Process Substance Containment

On most oil / gas installations the gas being handled will be a mixture of hydrocarbons and some inerts, of relatively low toxicity but posing an asphyxiation risk. Some gases containing hydrogen sulphides may be more toxic. Any release of gas, though diluted below the lower flammable limit, may still pose a direct safety threat. Ideally, such releases should be detected by gas detectors and/ or by smell, and the fault repaired. Some devices such as valve glands, sample points and simple mechanical seals, release small quantities of gas during normal operation. T F P P T L P F Control ) Recycle system & cooler Suction K.O. Drum

Compressor Flow & Bypass Process Flow Control PCV ( if required ) Pressure, Temperature, Level

and Flow Instruments

Suction Pulsation Damper Discharge Pulsation Damper

Reciprocating Compressor System (see Figure 4,4 - 5

Toxic gases require care because of the immediate risk to people in the vicinity, who can be protected by good ventilation, and where necessary by the use of breathing apparatus. Reciprocating compressors require piped vents to flare or safe area, as the seals continuously release a small flow of gas at low pressure. This gas cannot be recovered as it may contain air. Hydrocarbon gases pose a real safety threat if released in quantity / concentration sufficient to permit a fire / explosion. Because of the pressures / inventory involved in oil / gas installations, it must be accepted that any leak in the pressure containment envelope is likely to lead to a large release. Designs with the least number of joints and connections are much preferred, and all possible joints should be welded or permanently bonded. Even on small bore lines screw connections should be avoided. Due to the large number of mechanical joints e.g. valve covers, small gas leaks must be anticipated and detection devices installed.

In the event of a major release it may not be possible to get near to the machine to close the isolation valves. Strategically located emergency shut down valves are installed, to prevent venting of large capacity storage or pipe mains. Such isolation valves should permit closure from the control room, but should also close if their energising supply fails or is burnt through. The closure times of the isolation valves should consider both the requirements for effective isolation and the effects of pressure surge. Control valves should not be used as isolation valves because they do not close sufficiently tightly. Closing of the isolation valves should also cause the compressor to stop. A non-return valve in the discharge pipework (as distinct from the compressor discharge valve) will, if it works, prevent the venting of the high pressure gas manifold as part of the release. Operation of isolation valves to safeguard the machine must be designed to avoid introducing their own hazards, machines should be shut down by the action of valve closure, and the design must still allow re-circulation of gas from the compressor discharge to suction or through a pressure relief device.

The process gas pipework within the main isolation valves should be treated as part of the machine system, particularly as part of it may well be supplied with the package. It may have been necessary to install bellows in the main process lines because of space constraints. A bellows failure can cause a major gas release. If the bellows are within the remote isolation valves, then exactly the same emergency isolation action will stop the release. Small bore pipework is weaker than large bore, thus more vulnerable to damage. It is good practice to have robust primary isolation valves, at minimum 1" ( 25 mm) or 1 1/2" ( 40 mm ) size, at the termination points of small bore harnesses. A failure can then be isolated quickly. Included in all pipework design should be considerations of mechanical resonance, excited by either pressure fluctuations or machine vibrations. Vibrations of pipework and fittings can lead to fatigue stresses being introduced to components, which if not corrected can lead to failure and loss of process gas containment.

It must not be possible to bypass the main remote isolation valves, except as a planned activity, probably as part of commissioning or testing on non-flammable gas. No modification that bypasses the isolation valves should be accepted, without a clear understanding of the necessity of this arrangement, and the associated risks. There is likely to be a venting system, usually to flare, for purging or de-pressurising the compressor system. The system may hold a significant quantity as gas in casings, lines, interstage vessels and coolers. It is possible under some circumstances for gases from one system to be blown into another via common flare or vent lines. This is particularly the case when gas liquids are being handled, these can run down vent lines or cause blockages by freezing water in vent lines.

Compressors inherently increase the superheat in the gas being processed. Hence any free moisture in the gas will evaporate. Any tars or salts will be deposited on internal surfaces, particularly on valves. This will cause fouling. Similarly any solids e.g. dust or catalyst particles will potentially be deposited. These can cause loss of performance by restricting the valves or jamming piston rings, increase leakage by damaging piston rod seals, and in extreme cases cause mechanical damage by limiting piston travel thus overloading bearings.

Reciprocating compressors are in general intolerant of the ingestion of liquid. Slugs of liquid can cause major damage and a major gas release. If there is any risk at all of liquid, the inlet piping

must be designed to avoid liquid ingestion. In all cases, the low points of inlet pipes require manual low point drains, for checks after overhaul / cleaning work. The drain valve should be of straight-through design e.g. plug or ball, permitting a wire or even an optical probe (borescope) to be used for a cleanliness check. The worst design is a long horizontal suction line, with a rising bend to the compressor. Liquid can collect in the line at low flow rates; this is swept up into a wave when flow is increased. A suction knockout pot as close as possible to the compressor, with drains, level detection, alarm and trip, is the normal solution. If liquid is rarely found, the drain valve may be blanked off. While some compressors can tolerate sucking in a mist of clean liquid with no ill effects (in some cases this is used for inter-stage evaporative cooling) accumulation of liquid must be avoided. Operating practices must ensure that all pipework is fully drained of liquid prior to restart the machines, and the machine itself does not contain liquid from process or internal leakage.

