Originally published on GMI blog by GM International | September 10, 2020       An ESD (Emergency Shut Down System) is an emergency control system used to manage the start and stop sequences of a plant or machine.   In process plants, the function of emergency shutdown is to minimize the consequences of emergency situations, usually the leakage of hydrocarbons or the initiation of a fire in areas with hydrocarbons or the failure of power systems or essential components.   The purpose of the ESD is to protect people, facilities and to prevent  negative environmental impacts. The ESD is one of the main safety systems in plant engineering and complex industrial applications. An emergency stop system is also a method to block process operation, isolate incoming connections or current and quickly reduce the risk of an unexpected event. Emergency shutdown is a minimum requirement which must be implemented at all stages: design, production, testing and as a safety system requirement. The redundancy function is the most popular among ESDs. Usually, these systems are integrated in a closed loop and are connected to an independent shut-down system which can be redundant.   Typical actions implemented by ESDs are: stopping the flow of hydrocarbons, stopping the switch for rotating equipment, isolating hydrocarbon stocks, ignition sources, non-essential electrical equipment, activating fire protection systems, opening/closing blocking valves in safety position, blocking electric motors and package units, initiating depressurization and deactivation procedures of the plant, where available. Once the shutdown is started, all the final elements used to ensure safety must remain active (safe state). A manual action will be required to restore the shutdown state. The ESD shall be designed in order to minimize the risk of accidental shutdown. It is necessary to consider the use of a logic solver on the activating elements (e. g. Gas detectors, manual buttons, etc).   Logics and levels Generally, the ESD is based on PLC (Programmable Logic Controller) certified for safety applications, DCS (Distributed Control System) or BMS (Burner Management System) to work in case of malfunction or error, guaranteeing the safety of the plant. The ESDC is a system independent from the control units dedicated to the operational sequences of the plant. The shutdown may involve the entire plant if required or a part of it if the unit involved in the hazardous event can be brought to safety, while still maintaining the rest of the plant in operation.   The complete or partial shutdown of the plant can begin either by automatic sequences, by exceeding certain operating conditions, or by manual activation using the controls positioned in the field or in the control room, as necessary. The starting sequence begins after the ESD reset. After a shutdown, the ESD levels must be reset individually and manually by the operator of the console. For field equipment, unless otherwise specified, shut down valves (SDV) are manually reset locally, while to start the equipment or process areas, some inputs to the ESD system must be blocked because, sensor signals may be in an abnormal state prior to start-up and cause a shutdown.  Such inhibitors are known as "start-up inhibitors". Each inhibition function is automatically reset by the sensor signal returning to normal state or after a predetermined delay time.   Typically, the ESD works in fail-safe mode, that is in a deactivated state of any digital sensor (input) or actuator (output). Therefore, the detection of failures of critical components of the system and field inputs/outputs must lead the plant to a safe condition. I n general, an ESD is designed as a hierarchical structure with several levels of protection, in increasing order of emergency.  For example:   ESD 0 – Abandonment of plant or platform ESD 1 – Emergency shutdown and depressurization of the entire plant ESD 2 – Emergency stop for a process unit within the plant ESD 3 – Complete shutdown of the process ESD 4 – Process stop for a single process unit within the plant ... View more

Originally published on GMI blog by GM International | September 3, 2020       The BLEVE phenomenon (Boiling Liquid Expanding Vapor Explosion) occurs when a tank containing a fluid collapses as a result of overheating.   Many Italians will remember in August 2018 one of the most catastrophic explosions in Italy, in Borgo Panigale, close to Bologna. A tanker loaded with LPG struck a truck full of solvents in polyethylene containers: dozens of cars involved, a dead man, a hundred wounded, a collapsed bridge. After a few minutes, the steel of the tank began to fall apart, the pressure of the gas rose and the tank became a bomb: a first explosion, a series of bursts, then the final one with the fire that obscured the sky. It was a BLEVE, a phenomenon identified by J. B. Smith, W. S. Marsh and W. L. Walls in 1957. Other researchers have proposed alternative definitions. AIChE (American Institute of Chemical Engineers) has defined it as a sudden loss of containment of a pressurized liquefied gas, which is, at the time of failure, above its boiling point at atmospheric pressure, resulting in rapid vapor expansion and fluid flash.   