Printer-Friendly Page Page 1 of 8

Printer-Friendly Page

Protect Plants Against Overpressure

In a petroleum refinery or chemical plant, vigorous effort is required to avoid overpressure-related equipment ruptures. Such failures happen
when the internal pressure of a vessel exceeds its maximum allowable working pressure (MAWP), often from a buildup of heat or materials.
Ruptures of vessels, pipelines, seals and connections, can lead to fire and explosion, and the loss of liquids and vapors, all of which threaten
workers. safety and the environment.

In certain circumstances, when the internal pressure of a vessel rises in response to some abnormal situation, operators can take quick action to
restore it to its normal operating pressure. However, sometimes operators may not have sufficient time to take corrective action. And, humans
are prone to mistakes when they panic.

On March 4, 1998, Sonat Exploration Co. in Pitkin, La., had a catastrophic vessel explosion (Photos, pp. 70 and 71), which killed four workers
and resulted in more than $200,000 in damage. An investigation noted several overpressure-related causes:

•Two outlet block valves were inadvertently closed

•The separator was rated for atmospheric service, but the operating pressure had reached 800 psig

•No overpressure-protection devices, such as pressure-relief valves, were installed on the separator

•No engineering process safety management (PSM) review had been conducted on the process

Using a pressure-relief system is the best way to automatically relieve rapid pressure buildup in a process system. Using one or more pressure-
relief devices, such as pressure-relief valves (PRVs), rupture disks and automatic pressure-relief vents, such systems automatically discharge
any rapid buildup of materials to a safer location, thereby protecting equipment from pressure or heat buildup.

Common overpressure causes

Listed below are the most common potential overpressure scenarios. Each is discussed later in this article:

1.External fire

2.Blocked outlets

a. Blocked liquid outlet

b. Blocked vapor outlet

3.Utility failures, including:

a. General power failure

b. Partial power failure

c. Loss of instrument air

d. Loss of cooling water

e. Loss of steam

f. Loss of fuel gas or fuel oil

4.Loss of cooling duty, caused by:

a. Loss of quench

b. Air-cooled exchanger failure

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 2 of 8

c. Loss of cold feed

d Loss of reflux (top, intermediate)

5.Thermal expansion

6.Abnormal heat input

7.Abnormal vapor input

8.Loss of absorbent flow

9.Entrance of volatile materials

10.Accumulation of non-condensibles

11.Valve malfunction, such as:

a. Check valve malfunction

b.Inadvertent valve operation (open/close and bypass)

c.Control valve fails fully open

d.Control valve fails closed

12.Process control failure

13.Equipment mechanical failure

14.Exchanger tube rupture

15.Upstream relieving

16.Runaway chemical reaction (no corrective action possible within a realistic time frame, say 10 milliseconds)

17.Human error (such as inadvertent valve operation)

Pressure-relief systems

Because of the complexity of most process plant and refinery operations, certain overpressure situations are often easily overlooked during the
design phase. Identifying all potential overpressure scenarios at the site is the first step in an overpressure analysis.

Plant managers must perform regular PRV audits [1] to assess the current condition of their PRVs, in terms of proper installation, operation and
maintenance. Similarly, existing PRV systems must be reevaluated after every revamp project, and, in many cases, after any minor change that
alters the operating conditions of the process or plant. Until a comprehensive PRV audit is performed, one cannot be certain the plant is
adequately protected from overpressure.

It is very common for a plantwide PRV audit to reveal that one or more potential overpressure situations were not adequately identified during
the PRV planning and design stage. For instance, if proper equipment sizing was not addressed as a potential overpressure scenario during PRV
design, then the existing PRV may be undersized.

The list of overpressure causes on p. 66 should be used to guide the PRV audit. However, this list should not be considered all-inclusive. Plant
managers and design engineers should use their own engineering judgement to carefully assess site-specific hazards or uncommon factors that
might also constitute an overpressure source.

