Pressure Relief Systems Vol 2

Refinery Process Stream Purification Refinery Process Catalysts Troubleshooting Refinery Process Catalyst Start-Up / Shutdown Activation Reduction In-situ Ex-situ Sulfiding Specializing in Refinery Process Catalyst Performance Evaluation Heat & Mass Balance Analysis Catalyst Remaining Life Determination Catalyst Deactivation Assessment Catalyst Performance Characterization Refining & Gas Processing & Petrochemical Industries Catalysts / Process Technology - Hydrogen Catalysts / Process Technology – Ammonia Catalyst Process Technology - Methanol Catalysts / process Technology – Petrochemicals Specializing in the Development & Commercialization of New Technology in the Refining & Petrochemical Industries

Web Site: www.GBHEnterprises.com

GBH Enterprises, Ltd.

Process Safety Guide: GBHE-PSG-008

Pressure Relief Systems Causes of Relief Situations Vol.2 of 6

Process Information Disclaimer

Information contained in this publication or as otherwise supplied to Users is believed to be accurate and correct at time of going to press, and is given in good faith, but it is for the User to satisfy itself of the suitability of the information for its own particular purpose. GBHE gives no warranty as to the fitness of this information for any particular purpose and any implied warranty or condition (statutory or otherwise) is excluded except to the extent that exclusion is prevented by law. GBHE accepts no liability resulting from reliance on this information. Freedom under Patent, Copyright and Designs cannot be assumed.



Process Safety Guides: Causes of Relief Situations INDEX VOL. I BACKGROUND TO RELIEF SYSTEM DESIGN (This includes principles of pressure relief and use of this Guide, alternatives, statutory and mandatory requirements, and reporting). VOL. II CAUSES OF RELIEF SITUATIONS VOL. III CALCULATION OF REQUIRED RELIEF RATE VOL. IV SELECTION, SIZING, AND INSTALLATION OF PRESSURE RELIEF DEVICES (This includes the pressure setting in relation to the design pressure of the protected equipment). VOL. V DISCHARGE AND DISPOSAL SYSTEM DESIGN VOL. VI REFERENCE SECTIONS DOCUMENTS REFERRED TO IN THIS PROCESS GUIDE It is emphasized that this document is only a Guide, describing good practice at the date of issue, and is not itself mandatory (although some mandatory instructions are quoted). When used in this Guide, the words "must", "shall", and "should" have no legal force and are not mandatory, except where they are part of a quoted mandatory instruction from another source. The word" must" has not been used, except when part of a quotation. "Shall" is a strong recommendation of GBHE based upon experience or upon the position adopted by recognized authorities, and the engineer may quote compliance with this guide only when that recommendation has been followed. "Should" is a recommendation based upon the judgment of experienced people but recognizes that some discretion may be appropriate. Note: This Guide includes references to and quotations from external and British Standards. The reader should always check if the Standards have been updated since the last issue of this Guide.



Volume 2: Causes of Relief Situations SECTION 1: IDENTIFICATION OF EVENTS LEADING TO OVERPRESSURE / UNDERPRESSURE 1 INTRODUCTION

1.1 General Statement 1.2 Hazard and Operability Studies and Hazard Analysis

2 METHOD OF IDENTIFICATION

2.1 Potential Causes of System Overpressure 2.1.1 Principles and Terminology 2.1.2 Plant or Process Conditions 2.1.3 Prime Events 2.2 Procedure 2.2.1 Tabulation of Potentially Hazardous Events 2.2.2 Stepwise Procedure for Each System

3 DEFINITION OF A PROCESS EQUIPMENT SYSTEM (PES) SECTION 2 : EXTERNAL FIRE 4 INTRODUCTION 5 FACTORS TO CONSIDER

5.1 Nature of Material Inside Equipment 5.2 Extent of Fire Zone 5.3 Type of Fire 5.4 Loss of Structural Strength 5.5 Radiation from Adjacent Fires 5.6 Radiation from Adjacent Fires 5.7 Thermochemical and/or Decomposition Effects 5.8 Small Vessels

6 PITFALLS WITH FIRE



SECTION 3: PROCESS ABNORMALITIES 7 INTRODUCTION 8 SYSTEM BLOCKED-IN (CONDITION 1)

8.1 General Considerations 8.2 Mal-operation 8.3 Process Aberration 8.4 Pitfalls with Blocked-in Equipment

9 RESTRICTED OUTLET (CONDITION 2)

9.1 Mal-operation 9.1.2 Outlets Closed or Restricted 9.1.2 Outlets too Small 9.2 Process Aberration 9.2.1 General Considerations 9.2.2 Causes of Blockage 9.3 Pitfalls with Restricted Outlet Condition

10 RESTRICTED INLET (CONDITION 3)

10.1 Equipment at Risk 10.2 Events Leading to Underpressure (Vacuum) 10.3 Pitfalls with Restricted Inlet

11 CHEMICAL REACTION (CONDITION 4)

11.1 Normal and Abnormal Chemical Process 11.2 Runaway Reaction 11.3 Chemical Reaction in Relation to Prime Events 11.3.1 Fire 11.3.2 Mal-operation 11.3.3 Process Aberration 11.3.4 Equipment Failures 11.3.5 Service Failures 11.4 Underpressure Relief

SECTION 4: EQUIPMENT AND SERVICES FAILURES 12 INTRODUCTION



13 EQUIPMENT FAILURE

13.1 System Blocked-in or Restricted Outlet (Conditions 1 and 2) 13.1.1 Factors to Consider 13.1.2 Failures Involving Inter-stream Leakage (Heat Exchangers and Similar Items) 13.1.3 Fired Heaters 13.1.4 Control System Failure 13.1.5 Machines (and Ejectors) 13.2 Restricted Inlet (Condition 3) 13.2.1 Factors to Consider 13.2.2 Failures Involving Inter-stream Leakage 13.3 Chemical Reaction (Condition 4) 13.4 Pitfalls with Equipment Failure

14 SERVICES FAILURE

14.1 General Considerations 14.2 Principal Services 14.2.1 Cooling Water 14.2.2 Electrical Power 14.2.3 Instrument Air 14.2.4 Steam: HP, IP, LP 14.2.5 Fuel Gas and Fuel Oil 14.3 Secondary Services 14.3.1 Heat Transfer Fluids (hot oil, "Thermex", hot water) 14.3.2 Hydraulic Oil 14.3.3 Inert Gas and Nitrogen 14.3.4 Refrigerant 14.3.5 Water (other than cooling water) 14.4 Pitfalls with Service Failures

SECTION 5 : AMBIENT CHANGES 15 INTRODUCTION 16 ENVIRONMENTAL CHANGES 16.1 Atmospheric Conditions 16.2 Plant Environment 17 EXPANSION/CONTRACTION OF VAPOR INVENTORY

17.1 Low-Pressure Storage Tanks 17.2 Low Temperature Atmospheric Pressure Storages and Equipment 17.3 Sealed Containers (IBC)

