Safety instrumented systems: Diversity in flow measurement

The designer should consider what problems should be avoided via diversity — use of a different approach or technology.

 

Real-world common-cause problems in safety instrumented systems (SIS) must be quantified by the user in each application. Such SIS problems are not quantified by the usual white paper analysis suppliers and third parties use to provide safety data for products. In a previous article (Safety instrumented systems: Applying measurement best practices, Control Engineering, Feb. 2017), the SIS designer was advised most safety risks for measurements are caused by “real-world common cause” problems.

Since such problems are “common cause” — impacting multiple devices — they cannot be addressed by applying redundancy. The article detailed the most common examples of real-world common cause problems for pressure, temperature, flow and level measurements, and provided recommended design practices to minimize impact on safety. Some examples included plugged sensing lines, cold capillaries, coated or breaking thermowells, even some sub-optimal installation and maintenance practices.

In a follow-up article (Using diagnostic functions to improve system safety, Control Engineering, May 2017), the designer was asked to consider if a problem can’t be eliminated with better design, can diagnostics detect the problem so it can be fixed before it affects safety or causes a shutdown? Diagnostics also were shown to simplify partial proof testing and/or extend the need for comprehensive proof testing.

In this article, the designer is asked to consider what problems should be avoided via diversity — use of a different approach or technology. Diversity does not have much application to pressure measurement, since there really is no different way to measure pressure. Similar comments apply to temperature. While various types of sensors exist, in practice all will be affected similarly by any real-world problem. The first article explained how radar level is usefully diverse from differential pressure-based level (dP), because it avoids vulnerability to the real-world common causes of plugged process connections and changing fluid densities. Another important and useful application of diversity is in flow measurement.

Common cause problems affecting flowmeters

Many problems can cause a flowmeter to fail or read incorrectly. Of particular importance in a safety application are the following questions:

• Can the problem cause the meter to read the wrong flowrate without any warning to the user? These are defined as covert failures (sometimes also called undetected). If the measurement is wrong in a direction that can impact safety, for example, if the flow wrongly reads high in a cooling loop, this is a “dangerous” failure, since it could lead to process overheating. Note that if the flow wrongly reads too low in a cooling loop, that would be a “safe” failure since it would not risk a dangerous condition, though of course it might result in an unnecessary (spurious) shutdown. Dangerous, covert failures affect safety; safe and overt failures affect availability.
• Can the problem affect a second (or even third) meter in the same way? So, redundancy does not help; these are defined as common cause.

A common approach to measuring flow is the differential pressure (dP) flowmeter. This uses a restriction in the line — orifice plate, averaging pitot tube (Annubar), etc. — to create a pressure drop, which is measured by the dP transmitter. Flow is inferred from this dP using the Bernoulli Principle. The dP flowmeter is often used due to its versatility and familiarity. When correctly selected, installed and maintained, can provide high repeatability and reasonable permanent pressure loss. Unfortunately, it can suffer from serious safety problems in certain applications:

• Variation in fluid properties such as composition or density affects repeatability (although the user can attempt to compensate).
• Dirty fluids or cold ambient can slow or plug the sensing lines.
• Entrained pockets of gas or liquid (depending on what phase is being measured) can bias the measurement or can collect in the sensing lines and slow response time.
• Dirty fluids can block, coat or erode the primary element (orifice plate or other), causing bias.
• Multiple threaded connections increase potential for fugitive emissions and leaks, especially at the manifold in a cold environment if the user has selected ANSI rather than ISO manifolds.
• Risk of error if multiple parts are specified then assembled onsite (unless the user specifies an integrated meter, preassembled and pressure-tested by the supplier), leading to mismeasurement or potential leaks (see Figure 1).
• Proof testing: Most users check only that the dP transmitter has not drifted and the sensing lines are not plugged. The primary element itself is rarely checked, not because it does not fail, but rather because it is often not accessible for checking.

