DETECTION OF SAFE ACTIVATION OF SHUTDOWN VALVES AND BLOWDOWN VALVES

Abstract

The present disclosure relates to a system and a method to detect or determine faults in a valve activation system of an on/off valve with an actuator connected to a pneumatic or hydraulic pressurized fluid line.

Description

FIELD OF THE INVENTION

The present invention relates to a system and method to detect failure to de-energize ON/OFF valve actuators, especially around ESD/PSD/BD valve failure to de-energize without interfering/degrading the safety integrity of the Shutdown Valve, (SDV) defined as a Final Control Element in the Safety Instrumented System (SIS) (IEC61508, IEC 6151 or the PSA).

BACKGROUND

A Shutdown Valve, SDV (also referred to as Process Shutdown Valve (PSDV) or Emergency Shutdown Valve (ESV) or Emergency Shut Down Valve (ESDV)) is an actuated ON/OFF valve designed to stop the flow of a hazardous fluid upon the detection of a dangerous event. SDVs are energized to open in normal operation and de-energized close when required by the process. Blow Down Valves (BDV) are actuated ON/OFF valves designed to depressurize a process system in case of a detected hazardous situation on the plant. BDV's are energized shut in normal operations and de-energize to open when a process blow-down is required.

SDV's and BDV's are examples of general ON/OFF valves used in a variety of industrial application to safeguard process equipment for exposure of internal pressures exceeding the equipment design pressure, among others the oil and gas industry.

To simplify the description of this invention ON/OFF valve, energized in normal operation and de-energized to safeguard the process, are used in the following, but the description is equally valid for SDV's and BDV's.

In the process industry the Process Control System (PCS) will ensure stable production and processing during normal operation. The Safety Instrumented System (SIS) will respond in case of a failure of the PCS such as instrument faults, or in case of a hazardous event not managed by the PCS such as an external equipment faults, gas leaks, fires etc.

The Safety Instrumented System (SIS) normally consist of several independent systems, the Process ShutDown (PSD) system, and the Emergency ShutDown (ESD) system including the Fire &Gas (F&G) system.

For both technical and financial reasons, an SDV can be activated by both ESD and PSD independent of each other, and to allow a graceful start-up of the process and for the purpose of system synchronization, the Process Control System (PCS) is also interfaced to the SIS logic systems and the activation of SDVs.

All of the international safety regulations (PSA regulations, IEC 61508/61511 and ISO 10148) include requirements related to independence between systems comprising the SIS, i.e. ESD, PSD and PCS. Such requirements are introduced as a defence against making several barriers vulnerable to one common event or cause, and to avoid negative effects from one function onto another.

IEC 61508 classifies the frequencies of demands of the SIS into three different demand modes. Low-demand which would occur less than once per year, high-demand occur more than once per year and continuous-mode are always present.

The safety integrity of the SIS is the probability to satisfactorily performing the required safety functions under all the stated conditions within a stated period.

SDV's are Final Control Elements in the SIS to manage functional safety to the process, or the Equipment Under Control (EUC) to protect people, environment, and the economical investments against possible harm, upon the detection of a hazardous event.

However, for some applications, for example when the pneumatic or hydraulic actuated SDV is the Final Control Element in the EUC, a normally used configuration is to operate the SDV actuator from independent solenoid valves controlled by the ESD and the PSD system in the SIS. In some applications a third solenoid valve controlled by the DCS system is connected to the mentioned SDV's.

For the process industry the low-demand mode of the SIS means that a failed state is not hazardous unless a demand occurs. By nature of the faults some may remain hidden until a demand occurs, at which time the SIS will not be able to execute the safeguarding action on the EUC. These faults are defined as Dangerous Undetected (DU) faults. DU faults can be detected by proof tests. A shutdown test will reveal if SDVs are closing or not. However, when both ESD, PSD and DCS are energizing individual solenoid valves to supply fluid (air/hydraulic) to on the SDV actuator, a simple shutdown test of the SDV will not reveal which solenoid valve have failed, since all systems will act on a general shutdown. A Dangerous Undetected fault in any individual solenoid valve connected to the ESD system or the PSD system will jeopardize the safety function of that system, and therefore also the overall safety of the EUC.

