture has occurred. However, remember that any closure of an isolation valve during operation results in loss of flow. Further interlocks must be provided to shut down the burner if this occurs. Even after the shutdown, radiation from the refractory continues to heat the trapped fluid. Boiling may result in over-heated tubes. If the fluid is susceptible to coking, tubing damage may accumulate even after the immediate incident is past.

If careful analysis shows that an isolation valve would provide a net contribution to safety, the valve must be installed correctly. Details of XV51 are shown in Figure 5-4. The valve must be a fire rated valve. That is, it must be capable of maintaining a seal in the presence of fire. API SPEC 6FA13 and 6FC14 outline the requirements. The wiring for both solenoids and for the associated limit switches should also be fireproof. Mineral insulated (MI) cable is an appropriate choice. XV-51 should be located at least 50 feet (15 meters) from the furnace. Provision must be made to manually initiate valve closure from a location at least another 50 feet from the valve itself. The DCS console in the main control room is an ideal location. XYO/C-51 If the process fluid is sufficiently hazardous that isolation valves are considered necessary, a difficult issue must be addressed: What should the failure mode of the valves be? If the valve fails to shut during an emergency, a hazardous situation exists. If the valve fails closed due to a power or instrument failure, other hazards occur. One solution to this problem is to use double-acting, fail-last (-locked) valve actuators. These should be installed with two separate solenoids: XYO to open the valve and XYC to shut it. If this is done, two failures are required to cause an undesired valve action. For example, if the valve is required to be in the open state, XYO will be energized. A signal failure results in both solenoids being de-energized. However, the valve will not move since air pressure on the piston is still balanced. It requires energization of XYC before anything happens. A valve that has been shut because of a fire will not re-open due to burned out wiring. Incidentally, double-acting actuators are considerably less expensive than spring-return actuators. ZSC/O-51 Limit switches 8 are provided on the valve to ensure that it is fully open before furnace ignition is permitted, and fully shut when necessary. XV-52 If the furnace contains a large inventory of flammable fluid, a depressurization valve may be required. It should be capable of dumping the entire contents of the furnace to the flare. A check valve should be added at the outlet of the furnace so that the blowdown valve does not attempt to depressure the entire downstream process. XYO/C-52 The problems associated with a fail-open depressurization valve make it very unlikely that it would be acceptable to operations. Any power or air failure would result in massive flaring. Thus a fail-last valve actuator arranged in same way as XV-51 is the most reasonable choice. ZSC/O-52 Limit switches on XV-52 should be interlocked to prevent opening XV-51 when the depressurization valve is open.

FSLL-53 Measuring the process outlet flow is an excellent safety feature. Remember that a process furnace is essentially a heat exchanger. If there is no process flow, the furnace tubes will overheat and may coke or even rupture. The flue gas will overheat upper section of the furnace and the stack. No furnace can be allowed to operate under these conditions. If the inlet process flow, FE-33, is high and the outlet is low, it can only mean that a tube has ruptured. Immediate shutdown is imperative. TSHH-53 High process outlet temperature means that the temperature controls are not functioning properly: The furnace must be shut down. The note under PSHH-27 concerning the use of transmitters instead of switches also applies here. Modern programmable logic controllers (PLCs) and distributed control systems (DCSes) are quite capable of interpreting thermocouple and RTD signals directly. Consideration should be given to using them instead of the less reliable temperature switches or the combination of thermocouple and millivolt trip relay10 . PSV-54 In all probability there will be block valves somewhere on either side of the heater so that it can be isolated manually. If these exist, a relief valve must be provided. SUPERVISED MANUAL. The NFPA standards 5, 6 specify several types of burner management systems: o o o

Automatic (Recycling) Automatic (Nonrecycling) Supervised Manual. The type most commonly used in industrial process furnaces is supervised manual, often called semiautomatic. NFPA describes it best: Supervised Manual. A system by which the furnace is purged and a burner started, ignited, and stopped manually, with interlocks to ensure that the operation follows proper procedures. That this means is that the operator must be present at the burner to control the ignition procedure. At various key points he pushes a button or takes some other action to advance to the next step. The BMS supervises the operator and confirms that all conditions are appropriate for that step before allowing it to proceed. If conditions are wrong, the BMS shuts down the entire sequence and the operator must rectify the problem and start all over again. It's a little like playing Snakes and Ladders except that there is no quick way to the top. A detailed example of the ignition sequence for a furnace with an FD fan is given below. The indented paragraphs marked " " indicate automatic action. STEP 1: Close the gas flow control valve, FV-3, to its minimum stop.

Open the combustion air valve, FV-33, full.

Push the Start Fan button, HS-34. (The fan may be started from the main control panel or by some other means.) 

The green Fan Running light, YL-34, comes on.

PAUSE The sequence may wait indefinitely at this point.

STEP 2: Switch the Enable switch, HS-2, to ON. (This can also be done before the fan is started.) Any other shutdowns, such as from the Main Control Panel or a plant emergency shutdown (ESD) must be cleared before this has any effect. 

The green Ready light, XL-2, comes on if there are no active shutdowns.



Automatic functions are enabled once the switch is ON. Until that point, no lights are on except the Fan Running light, and no push buttons function except the Lamp Test. All block and vent valves are deenergized.

PAUSE The sequence may wait indefinitely at this point.

STEP 3: Push the Lamp Test button, HS-9.



All lights should come on.

STEP 4: Push the Start Purge, HS-35, button. 

The following conditions must be met before the purge sequence can begin: - Both safety shutoff valves are confirmed shut.

- The gas flow control valve is confirmed on minimum stop. - The combustion air control valve is confirmed wide open. - The fan is confirmed running (YS-34). - The purge flow signal, FSH-35, is on. 

Once these conditions are met, a timer, KC-35, is started. The timer is set so that a minimum of eight air changes of the furnace is assured. (See Table 5-1, Minimum Purge Requirements.) The green Purge Complete light, FLH-35, flashes while the timer is running. Any time any of the conditions are not met, the timer is reset and the light goes off.



Once the timer has completed the purge interval, the green Purge Complete light is on steady.

PAUSE The sequence may wait indefinitely at this point as long as the fan is running.

STEP 5: Push the Start Ignition button, HS-14. 

A twelve second timer, KC-14, is started.



The ignition transformer, BY-18, is turned on.



The green Pilot Flame On light, BLH-19, is flashing.



The pilot vent valve, BV-25 is shut.



The first pilot shutoff valve, BV-24, is opened.



The second pilot shutoff valve, BV-26, is opened.



Pilot flame, BSLL-19, must be confirmed for two seconds during the twelve second interval or the BMS reverts to Step 4.

Once the pilot flame, BSLL-19, is confirmed. 

The ignition transformer, BY-18, is turned off.



The green Pilot Flame On light, BLH-19, is on steady.

PAUSE The sequence may wait indefinitely at this point as long as pilot flame is detected.

STEP 6: Push the Open Main Fuel button, HS-24. 

A second twelve second timer, KC-24, is started and the green Main Flame On light, BLH-29, is flashing.



The fuel gas vent valve, BV-25, is shut.



The first fuel gas safety shutoff valve, BV-24, is energized.

STEP 7: Lift the lever on the first fuel gas safety shutoff valve, BV-24, within ten seconds. The valve will then stay latched in the open position. It will not open at all if conditions are not safe. 

If this is not confirmed by ZSO-24 within the allowed ten seconds, the sequence reverts to Step 4. If it is, the open limit switch will trigger the BMS to open the second fuel gas safety shutoff valve, BV-26.



Main flame must be confirmed by BSLL-29 for two seconds during the twelve second interval or the BMS reverts to Step 4.



Once the Main flame is confirmed, the green Main Flame On light, BLH29, is on steady.

PAUSE The furnace is now running on minimum flame (also known as "low fire"). The sequence may wait indefinitely at this point.

STEP 8: The operator may open the gas flow control valve at any time. EMERGENCY SHUTDOWN. Various trouble indications will trigger a partial or total furnace shutdown. They are tabulated in Table 5-2. These shutdowns, except the two flame failures, are active at all times, including during the ignition sequence. The flame detectors are bypassed during the trial for ignition period.