Sealing of process gas within the cylinders is achieved by a series of close fitting packing rings (Section 4.4.6.5), leakage from the seal is normally monitored at different positions on the packing box, allowing a progressive view on the rate of deterioration of the seal. Though some leakage can be attributed to bedding in of the packing rings it is unlikely that prolonged or increasing leakage will correct itself and such leakage is in general a sign that seal maintenance is required. The sealing system is highly intolerant to defects and seal wear out can happen rapidly even with a “new” seal. Complex maintenance is required to change and overhaul the seal gland boxes with the highest standards of care required to avoid intolerable defects.

The cooling system can be complex, being required to cool compressor cylinders, sealing glands, gas coolers, and oil coolers. The operational establishment of cooling to a compressor must ensure that all requirements have been met with the appropriate balance of flows to each cooling element. The potential for leakage of cooling water into the machine during normal operations is normally low, however during machine shut downs the risk significantly increases. Any liquid ingress into the machine may result in the machine becoming liquid locked with catastrophic results. Operator activity is required to prove the machine clear prior to any re- establishment, and it is good practice to isolate drain down cooling systems during any extended off line period.

4.4.3.2 Equipment Hazards

The reciprocating action of the motion works imposes a variable torque on the crankshaft, the total effect is that most parts of a reciprocating compressor are subject to fatigue conditions at 1 or 2 cycles per revolution. A failure of the crankshaft, connecting rod or cross-head has the potential to breach the crankcase and eject major parts. This will release a quantity of lubricating oil and may directly breach hydrocarbon containment. Failure or partial failure of the crankcase could displace cylinders leading to very high vibration levels which can rupture hydrocarbon pipework, flanged connections, and foundation bolting.

Within the cylinder, loosening or failure of the piston nut or cross-head nut can cause the piston to be driven against the end of the cylinder, breaking the cylinder end or bending the piston rod. A bent or unsupported piston rod could then wreck the piston rod seals. Failure of a valve cover or valve retainer could cause ejection of a valve complete with cover. Any of these failures open a large diameter hole from the process side to atmosphere, this will cause a major release until remote isolation valves are closed. Stopping the compressor will not stop the leak. Ejected parts may be expelled with a degree of force dependant on the gas energy stored within the machine. A rigorous maintenance and inspection regime is required to mitigate the risks of these hazards.

Reciprocating compressors are particularly vulnerable to damage from liquid slugs, these can instantly cause any of the above failures. As noted earlier it is paramount to prevent ingestion of any liquid, it is particularly important to ensure that all liquid is removed before starting a compressor. Some compressors require cylinder and gland lubrication, in such cases it is important that operation of the lubricating system is inhibited with the machine offline to avoid a build up of oil.

Oil feed pipes to bearings are at relatively low pressures (3 - 5 barg) but can drip or spray oil if damaged. The oil may pose personnel risk (toxicity, spray in eyes, or as a slipping hazard) or catch fire from a hot surface. Compressor metal temperatures are unlikely to be high enough, except as a result of ongoing bearing failure. A failed or failing crankshaft bearing can generate sufficient heat to ignite oil. The benefit of a nitrogen atmosphere in the crankcase is that such fires should be prevented. Opening a crankcase cover can let air contact hot, oily, metal, provoking a fire or explosion, procedures should allow cooling of the machine so that by the time the equipment has been isolated and covers removed the hazard is no longer present. Sets should not be run with crankcase covers loose or partly bolted, as this could let air in. Mechanical shaft couplings pose a significant safety risk, particularly if neglected, or if the compressor is subject to serious misalignment or vibration. The potential for damage (and the amount of power wasted) within a coupling increases with the misalignment. Reciprocating compressors run relatively slowly, thus a failed coupling is unlikely to be thrown far. Vulnerable components (e.g. oil flexible pipes, cables, seal lines) ideally should not be located tangential to a major drive coupling. The abrupt loss of load and shaft inertia could provoke a dangerous overspeed event on the driving machine.

The consequence of machine failures can be rapidly amplified by the very high vibration levels possible once the balance of internal forces is lost. This can lead to loosening of all connection and containment bolting. Prompt action is necessary to avoid the escalation of any event. For details of Bearings, Seals, Shaft Couplings and related hazards see Section 5 – Ancillary Systems & Equipment.

Overspeed and Reverse Rotation

Where the compressor is driven by a variable speed device, such as a gas turbine, the compressor must be protected from overspeed by the speed control system of the driver. In the event of coupling failure, this control is lost along with the drive. Reciprocating compressors have self-acting valves, and thus cannot be forced to spin backwards by the gas pressure. If both delivery and suction valves are jammed partly or fully open, gas will vent back into the suction line. Significant valve faults are normally detected quickly in operation, as the effectiveness of the compressor is compromised.