In any case, in a BLEVE the vapor content leak very rapidly and instantaneously carried the underlying liquid to ambient pressure; the liquid is not in balance and overheats before evaporating instantly, the evaporation is so strong (usually indicated by the acronym RPT, Rapid Phase Transition) that the vapor formed can’t vent through the slot and pressurize again the tank causing the explosion.   Causes and analysis of the phenomenon A BLEVE requires the occurrence of three actors: 1) a liquid above its boiling point at atmospheric pressure; 2) the containment that allows the pressure of the liquid to be high enough to prevent it from boiling; 3) a sudden loss of containment which determines a rapid drop in pressure on the liquid.   This type of explosion can be extremely dangerous due to the shock wave and the projection of the fragments. In addition, the vapor cloud generated by the explosion can act as trigger for other flammable substances. The BLEVE does not necessarily involve flammable substances. Sometimes other substances are concerned, like water, nitrogen or liquid gel and other refrigerating or cryogenic liquids.   But in the case of flammable substances the physical explosion can be followed by fire or explosion (the Flammable Liquid BLEVE usually forms a fireball). It is also known as the “Boil-Over”, which occurs when water is poured into tanks containing heavy oils or bituminous oils at the temperature greater than the temperature necessary to have explosions. Similar conditions may happen when boiling liquids are placed on the bottom of tanks containing heavy liquids at high temperatures and, if after release, the vapor cloud is triggered, an extreme explosion (provoked by the fuel/combustor ratio) called VCE (Vapor Cloud Explosion) or a violent ignition (flash fire) may happen, not counting the risks of environmental contamination if the involved gases are toxic.   Examples of BLEVE can happen after the abrupt breaking of containers containing LPG, methane, ethylene, propane, ammonia, chlorine, sulphur dioxide, oxygen and liquefied nitrogen under pressure, or liquefied and maintained at low atmospheric pressure at low temperature.     Prevention Today, containers and tanks are equipped with ventilation valves to allow the evacuation of the gas thus avoiding explosions. However, there is still a remote risk that the valve will not be able to release enough vapor. Because of that, in line with the safety policies in the process industry expressed by the European Federation of Chemical Engineering (EFCE), it is important to implement strategies to “prevent losses” of product or energy. Different studies and simulations have been made using Finite Element Models (FEM) to reduce the risk in road and rail transport of LPG adopting passive protection against the effects of fires. Tanks without passive protection can break in few minutes, while breakage conditions, during long simulation periods, are never reached adopting protected tanks with insulating coatings. ... View more

Originally published on GMI blog by GM International | August 27, 2020     Alarm systems are essential to manage modern industrial plants. Their operation is fundamental for the production, informing operators and supervisors on possible risks.   Alarm management is one of the hottest open discussions in plants automation and maintenance. This is given to some key factors such as risk reduction, people and environment safety, the  need  to improve alarm system s already  present in the plant.    In the past ,  it was quite uncommon that the operator had to manage more than one hundred alarms. Usually those alarms were configurable via hardware  as with light signals which were expensive and not adaptable.   With modern automation, alarm system functionalities are  achieved  through interfaces  that are  suitabl e , smaller  in  dimension, less  expensive  and  that make use of  standard and open software components.     Today,  the increased number of alarms and warnings, caused by the increased number of connectivity and  available  data, has a negative impact on  working  stress. For th is  reason, companies and associations have faced the problem focusing on analysis and optimization of alarm systems. The most interesting goals reached are the standards A IS /I SA  18.2  and  Eemua-191.   Th ese  standards define wh at  an alarm  is , emphasizing the response to malfunctions and feedback model.   Moreover, they  also develop the concept of “Alarm Management Lifecycle ”  that define s  the methodology to classify and realize alarm messages to analyze risks and principles to  be  adopt ed  in the engineering of control systems.     To  be  notice d  that  even international standards, ISA 18.2 and IEC 62682, for alarm system management in process industries ,  are aligned with Eemua-191.  Norms included in EN 50131 should   also  be  taken into consideration ,  since they  describe performances for Intrusion & Hold - Up  Alarm  Systems (I&HAS) indicating the  safety level of the  system and  of its  components.     The  9 steps of Alarm  Management   Alarm Management is necessary  in a production environment,  controlled by operators using a  system for  control ,  maintenance  and supervis ion ,  with  hundreds or thousands of single alarms. At the same  time,   it  is crucial to ensure that all the alarms  are  shown  to operators   in  a  suitable time. Alarms should also be  able to provide the operator with the necessary means for intervention basing on priority.  