18.4 Field Instrumentation, Control Valves, Alarms, and Safety Instrumented Systems
Key Takeaways
- Liquid control valve capacity uses \(Q = C_v \sqrt{\Delta P / SG}\) with \(Q\) in gpm and \(\Delta P\) in psi, so \(C_v\) is numerically the gpm of \(60^\circ\text{F}\) water the fully open valve passes at \(1\text{ psi}\) drop.
- An **equal-percentage** valve follows \(f = R^{x-1}\) with rangeability \(R \approx 50\); at 50% travel it passes only \(50^{-0.5} = 14\%\) of maximum \(C_v\), and its inherent curve compensates for line loss to give a roughly **linear installed characteristic**.
- **Valve authority** is the fraction of total system pressure drop taken by the fully open valve at design flow; below about **0.25** the installed characteristic distorts badly and the valve does nearly all its work in the first few percent of travel.
- ISA-18.2 alarm performance targets an average of about **one alarm per operator per 10 minutes** (two is manageable, more indicates overload), and counts any 10-minute interval containing **more than ten alarms** as an alarm flood.
- A safety instrumented function's **risk reduction factor** is \(RRF = 1/PFD_{avg}\): SIL 1 spans \(RRF\) 10 to 100, SIL 2 spans 100 to 1,000, and SIL 3 spans 1,000 to 10,000; for a simple 1oo1 loop, \(PFD_{avg} \approx \lambda_{DU} \cdot TI / 2\).
18.4 Field Instrumentation, Control Valves, Alarms, and Safety Instrumented Systems
The NCEES specification lists Instrumentation and process control (e.g., sensors, controller actions, control valve sizing, alarms, safety instrumented systems) under Plant Design. Sections 18.1 and 18.2 covered the dynamics and the tuning. This section covers the physical layer — what measures, what moves, what alarms, and what trips.
1. Measurement Elements
| Variable | Common element | Key characteristic |
|---|---|---|
| Temperature | Thermocouple (Type K, J, T, E) | Wide range, self-powered, (\pm 1-2^\circ\text{C}); needs cold-junction compensation |
| Temperature | RTD (Pt100, (\alpha = 0.00385)) | More accurate and stable, (\pm 0.1^\circ\text{C}); narrower range, needs excitation |
| Pressure | Strain-gauge / capacitance transmitter | Specify gauge vs absolute explicitly |
| Flow | Orifice + DP transmitter | (Q \propto \sqrt{\Delta P}); rangeability only about 3:1 |
| Flow | Coriolis | Direct mass flow, high accuracy, no density correction |
| Flow | Magnetic | Conductive liquids only; no pressure drop |
| Level | DP transmitter | Infers level from hydrostatic head; density-dependent |
| Level | Guided-wave radar | Density-independent; preferred for varying-density service |
Two recurring exam traps:
The square-root trap. An orifice meter's differential pressure varies with the square of flow. A DP transmitter calibrated (0-100\text{ inH}_2\text{O}) reading (25\text{ inH}_2\text{O}) is not at 25% of flow — it is at (\sqrt{0.25} = 50%). This also explains the poor rangeability: at 10% of flow, DP is only 1% of span, which is inside the transmitter's own error band.
The DP-level trap. A DP level transmitter measures (\rho g h), not (h). If the transmitter is calibrated for a liquid of (SG = 0.90) and the tank is filled with (SG = 0.75) product, the indicated level reads low by the ratio (0.75/0.90 = 0.833) — a tank that is genuinely 90% full indicates 75%, and the high-level alarm never actuates.
2. Control Valve Sizing
Liquid sizing. In USCS units:
with (Q) in gpm and (\Delta P) in psi. (C_v) is thus the gpm of (60^\circ\text{F}) water a fully open valve passes at (1\text{ psi}) drop.
Example. (200\text{ gpm}) of water ((SG = 1.0)) across (25\text{ psi}): (C_v = 200/\sqrt{25} = 40). A valve is then selected with a rated (C_v) comfortably above 40 — typically sized so design flow falls between 20% and 80% of travel, leaving margin to open up for future capacity and enough closure to control at turndown.
Flashing and cavitation. Pressure falls to a minimum at the vena contracta inside the valve, then partially recovers.
- If (P_{vc} < P_v) (vapor pressure) but the outlet recovers above (P_v): bubbles form and violently collapse — cavitation, which erodes trim and generates severe noise.
- If the outlet pressure stays below (P_v): the fluid remains two-phase — flashing, which erodes the downstream body and pipe rather than the trim.
Cavitation is fixed with anti-cavitation trim or by staging the pressure letdown; flashing cannot be designed out at the valve and must be handled with hardened, expanded-outlet bodies.