18 HYDRAULIC EXPANSION - PIPELINES AND VESSELS



TABLE 1 IDENTIFICATION OF EVENTS LEADING TO OVER / UNDERPRESSURE



SECTION 1.0 IDENTIFICATION OF EVENTS LEADING TO OVERPRESSURE/UNDERPRESSURE 1 INTRODUCTION 1.1 General Statement

In every pressure relief study the first and often most difficult step is that of recognizing every potential cause of overpressure in the process equipment system being studied. This Guide does not, however, include any consideration of dust, gas/air or vapor phase explosions where the speed of reaction is such that the equipment will be vented directly to the atmosphere. See also Part C, Section 5 of this Guide. This Part B is a guide to the qualitative identification of common causes of overpressure in process equipment. It cannot be exhaustive; the process engineer and relief systems team should look for any credible situation in addition to those given in this Part which could lead to a need for pressure relief (a relief situation). Note 1: OVERPRESSURE: Following common usage, the term "overpressure" or "system overpressure" is used in this Guide to refer to any excess of pressure in a system over its design pressure. It should be distinguished from the more specific term "relief valve overpressure" defined in Vol. 1 of this Guide in relation to the set pressure of a relief valve. Note 2: UNDERPRESSURE: The corresponding term "underpressure" (system under pressure) is used for any situation where the absolute pressure is reduced below that at which the equipment might be damaged or collapse (an under pressure relief situation). To create a relief situation, there must be an energy source. Pressure relief may be needed when either: (a) T he normal mass balance is disturbed; or (b) The energy balance, is disturbed. An example of each of these situations is given below:



(1) Outlets from vessel are blocked or restricted while inlets remain open to source of fluid at a pressure higher than design pressure. (2) Reaction goes out of control (runaway) leading to energy release too great for normal equipment to handle. Sections 1 through 5 are intended to lead the user through the process of identifying all situations that need to be considered, at an early stage in the development of engineering line diagrams. It is recognized that the individual user needs an introduction to the recommended method though he may or may not require detailed technical advice, dependent upon his own level of experience. ALL USERS ARE STRONGLY RECOMMENDED TO READ THIS SECTION 1.

1.2 Hazard and Operability Studies and Hazard Analysis It is essential that engineers and/or teams responsible for pressure relief systems (sometimes referred to as Relief and Blowdown Teams) identify possible causes of system overpressure and hence the main relief system equipment early in the project so that design and ordering may proceed. Every attempt should be made to ensure that every significant risk is considered. Further examination in the form of detailed Hazard and Operability Studies provides a check that no causes have been missed. Quantitative Hazard Analysis can be used to assist in deciding for what combinations of hazards a relief system needs to be designed or whether a particular event is sufficiently remote to be discounted. In high risk situations, Hazard Analysis may be essential to determine the level of integrity required of the relief system itself.



2 METHOD OF IDENTIFICATION 2.1 Potential Causes of System Overpressure 2.1.1 Principles and Terminology

When reading this Section, refer to Table 1. Inadvertent pressure rise (or fall) leading to the need for pressure (or vacuum) relief is caused by certain EVENTS occurring while the plant or process is in a susceptible CONDITION. An EVENT (e.g. thermal energy input) may arise from: (a) A fault or defect (e.g. control system failure). (b) Normal process mass and heat flows. (c) Changes in ambient conditions. (d) External fire. Faults or defects may arise from human error, design limitation, equipment failure or external factors. Many faults can occur without a potential hazard arising because the conditions are not appropriate at the time. Of a number of possible approaches, the GBHE Process Engineering (Relief Systems Team) recommends the method given in this Guide for the identification of inadvertent causes of pressure rise or fall. The plant items are first grouped together into one or more process equipment system(s) for the purpose of the pressure relief study. All events likely to cause the pressure to rise or fall are identified by considering the plant and/or process to be in each of four PLANT/PROCESS CONDITIONS in turn. To help the user to carry out this procedure a number of common faults, defects etc. have been assembled in Table 1 under the column headings of four PRIME EVENTS. Note: To avoid duplication in the Table, some events are listed in a box only under the CONDITION under which they would be most likely to occur. They may, however, be relevant to other CONDITIONS and so it is imperative to consider the contents of all other boxes in the same column. The user should also consult the corresponding Sections of Part B of this Guide.



Sometimes a condition in which the system becomes prone to overpressure generation is not a normal condition of operation but is itself caused by a fault. For example, a blocked-in condition may be caused by solidification of process material as a result of a heating failure. Overpressure may then be generated either by normal or abnormal events.

2.1.2 Plant or Process Conditions The four conditions tabulated and to be considered in turn are: CONDITION 1 : SYSTEM BLOCKED-IN A process equipment system having both inlets and outlets closed but which can still be subject to energy input especially by heat transfer. The closing of blocking valves may be intentional or accidental so CONDITION 1 may be normal or occur as a consequence of an operational fault. CONDITION 2 : RESTRICTED OUTLET The situation where, because of restriction of flow through the outlets, the maximum rate of discharge from the system at its design pressure is less than either the potential inflow from all sources or the rate of expansion of the contents. The outlet(s) may be closed, restricted unintentionally or too small. CONDITION 3 : RESTRICTED INLET The situation where the potential inflow to the system is less than either the maximum outflow or the rate of contraction of the contents because of restriction of inlets. This condition is only a hazard for equipment not designed for operation under vacuum. The inlet(s) may be closed, restricted unintentionally or too small. CONDITION 4 : CHEMICAL REACTION The potentially hazardous situation when a chemical process (usually, but not necessarily, exothermic) is capable of causing the pressure to rise if outflow of fluid or removal of heat from the system is restricted; alternatively a chemical reaction may also cause the pressure to fall when inflows are restricted. In some cases the chemical reaction itself may go out of control if the operating conditions deviate from normal. Either the basic chemical reaction rate then accelerates uncontrollably or undesirable side reactions are initiated which rapidly predominate. In either case heat may be



evolved at a rate that cannot be dissipated, or gas/vapor may be generated at a rate that cannot be discharged via the normal routes available. When chemical absorption of gas occurs, the process has potential for creating an underpressure relief situation. Thus the involvement of chemical reactions with potential for causing overpressure (or underpressure) is defined as a PROCESS CONDITION; an abnormal reaction is an EVENT which can be triggered by various faults. CONDITION 4 can occur in combination with either 1, 2 or 3. Note: Clearly overpressure can arise under CONDITIONS 1, 2 or 4 and underpressure can arise under CONDITIONS 1, 3 or 4.

2.1.3 Prime Events The four PRIME EVENTS tabulated and whose effect has to be examined for each one of the PLANT/PROCESS CONDITIONS are:

PRIME EVENT A : EXTERNAL FIRE A plant fire is treated as a PRIME EVENT rather than as an effect of some other EVENT which started it because: (a) Direct quantitative relief requirements follow from considering the heating effect of fire. (b) Secondary effects are sometimes caused by fire. (c) The initial cause of the fire does not affect the relief systems study. (d) It is established practice in pressure relief studies. PRIME EVENT B : PROCESS ABNORMALITY Abnormalities include both mal-operation and process aberration. Mal-operation means that the process is inadvertently operated in an abnormal way. Process aberration is an abnormality which may occur within the process itself as a result of factors outside normal control - such as deviations in chemical or physical state of materials.