To guarantee production continuity, safety and quality 24/7,  that is able  to  react to  all the alarms, alerts and anomalies , an organization with a precise strategy must be in place. The following nine steps summarize it.      Step 1:  Guide Lines   It is important realize a document comprehensives of design phase which includes guidelines, defines standards of the plant and the  management  methodolog ies of the alarms based on best practice       Step 2: Comparative evaluation   It is important to analyze the alarm sy ste m in order to define  its  strengths and weaknesses, as well as  to  find a practic al  solution to improve performances     Step 3:  Documentation and alarm classification   A revision of documents  and of the entire  alarm  database  is useful to  guarantee  that each alarm conforms to the philosophy and principles of a good alarm management.     Step 4:  Alar m  system performance definition   The so called “Alarm System Performance” should be defined with easily  accessible  metrics, through spreadsheets or structured data bases. Examples of such metrics a re the “number of alarms per operator”, alarm frequency, how many  hours the alarms were triggered more than a certain amount of times.     Step 5: Control system design   It is important to design control systems that are capable of configuring several alarms without losing  performances and flexibility , as much as to have the possibility of adding and configuring alarms easily and rapidly.     Step 6: KPI   The alarm system should operate in accordance with KPIs and concepts of ergonomics  and Human Factors Engineering. Software tools wi th specific characteristics and functions  are needed  to ensure that  performances  of the entire system are in accordance with the desired final results.     Step 7: Safety design   When possible, the alarm system must be designed in accordance with IEC 61508 and the required availability specifica tions. The alarm system should be independent from the control system and from other  secondary  alarm systems.     Step 8 :  Defining priorities   Priorities need to be assigned in order to  guarantee  that the most critical alarms receive the needed attention by the operator, as soon as possible. Alarms must be presented to the operator in a clear way, depending on their priori ty and  should be  distinguished  from  other alarms , remaining ON and visible as  long as the  alarm is active.     Step 9: Information for  operators   Alarm configuration must allow operators to take correct evaluations and to take action in a reasonable amount of time. Each alarm should provide the oper ator enough informatio n on alarm  conditions ,  areas involved , requested actions, priorities, when the alarm was triggered and its status.   ... View more

Originally published on GMI blog by GM International | July 30, 2020       Signal conditioners isolate, supply, amplify, normalize and convert various electric, mechanic, chemical signals in standard signals for data acquisition systems. Signal conditioning is an electronic technique aimed at solving problems that arise when interfacing sensors with control units. This is needed because sensor’s output signals do not all share the same electric nature (current, voltage, resistance, etc.), or typology (for example alternate, direct or pulsing current). Signal conditioners (converters) can be installed in electric panels, on sensors or actuators or controllers, integrated in A/D (Analogical/Digital) conversion boards and in multiplexing systems. Below we are going to review some conditioning techniques implemented in G.M. International Series   D1000   &   D5000. It should be highlighted that GMI conditioners, apart from their converting functions, are also capable of operating in hazardous areas, galvanically isolating the signal loops. Other output options are also available for communicating via Hart, Modbus, offering flexibility to fit all applications in the market.     Current, voltage and frequency converters Typically, in process and factory automation, input signal needs to be converted to a normalized signal (4-20 mA or 0-10 V for example)   on the output. Additionally, it is crucial to have the correct conditioner-equipment to isolate, amplify, linearize and convert any signal from low-level sensors in order to transmit without any voltage drop even for long distances. In factory automation, common ground connections should always be avoided since presence of multiple and different loads, all of them being connected to ground. Another problem may be caused by the noise present in almost all industries. Solutions to this and other normalization problems are provided by analogic, digital, serial, pulse and frequency converters-conditioners-repeaters.     Trip amplifiers Trip amplifiers are digital signal converters or analogic signal conditioners (current, voltage, temperature) based on independent amplifiers, where output signal can be direct or reverse. Alarms activate or deactivate a relay or transistor with the following functions: high-alarm, low-alarm or burnout. The activation or deactivation of any relay can be configurable within all the input signal range. Typically, such devices supply stabilized power to transducers with short-circuit protection and allow configuration of alarm set-points, delay and hysteresis.     