Burner E S D

Main Gas

Pilot Gas

FD

Manual restart

cause

BV-24/25/26

BV-14/15/16

Fan

at

VSHH-34 fan

De-energize

De-energize

HS-2 manual

De-energize

De-energize

FSLL-36 air

De-energize

De-energize

BSLL-19 pilot

De-energize

De-energize

BSLL-29 main

De-energize

PSLL-22 fuel

De-energize

PSHH-27 fuel

De-energize

TSHH-41 tube

De-energize

TSHH-43 stack

De-energize

FSLL-53 process

De-energize

TSHH-53 process

De-energize

Stop

Step 1

Step 4

Step 6

Table 5-2 Furnace ESD Key Other, process related ESD functions such as isolation and depressurization of the furnace, may also be implemented. A thorough analysis of the entire process is required to determine what else, if anything, may be required. LOCAL CONTROL PANELS. Figure 5-5, The Basic Local Control Panel, shows the minimum status lights, push buttons and switches required at the burner. This minimum assumes that all alarms and shutdowns are displayed on a main control console, perhaps a DCS, somewhere else in the plant. The local operator and the console operator must be in close communication during the light-off sequence. At other times the burner is unattended.

Many burners are supplied as self-contained packages. For such installations, a more complete local panel is required. Every pre-alarm, shutdown alarm and valve status is displayed as a separate indicating light on the panel. In general, a good colour code is: Pre-Alarm

Orange

Shutdown Alarm

Red

Ready Light

Green

Valve Open

Green

Valve Shut

Red

Avoid the use of blue indicating lights as they are practically invisible in bright daylight. Alarm logic must be provided to drive the alarm indicators and a horn according to the standard ISA Automatic Reset sequence A. The First Out and Lamp Test features (ISA sequence15 F3A-14) are often requested These can be accomplished by dedicated alarm annunciator logic or by a PLC. Logic and control hardware may be housed within the local panel or elsewhere in the plant.

FEEDBACK FUEL CONTROL. The simplest combustion control arrangement is to have a temperature controller (TIC) on the process outlet controlling the fuel gas firing rate. This system is essentially like the medium side, inlet throttling, arrangement described "Controlling Shell and Tube Exchangers"3. The TIC may drive the fuel valve directly, in which case the valve is tagged "TV", or it may cascade to a flow controller (FIC) on the fuel gas. FEEDFORWARD FUEL CONTROL. In theory, feedback fixes everything. In practice, there are problems. Fired heaters have a considerable response lag to changes in either the firing rate or process inlet conditions. There will be transient dips or bumps whenever a significant change occurs on any process, fuel, or air variable. If deviation from setpoint is the disease, then feed-back is the cure. But an ounce (28 grams) of prevention is worth a pound (454 grams) of cure. Feedforward is the technique of preventing the problem before it occurs. If there is significant variation in feed rate, feed forward can be applied as is described in "Controlling Shell and Tube Exchangers"3. Similar methods can be used to compensate for rapid variations in feed temperature.

Direct control of the fuel valve is not enough for any but the smallest burners. The fuel must be controlled to provide the exact amount of energy that the process requires. This implies that the heat content of the fuel as well as its flow rate must be known. If the fuel pressure, temperature and composition are constant, a simple flow meter is sufficient. If significant variations are expected, more complex feedforward techniques can be applied. Figure 5-6 shows the "full meal deal". It is seldom necessary to include all this instrumentation. A chromatograph measures the composition. From this the density, heating value, and oxygen demand can be calculated. Combining these calculations with the PT, TE and FT readings results in an exact figure for heat input per unit time. The result of this arrangement is that any changes in fuel gas condition will be corrected before any change in the process temperature occurs. In the past, a calorimeter has been used instead of a chromatograph. It was specially designed to produce a single figure called the "Wobbe Index". (I don't know if this rhymes with "lobby" or "Toby".) This index is defined as Btu/scf/(specific gravity) 1/2 . The square root in the denominator automatically accounts for the effects of molecular weight changes on an orifice plate. A calorimeter with such an output is frequently called a "Wobbe meter". Wobbe meters function by actually burning a small amount of fuel that has been metered through a fixed restriction orifice. In this manner the effect of changing density on the flow meter and the control valve is mimicked. They serve very well with mixed hydrocarbon fuel gas. The assumption is that there is a proportional relationship between heat content and oxygen demand. This assumption is reasonably accurate for hydrocarbons but is not reliable if there are large, variable proportions of hydrogen in the fuel. In such cases, more complex analyzers are needed to provide an exact oxygen demand figure which can be used to adjust the ratio of the air controller, FFIC-33. AIR CONTROL. Air must be supplied to the burner in proportion to the fuel. In small, simple units this is accomplished by having the two valves linked by a cam. The ratio between the two flow rates is set by mechanically adjusting the cam. Several significant assumptions are made when this arrangement is used: 

The pressure of both the fuel and the air is constant.



The temperature of both the fuel and the air is constant. Note that a 90F (50C ) swing in temperature results in an 18% variation in density. Because of the square root relationship between density and the flow rate, this will result in an error of 9% in the measurement and hence a 1.8% change in excess oxygen.



The composition of the fuel, and hence its air demand, is constant.

If these conditions are not met, the fuel/air ratio will vary. A fuel-rich mixture results in serious waste of fuel and possibly a hazardous condition. An air-rich mixture also results in inefficiency due the volume of air that must be heated and blown out the stack while reducing heat transfer.

Natural draft burners may have a set of actuator-driven louvres controlling combustion air. Accurate flow measurement may not be possible for such installations. The correct louvre position can be controlled by sending it a signal that is proportional to the signal sent to the fuel gas valve. Exact adjustment of the ratio can only be done on-line with the assistance of the stack O2 analyzer. LEAD/LAG COMBUSTION CONTROL. In order to control the fuel/air ratio on a continuous basis through all load changes, a flow ratio controller is used. This involves measuring both the fuel and the air. Figure 5-7 shows the complete arrangement; it has a number of specialized features. Firstly, the total heat demand is determined by the load controller, XIC-99, responding to the demands of the process. Most probably it is a temperature controller on the outlet. The XIC is cascaded to both the fuel and air controllers. Since these two controllers are measuring different flows, the signal from the XIC must be in units that both controllers can understand. The most convenient set of units is to have the 0 to 100% signal equal to the span of the fuel gas controller, either in SCFM, BTU/min or some other appropriate unit. Some DCSs have the features to do this automatically. Ignoring, for a moment, the two selectors FY-3B and FY-33B, the XIC-99 signal becomes the setpoint of both the fuel controller, FIC-3, and the air controller, FFIC-33. The latter is configured as a ratio controller which has the appropriate air/fuel ratio built in. Be careful here: Sometimes, for reasons of tradition, fuel is measured in SCFM and air is measured in lb/min. Ensure that the ratio programmed into the control system takes such peculiarities into account. Once the furnace is in operation, the ratio may be adjusted with the help of the flue gas analyzer.

