OTC 15358

Dynamic Simulation of a Gas Compression System for Relief and Controlled Blowdown
Cases
Kiho Moon, Donghun Lee, Kwangpil Chang, Joonho Min, Junhong Kim, Sejoong Lee, Kiil Nam, and Daejun Chang/
Hyundai Heavy Industries, Co., Ltd.
Copyright 2003, Offshore Technology Conference

This paper was prepared for presentation at the 2003 Offshore Technology Conference held in
Houston, Texas, U.S.A., 58 May 2003.

This paper was selected for presentation by an OTC Program Committee following review of
information contained in an abstract submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Offshore Technology Conference and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Offshore Technology Conference or officers. Electronic reproduction,
distribution, or storage of any part of this paper for commercial purposes without the written
consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print
is restricted to an abstract of not more than 300 words; illustrations may not be copied. The
abstract must contain conspicuous acknowledgment of where and by whom the paper was
presented.

Abstract
This study presented the dynamic simulation of a gas
compression system, proving the viability of operational
philosophy and emergency shutdown logic with quantitative
process responses in various situations. To avoid unnecessarily
high peak in an initial stage of blowdown, this study employed
the controlled blowdown and investigated its safety level.

Introduction
This study concentrated on the dynamic simulation of a gas
compression system of a topside module on offshore facilities.
The gas produced from the wells was separated in the Inlet
Separator and routed to the Gas Compression Module. Such
various process specifications and operation logics as dew-
point control, turbine speed, and compressor surge were taken
into account in the dynamic simulation. Revealing the time-
varying behavior provided the viability of operational
philosophy and emergency shutdown logic, illustrating the
detail and quantitative process responses to various
disturbances. For example, it showed the transient behavior of
the compressor control system consisting of the recycle valve
opening at 15% above the surge flow and the surge control
valve opening at 10%.
Event scenarios included the possible cases of emergency
and relief operation. The history of such process variables as
pressure, temperature, liquid level, and flow rate were
demonstrated to the virtual event scenarios.
Flare system should be designed to the peak flow rate. The
conventional blowdown systems is easy to install and simple
to operate. But, it suffers an unnecessarily high peak flow rate
in an initial stage of blowdown. In offshore processes, this
high peak rate means costly flare facilities. Especially, the
flare stack location and weight distribution demand careful
consideration for floating units like FPU, FPSO, and LNG
FPSO. Therefore, it is important to mitigate the peak flow rate
for environmental protection and optimization of the flare
system design. In addition to rigorous dynamic simulation, this
study also examined the feasibility of the controlled blowdown
application to the floating units, to decrease the peak flow rate.
The blowdown system was compared with the normal practice
in terms of safety level as well as of flare load.