PRIME EVENT C : EQUIPMENT AND SERVICES FAILURE Equipment failure (or breakdown) of mechanical systems, machines or control systems. Services failure is that of ordinary services (steam, water, electrical power, etc.) supplied from outside the process unit. It may be partial or total. PRIME EVENT D : AMBIENT CHANGES Usually this means a change in the atmospheric conditions (temperature, rainfall, wind, etc.) that can cause problems due to pressure changes in low-pressure storage tanks and in pipelines. Other environmental changes have to be included (e.g. heat radiation from nearby installations) in some plant studies.

2.2 Procedure 2.2.1 Tabulation of Potentially Hazardous Events

Table 1 is a tabulation of possible events caused by faults and other factors in design and operation that constitute the PRIME EVENTS as defined in 2.1.3. All relevant listed items plus any others that may be suggested should be considered by the team or engineer responsible for relief and blowdown studies. The Table serves as a check list to be used in conjunction with the more detailed advice in Sections 2 through 5 to which cross reference is made. These Sections are intended to lead the user to recognize possible hazards other than those given in the Table. It is not only important to identify all the potential causes of a relief situation but also to establish whether each source will affect the design of the relief system; hence it is necessary to calculate the required relief rate for each source as it is identified and consider whether: (a) The various sources are either independent and their effect simply additive or whether they are subject to more complex interactions. (The effect can be either less or more than simply additive). (b) Any lesser sources, either alone or in combination, are significant after designing the relief system for the major causes.



2.2.2 Stepwise Procedure for Each System The general procedure for identification of causes of overpressure and calculation of the total required relief rates is as follows. Recommended methods for performing the calculation of individual rates are covered in Part C of this Guide. (a) For each process equipment system mark a boundary on the line diagram for the system such that all equipment within the boundary can be effectively served by one pressure relief device or combination of devices. (b) Consider the process equipment system to be in each of the four PLANT/PROCESS CONDITIONS that are relevant, in turn. Whatever the CONDITIONS, think carefully about the events listed under all other CONDITIONS in Table 1 to identify every event that could lead to a relief situation. (c) With the help of Sections 2 to 5, try to recognize any other significant event which has not already been considered. (d) Check whether the effect of a fault could pass either forwards or backwards through the train of plant items and cause a relief situation at a remote location. (e) Consider whether the effect of any significant cause can be easily reduced in magnitude or eliminated, by changes either in design or operating procedures. (f) Determine the total required relief rate as follows:

(1) calculate the required relief rate for each individual event;

Note: With large projects, because of long delivery times for main plant items and relief devices, it is sometimes necessary to estimate relief rates before detailed equipment data are available. It will be necessary to check these calculations later, when sufficient data are available, and make any necessary modification to the relief system design.



(2) select the highest individual or highest credible combination of relief rates (determined by hazard analysis if necessary); (3) if the total required relief rate is excessive, consider in detail any way by which it may be reduced.

Note 1: It may be necessary to do this after considering the combined relief requirements of a number of process equipment systems. For instance, the combination may affect the design of a flare system more than the size of the relief device. Note 2: The effect of some events cannot be precisely defined for the purpose of calculating relief rate and may seem to be unlikely occurrences. Such events may only be ignored if they can be made acceptably remote (checked by hazard analysis if necessary). Otherwise, the best possible calculation should be made and an appropriate factor of safety applied.

(g) With large plants, to facilitate the subsequent design of common disposal systems and also as an aid in reporting, it is recommended that a code number be allocated to each fault or defect identified as a potential cause of a relief situation. The code number can be used to rapidly identify anyone fault that could affect more than one process equipment system at the same time.

Note: For a large plant the required relief rate resulting from services failure (for instance electrical power) is often the sum of a number of relief rates produced by coincident effects in more than one process equipment system. All these rates contribute to a combined relief discharge to flare, scrubber or other disposal system.



3 DEFINITION OF A PROCESS EQUIPMENT SYSTEM (PES) (For Relief and Blowdown Studies)

Items or groups of items of equipment which will be connected by pipework to an appropriate pressure relief device, and not containing any means of internal isolation, are considered to be one system for the purpose of protection from overpressure or underpressure. If any item or part of the system can be isolated by mechanical means or by an abnormal process condition, such as accidental blockage (ice, etc.) then that system must be subdivided into separate systems each of which may require protection against overpressure or underpressure. See Part D of this Guide. Note: It is important to ensure that at all times the interconnecting pipe work and ducts within items of equipment are capable of passing the relevant fluids at the required relief rate to the relief system. Isolatable sections of pipework within the plant often do not require pressure relief. (This normally refers to fire or thermal relief). However, long pipelines, some large diameter pipes and pipes containing liquid with high vapor pressure at ambient temperature may require protection and should be treated as a process equipment system. See Section 5. Sometimes, Administrative Safety Procedures can be proposed by the Relief and Blowdown Team or the Project Team with regard to isolation practices. Isolation valves between two systems can be locked open in certain circumstances to allow the two systems to be regarded as one for pressure relief purposes. Any such proposals should be agreed by the appropriate Works authority. It should be remembered that isolation valves even when fully open might impair the safe operation of a relief system. Note: The preceding statement does not refer to the isolation of relief devices from the equipment they protect - a practice which is only permitted in a very limited number of circumstances and which shall be approved by the appropriate authority. See Part A. When defining a PES the isolation of equipment by means of slip-plates, blanks, or bobbin pieces need not be taken into consideration provided that the operation is part of the normal maintenance procedures and equipment is drained/vented until its return to on-line duty.



However, the precise siting of slip-plates and blanks is important in ensuring that pipework and items of equipment still in service do not become isolated from their normal relief systems. Thus, the position of any isolating device should be clearly identified on the engineering line diagram when the PES is defined. It is essential to take into consideration any specification breaks in pipework when defining each PES.



TABLE 1: IDENTIFICATION OF EVENTS LEADING TO OVER / UNDERPRESSURE





SECTION 2: EXTERNAL FIRE

4 INTRODUCTION

At an early stage in a project, any areas in the plant in which a significant fire could occur for a prolonged period need to be identified as a fire zone. Any vessel located in a fire zone could be subject to energy input from a fire either by direct contact with the flame or by radiation from a nearby fire. This may be sufficient to generate excessive pressure in the vessel so that pressure relief ("fire relief" being the generally accepted term) will be necessary. Alternatively, although a fire is possible, the amount of available fuel may be insufficient to raise the temperature and hence the vapor pressure of the vessel contents to the extent that makes pressure relief necessary. When assessing the need to provide either fire relief, vapor depressring facilities or any other protection of process equipment against overpressure, all the consequences of failure of the equipment (by rupture or other major breakdown) should be borne in mind, for example: (a) Release of flammable material increasing the scale of the fire. (b) Discharge of toxic substances to the atmosphere. (c) The cost of damage to the plant (repairs and outage). (d) Risk to personnel and plant from fragmenting vessel. (e) Vapor explosion as a result of external ignition of material released as a result of the failure. When fire is the main hazard, in addition to a pressure relief system, it is usually prudent to provide protective equipment such as: (1) Use of fire resistant lagging or other materials resistant to fire to protect appropriate areas. (2) Vapor depressurizing systems to reduce the system pressure below the relief set pressure - especially when there is a risk of weakening the metal by overheating (See 5.4). (3) Liquid release systems discharging to an appropriately protected dump tank - particularly for toxic or flammable materials. Even when fire is a lesser hazard, consideration should still be given to such measures.