Load cell and vibration transducers Measures based on strain gauge bridges, such as weight, vibration, torque and force are other very common conditioning techniques. Typically, the weight of the external measuring bridge is read by the signal conditioner and converted into a normalized analog signal. Bridge measure-converters process millivolt input signals. In applications such as industrial weighing, load cells under “measure bridge” produce a voltage signal which is amplified, isolated and converted in one linear voltage or continuous current output.     Temperature Converters Whenever a  resistance  measure depend s  on temperature,  a  current  of a few   milliAmps   is injected  from  a  source of constant current to  a  signal converter.   In order to take voltage drops into account ,  voltage drop on the return cable is measured and  its  value is multiplied by two.   If thermocouples are used instead, a  thermal-voltage  is present on the terminal blocks of the converte r, because of the difference between the cable’s and the conductive bar’s material . To compensate the consequential  alteration of the  measure, temperature is measured  close to the terminal blocks of the converter .  The si gnal converter  calculates the final measure, basing on the value at the terminal blocks.  This technique is known as  “Col Junction Compensation ” .       Signal Repeaters Inputs received by repeaters are typically transmitted with higher power so propagation can be guaranteed over long distances with low drop. Analog repeaters are used whenever current or voltage analog signals are transmitted. They are also used in junction lines which transmit multiple binary pulse signals through Frequency Division Multiplexing (FDM). Digital repeaters can amplify the signal as well as restoring and synchronizing pulses.     Smoke Detectors Smoke Detectors represent one of the most important conditioners for people and objects safety. To reduce spurious trips, their installation and use must be configured in conformity to environment conditions. It is possible to divide detectors basing on their functionality: variation of the electric field due to combustion; reduction of light intensity due to smoke; rise of temperature; smoke movements. Elements such as field display, interfaces, software compatibility; number of relays or transistor output, possibility to use sensor remotely, on-board-diagnostic and other advanced functions offer users other advantages and make a product more suitable than others.     G.M. International signal conditioners G.M. International offer a wide range of intrinsically safe signal isolators, SIL2 & SIL3 certified, with the   D1000   &   D5000   series: analogic isolators (D5014S,   D5212,   D5011,   D5020), frequency and digital isolators (D5030,   D5031,   D5032,   D5036,   D5037,   D5040,   D5048,   D5049,   D5090,   D5096), trip amplifier (D5254), signal repeaters (D1061), vibration and strain gauge converters (D5062,   D5263,   D5264), temperature converters (D1072,   D5072,   D5273,   D1073), smoke detectors (D1022,   D1080,   D1081,   D1180). ... View more

Originally published on GMI blog by GM International| June 26, 2019   In an industrial environment, security specialists need to shield communication networks from surges and transients using electrical insulation or voltage stabilization. Let's see which solution fits best different scenarios. The most widely applied differential digital transmission standards in this area are EIA/TIA-422 and EIA/TIA-485, i.e. RS-422 and RS-485. They offer advantages in terms of robustness, cost-effectiveness and resistance to external interference. However, there's a flip side: industrial environments are usually very complex, as they combine equipment that usually work for long periods, if not always, with outstanding performance, according to the type of production. In addition, data networks often cover long distances, further increasing potential risks. Accordingly, data-circuits may be damaged by malfunctions on the path: electrical noise, lightning strikes, overvoltages which can lead to transients passing through the serial communication system and the connected machinery as well. Again, the number of "nodes" within the network, with different ground potentials, could cause ground currents to flow along the path which offers the lowest resistance, i.e. grounding. However, the results are always the same: serious damages to equipment considered essential for the activity, meaning production shutdowns, delays, rising costs and in the most serious cases also risks for human life.   Most common issues The above mentioned potential risks can be roughly classified into two categories: very high voltages (several kV) with a very short lifespan (thousandth of a second), such as lightnings and sparks, electrostatic charges, switching of large inductive loads and so on; and then, less relevant voltages with a very long lifespan, usually generated by a short-circuit that occurs between the data network and the power supply cables. Interference that could affect the grid can also be divided into two categories: the common ones, measured with respect to the local ground of the circuit, and the differential ones, which can be measured on the basis of two lines, such as the one that carries data and high voltage supply.   