Other technologies are used less frequently, but also suffer from problems in safety applications:

• Debris, buildup, binding, wear or damage to any component inside a turbine meter can cause high or low reading. The user may have no indication this is happening until the meter is proof tested using an external prover.
• If a magnetic flowmeter is being used in a cooling application, the user needs to verify there is no risk that nonconductive fluid (like deionized water) will find its way into the system. If it does, the flowmeter(s) could read low or noisy.
• Magnetic flowmeters can suffer problems with grounding, liners and electrodes, though modern devices can detect some of these problems using diagnostics and verification.
• Most flowmeters require straight pipe on both sides to ensure the flow is uniformly distributed in the pipe. Unfortunately, many meters are installed using simple, older guidelines like “10 up, 5 down.” Modern standards like ISO-5167 (Miller, R.W., “Flow Measurement Engineering Handbook,” McGraw-Hill, Toronto, 1996) can require 50 or more diameters of straight pipe to ensure accuracy, depending on the upstream disturbance.

If there is a risk that one of these problems can occur, the user must quantify that risk for safety analysis. Then, he or she must perform a periodic proof test to detect the problem. The required frequency of the proof testing depends on the user’s estimate of how quickly the problem can arise in the specific application. Quantifying the likelihood of a problem and how quickly it can develop is challenging during a project’s design phase. The user needs to rely on experience — backed up by failure records obtained during operation of a similar process at another plant — to answer questions like:

• Of 100 impulse lines installed in a similar application, how many are likely to be plugged at any given time during plant operation?
• If maintenance has verified a line is not plugged today, how long before it is possible for that line to be plugged in future?

Instead of investing many hours attempting to quantify the likelihood and frequency of a possible common cause in each application, the user is advised to improve the design to eliminate the cause. Where the user is not able to use better design to eliminate a problem that might cause multiple meters to read the wrong flow, the user should consider a diverse technology. For flow safety applications, the most common are vortex and Coriolis.

Vortex flowmeter

The vortex flowmeter uses the von Kármán effect: When flow passes a bluff body, a repeating pattern of swirling vortices is generated. The frequency of vortex formation varies linearly with flowrate, which leads to one of the key benefits of the vortex flowmeter. A small degree of coating or plugging of the shedder bar of the sensor will weaken the signal, but not change the measured flow value. As the coating and plugging increases, the frequency signal will become progressively weaker, until the flow signal is altogether lost.

While this is a safe rather than dangerous failure — no flow rather than wrong flow — it still affects availability. For this reason, if a user is considering vortex instead of another technology because of resistance to coating and plugging with a dirty fluid, they should ensure the vortex flowmeter under consideration is itself resistant to coating and plugging. This can be achieved by selecting a meter with a non-wetted sensor and no internal ports or crevices that can become plugged over time. If the user is selecting vortex to reduce potential leak points, they should select a device that can be installed without wetted O-rings or gaskets.

In fluids with large or abrasive entrained particles, the user should consider a vortex meter with dual shedder bars (see Figure 2). In most applications, the first bar will be most exposed to any blockage or abrasion; the user can detect any calibration shift by monitoring differences between the signals measured at the first bar versus the second bar. Single or dual transmitters can be specified for each shedder bar, so in a single installation, the user can connect up to three independent transmitters to the SIS, with the 4th transmitter connected to the basic process control system.

One key challenge in many safety applications is understanding what happens to the measurement in low flow conditions, since that’s where many processes are dangerous, where the flame blows out in a combustion process or the compressor goes into surge. With a dP flowmeter, error becomes larger as flow decreases, but the meter can, in theory, provide an output to almost zero. While the vortex flowmeter maintains its accuracy as flow decreases, below a certain minimum Reynolds number, the vortex meter will not register any flow at all. Note the limitation is based on Reynolds number — not just flowrate — the distinction is important in hydrocarbon applications.

Since most hydrocarbons suffer from high viscosity when cold, at start up, the vortex flowmeter may not read any flow until the fluid has warmed. If the SIS interprets no flow as a fault condition, which is common, this may prevent start up. To avoid this, the user should ensure they apply process heating at start up or size the vortex flowmeter to allow for these low flow, high viscosity start up conditions. One solution might be the reducer vortex, which contains a smaller meter body inside the flanges and lay length of a larger meter (see Figure 3).