Process description
The gas compression and treatment facilities are rated for gas
export capacity of 60 MMscfd and fuel gas requirement of 4
MMscfd at 108 F ambient temperature and 100 % relative
humidity. The overall compression requirement is satisfied by
two process stages. The Low Pressure (LP) and the
Intermediate Pressure (IP) stages are in the form of a complete
100% train, comprising a single driver with two compressors
in a tandem arrangement. The gas turbine for LP and IP
Compressors is capable of running both on fuel gas and diesel.
Diesel is to be used only for field black start when fuel gas is
not available. The discharge pressure of the IP compressor is
fixed at 638.5 psia (43 barg) to fulfill the required
hydrocarbon dew point specification.
The compression module receives the gas from the Inlet
Separator, the gas produced from the wells is separated into
two phases of gas and liquid. Compression is performed in
two stages increasing the pressure from the Inlet Separator
operating pressure to the required export discharge pressure.
The Inlet Separators operate under pressure at a normal
pressure of 55 psia (2.8 barg). The Inlet Separators are
designed to handle up to 100 MMscfd of gas. The actual
quantity of gas produced in the Separators varies over time,
and may be higher than the capacity of the Gas Compression
Module, 60 MMscfd. The balance gas produced from the Inlet
and Test Separators, which is not compressed, is flared under
pressure control.
The gas from the Inlet Separators is routed to the LP
Compressor Suction Scrubber where the liquid carried over
from the Separators, if any, is separated and drained under
level control to the Closed Drain Vessel. The gas from the LP
Suction Scrubber is compressed in a gas turbine driven LP
Compressor in tandem with the IP Compressor and cooled in
the LP Compressor After-Cooler. The gas from the LP
Compressor After-Cooler is routed to the IP Compressor
Suction Scrubber, where liquid is separated and drained under
level control to the Inlet Separator on the respective Well
Head Platform.
2 OTC 15358
The gas from IP Suction Scrubber is compressed in the IP
compressor and cooled in the IP Compressor After-Cooler.
The interstage pressure or IP Compressor discharge pressure is
to stay at 638.5 psia (43 barg) minimum in order to achieve
the hydrocarbon dew point. Both the LP and IP Compressor
After-Coolers are seawater cooled shell-and-tube exchangers.
Prevention of compressor surge is two folds. The Unit
Control Panel (UCP) controls the compressors and turbine. It
manipulates the individual anti-surge valve installed on each
compressor. IP Station Recycle Valve recycles the gas from
the IP Compressor After-Cooler to LP Compressor Suction, if
required, during start-up and / or high turn down scenarios.
In order to reduce the hydrocarbon dew point of the gas,
the liquid condensate knocked out in the Pre Glycol KOD is
flashed over a Joule-Thomson valve (Pre Glycol KOD
condensate stream level control valve). The flashed
condensate cools the gas leaving the IP Compressor After-
Cooler in a gas/liquid heat exchanger (JT Cooler) before it is
led to the Flash Vessel.
In the Flash Vessel the liquid and the gas are separated.
The gas from the Flash Vessel is recycled back to the LP
Compressor Suction Scrubber under pressure control. It is also
possible to flare the Flash Vessel Gas instead of recycling the
gas back to the LP Compressor Suction Scrubber. The light oil
separated in the Flash Vessel is pumped into the crude export
and leaves the platform complex.
The outlet line from individual pressure relief valves,
blowdown valves, pressure control valves, compressor
primary seal, and manual vent valves are collected to a
common flare header provided in the compression modules.
The flare header is combined with the flare header on each
Well Head platform and led to the HP Flare KO Drum located
on each Flare platform. Flare header piping arrangement is
positioned without low points, and the header from
Compression module to the wellhead tie-in has a slope of
1:200 towards HP Flare KO Drum. During normal operation
of the Compression module, the flare header receives gas
continuously from primary seal vents of LP and IP Gas
Compressors, and moisture analyzer. Only during process
upsets, emergency, and blowdown condition, the gas and
associated liquid streams are released from various relief
valves and blowdown valves to the flare header.
The flare header is purged continuously with fuel gas to
protect the system from air ingress, which can lead to
undesirable internal combustion inside the system. The fuel
gas is tapped from the main fuel gas distribution header and
provided with a pressure regulator to maintain the fuel gas
purge supply pressure to the flare header. A pressure regulator
is set at 2 barg. The purge line is also provided with a
rotameter globe and a needle valve. The globe and the needle
valves are throttled to limit the purge gas flow.

Dynamic simulation
This study considered two-stage gas compression system
(LP/IP Compression Module) of whole process. Dynamic
simulations are performed using Hyprotech dynamic simulator
HYSYS.Plant with Peng-Robinson as the Equation of State.