SUMMARY

To solve the above-mentioned problems and to satisfy the above-mentioned need, in accordance with the present invention it is provided a detector system to detect or determine at least a solenoid valve failure to de-energize the ON/OFF valve actuator, the specialty of the detector system is that it comprises

• • at least one detector which monitor if a solenoid valve is energized or de energized, and at least one detector which monitor if a solenoid valve has closed and properly and vented the fluid to de-energize the ON/OFF valve actuator and at least one detector that monitor if the ON/OFF valve actuator is energized or not
  • a controller that connects to the said detectors to detect and evaluate if any dangerous solenoid valve failure occurs
  • a method and system to detect correlation between electric de-energizing a solenoid valve and the vent of air or fluid from the same solenoid valve.
  • a method and system to increase overall system availability by failure detection and thereby reduce testing and maintenance work.
  • a method and system to generate and store fault messages related to electric de-energizing a solenoid valve and the vent of air or fluid from the same solenoid valve in real time in the local Predictor microcontroller and transmit the messages wireless as required by external operational data systems.

These objectives are achieved with the method and system of the present invention as set forth in the appended claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described in more detail and with reference to the appended drawings, in which:

FIG. 1 illustrates system communication in the inventive system,

FIG. 2 shows the placement of process components, sensors, and processor,

FIG. 3 is a flow chart of solenoid valve operation and failure detection, and

FIG. 4 is a table showing solenoid states and solenoid valve faults.

DETAILED DESCRIPTION OF THE INVENTION

At least one embodiment of the present invention is described below about operation of ON/OFF valves with pneumatic or hydraulic activation system within an oil and gas production plant. However, it should be apparent to those skilled in the art and guided by the teaching herein that the present invention is likewise applicable to any Emergency ShutDown Valves (ESDV's) with either pneumatic or hydraulic activation system and any, Blow Down Valves (BDV's) in any industrial facility that may employ SDV's, ESDV's or BDV's.

A non-exhaustive listing of possible industrial facilities that employ ON/OFF valves, SDV's, ESDV's or BDV's and have a need to monitor such valves includes power generation plants, chemical facilities and electrical facilities. Those skilled in the art will further recognize that the teachings herein are suited to other applications in addition to industrial settings such as for example military, commercial and residential applications.

Referring to the drawings FIG. 1, is a schematic illustration of a Shut Down Valve solenoid valve(s) activation system depicting the communication as a generic symbol, achieved either over a Wi-Fi network, Bluetooth protocol, SMS protocol (a Cloud, dedicated Application, or a Handheld Device), or any other applicable method according to the present invention, also including cabled connections. This setup allows ON/OFF valves such as SDV's and/or BDV's with sensors and the Predictor 50 to communicate with different applications and or devices.

Referring to FIG. 2 where the on/off valve (VI) with an actuator 4 fixed to VI by mechanical arrangement 2, where the actuator 4 energized by a fluid medium, which may be air, gas or a liquid moves the stem 3 connected to the flow controlling element in VI between open and closed position by the actuator 4 to let process medium pass from inlet pipe 5 to outlet pipe 6 in said open position or to stop said process medium passing from inlet pipe 5 to outlet pipe 6 in said closed position, where the actuator 4 is connected to a fluid line 7, acting as a fluid power supply, through a solenoid valve assembly unit comprising at least one solenoid valve which may be direct or indirect (pilot) operated by a solenoid, and where the solenoid valve fluid connections are characterised by one input port, one output port and one vent port, and where the solenoid valve can have at least two operating states, which may be energized or de-energized, where in the energized state the valve input and output port are connected for fluid flow and the vent port is closed and in the de-energized state the output port and the vent port are connected for fluid flow and the input port is closed. The de-energized state should bring the valve to a safe position, i.e. where the associated plant or equipment is being closed down.

For the purpose of describing one embodiment of the invention illustrated schematically in FIG. 2 where VI is defined in de-energised safe position when closed, when the actuator 4 de-energized, three solenoid valve SOV1, SOV2 and SOV3 are included in the solenoid valve assembly where solenoid valve SOV1 and solenoid SO1 through terminal T1 is electric energized or de-energized from external control system A, and where solenoid valve SOV2 and solenoid SO2 through terminal T2 is electric energized or de-energized from external control system B, and where solenoid valve SOV3 and solenoid SO3 through terminal T3 is electric energized or de-energized from external control system C.