When considering external fire the plant condition is always considered to be "Blocked-in" except when it is physically impossible to block it in. In all cases, decide whether fire should be considered together with other PRIME EVENTS (e.g. equipment failure).

5 FACTORS TO CONSIDER 5.1 Nature of Material Inside Equipment

Examine the properties of the process materials that can be present at any time and establish the effect of overheating. The commonest pressure hazard due to fire arises with vessels containing: (a) Volatile liquids whose vapor pressure might exceed the design pressure when heated by fire. (b) Materials that can undergo abnormal chemical reaction with evolution of gaseous products when overheated in a fire. See Part C, Section 5 of this Guide.

5.2 Extent of Fire Zone A very broad guideline is that a fire hazard exists in equipment which: (a) Contains more than about 2 t of flammable liquid; and/or (b) Is continuously fed at a rate of about 2 t/h or more of flammable liquid, gas or vapor unless it is safe to assume that the flow can be reliably stopped in the event of a fire. See Process Safety Guide No.2. The space surrounding a fire hazard constitutes a "fire zone". Subject to accepted limitations based on experience, the zone should be taken as either 12 m by 12 m square or 6 m laterally from the boundary of the equipment constituting the fire hazard unless special provision is made to limit the spread of fire. Suitable fire resistant walls and screens or the plant drainage layout may be considered as limiting the extent of the fire zone.



Note: Engineers responsible for specifying fire zones should satisfy themselves that these guidelines are appropriate to the particular situation in question because local environmental factors often affect the demarcation.

5.3 Type of Fire Experimental and other research work has shown that the heat input can vary with the type of fire surrounding the vessel. Vessels completely enveloped by flames are subject to much greater heat fluxes than those in situations where the heat transfer is reduced by air currents, smoke, etc. See Part C, Section 1 of this Guide. More specifically, at heights of more than 15 m above the fire source, heat transfer is considered to be drastically reduced by smoke, eddies and wind currents. Normally fire relief need not therefore be considered for vessels and other equipment that are more than 15 m above the source of the fire except for the following: (a) Equipment in buildings or other locations where a "chimney" effect can be created. (b) Any vessel where the heat input can be increased by conductive heat transfer (usually via heavy structural steelwork). (c) Equipment in locations where some induced airflow could increase the height of the fire (e.g. fire near an up draught air cooler).

5.4 Loss of Structural Strength A process vessel that is heated above its design temperature may fail at a pressure well below its design pressure. Hence, a relief valve set at design pressure cannot be relied upon to protect a vessel subjected to fire for a prolonged period. This risk is greatest to parts of the vessel not internally wetted by liquid. Vessels sited in a fire zone may therefore need to be provided with remotely operated independent systems to guard against such failure by discharging some or all of the vessel contents in order to lower the pressure in the vessel to a safe value below the design pressure and usually less than the relief set pressure.



This can be achieved by discharging vapor ("vapor depressuring") or liquid ("liquid dumping"). Refer to Process Safety Guide No.2 for more detailed guidance. Localized flame impingement may also lead to failure at pressures below design pressure and should, if possible, be prevented by lagging, screens, etc. Otherwise provide a depressuring system. In cases where supercritical temperature will be reached before the relief pressure, loss of evaporative cooling by boiling inside the equipment will allow the metal to overheat and lose its strength much sooner than when it is in contact with liquid. This is, therefore, another possible case for providing depressuring facilities.

5.5 Radiation from Adjacent Fires Radiation may affect equipment in a neighboring area not designated as a fire zone. Fires may spread to other areas including non-fire zones if the plant layout and arrangements for drainage are not designed with this hazard in mind.

5.6 Reduction of Heat Absorbed by Equipment Measures taken to reduce heat absorption can significantly reduce the size and number of protective devices required for fire relief. Such measures include the use of fire resistant lagging and sloping the ground beneath the plant. The reduction that may be allowed depends on the specific actions and the prevailing situation. See Part C, Section 1 of this Guide. Sometimes it is possible to design out completely the need for fire relief by such measures as: (a) Use of very thick fire resistant insulation. (b) Use of fire resistant concrete protection for plate-fin exchangers. (c) Separation of air coolers by concrete floors. (d) Burying pipes underground.



5.7 Thermochemical and/or Decomposition Effects Materials on hot surfaces may well undergo side reactions which generate much heat simultaneously with that from the external fire. Consideration shall therefore be given to all possible side reactions and the temperature at which such effects would begin.

5.8 Small Vessels Some vessels may be sufficiently small for rupture in a fire to be regarded as a minor risk so that pressure relief need not be provided. The following hazards should be examined before making any decision not to provide pressure relief: (a) Pressure energy (depending on pressure at failure and volume of vessel). (b) Nature of contents likely to be released.

(c) Damage likely to be caused by fragmentation, blast, etc. In the case of pressure energy, guidance is given in SI 2169 - "The Pressure Systems and Transportable Gas Containers Regulations 1989" for exemption from registration. Exemption may be granted for equipment which meets both the following criterion: The product P x V is less than 0.25 bar g m3 where: P = design pressure (bar g) V = vessel volume (m3) These regulations come into force in July 1994. The existing regulations granted exemptions if: P x V is less than 1 bar g m3 and design pressure less than 7 bar g.



These remain valid until July 1994. It is strongly recommended that the criterion of P x V < 0.25 bar g is used for all new designs and modifications. Provided that the vessel is not greatly overdesigned (i.e. it would only rupture at many times the design pressure) the same criteria may be used when considering the possible elimination of pressure relief devices on a small vessel. Caution shall be exercised, however, when using these criteria to justify that there is no need for pressure relief where: (i) very high -pressure can be generated in a fire (e.g. cylinders containing LPG); (ii) brittle fracture can be a possibility;

(iii) any potential cause of metal failure such as corrosion can be recognized.

6 PITFALLS WITH FIRE During stand by, start up or shut down the fluid in the equipment may be totally different from that during normal operation. The relief system shall be designed to cope with the worst case identified by a study of all possible normal and abnormal operating conditions. Often, many items subject to different events are included in the process equipment system for which fire relief will be provided and this means that careful attention should be given to the following aspects: (a) Fire relief should not be assumed to be the limiting case for pressure relief. The required relief rate for each event should first be evaluated. (b) High pressure losses can be built-up within the process equipment system itself if each item and all interconnecting pipework are not adequately designed so that material can flow without restriction to the relief outlet. This is a very important aspect in the case of fire relief. Typical examples of the effect of restrictions are:



(1) condensers that can become flooded; (2) overhead pipework connected to a reflux drum on ground level that can be liquid-logged. British Standards govern the provision of fire relief on certain vessels such as air receivers, refrigeration units and steam boilers or receivers. See Part A of this Guide.