Controlled blowdown
The objective of depressuring (blowing down) is to
immediately evacuate the plant inventory in an emergency.
This avoids over-pressuring of equipment that may occur
during a runaway reaction or in case of fire. The depressuring
action also reduces the consequences of leakage.
Emergency depressuring can be initiated automatically or
manually, depending on the type of emergency and the
safeguarding strategy. The arrangement for emergency
depressuring systems is dictated by the air failure action of the
depressuring valve.
The blowdown requirement specified by API RP 521 [1] is
a reduction to 50% of design pressure or 100 psig in 15
minutes. In either case, the blowdown continues after the 15
minutes so that eventually the vessel is completely
depressurised.
The traditional blowdown arrangement is to simply install
a restriction orifice in the line to flare with an automatic
isolation valve upstream. When the isolated boundary is to be
blowdown, the valve is opened. This method is very simple,
but it has the disadvantage that the blowdown rate declines as
the pressure in the vessel is reduced. It necessarily suffers a
high peak flow rate in the incipient period to achieve the
blowdown in the fixed interval. The flare stack has to be sized
to the peak flowrate. In offshore developments, this can result
in very costly flare structures.
As flaring rate increases, nominal equipment size and
spacing requirement must increase. Added costs for
equipment, though large, are usually overshadowed by the
added costs due to spacing requirements to avoid high
radiation flux on equipment and personnel. This is especially
true if the cost of real estate is high. The best example of this
is offshore platforms and floating units. The use of a
controlled blowdown design can often eliminate an
intermediate flare bridge platform costing several million
dollars.
Paruit and Kimmel [2] initially described the concept of
controlled blowdown. By maintaining the flow rate at a
constant value for a period of time, the required peak flowrate
is reduced, enabling the flare stack to be lower. They reported
reductions in the peak flare rate by 56% if the constant flow
rate is maintained for the whole 15 minutes.
The initial rapid rise becomes more apparent when the
flare headers are being packed up by the discharge from the
depressuring devices. In the uncontrolled blowdown case, the
initial peak flow into the flare system is typically 5 to 10%
higher than the peak flow out of the flare tip. Even this
reduction is worth significant savings. The controlled
blowdown has a lower peak flowrate, and the peak flow is
held constant for a period. The longer the flow is held
constant, the lower the rate is. In the ideal case, the rate is held
constant for the entire period under consideration.
Paruit and Kimmel used a control valve in parallel to a
restriction orifice. The restriction orifice was sized to give the
desired flow at the initial high pressure and provided some
redundancy to the control valve. The control valve
progressively opens, as the equipment is depressurised to
maintain a constant pressure in the flare header and hence
maintain the flare tip at its design flow rate.
OTC 15358 3
A full safety analysis has to be done to check the
controlled blowdown reliability and to satisfy the regulatory
bodies since it looks more complex than the traditional system.

Safety integrity level assessment
The reliability block diagram (RBD) is used to represent the
system configuration and analyze the reliability of the
controlled Blowdown system. The failure rates of the overall
instrumentation and equipment are obtained from the
surrogated data such as OREDA [3] and PDS [4]. The SIL
requirement by IEC is employed as the safety level
determining the system integrity.
In the IEC standards, a safety function is considered as a
function to be implemented in order to achieve a specified risk
reduction related to a hazardous event. A safety function is
thus specified in terms of the action to be taken and the
required probability to successfully carry out this action. This
probability is also referred to as the safety integrity, and in the
context of IEC 61508 [5] the safety integrity is classified to
discrete levels as indicated in Table 1.

Table 1 Safety integrity levels for safety functions
SIL Low demand mode of operation
4 10
-5
to < 10
-4

3 10
-4
to < 10
-3

2 10
-3
to < 10
-2

1 10
-2
to < 10
-1


In addition to specifying a quantitative requirement to the
failure probability, the SIL also forms the basis for a number
of qualitative requirements. This includes architectural
constraints on the safety systems as well as the description of
which techniques and measures should be used in order to
avoid and control systematic faults in both hardware and
software. Both IEC 61508 and IEC 61511 [6] describe a fully
risk-based approach to determining the SIL requirements. The
methods indicated within IEC 61508 for determining the SIL,
range from using pure quantitative risk assessments to more
qualitative methods such as risk graphs. In particular, the risk
graph technique has been extensively applied when
determining SIL requirements for local safety functions such
as process shutdown systems.