When all solenoid valve SOV1, SOV2 and SOV3 are energized the fluid line 7 pressurizes valve actuator 4 to keep the VI flow controlling element in open position, but if one of the solenoid valve SOV1, SOV2 or SOV3 are de-energized the valve actuator 4 is de-energized and VI flow controlling element goes to closed position, and where an actuator energized/deenergized detector which may be pressure sensor AP8 monitor the said actuator state.

The solenoid valves SOV1, SOV2 and SOV3 are equipped with solenoid energizing detectors which may be current detectors CD1, CD2 and CD3 which will detect when any of the solenoids SO1, SO2 and SO3 are magnetized or not to confirm that the said solenoid valves are energized or not, and solenoid valve deenergizing detectors which may be fluid flow detectors/valve vent detectors VENT1, VENT2 and VENT3, which will detect if any of the solenoid valve SOV1, SOV2 or SOV3 have changed from energized to de-energized state.

Referring to drawing FIG. 2, an important element of the invention is the predictor 50, which communicates with the sensors through interfaces 9, and which also includes a microcontroller 51, programmed to compute logic sequences, store data and to read hardwired sensor data from the said solenoid valve assembly sensors including but not limited to:

• • VENT 1 detecting air/hydraulic vent flow from SOV1 exhaust port
  • CD1 detecting current or no current in SO1 solenoid.
  • VENT 2 detecting air/hydraulic vent flow from SOV2 exhaust port
  • CD2 detecting current or no current in SO2 solenoid.
  • VENT 3 detecting air/hydraulic vent flow from SOV3 exhaust port
  • CD3 detecting current or no current in SO3 solenoid
  • AP8 monitoring actuator 4 pressure.

Where any of CD1, CD2 or CD3 current detector will generate a signal to trigger the microcontroller 51 to wake up from sleep mode when the current in any solenoid is turned on or off.

One function of the microcontroller 51 is to store defined threshold values for the said hardwired sensors, including pressure, current and flow.

Referring to FIG. 3 which illustrates the program steps for the microcontroller 51 where start is the initial sleep mod state of the microcontroller 51, and at least one of the current detectors CD1, CD2 or CD3 detect a change in solenoid current, where the wake-up 110 will initiate to read sensors 111 over a programmed period. If sensor AP8 has an air/hydraulic pressure reading blow a defined threshold, the data from CD1, CD2 and CD3 will document if any of the solenoid valve SOV1, SOV2 and SOV3 is de-energized or not and the microcontroller will correlate the said solenoid valve state with the flow detected in VENT1, VENT2 and VENT3 to determine if any de-energized solenoid valves have not closed as expected, and generate SOV1 FAULT and/or SOV2 FAULT and/or SOV3 FAULT and store solenoid valve fault data and alarms 131.

Similarly, all solenoid valves which are de-energized and vented according to design will be logged together with AP8 low pressure to indicate that the VI have closed will be logged 140 and the microcontroller 51 will go back to sleep 141.

An important element of the present invention is that the microcontroller 51 will store the relationship between system A and SOV1, system B and SOV2 and system C and SOV3 and record and store sequences of low or high pressure of AP8, associated with changes in solenoid valve SOV1, SOV2 and SOV3 open or closed states, deducted from detected above or below set threshold values for solenoid currents CD1, CD2 or CD3 and solenoid valve vent flow VENT1, VENT2 and VENT3 and compare with the correct combination of said pressure and valve states according to table in FIG. 4, to keep the system operator informed of which of System A, B or C have closed SDV1, and thereby reduce dangerous undetected fault in any one of the said solenoid valves which otherwise would have jeopardize safe closing of VI.

Claims

1. A system to detect or determine faults in a valve activation system of an on/off valve (VI) including an actuator connected to a pneumatic or hydraulic pressurized fluid line, the system including at least one solenoid valve (SOV1, SOV2, SOV3) connected in the fluid line ahead of the actuator, wherein each connected solenoid valve (SOV1, SOV2, SOV3) is activated by a solenoid (SO1, SO2, SO3) controlled by an external control systems (A, B, C), said solenoid valves being adapted to block the fluid line when de-activated, and vent the fluid line releasing the pressure from the actuator, which will de-energize the actuator and move the on/off valve (VI) to safe position, characterized in that the system further includes a current detector (CD1, CD2, CD3) associated with each connected solenoid (SO1, SO2, SO3) monitoring magnetizing current in said solenoid,a fluid flow detector (VENT1, VENT2, VENT3) associated with each connected solenoid valve (SOV1, SOV2, SOV3) detecting any flow of fluid vented from the fluid line through the solenoid valve, anda controller connected to and monitoring signals from each connected current detector (CD1, CD2, CD2) and each connected fluid flow detector (VENT1, VENT2, VENT3).