A gas compressor can be driven backwards e.g. by incorrect electrical connections to the motor. The compressor will run and will compress gas, but the bearings and lubrication system are not intended for reverse running and will be damaged. The shaft driven oil pump, if fitted, may well not work if run backwards.

Piece Valve with Vent to Valve with Vent to Suction Pulsation Damper

Suction Pulsation Damper

Delivery Pulsation Damper Delivery Pulsation Damper

Flywheel & Shaft Coupling Crankcase with Four

Opposed Cylinders Suction Isolation Delivery Isolation Distance Double Acting Cylinder Relief Flare Relief Flare

Figure 4,4 – 6 Suction and Delivery Pipework – Reciprocating Compressor

4.4.3.3 Operational / Consequential Hazards

An abrupt loss of the operation of the compressor may cause disruption of the upstream or downstream systems. This may result in systems being shut down, or load being transferred on to other compressors. The safety studies carried out as part of the safety case must ensure that there are no circumstances where a compressor failure might cause an unsafe condition e.g. over-pressurisation of a pipe header.

A compressor can cause problems without actually failing. Examples are: -

x A fault in the load control system can result in rapid changes in flow or pressure; this disrupts upstream or downstream systems.

x A fault in the control system lets a process parameter drift outside the normal operating area. Trips and alarms normally protect against an individual value being unsatisfactory, but it is much more difficult to protect against a combination of changes that make a system inoperable or less efficient. It is up to the operators to remedy the situation.

x A change in the process gas composition, caused by a process upset or change in feedstock, can rapidly change the compressor discharge temperature or pressure. Reciprocating compressors are relatively tolerant to composition changes.

x Failure or partial failure of the machine valves will result in gas recycling within the machine. This can cause high temperatures within the machine, the balance of forces within the machine to be disturbed sufficient to cause bearing overload, interstage pressures to be to

high, thus lifting interstage relief valves, and the potential for larger back-flow through the machine once shutdown.

x A variable speed compressor can run under or over speed, within the mechanically safe range; the relief / vent system must be able to cope with excursions for conditions normally outside the process envelop and with the increased gas flow generated by the compressor running up to trip speed.

x Reciprocating compressors generate significant pulsations in both suction and discharge lines. These pulsations can be greatly reduced by good pipework design and by fitting tuned pulsation dampers. Note that these dampers are not the same as pump pulsation dampers, they are simpler and do not contain moving parts.

x Reduction in the capacity of the machine can be achieved by offloading one or more cylinders. Though this can be designed as a normal operating mode, the faciltiy can be available for use during transient operations (start up / shut down). Such options in the machine operation can cause an imbalance of forces, in this case the configuration may only be suitable for short term activity and extending the activity can lead to machine failure. If a standby compressor is already connected up and under automatic control, load may be shed to it without operator intervention. This is likely to pose negligible risk. If operators feel obliged to bring a spare machine into service quickly, they may take potentially hazardous shortcuts, for example omitting gas purging. If the status of a machine under overhaul is in doubt, and this machine is brought back into service in a hurry, serious risks are being taken. This was one of the prime causes of the Piper Alpha fire.

Where the installation is subject to significant motion, for example when under tow or during a storm, the motion may exceed the capabilities of the compressor. The unit may have to be shut down as a precautionary measure; otherwise mechanical damage may be caused. The most sensitive system is likely to be the lubrication oil system; movement or roll angles may interfere with oil distribution & return, or cause spurious level trips.

4.4.3.4 Maintenance / Access Hazards

The standards of maintenance for reciprocating compressor must be maintained at the highest level. Reciprocating compressors are vulnerable to incorrect mechanical standards, these can lead to rapid deterioration and failure of components leading to potential for disruption of the machine and loss of containment of the process gas. Examples of this are -:

x Correct assembly and fitting of the self actuating machine valves is crucial to machine operation. Though such valves are normally designed to be unique to a particular position and duty on the machine it may still be possible to confuse the installation. In such cases this can cause the machine to be gas locked with catastrophic results. Machines returning from external maintenance may require preservative actions to be reversed and the removal of dessicant bags from valve ports is also vital.

x Incorrect bearing clearances – on crankshaft this has led to failure of the crankshaft and major machine disruption.

x Incorrect set up for piston rod connections either for cylinder or crosshead can cause complete failure of piston rod.

x Wrong maintenance standards applied to recover wear on piston rods have caused rod failure and loss of containment through the seal.

x Wrong maintenance standards applied to recover wear on crankshafts has resulted in failure of crankshaft, disruption of the crankcase and loss of process gas containment. x Incorrect installation of the process gas valves can block in the gas pressure causing the

Horizontal reciprocating compressors are wide, low machines, so most parts are readily accessible. Access may be restricted by pipework and fittings, with consequent trip and head injury hazards. Valves and seal assemblies may require handling or lifting devices to reduce the risk of hand injuries and muscle strains. Vertical compressors can easily exceed 4 m high, requiring platforms or scaffolding for access. The valves, which require the most frequent attention, are mounted high on the machine.

Seal housings and crankcases may have nitrogen purges, these purges must be isolated and enclosed areas ventilated and checked for safe access – even if for head access only.