So far, so good. But this arrangement does not allow for either rapid transients in the fuel demand nor the possibility that either the fuel or the air valves may not be responding correctly. This is where the two limiters come in. They are arranged in what is commonly called a "lead/lag" arrangement. (Note that the expression "lead/lag" has at least three totally unrelated meanings in process control: The first refers to a specific form of dynamic signal conditioner; the second to a two-stage pump or compressor control; the third applies to burners and is explained here.) Some call this arrangement a "cross limiter". The purpose of the high selector on the setpoint of the air flow is to pass the greater of the process driven air demand and the actual fuel rate. On a rising demand signal, the air will lead the fuel since it responds immediately and does not wait for the fuel to rise. On a falling demand signal, the air setpoint will not fall until the fuel, as measured by FT-3, has fallen. Thus the air will lag the fuel on the way down. Both the fuel and the air controllers have their setpoints based on the same fuel rate. In the event that the fuel valve opens without the setpoint to the air controller rising a corresponding amount, the increased fuel rate will pass through the high selector to increase the setpoint to the air controller to agree with the actual fuel injected into the burner. The purpose of the low selector on the setpoint of the fuel controller is to prevent the fuel flow from rising before the air flow has risen. The fuel lags the air on the way up and leads on the way down. If the air supply should fail, the fuel setpoint will fall with the air, regardless of the demands of XIC-99. One detail remains: FIC-3 is not a ratio controller. Its setpoint is defined in terms of the fuel flow rate. Both inputs to the selector FY-3B must have identical units and range. FY-33C is a simple scaling function with the scale constant "K" exactly equal to the reciprocal of the air/fuel ratio of FFIC-33. In a DCS it is possible to configure this function block to automatically read the value of the ratio from FFIC-33 and apply it directly in the formula. This is important because the value of the ratio may be changed in response to changes in the fuel gas composition or the combustion efficiency. It is easy to overlook the K factor when making this adjustment. FLUE GAS MEASUREMENT. Most modern process furnaces, even relatively small ones, have some form of continuous excess air measurement in the flue. This is important for both efficiency and safety. In the past, such instruments have had a well deserved reputation for high maintenance and low reliability. This is no longer the case. Today's instruments are based on the electrochemical response of zirconium oxide (ZrO 2), also known as zirconia. A probe is inserted directly into the flue and does not require any sampling system.

An explanation of the meaning of excess air is in order. Excess air is combustion air in excess of the theoretical, or stoichiometric, air. This is approximately, but not exactly, the same as what is measured by the stack O2 analyzer. The difference is that there will be at least some oxygen in the stack that could have burned but did not because of poor combustion conditions. This implies that it is possible to have some O 2 as well as unburned fuel going up the flue. This condition cannot be cured by instrumentation. Air is about 21 volume percent oxygen. This means that a 10% excess O2 reading implies that only half the oxygen is being consumed and that twice as much air is being blown into the furnace, heated up, and sent up the stack, as is necessary for combustion. That wastes a lot of energy and reduces the capacity of the furnace. Since the cost of unburned fuel is higher that than of excess air, a typical optimum is approximately 2% excess O2 representing approximately 10% excess air. Natural draft furnaces without continuous air control should be operated at approximately 6% excess O2. This ensures complete combustion under upset conditions. Large furnaces such as power boilers, where the cost of inefficiency is high, often include a combustibles analyzer in the same unit as the excess O2 analyzer. These devices can also make in-situ measurements without sampling. They use an infrared beam directed across the stack to measure the carbon monoxide (CO) content. Excess air levels below 1% give no useful indication of combustion efficiency as there is no longer any correlation between the amount of residual oxygen and the amount of unburned fuel going up the flue. A combustibles analyzer can provide that information. They are expensive, however, and must be justified on a cost/benefit basis. Sometimes the flue gas analyzer is used to automatically adjust the air/fuel ratio of FFIC-33. Great care should be exercised in taking this obvious-looking step. Despite their considerable improvement in terms of accuracy and reliability, flue gas analyzers are still complex instruments and do not approach the reliability of flow transmitters. This step should only be taken if the benefit justifies the necessary commitment to maintenance. Even then, high and low limits must be placed on the signal going to the ratio controller so that failures or inaccuracies cannot drive the air/fuel ratio to dangerous extremes. BURNER CONTROL and MANAGEMENT SYSTEMS. NFPA5, 6 defines three distinct control systems: Boiler Control System. The group of control systems that regulates the boiler process including the combustion control system but not the burner management system.

Combustion Control System. The control system that regulates the furnace fuel and air inputs to maintain air/fuel ratio within the limits required for continuous combustion and stable flame throughout the operating range of the boiler in accordance with demand. This control system includes the furnace draft control where applicable.

Burner Management System. The control system dedicated to boilerfurnace safety, operator assistance in the starting and stopping of fuel preparation and burning equipment, and prevention of damage to fuel preparation and burning equipment. For a process heater, the various process related controls would be equivalent to the boiler control system.

Contrary to common belief, neither PLCs nor DCSs are mentioned in any of the NFPA 8500 series. They are not mentioned in the CGA Code either. What NFPA says is The logic system performing the safety functions for burner management and boiler control systems shall not be combined with any other logic or control system. Unfortunately it is not at all clear what the word "combined" means, nor is there any explanation of the word "system". There seem to be many interpretations, some of them quite extreme. One I have heard is that "NFPA requires that the combustion controls shall be in the DCS, the sequenced start shall be in a dedicated PLC and there shall be hardwired shutdown relays." The problem with this approach is that there are too many links between these three systems. Each link adds complexity that reduces the reliability of the whole. For example, the sequenced start requires that the flame detectors must be bypassed during the trial for ignition period. Once the relays have bypasses from the PLC, they no longer have any independent reliability. And besides, who says that relays are safer than PLCs10?

There are also links between the PLC and the DCS. The start sequence turns the fuel gas control valve down to its minimum stop. It then manipulates the air flow for purging. Whether these links have the form of signals passing between the PLC and the DCS or they take the form of solenoid valves interrupting the air signals to the actuators, complexity is added that compromises the integrity of both the BMS and the combustion control system. Firstly, the start sequence and the safety interlocks are one inseparable control system. Normal operation is simply the final stage of the start sequence. The main flame is now on, and all safety interlocks are fully operational. Programmable control systems commonly used in today's process industries are built of large and powerful units that can handle logic and control functions far more complex than control of a single burner. A DCS, in particular, consists of many independent function blocks that are either linked together or kept separate according to the requirements of the control strategy. There is no reason why all aspects of a burner control cannot be carried out within a single physical controller. Certain precautions must be taken to ensure that the NFPA requirement for separation is met: 1. The BMS must reside in a clearly identified block of logic functions. This block must have all inputs and outputs clearly identified within the block. A DCS that

requires this identification as part of its programming approach is acceptable. A DCS that requires "hardware" addressing is not.

For example: Assume that Logic Block 13 is the BMS. The statement "Set Register 21 in Logic Block 13 ON" appearing elsewhere in the DCS is an example of risky programming practice. An inspection of Block 13 would not reveal the connection. This type of statement is even more dangerous if it is made in error in a totally unrelated function. A safe method of accomplishing the desired function is to include the statement "If HS-12 is ON, then set BV-24 ON" within the body of Block 13. Anyone examining the BMS can readily see the statement and judge its validity. Such statements cannot accidentally be included in Block 13 by someone working on a different block. 2. Outgoing links between the BMS and other control functions must always be "pushed" by the BMS. For example: The BMS forces the fuel gas valve shut and then puts it back on automatic at the appropriate times. The fuel gas controller does not check the BMS to see what it should do. 3. Incoming links between the BMS and other control functions must always be "pulled" by the BMS. For example: The BMS checks the status of a bypass switch to see if it should ignore a high discharge temperature. The bypass switch does not force the BMS. 4. No unrelated logic function may reside in the same block as a BMS. It must always be extremely clear to anyone making modifications whether or not they are in a BMS block. Since there may be times when it is necessary to disable some unrelated function, it must always be possible to do this without disabling any part of the BMS. 5. Input and output modules for BMS related signals should not also handle other signals. 6. A hardwired "kill" switch should be included on the operator's console. This switch de-energizes all gas safety shutoff valves. This can easily be accomplished by cutting the power to the output modules. If rule 5 is followed this can easily be accomplished without disturbing unrelated functions of the DCS. The kill switch should also have a second contact wired to provide input to the BMS logic in the DCS. The BMS will then carry out an independent shutdown. In this way full redundancy is accomplished. In addition, the DCS logs the use of the kill switch. 7. A DCS control unit that carries out any functions beyond the control of a single furnace must be fully dual redundant with automatic transfer to an identical, on-line, backup unit. All communications between the control unit and the operator's console must be fully dual redundant with auto transfer.

The consoles themselves must be at least dual redundant with no shared components. It is my own opinion that a BMS can be integrated into DCS control unit safely, reliably, and legally if the above rules are followed. But... I realize that this a complex subject and that many users have had different experience. I would very much welcome feedback on this controversial subject.