How the voltage stabiliser and isolator work Let's see how the voltage stabilizer and the isolator work so as to identify the most suitable application settings. A voltage stabiliser is a device that limits the input voltage by blocking or shorting to ground the voltages exceeding a specific threshold, thus dissipating the surplus energy transmitted, for example, by a thunderbolt. The isolator, instead, is a device intended to isolate the voltage considered dangerous in a single area of the system, so that it does not temporarily or permanently damage the other parts. An isolator converts signals carrying data into light pulses or into an electric field then, once completed, the signals are turned back into data and overcome the obstacle. As a result, data lines and ground lines are separated, so no ground loop accidents can occur. In addition,  thanks to this segregation, the isolator keeps the data line free from interference caused by electric and magnetic fields.   Both technologies are suitable and useful for the industrial sector, although some aspects have to be considered when designing the plant. The voltage stabilizer, for example, may not be enough, and if wrongly chosen and installed, damages may even outweigh the benefits. The same applies to the insulator: very high transients could damage it making it useless. Having considered the pros and cons, it is often worthwhile to combine both solutions by choosing the appropriate location for each of the two devices according to the specific application. The voltage stabiliser, for example, is more effective when used as a primary power line protection, while an isolator effectively protects the signal. Matching the two of them, the best protection level is thus achieved. ... View more

Originally published on  GMI blog   by GM International | October 30, 2019                   The latest edition of the European Guide to application of the Machinery Directive introduced some significant new interpretations. Let’s look at the main ones. The aim of Machinery Safety is to ensure the safety of workers, process facilities and users coming into contact with various types of machinery, and to integrate safety in the design and construction phases, all the way through to correct installation and maintenance. Manufacturers and Employers have to ensure that any machinery on company premises complies with Article 70 of Italian Legislative Decree 81/08 (Consolidated Law on Safety) which applies to machines manufactured since 1996 with CE marking; to machines prior to 1996 which will have to be checked for minimum safety requirements, in accordance with Annex V; and to modified machinery which will require new certification. According to the   Machinery Directive 2006/42/EC   (which came into force throughout Europe on 29 December 2009 and is known as the New Machinery Directive) machinery is defined as “an assembly, fitted with or intended to be fitted with a drive system other than directly applied human or animal effort, consisting of linked parts or components, at least one of which moves, and which are joined together for a specific application”. The latest new legislation is edition 2.1 of the   European Guide   to the application of Directive 2006/42/EC, issued in late July 2017 and made public in early 2018. It contains some significant new interpretations. Here are the main ones: 1. Regulations on use of machinery.   When commissioning a machine, national regulations and directives established by various member states shall in no way undermine the provisions of the directive itself. 2. State of the art. It introduces the concept of "State of the art".   At the time of manufacture, the manufacturer is required to equip the machine with the best safety measures, taking into account the current state of the art in technology. 3. Intended use.   The importance of the intended use of a machine is underlined as being essential for the manufacturer as well as for the user and for non-professional personnel, in order to evaluate its safety. 4. Meaning of “equipment”.   A piece of machinery shall be regarded as a machine only as an assembly and with regard to the specific use for which it is intended. 5. Meaning of “partly-completed machine”.   A partly-completed machine is a piece of equipment that cannot perform its specific application independently and is therefore incorporated into an assembly to which the Directive can be applied. 6. Meaning of “assemblies of machinery”.   “Assemblies” means machines or partly-completed machines, assembled and   controlled so as to ensure complete operation of the assembly correlated with safety protections. 7. Change management.   When changes are brought in that introduce new risks, which render current safety measures insufficient, the manufacturer is required to affix new CE marking to it. Another interpretation is provided by the current digital revolution and by national plans based on Industry 4.0. On this basis, institutions and corporations are beginning to take into consideration whether or not to introduce a new European Directive on “intelligent machinery” which would regulate human-machine interaction and the growing importance of cybersecurity, artificial intelligence, IoT, Big Data and other digital technologies which are built into such machinery. Finally, it should be noted that depending on the sector of use, in accordance with the Machinery Directive, other safety standards, directives and approvals may be applied and which GM International includes in its products:   ATEX   and   IECx, EAC EX, Nepsi, TIIS for intrinsic safety, DNV and KR for marine applications, SIL and TÜV for functional safety, UL, FM, CSA for the North American market, as well as other international metrological certifications.   ... View more