2. The system according to claim 1, further including a pressure sensor measuring the energizing/de-energizing pressure in the fluid line at the actuator, said pressure sensor being connected to the controller.

3. The system according to claim 1, wherein the controller is adapted to read and store time series of signals from the current detectors indicating that each connected solenoid valve (SOV1, SOV2, SOV3) being open or closed, and read and store time series of signals from each connected fluid flow detector (VENT1, VENT2, VENT3) detecting if any connected solenoid valve (SOV1, SOV2, SOV3) have vented fluid from the actuator to move the on/off valve to safe position and evaluate and generate event messages if said detector signals are above or below predetermined measurement limits and determine if said event messages are within a predefined program sequence, and generate alarm if said event message is outside said predefined program sequence.

4. The system according to claim 1, wherein said on/off valve is a shutdown valve (SDV) which in safe position is closed to stop a process medium to pass from an inlet pipe to an outlet pipe, or a blowdown valve (BDV) which in safe position is open to release process medium from the inlet pipe (5) to the outlet pipe (6).

5. The system according to claim 1, wherein the system is part of a safety instrumented system (SIS).

6. The system according to claim 1, wherein the system includes three solenoid valves (SOV1, SOV2, SOV3) connected in series in the fluid line ahead of the actuator.

7. A method to detect or to determine failures in the system of claim 1, wherein the method includes: reading and storing time series of signals from the at least one current detector (CD1, CD2, CD3) indicating that the at least one solenoid valve (SOV1, SOV2, SOV3) being open or closed, and read and store time series of signals from the at least one fluid flow detector (VENT1, VENT2, VENT3) detecting if any solenoid valve (SOV1, SOV2, SOV3) have vented fluid from the actuator to move the on/off valve (VI) to safe position and evaluate and generate event messages if said detector signals are above or below predetermined measurement limits and determine if said event messages are within a predefined program sequence, and generate alarm if said event message is outside said predefined program sequence.

8. The method according to claim 7, comprising waking up the controller if detecting in at least one current detector (CD1, CD2, CD3) that magnetizing current is turned on or off from at least one external control system (A, B, C) to at least one solenoid (SO1, SO2, SO3), read and compute time series of readings from the current detectors and fluid flow detectors (110),comparing actuator pressure (AP8) with predetermined setting and if pressure is high record that the actuator is energized and the on/off valve (VI) is in operating position, elsechecking that the first solenoid valve (SOV1) is safe closing when the first current detector (CD1) detects no magnetizing current and the first fluid flow detector (VENT1) detects vented fluid, and store that the first solenoid valve (SOV1) is safe closing, or if the first current detector (CD1) detects magnetizing current in the first solenoid (SO1) or the first fluid flow detector (VENT1) detects no vented fluid through the first solenoid valve (SOV1), store first solenoid valve (SOV1) failure,if a second solenoid valve is installed, checking that the second solenoid valve (SOV2) is safe closing when the second current detector (CD2) detects no magnetizing current and the second fluid flow detector (VENT2) detects vented fluid, and store that the second solenoid valve (SOV2) is safe closing, or if the second current detector (CD2) detects magnetizing current in the second solenoid (SO2) or the second fluid flow detector (VENT2) detects no vented fluid through the second solenoid valve (SOV2), store second solenoid valve (SOV2) failure,if a third solenoid valve is installed, checking that the third solenoid valve (SOV3) is safe closing when the third current detector (CD3) detects no magnetizing current and the third fluid flow detector (VENT3) detects vented fluid, and store that the third solenoid valve (SOV3) is safe closing, or if the third current detector (CD16) detects magnetizing current in the third solenoid (SO3) or the third fluid flow detector (VENT3) detects no vented fluid through the third solenoid valve (SOV3), store third solenoid valve (SOV3) failure,reading and storing solenoid valve failure data, generate solenoid valve failure alarms and generate on/off valve failure alarm to de-energize on command from the external control system A and/or system B and/or system C, elsestoring solenoid valve safe closing, store data and generate on/off valve safe de-energize message on command from external control system A and/or system B and/or system C command, elsesaving all relevant data and terminate the procedure.