SECTION 3: PROCESS ABNORMALITIES

(Mal-operation and Process Aberration)

7 INTRODUCTION Whenever intervention by operators is used in the operation of a process plant or any other equipment, mistakes can and do occur; any such event is called "mal-operation". If there is a potential for pressure rise such mal-operation would be serious unless its effects are considered and provided for at the design stage. Similarly, pressure rise may be caused by malfunction of the process as a result of: (a) Unusual operating conditions. (b) Inconsistent raw materials. (c) Unknown features inherent in the process. Any such event is called II process aberration II • All credible events of either type that could occur should be examined. The study is applied to continuous process plant while on line, starting up or shutting down and during shutdown periods; it is also applied to batch operations at all phases of the operating cycle. These events should be considered for each of the previously given PLANT OR PROCESS CONDITIONS that is possible in the given situation. See 2.1 & Table 1. The aim is to identify any combination of factors that can lead to a relief situation. Hence, both those events that can directly cause overpressure (or underpressure) in the existing CONDITION of the plant or process and those that create a new CONDITION in which the system is prone to overpressure (or underpressure) are included in this Section.



8 SYSTEM BLOCKED-IN (CONDITION 1) 8.1 General Considerations

This condition can arise with any equipment which can be isolated or shut down whilst containing liquids or gases. With continuous processes, the blocked-in condition usually arises from mal-operation but with many batch processes the equipment is deliberately isolated and blocked-in during normal operation. When blocked-in, the contents can be subject to energy input from: (a) A heating service. (b) Stored up thermal energy. (c) Sources of mechanical energy. (d) Chemical reaction. The following typical situations are some that can occur when a plant is shut down or put on standby: (1) Vessels isolated while containing liquid - as occurs during many batch processes. If partially filled, consider the vapor pressure; if completely filled, see (2). (2) Pipelines and vessels isolated while full of liquid. They may require relief protection from hydraulic expansion; consideration should be given to the need for relief whenever liquid can be trapped between isolation valves. See Section 5 and Part C, Section 8 of this Guide. (3) Machinery (pumps especially) left full of liquid when shut down. With very large pumps or those handling cryogenic liquids the pump casing may need to be fitted with a pressure relief device; thermal relief via the seal may be adequate in some cases but not always acceptable. See Section 5 and Part C, Section 8 of this Guide.



8.2 Mal-operation After a blocked-in CONDITION has been created a number of EVENTS can subject the equipment to energy input; any such event which is a mal-operation may cause overpressure. Note the following examples: (a) Heat exchange equipment continuing to transfer heat into the system after the heat sink has been isolated. (b) Electric heaters, if not switched off, may raise the temperature sufficiently to weaken metal walls as well as heat the contents. This could create a need for relief at a pressure lower than the design pressure. (c) An agitator or pumped circulation system left running after a vessel has been isolated can be a source of energy input that would raise the temperature sufficiently to cause appreciable hydraulic expansion, initiate abnormal chemical reactions or significantly increase vapor pressure. (d) Circulation pumps running on total recycle (kickback) can similarly heat the contents of the process equipment system with the same effects.

Note: Shaft seals may be damaged by a pressure which is within the safe working pressure for the pump body and other parts of the equipment.

(e) Chemical reactions may be:

(1) operated intentionally under blocked-in conditions, See 11.3; (2) accidentally blocked-in by mal-operation (e.g. wrong closing of valves); (3) blocked-in by malfunction (e.g. blocking of lines by inadvertent solidification).



8.3 Process Aberration Blocking of lines and equipment is covered under RESTRICTED OUTLET and also RESTRICTED INLET. Apart from abnormal chemical reactions there are other instances of unusual behavior that can cause a pressure rise in either the blocked-in or restricted outlet condition. See Clauses 9 and 10. The following is one such case that should be examined when appropriate. Roll-over is a phenomenon originally experienced with many large liquefied natural gas (LNG) storage tanks due to the formation of an unstable system of liquid layers of various densities and temperatures. Such instability may be caused in several ways, particularly by: (a) Feeding of a higher density liquid on to (or near to) the surface of a lower density liquid. (b) Feeding of a lower density liquid to the bottom of a vessel containing a higher density liquid. This cause of unstable layering is less likely than (a) because of the upward displacement resulting from the inflow. (c) Evaporation of more volatile components from the upper layers, following heat input from the environment so that these layers become more dense than the lower layers. (d) Heat input to lower layers (e.g. by base heating) that can increase the temperature and decrease the density to a value less than that of upper layers. The result may be that an unstable condition is set up in which the hydrostatic head temporarily prevents the boiling of the lower layers. If this unstable condition is disturbed, the higher density layers begin to sink and lower density layers to rise; once this happens, mixing of the layers can rapidly accelerate. The subsequent attainment of new equilibrium conditions may be accompanied by a violent boil-off of LNG.



This is due to material containing more volatile components suddenly achieving a higher temperature by mixing and/or material rapidly reaching a zone where the hydrostatic head is lower. Such boiling is capable of generating considerable overpressure. Similar phenomena have occurred in atmospheric storage tanks and should be considered wherever liquids of different densities and boiling points can be layered and stored for long periods of time. Every effort should be made to design out the likelihood of roll-over. There are two principal approaches available: (1) Design to ensure adequate mixing at all times (e.g. by provision of jet mixing facilities). (2) Assume that layering will occur and where there is a risk of subsequent mixing being caused by thermal effects, minimize the risk by use of effective insulation.

8.4 Pitfalls with Blocked-in Equipment (a) Heat exchangers have two sides and need to be treated as two vessels one of which is an energy source to the other. (b) A relief situation can be generated in heated pipes irrespective of ambient conditions. Estimation of maximum achievable temperature followed by a consideration of resultant pressure effects is required for all heated lines (including steam-traced, jacketed and electrically heated pipes). (c) Internal rupture can occur in canned motor pumps and certain other items having a weak internal wall despite the fact that the outer casing may be adequately designed. Take the maximum differential pressure into account. (d) The layering of two immiscible liquids may be a potential cause of a relief situation if boiling would occur when the layers are mixed. See 9.1.2.3.



9 RESTRICTED OUTLET (CONDITION 2) 9.1 Mal-operation 9.1.1 Outlets Closed or Restricted

Equipment items often suffer the total loss of one or more outlet paths due to closed valves and mechanical equipment. This condition may be either normal to the process or result from a mal-operation or failure. Examples of such mal-operations are: (a) Inadvertent closure of valve(s), or valve(s) incorrectly remaining closed during or after start up. (b) Incorrect closure of more than one valve at the same time during changeover operations of spare equipment or during batch operations.

Note: Non-return valves on inlets operating the way they are intended ad in same way as a blockage and should not be disregarded. See Part C, Section 3 of this Guide.

(c) Sudden stoppage of machinery, for instance a compressor. This is frequently accompanied by backflow from the downstream high pressure source through the bypass or through the machine itself. (d) Incorrect setting of a controller causing partial or total control valve closure. There is a high risk of these events during start up and shutdown operations. Most EVENTS which lead to pressure rise under BLOCKED-IN CONDITIONS also apply to RESTRICTED OUTLET and will not be repeated here. See 8.2. Note: Pressure surge (over or under pressure) may be caused by any of the above mal-operations and sometimes by normal operation, in which case special design considerations may be invoked. See Part C, Section 9 of this Guide.



9.1.2 Outlets too Small There are also process mal-operations which generate or admit to the equipment so much vapor or liquid that although it is on-line with its normal outlets functioning, fluid accumulates so that the pressure rises above normal. The events listed below can also occur while the outlets of the vessel are closed, for instance during start up, stand by or shutdown.