The high reliability vortex flowmeter is inherently resistant to dirty fluids and is easy to install correctly. Diagnostics are also available to ensure safe installation and operation and simplify ongoing proof testing. For example, maintenance can verify sensor strength and simulate a frequency input directly from the transmitter.

Neither of these proof tests require either process shutdown or external equipment. In fluids that can contain debris large enough to block the shedder bar, the user can specify an upstream port that allows a camera to be inserted for periodic visual inspection. While camera inspection is done offline, it’s much easier than disassembling, inspecting, then reinstalling the meter. The supplier would factory calibrate the meter with inspection port installed to ensure no impact on accuracy.

Coriolis flowmeter

A single Coriolis flowmeter measures mass flow, density and temperature directly, and from these can calculate volumetric flow. It can provide high accuracy over a wide range of flows and is mostly unaffected by changing fluid characteristics such as density, viscosity or composition. The Coriolis flowmeter does not require straight pipe on either side, which can simplify installation and avoid errors related to insufficient straight pipe. It also can allow the user to locate the entire meter in a location accessible for testing or inspection (note the reason many orifice plates are located in an inaccessible location in the pipe rack is because that’s where the user can find the needed straight pipe). Like the vortex flowmeter, the Coriolis meter is easy to correctly specify and install.

While Coriolis flowmeters tend to be reliable, the user should be aware of the risk of two-phase flow: gas entrained in a liquid flow, or liquid entrained in a gas flow. This is often observed with higher viscosity fluids or in batching applications, and causes the average volumetric flowrate to increase, even when the actual amount of fluid — the mass — has not changed. This can cause significant errors in most volumetric flowmeters, though modern vortex flowmeters can detect a phase change and alert the user. A Coriolis meter, which directly measures mass, should be minimally affected, especially modern smart meters with digital signal processing.

However, just like in a centrifuge, whose spinning separates heavy from light components, as the Coriolis tube vibrates faster, the (light) gas and (heavy) liquid can separate and move at different speeds in the tube, causing significant errors — 10 times when compared to a Coriolis meter’s (usual) extremely high precision. For this reason, in applications where two-phase flow is a possibility, the user should specify a Coriolis meter that uses a low drive coil frequency (Patten, T., “Handling Entrained Gas”, Flow Control, September 2010) and has two-phase detection capabilities (see Figure 4).

Devices designed for SIS incorporate special diagnostics that detect internal electronic failures (Brown, S., Menezes, M., “SIS: Focus on Measurement Diagnostics”, Chemical Engineering, August 2013). These diagnostics are often not configurable by or accessible to the user, but when they detect an internal, dangerous failure, they automatically force the device to a safe state. This provides higher safety, allowing the device to be validated or certified by third-party safety laboratories to specific safety integrity levels (SIL).

On-demand diagnostics also are available in modern Coriolis meters that allow the user to improve the coverage available from an in-situ proof test (Coleman, A., Mathiason, E., Wyatt, T., “Ensuring safety compliance with optimized proof testing”, Flow Control, May 2017), from the 50% typical in older devices to more than 90% (see Figure 5). This allows the user to extend the intervals between comprehensive proof tests. Since the comprehensive proof test requires the meter to be removed from service and connected to an external flow prover or sent to a calibration lab, its timing can ideally be extended to at least the plant shutdown schedule.

If the user has identified or observed any covert or dangerous common cause failure modes in their application, they must quantify likelihood for their safety analysis, and how quickly the problem can develop to determine proof test interval. Neither is practical when designing a new process, so unless the problem can be eliminated with better design, the user is often better served selecting a diverse technology that does not suffer from the failure mode at all. For flow applications, two technologies that should be considered are vortex and Coriolis.

Mark Menezes, PEng, manages the Emerson Automation Solutions measurement business in Canada, including pressure, temperature, level, flow, and corrosion. He has 31 years of experience in process automation; 24 of them with Emerson. He has a degree in chemical engineering from the University of Toronto and an MBA from York-Schulich. Edited by Jack Smith, content manager, CFE Media, Control Engineering, [email protected].

MORE ANSWERS

Keywords: safety instrumented systems; flow measurement

CONSIDER THIS

Are there covert, dangerous common cause failure modes in your applications?