Ask a lot of questions during such a system evaluation, particularly when you are aware of particular overpressure scenarios that you think
should be included in the PRV audit, but are not. Never take for granted .common-sense things.. For instance, question why a large PRV is
specified for a small vessel, and vice versa.

Before getting into the detailed analysis of common overpressure scenarios, we must clarify three related concepts - double jeopardy, automatic
process control, and administrative procedures.

Double jeopardy. The concept of .no double jeopardy in overpressure assessment. is very important. The American Petroleum Inst..s (API)
Recommended Practice RP 521 Section 2.2 [2] states that the causes of overpressure are typically unrelated. According to API, .The

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 3 of 8

simultaneous occurrence of two or more conditions that could result in overpressure will not be postulated, if the causes are unrelated.. Even
external fire, one of the overpressure causes, is considered to be unrelated to other causes .if no process or mechanical or electrical linkages
exist among them,. or .if the length of time that elapses between possible successive occurrences of these causes is sufficient to make their
classification unrelated.. This means that one does not need to assume that every contingency case being analyzed during system design would
occur simultaneously.

However, some contingency cases are obviously related by cause and effect. For instance, a .liquid-blocked outlet. can be the consequence of
an .inadvertent valve operation. that was probably caused by .human error.. When one is performing the detailed overpressure analysis, such
interrelated overpressure scenarios can be summarized as a single potential overpressure scenario. Other occurences, such as a .general power
failure,. will cause reflux interruptions if the reflux is driven by an electric pump, and may cause the cooling duty of an air condenser to be lost,
too.

The bottom line is that when performing an overpressure analysis, engineers must consider these cumulative effects, to deal with a
representative cause of potential overpressure. For instance, the possibility of reflux failure should be analyzed in terms of a number of potential
causes, including power failure, reflux pump failure, control valve failure, or a condenser blanketed by non-condensible.

If the reflux failure is included in the consideration of the power failure, the contingency case should be called a power failure. Similarly, if the
reflux failure is caused by condenser failure, the contingency case should be called a condenser failure.

As a general rule of thumb, if the potential outcomes of a given failure are not likely to occur simultaneously, then the PRV should be sized
separately for these two individual cases - not oversized by adding together the two relief capacities required for different potential outcomes of
a given failure mode. By way of example: if the pressure-relief capacity calculated for a single reflux failure case is 80,000 lb/h for a given unit,
and the required relief load for a power failure at the same unit is 150,000 lb/h, then to properly size the PRV, one should assume that the
power failure case includes the effect of reflux failure. In other words, the PRV needed to respond to a potential reflux failure should be sized for
the larger of the two values (in this case 150,000 lb/h; not a cumulative 230,000 lb/h).

Automatic process control. Generally speaking, reliance on so-called failsafe instruments or control loops is not a suitable substitute for installing
a properly designed pressure-relief system. Ideally, with the use of failsafe instruments or control loops, any abnormal conditions will prompt an
automatic adjustment of flowrate, pressure, temperature or other factors. However, given the potential unreliability or unpredictability of
electronic signals - especially during upset conditions - such protection cannot be relied on in lieu of pressure.relief devices. Similarly,
automatic-startup equipment should not replace the use of pressure-relief valves as protection against overpressure.

One exception is the use of a High Integrity Protective System (HIPS). Using triple redundant signals, the HIPS avoids the aforementioned
deficiencies of conventional failsafe systems for electronic process control.

Consider a control loop designed to maintain the liquid level in a tank or reactor when feed increases or decreases. The level signal may fail or
deviate for some reason. To make sure the signal would not be lost, a HIPS uses three independent signals installed in the same vessel. In
addition, it uses a two-out-of-three logic system (such a system relies on two out of three voting systems to determine if the signal received is
reliable), and either an emergency-power-supply (EPS) or an uninterrupted-power-supply (UPS) system. Using an UPS, when the normal power
supply is interrupted, a standby power supply would automatically start, in a fraction of a second, to support critical equipment or units.