Because of the wide range of interpretations of the functional separation rule, it is very wise to outline any proposed control system in detail and have it approved by the "authority having jurisdiction" before proceeding with implementation. I understand it is not very pleasant to have a design refused during commissioning. COMMISSIONING. No Burner Management System can be certified safe until it has been field tested. NFPA is quite clear on this point: The safety interlock system and protective devices shall be jointly tested by the organization with the system design responsibility and those who operate and maintain such systems during the normal operating life of the plant. These tests shall be accomplished before initial operation. The proof of the pudding is in the eating. No safety system is safe until it is demonstrated to be safe.

REFERENCES 1. Driedger, W. C., "Controlling Centrifugal Pumps"; Hydrocarbon Processing, July 1995. http://www.driedger.ca/CE1_CP/CE1_CP.html

2. Driedger, W. C., "Controlling Positive Displacement Pumps"; Hydrocarbon Processing, May 1996. http://www.driedger.ca/CE2_PDP/CE2_PDP.html

3. Driedger, W. C., "Controlling Shell and Tube Exchangers"; Hydrocarbon Processing, March 1998. http://www.driedger.ca/CE3_STX/CE3_STX.html

4. Driedger, W. C., "Controlling Steam Heaters"; Hydrocarbon Processing, November 1996.

http://www.driegger.ca/CE4_SH/CE4_SH.html

5. NFPA 85, Boiler and Combustion Systems Hazards Code (Formerly 8501, 8502, 85A, 85C). http://catalog.nfpa.org/

6. NFPA 86, Standard for Ovens and Furnaces. http://catalog.nfpa.org/

7. Driedger, W., Limit Switches Key to Valve Reliability; Intech, January 1993. http://www.driedger.ca/limitsw/LimitSw.html

8. CSA B149.3, Code for the Field Approval of Fuel-Related Components on Appliances and Equipment. http://www.csa-intl.org/onlinestore/welcome.asp

9. Gruhn, P. and Cheddie, H.L., Safety Shutdown Systems: Design, Analysis and Justification, ISA. http://www.isa.org/

10. ASME Boiler and Pressure Vessel Code, Section VII, Care of Power Boilers. http://www.asme.org/catalog/

11. API RP 556, Fired Heaters and Steam Generators. http://www.cssinfo.com/apigate.html

12. API SPEC 6FA, Specification of Fire Test for Valves.

http://www.cssinfo.com/apigate.html

13. API SPEC 6FC, Specification of Fire Test for Valves with Selective Backseats. http://www.cssinfo.com/apigate.html

14. ISA 18.1, Annunciator Sequences and Specifications. http://www.isa.org/

15. ISA 77.41, Fossil Fuel Power Plant Boiler Combustion Controls. http://www.isa.org/

16. CSA 3.9, Automatic Safety Shut-Off Gas Valves. http://www.csa-intl.org/onlinestore/welcome.asp

CONTROLLING VESSELS and TANKS © Walter Driedger, P. Eng., 2001 Sept 07. walter(at)driedger(dot)ca

First published in Hydrocarbon Processing , July 1995.

This Adobe® file is available for download.

INTRODUCTION. It would seem that controlling a vessel should be a very simple matter -- They don't really do anything! But then, if they didn't do anything why are there so many of them? And why do they have so many different names? Going through a typical set of Piping and Instrumentation Diagrams (P&IDs) I see the following vessels: · Degassing Drum

· Gas Separator

· Storage Tank

· Feed Flash Drum

· Reflux Accumulator

· Day Tank

· Surge Drum

· Suction Scrubber

· Slug Catcher

· Lube Oil Separator · Head Tank

· Deaerator

Although each of these is essentially a simple vessel or tank without any special internal structure, each serves a different purpose. Once it is clear what the purpose of a piece of equipment is, and how it functions, it will also be clear how to control and protect it. Different purposes require different controls.

SURGE TANKS. The most common function of a vessel or tank is to match two flows that are not identical in time but are expected to average out over the long run. Take a feed surge drum, for example. Flow into the unit is more or less steady but is subject to interruption. The flow to the processing unit should be as constant as possible, avoiding sudden change. Nevertheless, it, too, may be subject to interruption due to downstream conditions. The purpose of the surge drum is to maintain sufficient inventory to feed the process and to maintain sufficient void capacity to continue receiving feed as it arrives. Clearly the tank must be large enough to accommodate any normal discrepancies between input and output over a reasonable period of time. Between the upper and lower bound, the exact value of the level does not matter. Two separate control parameters are implied: Level and flow. Level control is no problem. Greg Shinskey 1 refers to "The easy element -- capacity". A high gain, level controller connected to a valve at either the inlet or the outlet will maintain the level very accurately at its setpoint. The only problem with this approach is that it absolutely defeats the purpose of the vessel. The same effect would be achieved by blocking in the vessel and bypassing the inlet directly to the outlet. To control flow alone is also quite simple. A flow controller at the outlet, properly tuned, will maintain a steady flow to the process. Unfortunately, there is nothing to make this flow equal to inflow. It will not even equal the average inflow unless there is something to make it do so. What we need is an instrument that measures the accumulated error between inflow and outflow. The tank itself is that instrument! Level = Starting Level +

(Inflow - Outflow) dt / Tank Area

(To a process controls engineer, every piece of equipment is just a big, non-tuneable instrument!) The level transmitter only transmits the process value to the control system. If we now cascade the output of the level controller to the flow controller, we have a

system that has one process variable: Accumulated flow imbalance. It has only one point of control: Outflow to the process. To start this simple process: · Fill the tank about half full.

· Give the level controller the current level as its set point. (PV tracking does this automatically.) · Switch the flow controller to automatic with an estimated average flow as its setpoint. · Switch the flow controller to cascade. · Switch the level controller to automatic.

The control system will keep the flow "constant" but that constant varies in response to the imbalance between outflow and inflow. It is not important that the initial estimate of average flow be exact. A low guess will result in the tank level rising a little. A new, higher, estimate will result and the outflow will be adjusted accordingly. In the long term the average flow out is not an independent variable at all. It will be exactly equal to the average flow in. This can be accomplished at any arbitrary tank level. The level setpoint is based on the operator's estimate of the nature of the flow interruptions and whether the most probable upset will require additional flow or void capacity.

Should a pump be necessary to transfer the liquid from the vessel to its destination it should be placed between the vessel and the flow measurement. Further information on the control of pumps is found in Controlling Centrifugal Pumps2 . This article also includes a section titled "On/off Control" for less critical level applications. There is a long discussion on the special requirements for level control of steam heat exchangers and condensate receivers in Controlling Steam Heaters3. Surge drums are sometimes used for gas. The abrupt flow variations of a Pressure Swing Absorption (PSA) unit, for example, often need to be smoothed out before the tail gas can be introduced into a down-stream process. In these cases, pressure takes the role that level has in a liquid process. That is, a pressure/flow cascade is the appropriate solution. TUNING SURGE TANK CONTROLLERS. Since the exact level of a surge drum is not important, the controller can be tuned very loosely allowing the level to rise and fall in

response to any short term imbalances. This exactly serves the purpose of the surge tank; tight tuning defeats it. There is a non-linear control algorithm which specializes in the type of loose control required by surge tanks. One common name is the "gain on error squared" controller. Figure 6-2 shows its characteristic. The controller responds to small errors with a small gain; it responds to large errors with a large gain. This means that in the vicinity of the setpoint, the controller allows the level to drift freely and the flow to remain almost constant. With luck, the level will average out again before the deviation from setpoint is too great. If the level changes far from the setpoint so that the danger of running out of capacity exists, the controller responds with a strong signal and rapidly brings the level back to near setpoint. Another form of non-linear controller is also available: The notch or gap controller. This algorithm has the gain divided into three segments by two break points. The middle segment, on either side of the setpoint, has a low gain to avoid excessive action while the outer segments have a higher gain for a rapid return. It has the advantage of allowing the user to set the breakpoints and gains below the setpoint differently from those above. Its disadvantage is that it has four tuning constants instead of only the one found in the gain-on-error-squared controller. Some gap controllers have a zero gain in the centre segment. This is totally useless as the controller will never bring the level back to the setpoint. (No gain, no action.) Instead it will tend to use either the upper or lower breakpoint as its effective setpoint and return the level with a high gain. It should be noted that an abrupt change in gain does not imply an abrupt change in valve position, only a change in the rate of movement. A simple proportional mode controller is sufficient for many surge drum applications. A slow integral may be used to bring the level back to the setpoint during a prolonged change in flow rate, but it should be turned off if cycling results. Do not use the derivative mode! Besides amplifying noise, derivative provides tight control by cancelling out the integrating capacity of the tank and thus defeating its purpose. A tuning rule I have heard of, but have not tested myself is K = D F/F * D L/L Where