9.1.2.1 Gas Breakthrough Liquid is frequently transferred under gas pressure into another vessel (often a low-pressure storage tank) through a regulating valve or other device. The valve may fail to close when all the liquid has been transferred and gas will pass through the line so that the low-pressure vessel can be subjected to the higher (blowing) pressure. If its design pressure is less than the blowing pressure it will require relief protection. Deliberate line blowing is often used to empty pipelines completely after movement of material into a storage tank - especially when the material solidifies easily. Always consider the risk of over pressuring the receiving vessel.

9.1.2.2 Liquid Overfilling Liquid overfilling of storage tanks is often possible, and an overflow large enough to accommodate the "pump in" rate of liquid feed is needed. Whenever such an overflow is not practicable, the pressure relief system shall be sized to pass this flow. Liquid overfilling of process vessels is less often recognized as a potential demand on the relief system. However, repeated operating experience has shown that it is quite possible to fill even the largest distillation columns with liquid and for it to take many hours for operating teams to establish what is happening. Liquid overfilling is a particular problem during start-up, when instruments are being brought into commission and when the plant is far from steady state. Accidental misrouting of streams and the unavailability (or mis-calibration) of instruments may result in incomplete or misleading diagnostic data which can take hours or even days to resolve.



The consequences of a major ingress of liquid into a relief system which is not designed for it can be very serious: the pipework and its supports may not be designed for the weight; the pipework may be damaged by slugging; the liquid knock-out and pump-out systems may be overwhelmed; the relief system capacity may be reduced to the extent that other demands cannot be handled. In the worst case, a loss of containment may occur, followed by a possible fire or toxic release. For the design of the relief system, it should be assumed that ANY process vessel, regardless of size, is capable of being flooded with liquid. This requirement should only be relaxed following a hazard analysis of the installation, or if an assessment of the inventories in the system shows that overfilling is not a credible event. For potential relief cases with liquid flowrates, designing out the relief case is strongly recommended. This requires a combination of suitable instrumentation and operator action. To "design out" liquid overfilling as a relief case, at least an independent, diverse, extra-high level alarm will be required and on critical applications an independent third instrument may be needed. The alarms shall be allied to suitable operator training so that immediate action can be taken. Consideration should be given to hard-wiring important alarms (as opposed to routing them solely through a Distributed Control System) so that the alarms remain effective if the DCS loses power. There are a number of pitfalls in considering liquid overfilling of process vessels: (a) The belief that a particular vessel is too big to overfill is misguided. Experienced operating teams have overfilled distillation columns of over 500 rn3 volume. (b) Many level instruments rely on an assumed liquid density to convert the measured parameter into an equivalent liquid level. During actual operation, and particularly during start-up, a range of densities may be experienced by the instrument. If the actual density differs from the calibration density, the level the instrument indicates will not be the true level. This can result in alarms and trips coming in at the wrong level (if at all). (c) A realistic view should be taken of the actions an operator can take to prevent overfilling. In particular, allowance should be made for the increased response time of an operator when under stress as well as the practical limitations on what the operator can do.



Sufficient instrumentation should be available to help the operator to diagnose the problem and effective action should be possible (e.g., by using an alternative disposal route or by stopping a feed stream). (d) Any instrumentation provided should be located to give a realistic amount of time for action. On some distillation columns, the extra- high level alarm is located half way up the column to indicate that a very serious problem is developing which needs immediate attention. Instrumentation for instrumentation's sake is not good enough. (e) Normal disposal routes may not be available, especially if loss of the normal disposal route is the cause of the problem. The proposed disposal route needs to be able to handle not only the rate, but also the quantity of material. Problems can be particularly acute during start-up of new equipment when construction debris can result in the rapid blockage of pump suction strainers. If the duty is hot, these may take several hours to cool before cleaning can commence. A similar blockage on the spare pump, during this time, will result in a loss of pump-out capability. (f) Large vapor duty designed to protect reboilers on a distillation column can pass considerable quantities of liquid if the column overfills. While this may occur at any time, there is an increased risk of it happening during a start-up or shut-down. The designer is cautioned to pay particular attention to the composition of the liquid which may be discharged, as this may be very different from the normal flowsheet. (g) In general, care needs to be taken over the composition of the liquid discharged by the safety valve: during start-up, compositions may be very different from design and this can cause problems in the disposal system. Unexpected corrosive materials, materials which cause chilling as they flash or materials which may undergo chemical reactions or phase changes may enter the disposal system with unforeseen results.



9.1.2.3 Contact Between Immiscible Liquids Hot heavy "oil" added to water or vice versa can cause violent boil-off with the release of large volumes of steam as a result of heat transfer to the water layer if the oil is above 100 o C. A similar effect may occur as a result of contact between any two immiscible or partially miscible liquids even if the resultant temperature is below the boiling point of both liquids. If the sum of the two vapor pressures is greater than the design pressure, relief will be required for vessels where such liquids are mixed. (Ref 5).

9.1.2.4 Low-Pressure Storage Tanks Low-pressure storage tanks are very susceptible to process mal-operation as they are frequently operated intentionally in the closed outlet condition. Such tanks should be fitted with a pressure/vacuum relief system which can be expected to operate frequently unless the vessel is also provided with a gas blanket control system. Their low design pressures (normally less than 100 mbar g positive pressure and less than 10 mbar g negative pressure) make them vulnerable to overpressure or underpressure by more events than are other vessels. Note: The mal-operations listed as 9.1.2.1, 9.1.2.2 and 9.1.2.3 tend to occur most frequently with low-pressure storage tanks; the risk is, however, not limited to these and should be considered for any type of equipment where the design pressure might be exceeded.

9.2 Process Aberration 9.2.1 General Considerations

Some aberrations in the process can cause the total loss or partial restriction of one or more outlet paths from equipment. Consider the behavior of the process under normal and abnormal operating conditions. Question whether blockages or other disturbances, either total or partial, can upset the mass and energy balance within the plant.



Side reactions which may be insignificant to the process yield can sometimes produce small amounts of products that can cause blockages (e.g. tars). The presence of gas and liquid together can lead to choke flow velocities much lower than the sonic velocity of the gas stream alone and so reduce the effective outflow.

9.2.2 Causes of Blockage Some examples are listed below: (a) Freezing: to form a solid blockage or restriction is a danger in many plants, particularly when an aqueous liquid is processed or steam inerting of vessels or stacks is used. (b) Solid Hydrates: are formed by certain process fluids, particularly hydrocarbons, when contaminated with traces of water. These can then collect in low points or low velocity areas and build up to form a solid blockage. (c) Degradation Accompanied by Polymerization: occurs with many reactive chemicals with the formation of long-chain solid or jelly-like polymers. This may occur when they are heated or contaminated or simply stored for a long period. The addition of stabilizers may prevent this but if there remains any risk of blockage it should be considered. (d) Iron Scale and other Corrosion Products: can also cause blockages; opportunities for this to happen especially in carbon steel lines of small diameter should be identified. (e) Settling of Slurries/Suspensions: can cause blockages in low velocity zones. Suspensions that are highly non-Newtonian can become immobile as a result of a relatively small reduction in the driving pressure. (f) Sublimation: of many products which are stored hot can be a problem because blockages may form where the vapor cools near the exit of a tank or vessel.