HIPS is not a pressure-relief system, but rather an automatic control system that can be used to guard against overpressure. It is now widely
accepted that the use of a HIPS, with either EPS or UPS, can eliminate some (not all) potential overpressure scenarios, and hence greatly
reduce the use of unnecessarily large relief valves and flares, which then reduces both capital and operating costs . However, operators should
consult an expert before relying on a HIPS, and if the facility chooses this route, it must implement a strict maintenance schedule for the HIPS,
along with rigorous training for operators.

Administrative procedures. Some refineries believe that reliance on strict administrative procedures is enough to prevent some overpressure
scenarios, and, thus, they cite such procedures to justify reducing the number of PRVs in the facility. While strict administrative procedures are
commendable, one should assume that the possibility of human error can never be completely eliminated; thus they should not be used in place
of a pressure-relief system.

API RP 520 and 521 do allow engineers to take credit for so-called .car seals open (CSO). or .car seals locked (CSL). valves. With the
installation of CSO block valves, operators do not have to drain the equipment after system shutdown, since the valve maintains an open
position all the time. However, API RP 521 does not allow engineers to take credit for standby pumps, because they cannot be considered to be
totally reliable.

Full or partial credit may be taken for normally operating, parallel, instrument air compressors and electric generators, whose drivers use two
unrelated sources of energy. The most common example is the use of a steam turbine as standby for an electric motor that is driving a pump to
transport fluids.

Since operator intervention (such as reliance on manual cut-in of auxiliaries by an operator) is time dependent, the potential impact of the time
lag required for the standby equipment to get into normal position, and the potential impact of human error, should be analyzed.

Common overpressure sources

Discussed below are each of the overpressue scenarios listed on p. 66.

1. External fire. Fire is a common cause of overpressure in pipes and vessels. According to API RP 520 [3] and 521 [2], operators should
assume that the effective fire-exposed area includes an area of 2,500 to 5,000 ft2 (this assumes a circle with a diameter of 58.80 ft) [6], with
an effective fire height no more than 25 ft above the grade. In contrast, National Fire Protection Assn. (NFPA) [4,6] guidelines recommend that
operators should assume a fire-exposure area with a fire height of 35 ft above grade (details on how to determine the area of a potential fire
zone can be found in a previous article by this author, [6]).

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 4 of 8

Analyzing for an external fire case assumes that the vessel exposed to the fire is blocked in. Potential vapors resulting from the fire must be
relieved using a PRV on the vessel, or via a vent path that remains in a locked-open position between the vessel in question and an adjoining
vessel [6]. These issues need be considered:

•Pressure-relief valves alone cannot protect vessels filled with gas or high-boiling-point liquids, so engineers must carefully evaluate other
protective measures [5]. Traditionally, design engineers use two approaches to size PRVs for gas-filled vessels. One is to use unwetted-surface
equations, as shown in API RP 520. Another is to assume the presence of some liquids in the vessel, so that wetted-surface equations can be
used to size the PRV (for a detailed discussion of this, see [5])

•The wetted surface areas of connected piping and accessories should be added to the wetted surface area of the main vessel when calculating
the potential vapor generated from an external fire. Because of the difficulty of calculating the wetted surface areas of connected piping and
accessories, engineers should add 15% to the overall wetted surface area of the vessel [6]

•Even if a vapor-depressuring system is installed along with the PRV, the required fire-relief load through the PRV should not be reduced. The
vapor-depressuring system is basically used to rapidly reduce the internal pressure to a level where stress rupture would not occur

•Tanks and vessels with design pressure less than 15 psig need to follow API Standard 2000 [8]

2. Blocked outlets. The closure of a block valve on the outlet of a pressure vessel can cause the vessel.s internal pressure to exceed its MAWP,
if the source pressure exceeds the vessel design pressure. However, if the MAWP of a vessel is higher than the source supply pressure, the
vessel has no blocked-outlet case.