Inherent characteristic. The flow-versus-travel relation at constant (\Delta P):
| Characteristic | Relation | Use |
|---|---|---|
| Quick-opening | Most capacity in the first 25% of travel | On/off, relief bypass |
| Linear | (f = x) | Level control; systems where valve (\Delta P) is nearly constant |
| Equal percentage | (f = R^{,x-1}), (R \approx 50) | The workhorse: flow and pressure loops where line loss is significant |
At 50% travel an equal-percentage valve with (R = 50) passes (f = 50^{-0.5} = 0.141), only 14% of maximum (C_v). That apparently perverse curve exists for a reason: as the valve opens, flow rises, line losses rise as the square of flow, and the pressure available to the valve collapses. The equal-percentage inherent curve bends the opposite way by exactly enough that the installed characteristic comes out approximately linear.
Valve authority. Define
Design practice puts (N) between about (0.25) and (0.50). An oversized valve with (N = 0.05) is a switch, not a controller: essentially all of its capacity is reached in the first few percent of travel, the loop gain becomes enormous near the seat, and the valve hunts.
Fail-safe action. Specify what the valve does on loss of instrument air or signal:
- Air-to-open / fail-closed (FC): fuel gas to a furnace, reactant feed, any stream whose continued flow is the hazard.
- Air-to-close / fail-open (FO): cooling water to an exothermic reactor, quench, any stream whose loss is the hazard.
This is a process-safety decision made from the hazard analysis, never a purchasing default.
3. Alarm Management
An alarm is not an indication. Under ANSI/ISA-18.2, an alarm must be actionable, have a defined operator response, and have consequences if unaddressed. Anything failing those tests is a nuisance and should be demoted to an indication during rationalization.
Performance targets:
| Metric | Target |
|---|---|
| Average alarm rate per operator | (\approx 1) per 10 minutes; 2 per 10 minutes is manageable |
| Alarm flood | Any 10-minute interval with more than 10 alarms |
| Priority distribution | Roughly 80% low / 15% medium / 5% high |
The failure mode is systemic: a plant that alarms on everything trains operators to acknowledge reflexively, and the one alarm that mattered is lost inside a flood. Standing alarms, chattering alarms, and stale alarms are the usual contributors and are addressed with deadband, on-delay filtering, and state-based alarm suppression during startup and shutdown.
4. Safety Instrumented Systems
A safety instrumented system (SIS) is an independent protection layer built from sensor, logic solver, and final element that takes the process to a safe state on demand. It is governed by IEC 61511 / ANSI-ISA 84.00.01.
Independence is the defining requirement. The SIS must be separate from the basic process control system (BPCS). If the same transmitter that controls level also trips the pump, its failure defeats both layers simultaneously and you have one protection layer, not two, no matter what the drawings claim.
SIL and risk reduction. The risk reduction factor is the reciprocal of the average probability of failure on demand:
| SIL | (PFD_{avg}) | (RRF) |
|---|---|---|
| 1 | (10^{-2}) to (10^{-1}) | 10 to 100 |
| 2 | (10^{-3}) to (10^{-2}) | 100 to 1,000 |
| 3 | (10^{-4}) to (10^{-3}) | 1,000 to 10,000 |
| 4 | (10^{-5}) to (10^{-4}) | 10,000 to 100,000 |
SIL 4 is effectively never specified in the process industries; a requirement that lands there is a signal to redesign the process rather than to buy more instruments.
Proof testing. For a simple single-channel (1oo1) function dominated by dangerous undetected failures:
where (\lambda_{DU}) is the dangerous undetected failure rate and (TI) the proof test interval. The relation is linear in (TI): halving the proof test interval halves (PFD_{avg}) and doubles the risk reduction factor. This is why a missed proof test is not a paperwork problem — it directly degrades the SIL the design claimed.
Example. (\lambda_{DU} = 0.010\text{ yr}^{-1}) with annual proof testing gives (PFD_{avg} = (0.010)(1)/2 = 0.0050), so (RRF = 200) — SIL 2. Moving to a 6-month interval gives (PFD_{avg} = 0.0025) and (RRF = 400), still SIL 2 but with meaningful margin against the SIL 2 floor of 100.
A control valve must pass 450 gpm of a hydrocarbon with specific gravity 0.72 at a pressure drop of 18 psi across the fully open valve. What C_v is required, and what is the valve authority if the total system pressure drop at design flow is 60 psi?
An equal-percentage control valve with rangeability R = 50 is installed on a flow loop. What fraction of its maximum C_v does it pass at 50% travel, and why is this characteristic preferred when line losses are significant?
A layer of protection analysis concludes that a safety instrumented function must provide a risk reduction factor of at least 500. A proposed 1oo1 design uses a final element with a dangerous undetected failure rate of 0.020 per year. What SIL is required, and what proof test interval does the proposed design need?