A shutdown valve (SDV) may also be referred to as an emergency shutdown valve (ESV, ESD, or ESDV) or a safety shutoff valve. It is not a simple isolation valve, but is operated by an actuator – usually pneumatic or hydraulic, but now often electro-hydraulic or electric – to stop the flow of a fluid immediately a dangerous event occurs.
Conversely, a blowdown valve (BDV) may open in an emergency situation, to depressurise a pipeline by directing fluid to a flare or vent, or divert it to an alternative line or storage vessel.
The SDV or BDV is typically a component of a safety instrumented system (SIS) that is designed to protect people, equipment and the environment from harm, as part of a functional safety setup (see also www.is.gd/miyeso). This SIS should be independent from the plant’s process control system or distributed control system (DCS), as it has a fundamentally different purpose.
The SDV or BDV must be fail-safe – that is, it will operate in the appropriate way if any part of the control system (pressure sensors, level sensors, flame detectors etc) should fail. For example, most solenoid-operated SDVs have a spring that comes into play if the power cuts off, shutting or opening the valve as appropriate.
ESVs need to be designed in circuit such that their safety functions are paramount, but some precautions can be taken to ensure that accidental (or deliberate) operation does not damage the system. A sudden shutdown of flow may cause hydraulic shock (‘water hammer’), resulting in rupture or implosion of pipework and vessels. This can be mitigated with a surge tank, a hydraulic accumulator or some sort of pressure relief valve (PRV). Studies on oil pipelines have shown that ball valve ESVs provide a more gradual pressure rise than faster-acting check valves, at the cost of losing more fluid from a ruptured pipe.
ESVs are typically quarter-turn ball valves, but the choice of sealing and seating materials is critical: soft materials can be rapidly damaged if any solids are present in the system, so should be inspected at regular intervals. The same goes for butterfly valves, which can be had in metal-seated, graphite-sealed versions suitable for high temperatures.
Swinging gate valves are sometimes used as ESVs because they can provide very rapid shutoff. Specialist versions such as IMI’s EPS gate valve are said to offer features such as a low centre of gravity, minimising forces in the surrounding pipework when the system is subject to motion or vibration.
SPECIFICATION VITAL
Where valves do not have built-in actuators, it is vital that external actuators are properly specified and sized. It is also preferable that limit stops are mounted externally, so that they can be periodically inspected; there have been cases of stops inside the valve being damaged by over-travel from the actuator, allowing the valve to over-rotate.
While pneumatic and hydraulic (or electro-hydraulic) actuation has typically been the norm, electric valve actuators offer straightforward control interfaces and potentially easier installation, and are even being used in ESD applications. They can also be installed in remote locations where solar power might be available, and some actuators are now equipped with self-contained power supplies (some using supercapacitors) to allow them to function for a limited time even when the power supply is lost.
Now batteries are becoming more common: Rotork, for instance, offers the IQT Shutdown Battery for its IQT3 range of explosion-proof electric valve actuators. This built-in lithium-ion battery can function as an uninterruptible power supply (UPS) to maintain control through brief power outages or solar power fluctuations, but more importantly it gives the actuator ’fail-to-position’ functionality. If the mains power or communication link is lost, the actuator can be configured to go to a specific ‘safe’ state: fail-closed, fail-open, stay put or go-to-a-percent-position. Rotork says that its system is ideal for applications that must be shut down in a phased or staged sequence, or where valves should fail to divert process fluid back to the storage tanks on loss of power.
Many of the components associated with SDVs are said to require little or no maintenance: for instance, Finnish manufacturer Neles, which makes devices for the petrochemical and process industries, says of its ValvGuard solenoids that “under normal service conditions there is no requirement for regular maintenance” but adds that “although these devices are designed to work under severe conditions, proper preventive maintenance can help to prevent unplanned downtime”, and recommends that a maintenance and inspection schedule be devised together with the firm’s own engineers.
INSPECTION SCHEDULE
The inspection and maintenance schedule, as well as the performance and reliability of shutdown valves themselves, would form part of the safety requirement specification required to comply with IEC 61508 – the generic standard for functional safety systems, modified to IEC 61511 for process industries.
Shutdown valves in service are generally tested in one of two ways: a proof test or a diagnostic test. The former is usually undertaken manually, simulating all possible failure modes and activating the valve through its full range of motion – which requires a genuine shutdown.
A diagnostic test, on the other hand, avoids a full shutdown of the installation but detects only some of the possible failure modes, or a fraction of a particular mode. The most common such test is a partial stroke test, which closes (or opens) the valve only to a certain level.
Diagnostic tests such as these can be automated to take place at intervals and, ideally, under a variety of operating conditions. This builds up a statistical picture of the performance of the safety system, which allows for predictive maintenance rather than the ‘fix on fail’ culture found by the HSE in a survey of pipeline ESVs (see also www.is.gd/edupax).
Many modern valves or actuators have such automated testing routines built in: for example, Neles’s ValvGuard VG9000 is described as an ‘intelligent safety solenoid’ with PST features, designed for emergency shutdown and venting valves. It “increases safety, and plant safety targets can be reached more economically than with other solutions,” according to Neles.
Whatever the type of test, the valve will have to perform to specific performance standards – for example, the time to close or the leakage rate once closed.
If inspecting valves in situ, it is vital to take precautions even if the overall system is inoperative: of course, power should be off, with extra caution where valves have independent power supplies or fail-safe mechanisms. “Ensure the risks associated with stored energy from equipment containing compressed springs are identified and control measures put in place,” as the HSE Gas & Pipelines team put it in a report on an ESV which failed open due to a corroded and broken return spring (pictured, far left; see www.is.gd/axibos).
Other hazards that can arise during inspection include residue remaining in the valve body, or gas or liquid remaining at high pressure in the system. Clearly, tamper-proofing is desirable in such safety-critical applications, as is the use of something like a Lock Out/Tag Out (LOTO) system to prevent operation of valves while they are in use.
When it comes to rectifying faults, many components are designed to be swapped out for new replacements rather than repaired in situ. The Neles ValvGuard solenoids incorporate a spool valve which is not designed for repair: “if maintenance operations are needed… it is advised to replace the whole spool valve assembly with a spare unit.”