A blocked outlet can be caused by control valve failure, inadvertent valve operation, instrument-air or power failure, and other factors. In
general, a pressure-relief valve must have sufficient capacity to pass a fluid flowrate that is equivalent to the difference between those of the
incoming fluids and the outgoing fluids.

a. Blocked liquid outlet. When the liquid outlet is blocked, the liquid level in the vessel may rise. If the surge time for liquid overflow from the
vessel is less than 15.20 min, then a blocked liquid outlet is a valid potential overpressure scenario. When the required surge time is longer than
15.20 minutes, then operators presumably have sufficient time to take action to avoid an overflow, so a blocked liquid outlet is not considered
to be a potential overpressure source.

For any pressure-relief valve installed on the liquid-feed line, the required relieving capacity (in units of volume per time) should be the
accumulated liquid capacity of the vessel. When the feed input is a two-phase fluid (i.e., the feed input for a separator, or flash or surge drum),
the required pressure-relief capacity for the blocked-liquid-outlet case is not for just the liquid. In this case, a two-phase scenario should be
considered, because the liquid level rising to a certain height may make liquid and vapor separation impossible. Too often, engineers fail to
recognize the potential for two-phase separation, and hence, they inadequately size the PRV in a blocked-liquid-outlet case to accommodate just
the liquid capacity [7].

b. Blocked vapor outlet. When the vapor outlet is blocked, the vapor in the vessel needs to be relieved. If there is another available vent outlet
on the vessel that would not be blocked by the same cause, the credit for this relief capacity can be taken.

3. Utility failures. Unlike other scenarios that can only affect one vessel at one time, utility failures, such as loss of power or cooling water or
those shown in the list on p. 66, can affect all the equipment using power or cooling water at same time. To be safe, the flare header should be
designed and sized based on the maximum relief load that could result by a potential utility failure.

a. General power failure (both an interruption of power, and total power failure in a plant). The immediate consequences are that:

•Electrical motor-driven pumps and compressors - and hence, feed input, product output and reflux - will stop

•Motor-driven fans for air coolers, cooling water towers and combustion air will stop

•Motor-operated valves will fail

•Instrument air will be interrupted

Due to the risk of power failure, API RP 521 does not permit credit to be taken for pumps with standby and automatic startup, even when the
pump has a separate power supply. In the event of a utility failure, such a setup cannot be considered reliable. However, if a HIPS is installed
for the automatic startup, and the time difference between the power outage and the standby system getting up and running is insignificant for
process conditions deviating into the upset region, it might be possible to take the credit for such an installation.

b. Partial power failure. Partial power failure is limited to one process unit, or may refer to the failure of either low-voltage or high-voltage
power. Credit can be taken for continuous parallel power-supply services if they have unrelated energy sources.

In the partial-power-failure case, one can assume that the general utility supply would not to be affected. The feed, heating or cooling from
other units would also not be affected.

c. Loss of instrument air. As mentioned before, instrument-air failure may be caused by power failure, control valve failure or other reasons.
Mechanical equipment failure can also result in the loss of instrument air.

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 5 of 8

Engineers should be cautious with the emergency electric power supply (EPS) used to ensure uninterrupted instrument air supply. As discussed,
only reliable EPS systems can take credit for overpressure protection.

Instrument air supplies that have a large air reserve and high air pressure may, after a power failure, be able to maintain an adequate air
supply for a short period of time. The time frame should be carefully evaluated. Normally the air receiver should be able to maintain 10.15 min
of air supply after the air compressor has stopped. To be safe, engineers are advised not to take the credit unless the air supply is sufficient to
last long enough for some corrective action to be taken. Generally, instrument air failure will cause all control valves to assume their failsafe
positions (either air-fail-open; air-fail-closed; or air-fail-last-position).

If a plant is well-designed, an instrument air failure holds relatively little risk of generating overpressure. For instance, with proper care, it is
possible to design most control valves so they will be locked in a safe position in the event of instrument-air failure.

However, instrument-air failure can cause many other problems related to such things as the alarm or shutdown system. The air-fail position
should not be designed as overpressure-relief protection. The reason is obvious - other outcomes might result from the same instrument-air
failure. For instance, other failures in an instrument system could cause a control valve to move to a position opposite from its originally
designed air-fail position, though not very often.

d. Loss of cooling water.During the case analysis for cooling-water failures, engineers often make mistakes in adequately defining the required
overpressure-relief capacity. Using a heat balance approach to calculate the relief capacity for a fractionation system is a must; nevertheless,
without a detailed analysis for both normal operating and relieving conditions, it is easy to end up an oversized PRV.