(g) Entrainment: of liquid droplets is a frequent cause of blockages or partial blockages. Entrainment is caused by high gas velocities, especially where the gas stream impinges directly on to a liquid surface. Coalescence and deposition is likely to occur in parts of the system where the velocity is lower and may possibly give rise to an hydraulic head. If the material can solidify in cooler zones downstream it is likely to cause a blockage. (h) Sparging of Gas: through a liquid in a vessel or evolution of gas within it may cause the liquid to "swell", without disengagement of the gas, enough for it to enter the gas/vapor off take line; this may also lead to blockage or restriction of flow. (i) Foaming: can also be a cause of entrainment and this possibility should be examined in relation to any tendency of the liquid phase to form a stable foam. (k) Dust, Floss and Fine Solid Particles: are often carried over by gas streams and may cause blockages downstream.

9.3 Pitfalls with Restricted Outlet Condition (a) Positive displacement machinery is frequently provided by the manufacturer with its own pressure relief protection against a closed outlet. Check the capacity of the valve fitted against the required relief rate taking account of:

(1) the increase in density of gas after compression; (2) any significant difference between gas density under normal operation and relief conditions.

(b) Pumping of liquid into a vessel expels gas/vapor. With inflow of volatile liquids the outflow volume may be significantly more than the incoming liquid volume due to saturation of the blanketing gas with vapor. This is a normal operation for storage tanks and creates a frequent demand on the relief system which should be designed to discharge to a safe place.



(c) When pressure relief is provided on a system prone to blockages caused by entrainment and solidification, the risk of blockage of the relief system itself shall be considered and prevented. (d) Flame arresters frequently have a tendency to get blocked. In many countries the design requires statutory approval and some of these approved designs are difficult to check for freedom from blockage because of their mode of construction. Thus flame arresters fitted to relief lines and vents can create more danger than they prevent. Therefore, unless it is a mandatory requirement, arresters should only be fitted after careful study of the risk of blockage. If it is necessary to use a type which cannot be properly inspected, ensure that an emergency relief path is provided in addition. (e) Increased pressure drop may build up inside process equipment as a consequence of liquid accumulation (e.g. by flooding of distillation columns).

10 RESTRICTED INLET (CONDITION 3)

10.1 Equipment at Risk In this case, the risk to be considered is the effect of system under pressure or vacuum. Always examine the vessel design for the lowest pressure that could be created. Large vessels are obviously more likely to be unable to withstand reduced pressures since general mechanical rigidity requirements usually provide ample strength with small vessels. If the vessel would be damaged by the lowest pressure attainable, a vacuum relief device will be required. In practice, low-pressure storage tanks and many other vessels designed for positive pressures up to 5 bar g. (but not specifically designed for vacuum) will usually require protection against the effect of sub-atmospheric pressures. In many cases the event likely to cause a vacuum situation is the reverse of that likely to cause overpressure, i.e. outflow of mass or energy rather than inflow.



10.2 Events Leading to Underpressure (Vacuum) The following events are usually the result of mal-operation: (a) Removal of Liquid: by pumping out or gravity drainage.

Note: Drainage of low-pressure tanks after hydrostatic test is a special case of this situation; it is usually covered by special operating procedures intended to eliminate the risk. However, the possibility of mal-operation may need to be considered.

(b) Removal of Gas: by connection to a low-pressure system - e.g. vacuum pump. (c) Cold Liquid Injection: into any vessel containing hot vapors can cause a very sudden and rapid condensation; this will lead to a severe drop in pressure unless the volume of vapor is replaced. A smaller but significant drop may be caused by gas cooling, without condensation. (d) Gradual Cooling: of any plant equipment items containing condensable vapor for example during a plant shutdown, or the loss of steam to a reboiler may cause a reduced pressure relief situation as a result of condensation. (e) Absorption, either Chemical or Physical: can remove gas from the system and cause a fall in pressure possibly leading to a low- pressure relief situation. This might occur as a result of process aberration - e.g. unexpected reaction or emergency cooling of some associated vessel. Examples of this situation are:

(1) rapid pressure reduction due to absorption of vapor when washing out a column filled with a water-soluble gas - e.g. ammonia or amine vapor; (2) slow pressure reduction following oxygen absorption by rusting or oxidation processes in items out of service and containing water.



(f) Ambient Temperature Fall: with consequent condensation of vapor and/or contraction of gas causes an inbreathing requirement. For further guidance on vacuum relief requirements refer to Part C, Section 7 of this Guide. See also Section 5.

10.3 Pitfalls with Restricted Inlet In systems where air ingress could result in formation of an explosive mixture and there is a risk of ignition, the vacuum breaking medium supplied to the relief system should be an inert gas. It may be preferable to design the system to withstand full vacuum.

11 CHEMICAL REACTION (CONDITION 4) 11.1 Normal and Abnormal Chemical Process

Many chemical reactions have a potential for producing gas or vapor especially when the temperature rises. Excessive pressure will be generated in the system whenever the volume rate of the gas/vapor evolution exceeds the (single or two-phase) volume outflow. In a blocked-in system the pressure may rise simply because of an increase in vapor pressure with temperature rise caused by any exothermic reaction or it may be due to evolution of a gas during the normal process - i.e. no chemical abnormality. The reactions involved may be either the main process reaction or unwanted side reactions. Some circumstances in which a need for pressure relief may arise are given below: (a) Limitation of normal gas/vapor outflow from the system due to BLOCKED-IN or RESTRICTED OUTLET CONDITIONS. (b) Heat balance disturbed so that the temperature rises (e.g. excessive heat input or decreased heat removal via heat exchangers). (c) Reaction rate greater than design rate as a result of other abnormal conditions or materials. (d) Initiation of side reactions which generate more gas or heat than the normal process. (e) Any combination of (a), (b), (c) and/or (d).



11.2 Runaway Reaction

A special case of 11.1 (b) is that of an exothermic reaction that accelerates until it is out of control - the so called "runaway condition". This situation can arise with many reaction mixtures where the rate increases with temperature. Irrespective of the cause of an initial increase in rate above normal, the reaction will accelerate if the corresponding heat of reaction is not removed. Extremely high rates of vapor evolution may then be achieved which demand very large relief system capacities particularly when a large proportion of the mixture is volatile. Very large relief capacities are also needed when a two-phase vapor-liquid mixture is likely to enter the relief system as a result of rapid evolution of vapor. See 11.3 and Part C, Section 5 of this Guide. Some processes that involve evaporative cooling of exothermic reactions and are normally overall heat-absorbing processes may self-heat and accelerate if outflow of vapor from the reactor is restricted. There is a noteworthy potential for generation of overpressure in the case of reactions involving materials (particularly polymers) having a tendency to break down into smaller molecules when overheated. When the breakdown products are volatile (as is often the case) there is bound to be a large increase in pressure within any confined system. Thus the CHEMICAL REACTION CONDITION should be examined in relation to other CONDITIONS obtaining at the time. Abnormal reactions can be initiated by numerous mal-operations and process aberrations (See 11.3). The assessment of potential for a chemical process to become self-accelerating should always be based on relevant chemical information obtained from internal records, published information or new investigations; the information needed is primarily: (a) Kinetic and thermodynamic data for the normal reaction. (b) Possible mechanisms for reactions other than the normal ones and also kinetic and thermodynamic data for these (either known from experience or deducible from the chemistry).