Minimum SIL requirements
Quantitative Risk Assessment (QRA) should have been used
in establishing the integrity requirements for safety functions.
However, the level of QRA as it is performed today is more
appropriate to evaluating conceptual options and verification
purposes, than to stating absolute criteria. As a result, SIL
requirements to safety functions can normally not be obtained
directly from the QRA. This will in particular apply to local
safety functions.
IEC 61508/61511 suggests a number of qualitative and
semi-qualitative methods for determining SIL requirements
such as risk graph and hazardous event severity matrix. These
methods are primarily screening tools and have proved
difficult to actually apply to some of the safety functions.
Whereas the use of risk graphs can work in determining
integrity levels for local safety functions, the use of this
method for global safety functions, such as ESD and F&G,
seems to cause important problems. Using these methods will
introduce considerable amounts of additional analysis work
and a possibility of selecting sub-optimal safety integrity
levels since numerous safety functions are present at an
average offshore installation. Consequently, it has been
decided to come up with a list of minimum safety integrity
levels for the most common safety functions.
The SIL requirements given in this list are based on
experience, with a design practice that has resulted in a safety
level considered adequate. This will reduce the need for time-
consuming SIL calculations for more or less 'standard
solutions' and will ensure a minimum level of safety. Another
advantage of using pre-determined SILs is that these figures
can be used as input to QRA during early design stages and
thereby set up a link between the risk analysis and the integrity
levels for important safety functions.
Table 2 presents the minimum SIL requirements. One
main objective in stating minimum SIL has been to ensure a
performance level equal to or better than today's standard.
Hence, in case the generic reliability data has indicated a
requirement hanging in the balance between two SIL classes,
generally the stricter SIL requirement has been chosen. This is
also in line with the NPD requirement for continuous
improvement.
For several safety functions, it has been difficult to
establish generic definition. Due to process-specific conditions
such as design and operational philosophy, the number of final
elements to be activated upon a specified cause will, for
example, differ from case to case. Consequently, some of the
requirements are given on a sub-function level rather than for
an entire safety function.

Table 2 Minimum SIL requirements
Safety function SIL
Functional boundaries for given SIL
requirement / comment
ESD
sectionalization
2
The SIL requirement applies to the sub-
function needed for closure
- ESD-node
- ESD valve including solenoid(s) and
actuator
Depressurisation 2
The SIL requirement applies to the sub-
function needed for opening
- ESD-node
- Blowdown valve including solenoid(s)
and actuator
PSV 1 PSV shall open at set pressure 3%

Reliability of safety system
The PDS is a method used to quantify the reliability, the safety
and the LCC (Life Cycle Cost) of computer-based safety
systems. The reliability data used in PDS method are based on
various sources, e.g. OREAD and expert's judgment.
Especially failure rate data is mainly based on the OREDA
phase . The OREDA project is also acknowledged for
allowing OREDA phase data to be used in preparation of
the PDS data. PDS is considered realistic as it accounts for all
major factors affecting reliability during system operation,
such as:
4 OTC 15358
Common cause failures
Automatic self-tests
Test-independents failures
Complete systems including redundancies
All failure categories/causes.