A common mistake is the inappropriate use of the extra heat accumulation in the system (which can vaporize liquid in the system) when
calculating the required relief load. In some cases, if the cooling is not normally used for condensing vapor, the extra heat buildup in the system
may not be enough to cause a pressure relief.

When the cooling is used to condense vapors, the required relief capacity must be equivalent to the total vapor load being condensed. The
important point is that the calculation be based on the relieving conditions, not the normal operating conditions.

Unlike normal operating conditions, at the overpressure-relief conditions, more vapor may become condensed because of higher pressure. A
rigorous simulation is typically required to help engineers quantify the required vapor-relief capacity. Simply using the normal condensed-vapor
quantity may result in an oversized pressure-relief valve.

One more point needs be emphasized here. API RP 521 suggests that the required relief capacity is the total vapor capacity (typically measured
as weight/time, such as lb/h) to the condenser at relieving conditions. Actually, it should be the difference between vapor entering and leaving
the condenser at relieving conditions. If there is an existing vapor outlet in the system, and that outlet would not be blocked during a cooling-
water failure, then the available normal vapor flowrate through the vapor outlet should be taken as a credit to reduce the required relief load.

e. Loss of steam. In general, steam has the following functions at a plant:

•It is a driving force for pumps, turbines, compressors, air blowers, and so on. When steam supply is interrupted, inlet flow and fluid discharge
will be interrupted

•When used as a heating source for reboilers, exchangers and direct injection, loss of steam will interrupt heating functions

•When used for stripping in fractionation columns, the loss of steam can have a similar impact as the loss of cooling duty. Neglecting this might
lead to an undersized PRV

f. Loss of fuel gas or fuel oil. Except for fuel gas or fuel oil that is used for driving pumps or turbines that provide cooling duty, the loss of fuel
gas or fuel oil would not generally cause overpressure in a system. If fuel gas or fuel oil is used for generating power, loss of such fuels should
be evaluated as a power failure when sizing the PRVs.

For fired heaters, the loss of fuel gas or fuel oil supply does not mean the clear cutoff of heat input to the system. The flow of the residual heat
in the fired heater can significantly contribute to a heat imbalance and overpressure in the system. This state of affairs is especially significant
when the heat duty is large. Generally, 25.40% of normal heating duty shall be used as the residual heat input to the fired heater, once power
fails and fuel gas or fuel oil input has stopped.

4. Loss of cooling duty. There are several different types of cooling duties (including the above-mentioned cooling-water failure), as shown
here:

a. Loss of quench stream.Normally, a quench stream is used to cool a vapor flow in a column or vessel, so the loss of quench means a loss of
cooling duty. A heat balance at the relieving condition must be performed, to determine the required relief capacity.

b. Air-cooled exchanger failure [14]. When air-cooled exchangers fail, natural convection continues. Therefore, a credit for 20 to 30% of normal
duty is often taken, to reduce the required relief capacity. However, louver closure is considered to be total loss of the cooling duty.

c. Loss of cold feed.Loss of cold feed is similar to the loss of quench. This item is often overlooked when no heat balance is performed.

d. Loss of reflux (top and intermediate). Reflux failure is a common cause of overpressure in fractionation columns. Power failure, pump
shutdown, pump mechanical problems and control valve failures are among the causes of reflux loss, which can result in receiver and condenser
flooding.

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 6 of 8

The loss of reflux will cause the temperature in the column to rise, leading to a vapor buildup and an increase in pressure drop in the column
and overhead receiver. Such failure often leads to a loss of total condensing duty.

Nevertheless, exceptions do exist. One example is when the receiver has a vapor outlet that would not be blocked by the same reason that
caused the reflux failure. In this case, the condenser duty may be reduced to a certain extent, or not even affected, depending on the system
configuration. Furthermore, if the receiver has enough surge time, say, more than 15 min from its normal liquid level as a safe assumption, one
could assume that the condenser would not flood.