K = controller proportional gain

D F/F = the proportion of flow variations in the uncontrolled flow

D L/L = the proportion of level available for surge. This is the distance between the level setpoint and the nearest alarm. This formula attempts to put the loosest level control consistent with keeping the level away from the alarms. There is a catch, however: It is necessary to predict the amount of flow variation to be expected in the future. Of course it is also necessary to do this to a certain extent when the vessel is sized.

SUCTION SCRUBBERS. A compressor suction scrubber is an example of a vessel whose purpose is to separate, collect, and dump relatively small quantities of liquid from a gas stream. The following conditions generally apply: · Precise level control is of no value.

· Smoothness of liquid flow is of no value. · The liquid flows to some form of drain. · The average liquid flow is quite small. · The pressure differential across the valve is high. · Relatively large slugs of liquid occur occasionally. The last three conditions would result in a valve that is usually operating near its seat with a high D P. It would experience severe erosion resulting in a short, unhappy life. The solution is to control the valve in on/off or "snap acting" mode. There are several ways to accomplish this. The simplest is to tune the controller to a very high gain. This would cause the valve to spend almost all its time in the full open or closed position. Unfortunately the high-gain controller would also try to maintain accurate level control by rapidly switching the valve between these extreme positions. Any saving in seat erosion would be cancelled by a high rate of stem and packing wear. The same response can be achieved by using a simple level switch connected to the control valve via a solenoid. (Pneumatic level switches tubed directly to the valve actuator diaphragm are also available.) A level switch can be viewed as a controller with an extremely narrow proportional band (0%!) and consequently an extremely high gain (100% / 0% = ).

Selecting a switch with a broad deadband results in a great improvement. The valve now remains fully open until a significant reduction in level is achieved. It then remains fully closed until the level substantially rises. With this arrangement it is possible for the valve to have both long life and peak capacity. Recent experience indicates that transmitters are more reliable instruments than switches and also demand less maintenance4. If transmitter is used the deadband function is accomplished through logic in the control system. This would have the added advantage of allowing the operator access to the high and low setpoints. In some ways the suction scrubber acts

as the exact opposite of a surge drum -- it collects slow dribbles of flow and releases them as intermittent surges. Sometimes there is a third option -- specialized liquid dump valves. These behave somewhat like steam traps in their ability to pop open in the presence of liquid and snap shut in the presence of vapour. Since they are not general purpose instruments, it is best to use them only when there is an opportunity to test their performance; the vendor should be consulted. These devices might be very cost effective in packaged equipment such as on the discharge receiver of an instrument air compressor. STEAM DRUMS. The purpose of a boiler steam drum is to provide space in which the water and steam may disengage. Since the drum serves at high pressures and temperatures, perhaps up to 3600 psi and 1000ºF (25 MPa and 540ºC), it is expensive to manufacture and there is considerable economic incentive to keep it as small as possible. The techniques of boiler feed water (BFW) control can be applied whenever extremely tight level control is a requirement. The level of the feedwater in the steam drum must be kept above the bottom of the drum or a catastrophic explosion may result. It must also be kept below the steam outlet or liquid water will be carried over. Water droplets will damage superheater tubes, turbine blades, and other equipment. The diameter of the steam drum, and hence its cost, is determined largely by the ability of the control system to keep the water level within bounds. Thus level control of a steam drum has exactly the opposite purpose of that of a surge drum: The water level must be kept within an extremely narrow band and tight control is of essence. It is a simple matter to maintain tight level control... use both the proportional and integral modes and turn up the gain! Figure 6-3, Single-Element BFW Control, shows this very simple arrangement. As always, there are

problems. Firstly, high gain means extremely rapid swings in flow rate. The BFW pumps suffer under that type of abuse. There is a second problem, peculiar to boilers, called "swell". Swell is the phenomenon in which a rise in steam demand causes a drop in pressure. This in turn results in a rapid boilup within the tubes which causes the water level to rise. Paradoxically, an increased steam removal rate causes a rise in level due to the swelling of the steam bubbles. The level controller responds by reducing BFW flow at the very moment it is needed most. The swelling water soon collapses as the steam rises to the surface. Now the controller reverses its response and adds a large amount of essentially cold BFW into the system. This causes the water temperature to fall. The cooler water shrinks, lowering the level further. The use of single-element control is not very highly recommended for boilers! The disturbanc e to the level is caused by a change in steam withdrawal rate. Since this is a measurabl e quantity, feed forward can be applied to the level controller output. Figure 6-4 shows how this is accomplished. The compensated steam flow is added to the output of the level controller. Thus a rise in steam withdrawal and the swelling of the water is accompanied simultaneously with a surge of cold BFW. Ideally the two cancel out exactly and the controller sees no change in level at all. They will not cancel out exactly for two reasons: Firstly, there is no reason why they should. One effect or the other will predominate. They won't even be simultaneous. Secondly, the BFW flow can only equal the steam withdrawal if the range of the valve is exactly equal to the range of the compensated steam flow. Since these two functions must be exactly equal over the entire operating range, it means that the valve must be perfectly linear and that its D P is absolutely constant. Not likely! So the level controller still has some work to do to keep the accumulated error at zero. The rather farcical suggestion in the previous section, piping the inlet to outlet and bypassing the vessel, suggests a solution to the valve linearity problem: Use the measurement of the steam leaving the boiler as the setpoint to a BFW flow control loop. The level should remain constant once the shrinking and swelling have reached the new equilibrium. This simplistic solution overlooks a basic principle of process control:

No two measured quantities are ever identical. In other words, the two flows will never be the same and the level will rise or fall at a rate proportional to the difference. Since level is a measure of the accumulated difference, a level controller is used to correct the BFW flow. What I have just described is the classic three-element boiler level control arrangement as shown in Figure 6-5.

The diagram also illustrates a few other features. Compensation has been applied to account for the effect of pressure on the steam density and its effect on the level transmitter. BFW flow is sometimes temperature compensated since it is most probably preheated and its temperature may vary. For a temperature change from 0ºC to 300ºC (32ºF to 572ºF) the specific gravity changes from 1.000 to 0.712 and a measurement error of 15% will result. This detailed exposition of boiler level control is presented only to provide an example of how extremely tight level control can be accomplished when necessary. Boiler control is a rather broad subject and many articles and textbooks have already been published concerning it. CONTROLLING LIQUID INTERFACES. It is generally assumed that level control refers to the control of a gas/liquid or vapour/liquid interface. It ain't necessarily so. An interface can occur between any two immiscible fluids. Since all gases are miscible with each other in all proportions, interface level control is always taken to mean the interface between two liquids such as oil and water.