Results and discussion

Relief system
In general, the whole process is equipped with three-layered
safety systems against emergency. The first layer is SCADA
(Supervisory Control and Data Acquisition System) that
enables operators to examine the alarm signals. Alarm signals
are activated at two levels. At the lower level, operators decide
from low or high alarms assigned to temperature, liquid levels,
and pressure on whether the state is urgent. At the upper level,
operators respond to low-low or high-high alarms and, if not
affordable, activate the automatic emergence system.
At the middle layer, operators conduct a series of
programmed tasks in response to fire and leakage detection or
SCADAs warning. Generally, it consists of the fire-fighting
system and ESD system. The programmed tasks are to
function to the cause-and-effect chart. In case of fire, the heat
ingress causes the contained liquid to boil off and the pressure
to rise. Since the ESD system is devised to trigger the
blowdown system, the overpressure is possible only when the
ESD system or the blowdown system fail.
The final layer is the PSV venting system. This relief
system has been designed in accordance with API RP 520 and
API RP 521. The top priority laid on safety in designing
offshore facilities like FPSO units indicates that the operation
of the PSV system means the worst case. In other words, the
failure of the former two layers should lead to the activation of
the final layer, the PSV system. Malfunction of the PSV
system would result in extensive fire and consequent
explosions, implying all personnels escape and abandonment
of the facilities.
Depending on the downstream back pressure, PSVs are
classified into the spring-loaded and the pilot-operated type.
The former is inexpensive and affected by the back pressure.
The latter is the first choice in usual practice of FPSO units
since it admits the back pressure up to half of the upstream
design pressure. If a PSV is oversized, it is subject to
chattering or repeated rapid opening and closing in a short
period, which may lead to its mechanical failure. Chattering is
also probable when the actual back pressure is much higher
than the design value. Dynamic simulation enables engineers
to quantitatively figure out the actual PSV venting rates and
back pressure effects.
Relief characteristics were realized by dynamic simulation.
Figures 1 and 2 depict the venting flow rates and pressure
profile in case of LP Compressor discharge blockage. API
standard indicates a T-type PSV of 19,720 mm
2
should be
chosen for the peak venting rate of 160 MMscfd. The PSV
chosen to API standard experiences chattering because it is so
large that the instant changes in venting rate lead to abrupt
fluctuations in the upstream pressure and consequently the
valves repeated closing and opening.
However, dynamic simulation suggests that the venting
rate is 82.5 MMscfd, and a Q type of 7,129 mm
2
can prevent
the valve chattering with a less relief load. The valve size
revealed through the dynamic simulation corresponds to the
maximum flow rate 100 MMscfd, indicating the API-based
PSV is oversized.
The venting flow rate and pressure profile in case of IP
compressor discharge blockage are shown in Figures 3 and 4.
The venting rate to API standard is 113 MMscfd, and the
corresponding orifice size is a P-type 4,648mm
2
. The
equipment design pressure is 54 barg. Analogous to the former
case, dynamic simulation suggests that the maximum venting
rate should be 76.5 MMscfd, and the orifice be a L-type. The
maximum venting rate is decreased by 50% considering the
peak venting rate in Figure 3 is 160 MMscfd, and a L-Type
PSV allows 80 MMscfd.


Figure 1 Relief rate of LP Compressor for discharge blocked


Figure 2 Pressure of LP Compressor for discharge blocked

OTC 15358 5

Figure 3 Relief rate of IP Compressor for discharge blocked


Figure 4 Pressure of IP Compressor for discharge blocked

Blowdown system
Figures 5 and 6 compare the controlled blowdown with the
normal method for IP Scrubber and LP Scrubber. They show
the history of the venting rate by the controlled blowdown and
the pressure of the section blocked by ESDVs. For the
flowrate adjusted to 1.1 MMscfd, the pressure profile looks
similar. The controlled blowdown gives a less decrease in the
pressure than the normal one.


Figure 5 Blowdown rate of LP and IP Compression section

Figure 6 Pressure of LP and IP Compression section

As shown in Figures 7 and 8, the peak flow rate from
Glycol K.O. drum is 7.2 MMscfd by the normal blowdown
and 4 MMscfd by the controlled case, a 56% of the former.

Figure 7 Blowdown rate of Glycol KO drum section

6 OTC 15358
Figure 8 Pressure of Glycol KO drum section


Risk assessment
Blowdown systems should satisfy SIL 2 as shown in Table 2.
The normal blowdown systems are carried out by final
blowdown valves after ESD systems and solenoid valves
while the controlled blowdown system is terminated at control
valves after pressure sensors and PLCs. Usually, ESDs and
PLCs employ 1oo2 voting logic for better safety. Table 3 lists
the PFD of each component.
The maintenance period was assumed 6 months. Figure 9
presents the SIL analysis results of the blowdown systems.
Both satisfy SIL 2. The PFD of control valves influences the
SIL results, and in some cases, the controlled blowdown gives
better SIL than the normal one.