In general, loss of cooling duty, by any of these mechanisms, can cause heat buildup, which can result in vapor buildup and system
overpressure. The loss of non-condensing cooling will not generally lead to an overpressre situation. However, loss of cooling in a partial or total
condenser would generally lead to a system unbalance, and potential overpressure.

When condensing duty is stopped, if the condensed liquid inventory has more than 15 min to deplete, one can assume that the operator has
adequate time to take corrective action.

The required relieving capacity for the failure of total condensing duty can be calculated by performing a heat balance on the system, based on
the loss of the condensing duty. The consequences of losing partial condensing duty should also consider the possibility of non-condensible
blanketing in the condenser. When this occurs, all the condensing duties will be lost.

The consequence of partial condensing failure can be more severe than that of total condensing failure. The relief-capacity calculations might
have to reconsider loss of upstream cooling duty if they were related.

5. Thermal expansion (sometimes call hydraulic expansion). Pressure-relief valves for the case of thermal (or hydraulic) expansion, are
relatively easy to analyze and size. It is rare that a vapor-filled pipeline or vessel would be overpressured by external heat sources, other than
fire. Therefore, no vapor thermal expansion is discussed here.

When liquid is blocked in a vessel or pipeline, external heat input can cause liquid temperature, and hence volume, to rise. Common causes are:

•The pipeline is filled with liquid that is blocked in and heated by steam or electrical heat tracing

•A heat-exchanger cold side is filled while the hot side is still flowing

•A pipeline or vessel is filled with liquid at ambient temperature, and is heated by direct solar radiation

Usually, a nominal thermal-relief valve is adequate for most cases, except for large vessels and long piping.

Backpressure should be assessed when the thermal-relief valve is discharging to another pressured pipeline or process vessel [11]. When the
backpressure exceeds 10% of the valve set pressure, or is variable, a balanced bellows may be required.

The case of blocked-in liquid with thermal vaporization has not been widely discussed. When the liquid being blocked in has a vapor pressure
higher than the PRV set pressure, thermal vaporization is a potential cause of overpressure. The PRV should be sized so that it can relieve the
vapor-generation rate, and should be installed on the top of the equipment, so as not to block the vapor discharge. Liquid displacement should
also be avoided.

6. Abnormal heat input. This case is not commonly discussed, but it should be analyzed if the following incidents might happen:

•The supply of heating medium, such as fuel oil or fuel gas to a fired heater, can be switched from medium heating value to higher heating
value

•Heat transfer occurs in a new and clean heat exchanger after a revamp

•The control valve for the fuel supply fails fully open

•The supply pressure of the heating steam is changed from its normal range to its maximum pressure

In general, when considering this case for sizing a PRV, the maximum heat duty assumed for the abnormal case should be no more than 125%
of the normal heat duty.

7. Abnormal vapor input. Abnormal vapor input to the process can occur when the upstream control valve fails fully open. Upstream relieving
or inadvertent valve opening can also cause abnormal vapor input to a reactor, vessel or pipeline.

In some situations, abnormal vapor input may not cause system overpressure. However, if the system is not able to discharge the extra vapor,
eventually, the extra vapor will cause system overpressure. The required relieving capacity must be equal to or greater than the amount of the
vapor accumulation expected under the relieving conditions.

8. Loss of absorbent flow. In general, loss of absorbent will not result in an overpressure situation. However, when gas removal by an
absorbent is more than 25% of the total inlet vapor flow, an interruption of absorbent flow could cause pressure to rise in the absorber.

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 7 of 8

In this case, the pressure-relief valve should be sized based on the net accumulation of the vapor at the relieving conditions. If the downstream
equipment would not be blocked at the same time the absorbent flow has stopped, then the design capacity of that equipment can be used as a
credit for reducing the required relieving capacity.