Figure 6-6 shows an example of a boot on a crude oil separator. This vessel serves three purposes: It is a gas/oil separator, a feed surge drum and a water separator. A real vessel in this service probably contains inlet baffles and demister pads. Each of the three phases must be individually controlled. But it is possible for the gas phase to discharge to an externally pressure controlled system or even to atmosphere. (Possible yes, acceptable no.) The key to understanding the function of any separator is to think in terms of a constant inventory of each component. To repeat: each component must be controlled individually. The amount of gas flowing in must be balanced by gas flowing out. Changing pressure is a measure of the gas imbalance, therefore pressure control is the appropriate way of controlling the gas outlet. Similarly, oil level is an indication of oil imbalance and water level indicates water imbalance. None of the three streams may be controlled on flow, although a level / flow cascade is often used to smooth out flow variations to the downstream equipment. Pressure / flow cascade is unlikely to be used unless the volume of the vessel is large enough to serve as a gas surge drum. Level / flow cascade on the water is unlikely since the water probably drains to a collection system that itself serves as a surge drum to a number of separators. Sometimes the ratio of water to oil is too great for a boot separator. In such cases a weir may be used to divide the vessel as shown in Figure 6-7. Certain precautions must be taken to make sure that the level transmitter actually gives a true indication of the interface. There are basically two varieties of level indicating devices: The first measures the distance of an actual interface from some fixed point. Ultrasonic and radar devices belong to this group. These would be ideal for the purpose except that they are often not suited for installation in pressurized vessels. Furthermore they have difficulty "seeing" anything other than the very top interface. Even surface foam and condensation on the instrument "window" can confuse them.

The second, and more traditional, variety integrates some particular property, such as density or dielectric constant, over a span. Displacers, differential pressure transmitters, bubbler tubes, nuclear densitometers, capacitance probes, and even gauge glasses all belong to this variety. The key to successful measurement is that the level sensing device must sense only the two fluids bounding the interface. For a gauge glass this means that the lower tap must be in the lower of the two fluids and the upper tap must be in the fluid immediately above it. There may be NO intervening phases. Figure 6-8 shows what happens when a gauge glass is connected to a vessel containing a vapour and two liquid phases. Assume that equal amounts of a liquid with Sg = 1.0, e.g. water, and a liquid with Sg = 0.5, perhaps propane, gradually flow into the vessel. Assume further that the span of the gauge glass is four feet, beginning one foot from the bottom of the vessel.

As the level of the propane rises, it flows into the glass. As both liquids rise further, water begins to enter the bottom of the glass. This is the state shown in vessel A. Up to this point, the glass shows a true indication of the level of propane in the vessel. Once water enters the glass, the propane is cut off. A constant plug, one foot thick, floats on top of the water. Its level no longer bears any obvious relationship to the actual level in the vessel. This is state shown in vessel B. The only relationship between the vessel and the glass is that the hydrostatic pressure is the same for both at the point where the glass taps into the vessel. A gauge glass is really nothing more than a manometer. Once the level of the propane rises above the upper tap, it flows into the glass and the two interface levels adjust to the same elevation, as shown in vessel C. The gauge will continue to read correctly as long as its lower tap is in the water and the upper tap is in propane. If either fluid is withdrawn so that the upper tap is in the vapour space, the glass will once again read falsely. This same analysis applies to any type of level indication based on density. Remember that a D P transmitter only gives a single reading, i.e. differential pressure. Therefore only a single quantity can be inferred. If the instrument is affected by only two fluids, it can yield the correct interface level between the two. If there are more than two distinct phases within the span of the two taps, it will give a reading based on the average densities of all the fluids within its span. Capacitance or nuclear level transmitters will give similar results in multiphase situations, based on the average dielectric or nuclear absorption constants, respectively. So... how can the process controls engineer be assured that the level readings are meaningful if even a gauge glass can't be trusted? Plan "A": Make the entire vessel out

of glass. This isn't usually practical so we must fall back upon Plan "B": Every section of a gauge glass must have separate taps into the vessel so that each pair of taps has no "hidden" phase floating in between. Either that, or accept the fact that until the interface reaches its "normal" range, gauge glasses and transmitters will read falsely. SLUG CATCHERS. Slug catchers are a special instance of three-phase separators frequently found in oilfield service. In addition to the usual separation functions, they are required to serve as surge tanks that can smooth out intermittent flow and also handle occasional very large surges in inlet flow. This is done by having two controllers connected to the oil-side transmitter. The oil overflow controller has its setpoint slightly below the top of the weir. In this manner, any surges can be accommodated by the large volume above the weir. This is in fact a non-linear, adaptive gain transmitter since transmitter gain = D output / D volume. The inlet controller responds to the same level but has its setpoint just below the top of the vessel. It takes action only when the level rises to its set-point. This would happen if an unusually large slug of liquid arrived or if an upset in the downstream process caused the system to back up into the slug catcher. The facility would then be operating under "capacity control". Facilities lacking the capacity control feature are likely to experience a high level shutdown precisely when they are attempting to operate at maximum throughput. Not a very desirable occurrence.

It is common for level controllers to be tuned using both the proportional and integral modes. Since the inlet controller is normally functioning with the level well below its setpoint, reset windup will occur. This is a phenomena in which the controller attempts to raise the level to the setpoint by forcing an ever higher signal to the valve. This does

not work, of course, since the valve is already wide open. If a sudden surge arrives that abruptly raises the level to the setpoint and beyond, the controller will be slow to close the valve since it has "wound up" in the opposite direction. Some form of anti-reset windup is required to prevent an unwarranted high level shutdown under these circumstances. It is probably a bad idea to use an equal percent valve in this application since it, also, is likely to respond slowly to a sudden demand. It is possible to control the outlet and inlet valves with a single, split-range controller. This method accomplishes the required function of preventing high level shutdowns but has a serious disadvantage. If the setpoint of the combined inlet/outlet controller is set below the top of the weir, it will not take full advantage of the surge capacity of the vessel since the inlet will begin to close well before the top of the vessel is reached. If the setpoint is above the weir, it defeats its purpose by allowing mixed feed to flow directly to the oil outlet before it has time to separate. Thus a split-range controller will sacrifice either separation quality or surge capacity. PRESSURIZATION SYSTEMS. A tank, vessel, or drum may require a pressurization system for any of a variety of reasons: · The surface of the liquid in a reflux drum consists of a liquid at equilibrium with its vapour. There may not be sufficient gravity head to provide the net-positive-suction-head required to operate the reflux pump without cavitation. Raising the vessel high in the air above the pump is one way of providing this. Unfortunately the condenser providing the liquid, drains by gravity so it must be raised even higher. The entire arrangement can become extremely expensive. An-other method is to use a canned pump which is sunk deep into the ground. This can also get pricey. A blanket gas pad may be a relatively inexpensive way of providing the necessary pressure.

· The liquid in a storage tank is subject to oxidation, e.g. the surge tank of a glycol-based heat exchange system. A blanket of fuel gas will prevent the tank from breathing air as it cycles from empty to full and back again. · The liquid in a storage tank forms an explosive mixture with air. (A rather extreme form of oxidation!) A continuous gas purge may be required to prevent this. · The storage tank vents to a flare or other vapour collection system. A gas supply must be provided to make up any volume withdrawn when the withdrawal rate exceeds the fill rate. In other words, the pressurization system serves as a vacuum breaker. A simple way of providing pressurization is to have a regulator connected to a source of pad gas and a second, back pressure regulator, connected to the vent. Care must be taken to set the back pressure regulator setpoint slightly higher than that of the inlet regulator. If there is no gap between the two settings, the pad gas will blow straight through to the vent. Remember that setting them to the "same" pressure is meaningless.

Often it is necessary to install a complete control loop including a pressure transmitter, a controller, and two valves. This has the advantage of allowing the panel operator to monitor and adjust a single setpoint. It also allows over- or underpressure alarms to be easily provided. Figure 610 shows how the complete pressure control loop is arranged. For the most part it is pretty simple but there are two things to watch for: Firstly, there must be a gap between the action of the two valves. That is the reason for the split range values not meeting at 50%. Secondly, the failure mode of the valves must be taken into account. Since the two valves have the opposite effect, they must have opposite failure modes if they are to be operated by the same control signal. A DCS allows the output of the controller to drive two separate output modules, each characterized in its own way. This means that it is possible for the first 45% of the controller output to produce a 100 to 0% signal for the fill valve, and the last 45% of the output to produce a 0 to 100% signal for the vent valve. In this way both failure modes are accommodated and overlap of valve openings is impossible. The gap in the middle does not cause a problem for the controller. Integral windup will move the output quickly through the gap whenever there is a deviation from the setpoint. The reader should note that the split range control described in this paragraph is not at all the same as that described in the section on Slug Catchers. It is possible to achieve the same effect by using a specialized, three-way valve that provides a gap in the middle. Most three-way valves are designed to have full overlap as they are intended for use in diverging/converging service. (If anyone knows of a centre-gap, non-overlapping valve, let me know.) A number of vendors sell specialized gas blanketing systems capable of self-contained action. They consist of regulators with the very large diaphragms required to drive valves with pressures as low as 0.5" WC (125 Pa, 0.3 oz/in 2 ). Such systems are especially useful now that ever more stringent regulations concerning the emission of volatile organic compounds (VOCs) are being enforced. Figure 6-11 shows one typical arrangement.

