Cryogenic ESD and Safety Systems

Safety in cryogenic transfer is never a single valve or a single push button. It is built from layers that back each other up. At a typical LNG loading or unloading point these layers are process control and alarms, an emergency shutdown (ESD) that stops the transfer in a controlled way, an emergency release arrangement that separates the connection safely when needed, gas and low-temperature detection, pressure protection against trapped liquid, and spill collection with structural protection. Which of these functions must reach which level of reliability is decided project by project through risk assessment.

The general logic of interlocks for pressurized liquefied gases at ambient temperature is covered on the LPG terminal ESD page. This page concentrates on the additional hazards that come from LNG's extremely low temperature and on how they shape the safety design.

What makes cryogenic transfer different

Depending on composition, LNG typically boils at about −162 °C at atmospheric pressure. That temperature brings four consequences that set its safety design apart from ambient-temperature fluids:

·         Cold spills and brittle fracture: Leaking LNG can expose carbon steel structures not selected for this temperature to brittle fracture, so the design considers where a spill will run and what surfaces it may reach.

·         Cold vapor that is initially heavier than air: LNG vapor at boiling temperature is denser than air and only becomes buoyant as it warms, which directly affects where detectors are placed.

·         A large expansion ratio: LNG occupies roughly one six-hundredth of the volume of the same gas, so liquid warming between two closed valves builds pressure quickly.

·         Rapid boiling on contact: LNG that touches a warmer surface, water or air starts boiling at the interface, which influences both vapor cloud formation and sudden pressure changes in the line.

Two-stage emergency shutdown logic

Published guidance for LNG transfer usually describes ESD in two stages. The first stage stops the transfer in a controlled manner in response to inputs such as an operator push button, high or low level, a tank pressure alarm or excessive movement: pumps trip and ESD valves close. The second stage triggers safe separation of the connection, meaning the emergency release coupling opens. Truck applications often use a simpler version of this structure, but every project should still answer the same question: which events call for a stop only, and which call for separation?

ESD valves and surge pressure

Closing a valve too quickly on a cryogenic line can bring the flowing liquid to an abrupt stop and generate a pressure surge. Closing it too slowly increases the quantity released during a leak. ESD valve closing time is therefore selected with line size, transfer rate and a surge assessment considered together, and pumps and any vapor return compressor are designed with that event in mind. Fail-safe action on loss of power, a body and sealing design suited to cryogenic temperature, and position feedback are further selection criteria to evaluate.

Breakaway and emergency release couplings

A breakaway coupling and an emergency release coupling (ERC) both limit spillage because each half contains a self-closing valve that seals when the connection separates under a set load or command. A breakaway coupling relies on studs that shear at a predetermined force and typically protects hose connections against a vehicle pulling away. An ERC separates through a mechanical, hydraulic or pneumatic collar mechanism in a more controlled way and is usually tied into the ESD system. The design should also provide relief so that liquid trapped in the hose or arm after separation cannot overpressurize it.

Gas and low-temperature detection

Because the vapor from a cryogenic leak can initially spread close to the ground, gas detector locations are chosen with cold vapor dispersion in mind, and a gas dispersion study helps support that choice. Temperature sensors in drip trays or spill channels can pick up a liquid leak before any gas detector does. Wiring detectors into the ESD system shortens the time between alarm and shutdown. In areas with a fire risk, flame detection is also considered as part of the safety architecture.

Trapped liquid and pressure protection

LNG left between two closed valves after an ESD vaporizes as it picks up ambient heat, and the pressure in that section can exceed its design value. Every section that can be blocked in therefore needs a thermal relief provision, and the relief destination, such as the vapor system or a safe discharge point, has to be defined in advance. Guidance also recommends arranging the ESD so that it does not trap liquid between closed valves, and providing a way to drain remaining liquid safely.

Where the SIL requirement comes from

The safety integrity level (SIL) of a safety function is derived from the hazard and risk assessment, not from an equipment list. The process-industry functional safety standard describes a lifecycle for specifying, designing, installing, operating and maintaining safety instrumented systems. In that approach the sensor, logic solver and final element are assessed together, and a certificate for one device does not by itself show that the whole function meets its requirement. Which functions become safety instrumented, and at what SIL, differs from project to project.

Safety functions and their design impact

How TLY Enerji fits in

TLY Enerji offers system design, product supply, engineering, installation, commissioning and maintenance for LNG truck loading and unloading facilities. On the safety layer, and depending on project scope, support can include selecting and supplying gas and flame detectors, valves and measuring instruments, configuring PLC-based control and interlock logic, and assisting with site testing and commissioning. Responsibility for risk assessment, SIL determination and verification should be defined separately in the project specification.

What to share for a safety design review

·         Transfer type: truck loading, unloading or both, and whether hoses or arms are used

·         Transfer rate, line sizes and every line section that can be blocked in

·         Existing or planned ESD architecture and the interface to the plant control system

·         Any hazard study or risk assessment results and the SIL targets they set

·         Spill collection arrangement, drip trays and surface materials

·         Hazardous area classification and a layout drawing for detector placement

·         Capacity and tie-in points of the vapor return and relief systems

Related pages

·         ESD and safety interlock systems for LPG terminals: Interlock logic for pressurized liquefied gases at ambient temperature.

·         LNG loading and unloading skids: How ESD valves are built into a pre-assembled cryogenic package.

·         LNG truck loading systems: Cool-down, vapor return and the loading sequence as a whole.

·         LNG vapor return systems: The system that relief and vapor handling tie into.

Frequently asked questions

How does an LNG ESD system differ from an LPG one?

The shutdown and interlock logic is similar; what differs is the nature of the hazards. With LNG, possible damage to structures from cold spills, vapor that is initially heavier than air, pressure from liquid warming between closed valves, and valves and couplings suited to cryogenic temperature all add design topics. Detector layout, thermal relief and spill management therefore carry more weight.

How fast should an ESD valve close?

There is no single correct figure. Fast closure reduces the quantity released but can create a pressure surge in the line, while slow closure reduces the surge but lengthens the leak. Closing time is chosen together with line size, flow rate and a surge assessment, then checked against the applicable regulations and the project specification.

Is an emergency release coupling mandatory for truck loading?

That depends on the applicable regulations, the transfer arrangement and the risk assessment. On hose connections, a breakaway coupling is a common safeguard against scenarios such as a truck moving before disconnection. On arm systems, an ESD-linked emergency release arrangement may be considered. The choice should be made together with truck position and grounding interlocks.

Can the SIL be fixed at the start of a project?

Usually not. SIL is set in the hazard and risk assessment according to how much risk a particular safety function has to reduce. The same type of function may need a different SIL at another facility, or may not be defined as a safety instrumented function at all. Equipment should be selected after that decision.

Why is trapped LNG dangerous?

LNG left between two closed valves vaporizes as it absorbs heat from its surroundings. Because the liquid occupies a tiny fraction of the volume of the same amount of gas, even a small quantity boiling off raises the pressure in the closed section rapidly. That is why blockable line sections are fitted with thermal relief routed to a safe location.