Some absorption systems are equipped with an automatic depressuring system (i.e., the use of an automatic vent that is electroncially triggered
to open and relieve pressure buildup caused by a rapid temperature increase). However, credit for this cannot be used to reduce the required
relief capacity needed for this case, because such an auto vent cannot be assumed to be completely reliable, unless a HIPS is used to control
the vent.

9. Entrance of highly volatile material. An example of this would be water or light hydrocarbons entering into hot oil during a process upset
- a situation in which the instantaneous phase expansion can be enormous. Pressure-relief devices may not open fast enough to relieve the
rapidly generated vapors. Instead, to minimize such risks, the facility should rely on a properly designed process, coupled with proper operator
training.

During the design phase, the use of double block valves, the avoidance of water-collecting pockets, and the appropriate use of steam
condensate traps and bleeds on water connections should be all considered. If the possibility of overpressure still exists, a rupture disk may be
the answer.

10. Accumulation of non-condensibles. During normal operating conditions, non-condensibles do not accumulate in the system. They should
be discharged along with process streams or through a vent. Non-condensibles will accumulate under the following conditions:

•The normal non-condensible vent is blocked, or

•The piping configuration or equipment has a pocket in which non-condensibles accumulate

The accumulation of non-condensibles can blanket a condenser and result in the loss of cooling duty. Thus, the analysis should be no different
from that done for loss of condensing duty.

11. Valve malfunction. Only one valve malfunction needs to be considered at a time, if other valve malfunctions are unrelated.

a. Check-valve malfunction (back flow). This is a rare case, but should be considered when a high pressure differential is present between the
inlet and outlet of a check valve, a pump, or other piece of equipment. In general, though multiple check valves are installed for this application,
backflow does occur at huge pressure differentials. When check valves malfunction, backflow can be from 5 to 25 % of the normal operating
flowrate. The required relief capacity is defined based on each case.

b. Inadvertent valve operation (open/close and bypass). This means that a valve was wrongly operated to a position that is opposite its
intended normal operating position. This is a very common overpressure scenario, and is the result of human error.

Bypass valves can also be either closed or opened inadvertently, due to human error. If this malfunction can cause downstream equipment
overpressure, it is a valid potential overpressure scenario to consider.

Very often, a fully open bypass valve can pass a greater fluid volume than the main control valve. Analysis shows that a fully open bypass block
valve, especially a control valve bypass, can provide a larger relief load compared to failure of the control valve itself. During the design stage,
the bypass valve should be carefully sized to avoid an oversized relief valve.

b. Control valve fails fully open or closed. This malfunction, caused by mechanical or electronic-signal failure, and it often results in heat or mass
accumulation in the system. However, this case is often confused with the air-failure position of the control valve. Mostly, air-fail positions for
control valves are designed to protect the process system.

Be aware that two overpressure scenarios related to "control valve fails fully open or closed" do not relate to the cases of instrument-air-failure
positions discussed above. The analysis of the instrument air failure is focused on whether the valve, at air-failure position, could cause
overpressure in the system. Furthermore, instrument air failure shall affect all the control valves in the system.

In contrast, the "control valve fails fully open or closed" situation may only affect individual control valves in the system. Thus, only one control
valve is considered at a time.

If a control valve on a feed line fails fully open, it can result in overpressure in a surge drum, flash drum or even distillation column.
Traditionally, when the liquid outlet or the liquid inlet blocked valve fully opened, engineers assumed that the required relieving fluid would be
liquid. In reality, this may not be true [7].

12. Process control failure. This contingency case is important, especially with the wide use of programmable logic controllers (PLCs) and
distributed control systems (DCS), but is often overlooked during overpressure analysis.

The potential impact of the failure of every control loop - due, for instance, to the loss of the digital signal for whatever reason - should be
analyzed, as should a situation in which all other loops continue to operate normally when one fails. As a general rule, the required relief
capacity must be greater than the vapor generated because of heat buildup in the system.