Many factors enter into the correct specification of the setpoints and sizes for the various regulator and relief valves. These include: · The maximum allowable pressure of the tank.

· The maximum allowable vacuum of the tank. · The vapour pressure of the stored liquid. · Inbreathing rate dependent on pump-out rate. · Outbreathing rate dependent on pump-in rate. · Vapour thermal expansion and contraction rate. · Tank surface area and insulation. Table 6-1 provides setpoints applied in a specific case. It must be remembered that actual values differ widely. API 2000, Venting Atmospheric and Low-Pressure Storage Tanks 5 and tank vendors provide much information, however it may be advisable to consult a specialist in the field.

oz/in2

"WC

kPa

Maximum Allowable Pressure

4.0

6.9

1.7

Manway Setting

3.5

6.1

1.5

Relief Valve Pressure Setting

3.0

5.2

1.3

Vent Regulator Setting

2.0

3.5

0.9

Fill Regulator Setting

0.5

0.9

0.2

Relief Valve Vacuum Setting

-.05

-.09

-.02

Maximum Allowable Vacuum

-1.0

-1.7

-0.4

Table 6-1. Typical Tank Blanket Pressure Settings A brief sermon on tagging: According to ISA-S5.1, Instrumentation Symbols and Identification 6, all forms of relief valves including pressure, vacuum, spring- or weightloaded, with or without a pilot are tagged "PSV". Common abbreviations such as "PVSV", "PVRV" or "PRV" have absolutely no official status and therefore are not acceptable as tags on P&IDs. LEVEL MEASUREMENT. Level measurement is deceptively easy, yet it seems that more time is spent specifying level instruments than any other. The reason is that the correct installation of level instrument is an interdisciplinary effort involving Process, who set the basic functional requirements; Mechanical, who have various constraints such distance of taps from seams; Piping, who have accessibility and orientation requirements; and Instrumentation, who must select from a finite catalogue of available instruments. Actually this task has become considerably easier in recent years due to the increased use of D P transmitters and other instruments such as ultrasonic and radar which do not have a predetermined span. There is no longer any significant penalty in either cost or accuracy if the instrument is specified to cover a broad span. For horizontal vessels the top connection should be vertical at the top of the vessel. The bottom connection should be horizontal a few inches from the bottom. This is necessary to prevent the accumulation of sediment. These connections no longer need to be in the same vertical plane nor do they require the same orientation.

Vertical vessels may still require a bit more attention. While a top-to-bottom span would be ideal, there may be trays, packing, or other internals that would cause a differential pressure in response to flow. It is also necessary for the level connections to remain clear of welding seams. This requirement may cause problems if alarms or other setpoints need to be near the bottom or top of the vessel. The design process begins with the basic information on a P&ID in a form similar to that shown in Figure 6-12. A brief outline of the vessel including the bridle, if any, holding a gauge glass and a transmitter are shown. The desired values for the level alarms and the setpoint of the controller are also shown. The Control Systems engineer must first decide if a D P transmitter is the appropriate choice. Let us assume it is. He/she must then try to find an appropriate span for the transmitter. A good rule of thumb is that alarms should not be set any lower than 10% or higher than 90% of the transmitter span. (Shutdown trip settings should not be closer than 5% from either end of span.) Since the two alarms are 42" - 6" = 36" apart, the span should be 36" x 1.25 = 45" thus allowing the alarms to be at 10% and 90% of span. This seems fine, but there is a problem. The first thing to determine is whether the vessel measurements are from the tangent line, from the seams or from some other reference point. In this particular case the vessel title block indicates that measurements are tan-to-tan. Since seams are generally 2" inside the tan lines, the lower tap of the transmitter is ½" above the seam. That is not acceptable. Mechanical considerations often dictate that nozzles may not be welded within 6" of a seam. This means that the lowest transmitter tap cannot be lower than 8" above the bottom tan line. The highest tap cannot be higher then 8" below the top tan line. This implies that the maximum transmitter span on a 48" T/T (tan-to-tan) vessel is 32". Alarms at 10% and 90% must be placed at 11.2" and 36.8". At this point, the Instrument Engineer becomes a broker between Process and Mechanical to help them find a compromise. Alarms at 11" and 37" are agreed upon. Don't forget to transfer this new information back to the P&ID! It is a great convenience to the maintenance staff if the span of the transmitter is exactly equal to the span of the gauge glass. This is not always possible with displacers since both the gauge glasses and the transmitters come in fixed spans. However, it can easily be done for D P transmitters. The centre line of the sensing taps must be located at the tops and bottoms of the visible glass. Unfortunately, the associated valves bring the centre line of the gauge glass tap 4½" below the bottom of

the glass. Fortunately, in extreme cases, it is possible to place the lower gauge glass tap below the lower bridle tap. There can be no meaningful readings below the lower bridle tap of course, since the bottom of the glass can never drain back into the vessel. As long as the glass itself does not go below the lower tap, it's OK. Since gauge glasses come in fixed lengths, it may not be possible for the upper tap of the transmitter to match the top of the visible glass. Remember that transmitter calibration will be more difficult if the upper tap does not fall within the range of the visible glass. Occasionally it is necessary to connect either the top or the bottom taps to interconnecting pipe instead of to the vessel itself. If the taps are attached to inlet or outlet lines, the level signal will be affected by flow rate. This effect can be seen in coffee percolators: The level in the gauge glass bobs up and down as coffee is drawn into a cup. SEALS. Diaphragm seals have become a very popular accessory to D P-based level transmitters. A very thin metal diaphragm isolates the transmitter from the process. The space between the diaphragm and the sensor itself is filled with a fluid such as silicone. The pressure changes are communicated through the diaphragm to the transmitter via an armoured capillary tube. The volume change between minimum and maximum pressure is extremely small in a modern transmitter; the amount of flex in the diaphragm is correspondingly small. The net effect of this is that the introduction of a diaphragm into a measurement system introduces an error of only several centimetres or less. This is seldom significant in level applications. A second effect is that only an extremely small amount of liquid movement actually occurs in the capillary tubes. This, together with modern low temperature fill fluids, means that the instrument response does not slow down too much on cold days. Figure 6-13 is an example from one vendor's catalogue.

Seals should be considered whenever one or more of the following conditions apply: · Dirty service - Whenever the process fluid is liable to plug the impulse lines, a diaphragm seal may be installed. It should be isolated from the vessel by a full-ported valve, NPS 2 or 3. Note that two NPS ½ taps are provided on the diaphragm housing for calibration and flushing connections. Seals are especially useful in sanitary service where all hardware in contact with process fluid must frequently be thoroughly washed. It is a good idea to use seals and capillaries of equal length on both the upper and the lower leg in order to maintain a balanced response to errors.

· Corrosive service -- Diaphragm seals made of corrosion resistant materials originated in corrosive service where they were referred to as 'chemical seals'. While the use of full-ported connections is not required in corrosive service, it is a good practice to maintain even if it might look strange to have 'such a big valve' for 'only' an instrument. · Freeze protection -- Diaphragm seals may eliminate the problem of freezing impulse lines. However, in extremely cold weather it may still be necessary to heat trace the capillaries to prevent measurement response from being excessively slow. Self-limiting electrical heat trace is the only way to go! Any heat trace system involving a thermostat will introduce spikes into the measurement system as the heat is switched on and off.