Originally published on  GMI blog   by GM International | November 20, 2019       In the Oil & Gas sector, any shutdown of a process facility is a highly undesirable event. Below we set out some best practices and technologies to ensure that countermeasures are effective.   Attention to safety is a key factor in the Oil & Gas sector, where the nature of the processes and tasks involved requires extraordinary precautions to be taken. For sector stakeholders, it is crucial to maximize operational efficiency and safety while reducing risks, protecting the environment and corporate assets, and complying with regulations. Downtimes, breakdowns and shutdowns are one of the main sources of hazards and financial losses at process facilities. However, a few overall general strategies can help to avoid or minimize such events. Let's look at them together briefly. 1. Access to real-time data. Latest-generation IT and HMI/Scada platforms can handle real-time data even in web architectures, distributed via standard connectivity from any access point. This makes it possible to connect the various sections of a process facility or pipeline, transport system, measurement or accounting system, refinery or off-shore platform. 2. Remote control. Revamping, maintenance, process facility management and data collection operations mean optimizing processes via remote control and other monitoring tools, in a Web 4.0 system. The roots of such a vision are firmly entrenched in the promising IIoT (Industrial Internet of Things) technology market. 3. Edge Computing. Edge computing is a cloud-based IT service environment, managing information on the edge of the network, where the data are produced. This enables Edge technology to be used in distributed environments typical of the Oil & Gas sector, at installations and at the sources of data, thus reducing delays and transforming management models. 4. Control, safety and diagnostics systems. In order to maximize efficiency, reliability and safety, extraction systems, oil pipelines and gas process facilities in general are becoming increasingly integrated. This involves using connectivity and control systems in compliance with the strict regulations governing the sector and supported by powerful diagnostic and supervisory tools. 5. Updating or replacing obsolete systems. Failures and downtimes of obsolete systems affect order delivery times and lead to unbudgeted additional costs. It is therefore crucial to check the wear on electronic components in the system by defining availability/repairability/replacement for obsolete components, drawing up revamping plans and installing performance detection sensors. 6. Predictive maintenance. Oil & Gas work is generally carried out in critical environments using complex KPIs. Intelligent use of data and predictive maintenance employing mathematical models to identify faults in advance offers better overviews of the status of process equipment, reducing downtimes and unplanned interventions. 7. Inverters and speed variators. Obsolete, old or damaged electric motors can be highly inefficient, compromising the performance of the system, even leading to shutdowns. Installing inverters, speed variators and specific, high-efficiency soft starts help to improve motor performance and durability. 8. Safe design. Designing process facilities in compliance with the IEC 61511 standard is the correct approach to deal effectively with Oil & Gas-related safety and reliability issues. This makes it essential to draw up a comprehensive risk analysis policy that will include configuring, installing and commissioning of the SIS (Safety Instrumented System), allocating SIFs (Safety Instrumented Function) to protection levels and determining the corresponding SILs (Safety Integrity Levels). 9. Training. The drivers of transformation, even in the crude oil sector, can be found in the technological evolution and in the staff training required, involving sensors, remote control, software and condition monitoring. Training must also preserve and pass on best practices and guidelines arising from the experience handed down by users, builders, maintenance engineers and engineering companies. For example, in the functional safety area, GM International offers courses compliant with the FSE (Functional Safety Engineering) certification scheme adopted by TÜV Rheinland for safety instrumented systems (SIS) according to IEC 61508/61511 standards. 10. Security. The Oil & Gas sector is a particularly attractive target for cyber criminals. There are many different access points that could be used to attack critical infrastructures and many targets where tampering could lead to large-scale disasters. Oil & Gas companies have to carry out massive information gathering and security-by-design operations to prevent and minimize the impact of cyber attacks.   ... View more