13. Exchanger tube rupture. API states that complete tube rupture, in which a large quantity of high-pressure fluid will flow to the lower-
pressure side of the exchanger , is a remote but possible contingency. Because the test pressure normally is about 150% of the design
pressure, a two-thirds rule is established from it. The rule is this: pressure relief for tube rupture is not required where the low-pressure

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008
Printer-Friendly Page Page 8 of 8

exchanger side (including upstream and downstream systems) is designed at or above the two-thirds criteria. (Because ASME changed the
hydrostatic test pressure for pressure vessels from the 150% design pressure to a new standard of 130% design pressure, the existing two-
thirds rule will be changed to a ten-thirteenths rule very soon. Many major oil companies are already following this rule.)

As a general rule, the required relief capacity is based on twice the tube cross-section area, and the assumption that high-pressure fluid can
flow through both the tube stub and the other end of the tube [9]. These aspects need to be analyzed:

•The battery limits for upstream and downstream equipment

•When a high-pressure vapor gets into a low-pressure vapor system, the situation is different from, for instance, getting into a low-pressure
liquid system

•When a high-pressure liquid enters a low-pressure vapor system without flashing, if the velocity of the liquid is high enough, the liquid acts
like a piston, pushing away the vapor until the liquid velocity has slowed down. Full flow credit can be taken for the vapor-handling capacity at
the low-pressure side. Similarly, when a high-pressure liquid enters into a low-pressure, liquid-full system, the inlet liquid would also initially act
like a piston, displacing the lower-pressure liquid. However, the high-pressure liquid would slow down quickly. Therefore, only the credit of the
volumetric flowrate of the low-pressure-side liquid at its normal operating conditions can be taken

•When high-pressure liquid could flash into the low-pressure system, the DIERS (Design Inst. for Emergency Relief Systems) methodology
should be considered [12]

•The impact of high-pressure fluids flowing into a low-pressure system should not be ignored, especially the impact on the manifold on the low-
pressure side when the pressure differential is too large

•If a steam reboiler tube ruptures, consider the impact on the column

•For steam-generation systems that use process fluids as a heating medium, a tube rupture can have environmental consequences

•Heat exchangers, in most cases, have a design pressure that is higher on one side than on the other. If the design pressure of the low-
pressure side is less than 10/13 that of the high-pressure side, one can assume a tube rupture is a valid overpressure scenario. The PRV must
be sized to handle the full high-pressure flow from the tube rupture [10]

14. Upstream relieving. The following two scenarios should be evaluated:

a. When an upstream vessel is relieving by discharging fluid into a downstream vessel, the downstream one should be designed to handle the
pressure and the volume of the incoming stream from the upstream vessel without overpressuring itself.

If the upstream vessel does not have adequate relief capacity, the downstream vessel needs to have a PRV of its own. The pressure drop
between the two vessels should be carefully evaluated, along with the proper pressure settings for the two PRVs. If the upstream vessel does
have sufficient relieving capacity, then the impact of the upstream relieving pressure on the downstream vessel should nevertheless be
evaluated.

b. Two vessels are connected by an open path. The first has its own PRV and it discharges to a flare header or other location. The second will
experience the impact from the relieving pressure of the first vessel relieving. A pressure profile between the two vessels at the time when the
first vessel is relieving must be carefully evaluated. The second vessel must be well-protected when the first vessel is relieving.

15. Runaway chemical reactions. During runaway reactions, which tend to accelerate with rising temperature, extremely high volumes of
non-condensibles with high energy can cause the internal pressure of a vessel or pipeline to rise rapidly. Unless properly controlled, the runaway
reaction cannot be controlled and explosion will follow. Basically, PRVs may not provide protection at all because of their relatively slow
response time. In this case, vapor-depressuring systems, rupture disks and emergency vents are better [13].

16. Human error. The potential impact of human error on plant safety should never be underestimated. When relying on operator intervention,
the allowable time limit must be long enough for the particular plant situation. If operator intervention is difficult or impractical, then it should
not be relied on at all.

Print This Window Close Window

http://www.che.com/articles/print/2001/Cov/Cov06012001_01.html?printbtn=Print+This+... 6/10/2008