· Uncertain phase -- This is the most frequent of all seal justifications. A warm vapour in equilibrium with its liquid will undergo condensation in the upper impulse line. Cold equilibrium liquid may experience boiling in the lower impulse line. Thus the measurement will slowly drift as the tube fills. Depending upon service and ambient temperatures, condensation and boiling may even alternate throughout the day. If this situation exists, the measurement becomes worthless. The traditional solution is to fill the upper line with a non-volatile, process compatible fluid. Depending on process and ambient conditions this might be water, glycol, oil or something else. The use of fill fluids introduces maintenance problems because any attempt to 'null' the transmitter by opening the equalization valve will drain the upper fluid into the process. It can only be replaced by climbing to the top of the vessel and filling the tube again. Bubbles are also a source of error. Seals provide a captive fill fluid that cannot be lost, does not form bubbles and cannot contaminate the process. (Did I say foolproof?) UNDERGROUND TANKS. A special requirement concerns underground (UG) tanks. Modern steel UG tanks have a double wall construction. Requirements are outlined in CAN/ULC-S603, Standard for Steel Underground Tanks for Flammable and Combustible Liquids 7. The two walls of the tank are approximately an inch (2 cm) apart. A vacuum of 51 kPa (7.5 psi) is drawn on the interstitial space so that the two surfaces are, in many places, actually in contact with each other. A vacuum gauge is connected to the interstice. It must read at least 42 kPa (6.1 psi) of vacuum before the tank may installed. If the reading is ever less than 34 kPa (4.9 psi) the tank should be removed from service and steps taken to determine the cause of the leak. These values are summarized in Table 6-2, below. If a facility has many UG tanks, it may be desirable to connect the tanks to the central control system by means of vacuum transmitters. Low vacuum alarms can then be configured to alert the operators of any cases of leakage.

Interstitial Vacuum

psi

kPa

Required at manufacturing

7.5

51

Minimum acceptable for delivery

6.1

42

Minimum allowable in service

4.9

34

Table 6-2 Interstitial Vacuum Requirements for Underground Tanks VOLUME MEASUREMENT. Most vessel and tank content measurements are made in the form of level. When true volume is required for such purposes as custody transfer,

the tank volumes are calculated taking into account all details of their geometry as well as dimensional changes resulting from the pressure exerted by the density of the liquid. The results of these calculations and calibrations are tabulated by the manufacturer in a form known as "strapping tables". True volume measurement is seldom relevant for control purposes since setpoints for controllers and alarms are usually related to specific geometric features of the vessels. The level must often be kept below the vapour outlet or a weir. A frequent requirement is that a specific head be maintained to prevent pump cavitation. Sometimes the requirement is simply to maintain the level near midpoint in order to provide surge capacity. None of these applications benefit from true volume compensation. Figure 614, Volume vs. Height for Cylinders and Spheres, provides the correct mathematical relationship between level and volume for these two vessel styles if true volume measurement is actually required. It can be seen that between 10% and 90% little is gained by applying the rather complex calculations required for volume control.

Volume = (R2L/2)(2q - sin 2q )

Where h = height of liquid in vessel R = radius of vessel L = length of cylinder q is radians and cos q = (R-h)/R

Volume = -(p /3)h2 (3R - h)

Note: The volume contained by elliptical vessel heads is ½ that of a sphere of equal radius. SAFETY. Vessels and tanks are probably the most hazardous pieces of equipment in any plant. Duguid's database shows that 22% of all safety incidents are related to storage and blending. This may seem a little surprising until one considers that they store energy as well as material. For example: · A vessel holding a compressed gas can cause a tremendous explosion if it ruptures. That is why "hydrotesting" with air or nitrogen is far more dangerous than with water.

· Storage tanks can hold a considerable amount of gravitational energy. The most notorious example of this energy being released is the infamous "Boston Molasses Disaster" which occurred January 15, 1919. A tank located at the top of a hill ruptured and released two million gallons of molasses down a narrow street. Twenty-one people were killed and 150 were injured. · The contents of the tank or vessel can be flammable. While a line rupture external to the tank may be the cause of a fire, it is the reservoir of flammable fluid inside a tank that turns a minor fire into a major one. API RP 750, Management of Process Hazards, specifically addresses this point, however, it does not offer much in the way of solutions. · The contents of a tank can be lethal. The February 1984 release of methyl isocyanate in Bhopal, India was the worst non-nuclear industrial accident in human history. Over 2000 people were killed by the toxic vapour. The single, most comprehensive guide to the design of vessels is the ASME (American Society of Mechanical Engineers) Boiler and Pressure Vessel Code8. This rather large document deals with all aspects of vessel design, construction and operation. Section VIII, Parts UG-125 to 136, in particular, deal with the requirements for pressure relief.

The pressure relieving requirements for non-pressure vessels, i.e. tanks, are covered in detail in API Standard 2000, Venting Atmospheric and Low-Pressure Tanks5. Most safety related design practices applying to vessels and tanks are beyond the scope of the instrumentation and controls engineer; relief valves are an exception. Their correct sizing and selection is too broad a subject to be covered in this article especially since there is already a lot of material in print concerning them. Items 9 through 14 of

the references below deal extensively with this subject. The earlier section, Pressurization Systems, gives a typical example of pressure protection for an atmospheric tank. REFERENCES 1. Shinskey, F. G.; Process-Control Systems, McGraw-Hill Book Company.

2. Driedger, W. C., "Controlling Centrifugal Pumps"; Hydrocarbon Processing , July 1995. http://www.driedger.ca/CE1_CP/CE1_CP.html

3. Driedger, W. C., "Controlling Steam Heaters"; Hydrocarbon Processing, November 1996. http://www.driedger.ca/CE4_SH/CE4_SH.html

4. Gruhn, P. and Cheddie, H.L., Safety Shutdown Systems: Design, Analysis and Justification, ISA http://www.isa.org/

5. API STD 2000, Venting Atmospheric and Low-Pressure Storage Tanks. http://www.cssinfo.com/apigate.html

6. ISA-S5.1, Instrument Symbols and Identification. http://www.isa.org/

7. CAN/ULC-S603, Standard for Steel Underground Tanks for Flammable and Combustible Liquids. http://www.ulc.ca/stdord.htm

8. ASME Boiler And Pressure Vessel Code, Section VIII, Pressure Vessels, Division 1, Unfired Pressure Vessels, Parts, UG-125 to 136, Pressure Relief Devices. http://www.asme.org/catalog

9. API RP 520-1, Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries: Part 1 – Sizing and Selection http://www.cssinfo.com/apigate.html

10. API RP 520-2, Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries: Part 2 – Installation http://www.cssinfo.com/apigate.html

11. API RP 521, Guide for Pressure Relieving and Depressuring Systems. http://www.cssinfo.com/apigate.html

12. API RP 526, Flanged Steel Safety Relief Valves. http://www.cssinfo.com/apigate.html

13. API 550, Manual on Installation of Refinery Instruments and Control Systems - Part 4: Steam Generators ( API has withdrawn this standard without a replacement. ) http://www.cssinfo.com/apigate.html

14. API RP 576, Inspection of Pressure Relieving Devices. http://www.cssinfo.com/apigate.html

15. API STD 620, Design and Construction of Large, Welded, LowPressure Storage Tanks. http://www.cssinfo.com/apigate.html

16. API RP 750, Management of Process Hazards. http://www.cssinfo.com/apigate.html

17. ISA-S77.42, Fossil Fuel Plant Feedwater Control System -- DrumType. http://www.isa.org/reference/index/cfm

18. Cho, C. H.; Measurement and Control of Liquid Level, International Society of Measurement and Control. 19. Clift, M. T.; Reduce Storage Tank Emissions, Hydrocarbon Processing, May 1997. 20. Duguid, I.; Take this Database to Heart (A history of 562 disasters, catastrophes and near misses). Chemical Engineering, July

2001. http://www.che.com/CEEXTRA