Table 3 PFD of each component
Component Voting
F, E-6
hr
F,
1/year
TIF CSU1 PFD
ESD 1oo2 1.6 1.4E-2 5E-4 3.5E-4 8.5E-4
SOV 1oo1 1.4 1.2E-2 - 3.0E-3 3.0E-3
BDV 1oo1 1.3 1.1E-2 1E-5 2.8E-3 2.8E-3
PT 1oo1 0.6 5.3E-3 5E-4 1.3E-3 1.8E-3
PLC 1oo2 1.6 1.4E-2 5E-4 3.5E-4 8.5E-4
CV(l) 1oo1 2.8 2.5E-2 1E-5 6.3E-3 6.3E-3
CV(s) 1oo1 0.8 7.0E-3 1E-5 1.8E-3 1.8E-3

10
-3
to < 10
-2
2
10
-2
to < 10
-1
1
10
-4
to < 10
-3
3
10
-5
to < 10
-4
4
PFD, 1/year SIL
10
-3
to < 10
-2
2
10
-2
to < 10
-1
1
10
-4
to < 10
-3
3
10
-5
to < 10
-4
4
PFD, 1/year SIL
ESD
8.5E-4
SOV
3.0E-3
BDV
2.8E-3
Normal Blowdown Normal Blowdown
PFD : 6.6E PFD : 6.6E- -3 3
ESD
8.5E-4
SOV
3.0E-3
BDV
2.8E-3
Normal Blowdown Normal Blowdown
PFD : 6.6E PFD : 6.6E- -3 3 PFD : 6.6E PFD : 6.6E- -3 3
ESD
8.5E-4
PT
7.2E-4
PLC
8.5E-4
CV(s)
6.3E-3
ESD
8.5E-4
PLC
8.5E-4
Controlled Blowdown Controlled Blowdown
PT
7.2E-4
CV(l)
1.8E-3
PFD : 8.7E PFD : 8.7E- -3 3
PFD : 4.2E PFD : 4.2E- -3 3
ESD
8.5E-4
PT
7.2E-4
PLC
8.5E-4
CV(s)
6.3E-3
ESD
8.5E-4
PLC
8.5E-4
Controlled Blowdown Controlled Blowdown
PT
7.2E-4
CV(l)
1.8E-3
PFD : 8.7E PFD : 8.7E- -3 3 PFD : 8.7E PFD : 8.7E- -3 3
PFD : 4.2E PFD : 4.2E- -3 3 PFD : 4.2E PFD : 4.2E- -3 3

Figure 9 Analysis of SIL level for blowdown system

Conclusion
Dynamic simulation of start-up and emergency operation
improved the operability of the whole process. The revealed
transient behavior demonstrated that PSVs sized to API
standard led to chattering because the standard gives excessive
size. Choice of properly sized PSVs eliminated the chattering
with a decrease in relief loads by 40%. The blowdown valves
and PSVs are likely to be oversized if the API RP 521 is
observed. The dynamic simulation gave precise estimates,
consequently decreased the flare loads, and better safety.
The controlled blowdown system mitigated the flare load
to about 60% of the conventional blowdown system. Its safety
was more reliable than that of the conventional, satisfying SIL
2 of IEC 61508.

References
1. Guide for Pressure-Relieving and Depressuring System, API
Recommended Practice 521, 4
th
Edition, American Petroleum
Institute, 1997
2. Paruit, B., Kimmel, W., Control Blowdown to the flare, Hydro
carbon Processing, October, 1979
3. Offshore Reliability Data, 3rd Edition, SINTEF Industrial
Management, 1997
4. Reliability Data for Control and Safety Systems, SINTEF
Industrial Management, 1998
5. Functional Safety of Electrical/Electronic/Programmable
Electronic Safety Related Systems, IEC 61508, International
Electrotechnical Commission, 1998
6. Functional Safety: Safety Instrumented Systems for the Process
Industry Sector, IEC 61511, International Electrotechnical
Commission, 1998