When doubt exists, an experimental investigation will be necessary to determine the effect of any abnormal conditions that can be envisaged.

11.3 Chemical Reaction in Relation to Prime Events 11.3.1 Fire

Overheating by fire may be local or general and cause gross chemical abnormalities and degradation of materials. See Section 2.

11.3.2 Mal-operation Many errors can lead to abnormal reaction in both continuous and batch processes. For general guidance a few of these are given below: (a) Cooling system: wrong setting of temperature controller or manual valves on coolant circulation. (b) Evaporative cooling: restriction of vapor outflow, reflux flow or vacuum control as a result of a faulty controller or setting. (c) Vapor/Gas outflow: restriction as in (b) when vapor or gas is normally removed from the system as part of the process. (d) Abnormal reactant, catalyst or solvent: wrong material or concentration due to incorrect charging or rate of feeding of the reactants. Question whether catalyst can be charged twice and whether incompatible materials in use close by could be a source of contamination. (e) Abnormal or Irregular feed rates: many batch processes where reactant(s) are added semi-continuously or stepwise are sensitive to this fault - rapid overpressure generation may result from a surge in reactant feed. (f) Agitator or mixing reclrculator switched off: this fault is a common cause of loss of cooling, abnormal local concentrations and conditions, phase-separation or layering. See Section 4.



11.3.3 Process Aberration Many process aberrations are possible and it is essential to identify those EVENTS that can lead to overpressure. The effect of all feasible irregularities on the chemical reaction should be examined. Some frequent causes are given as examples: (a) Inadequate agitation: an agitator design incapable of handling all possible forms of the mixture that can be present throughout the cycle (especially with highly viscous or highly non-Newtonian material) can lead to the situations given in 11.3.2(f) and also create an agitated inner core surrounded by static material. Large concentration and temperature differences may accompany such a condition. See 11.3.1. (b) Abnormal concentration or activity: a gross abnormality in the quality of the reactants, solvent, or catalyst can lead to exceptional reaction rate or unintended chemical changes. (c) Abnormal chemical behavior: a local hot spot or abnormal local temperature can also initiate abnormal reactions, decomposition, etc. Heating systems should be designed to avoid this possibility. (d) Inflow of Incompatible reactant: an event that can happen in many situations such as backflow from associated equipment - e.g. irrigant from an off-gas scrubber after the scrubber outlet has become blocked or restricted (e) Temperature control system: the normal system may not be capable of removing sufficient heat under some unusual conditions - e.g. abnormal reactivity (as above) or as a result of fouling of cooling surfaces. 11.3.4 Equipment Failures These are covered in Section 4 but some are mentioned here because so many equipment failures can affect chemical reactions in such a way as to lead to overpressure. Such failures include: (See Section 4, sub-clause 13.2)



(a) Metal exposure: in the case of a non-metallic protective lining, contact with metal following breakdown of the lining material can initiate abnormal chemical reactions and possibly very high rates. (b) Control systems: loss of effective cooling is an obvious possibility for initiating abnormal reactions as mentioned earlier. Many other control failures can lead to abnormal chemical process behavior.

11.3.5 Service Failures There are many circumstances when failure of a service can upset the chemical process, some of which are quoted in Section 4. A service failure may cause overpressure directly but it may also initiate abnormal chemical changes or rates of reaction. Every such possibility should be considered in relation to the sensitivity of the materials and process to changed conditions. See Section 4, Clause 14.

11.4 Underpressure Relief Underpressure can occur in many circumstances as a result of chemical reaction in low-pressure equipment following mal-operation or plant failures. It is only a problem when coincident with closed or restricted inlets and for pressure relief purposes it is no different from physical absorption; this problem was therefore covered earlier. See 10.2 (e).



SECTION 4: EQUIPMENT AND SERVICES FAILURES

12 INTRODUCTION

Relief situations may result from a variety of failures outside the control of the designers or operators. Such a failure may: (a) Directly cause a relief situation (e.g. escape of high pressure fluid from a burst heat exchanger tube into lower pressure equipment). (b) Indirectly cause a relief situation (e.g. failure of temperature controller or sticking of control valve allowing temperature to increase). (c) Start a chain of events leading to a relief situation (e.g. steam supply failure allowing pipeline to cool thus causing solidification of process materials and hence blockages). Relief situations can be caused by failure (partial or total) of mechanical or electrical equipment, instruments and any service supplied from outside the plant. This Section is, for ease of reading, subdivided into equipment failure and services failure. The designer should bear in mind that any such fault may cause other prime events (e.g. overheating due to cooling water failure can initiate many forms of process abnormality). See Table 1.

13 EQUIPMENT FAILURE 13.1 System Blocked-in or Restricted Outlet (Conditions 1 and 2) 13.1.1 Factors to Consider

The process equipment system may be normally blocked-in or restricted. It may also be put into one of these conditions by the loss of one or more exit paths as a result of mechanical failure (e.g. control valve failure). On the other hand, a failure can cause a sudden increase in mass inflow from a high pressure source which overloads normal outlets (e.g. burst tube).



The possibility of overpressure resulting indirectly from any credible failure of equipment should be examined even if the direct effect of the failure would not be hazardous.

13.1.2 Failures Involving Interstream Leakage (Heat Exchangers and Similar Items)

Equipment failure is particularly important in the case of heat exchangers. Because the two sides of the common types of heat exchanger usually operate at different pressures, the principal hazard is interstream leakage into a low-pressure system. Any interstream leakage, especially a major leakage following tube rupture, may overpressure both the low-pressure side of the exchanger and any associated equipment. The heat exchange surface may be contained in a vessel which has other functions - such as a coil in a reactor; in that case the leakage will commonly pass from coil to vessel contents but may well pass into the coil from a vessel at higher pressure. The source of high pressure fluid may be contained in either upstream or downstream equipment. Minor internal leaks can be important when equipment is blocked-in but are much less likely to be so in the restricted outlet condition. When assessing the need for pressure relief take account of factors such as : (a) Whether a relief system is required for any other reason, the additional effect of interstream leakage being small by comparison. (b) Whether the size of the leakage path is likely to be so small (e.g. pinholes) that the leakage can be neglected provided there is no danger of secondary effects of fluid mixing. (c) Whether leaks can give rise to more significant secondary effects, e.g. abnormal chemical reaction, swelling or explosive boiling. The mode of failure to expect depends upon the type of heat exchanger; thus advice on the types of exchanger commonly used is given as follows.



13.1.2.1 Shell and Tube Exchangers In shell and tube exchangers the most severe failure is tube rupture in which case the tube is assumed to have broken apart exposing two open ends. Experience indicates that a likely form of failure is a longitudinal split and checks have shown the leakage area to be equivalent to two open ends. It is important to decide whether such failure is credible and whether the relief system should be designed accordingly. When making this decision the relief systems designer should consider: (a) Whether the occurrence of a tube rupture while in either the blocked-in or restricted outlet condition requires the coincident failure of two independent items. If so, it may be possible to discount the event as a sufficiently unlikely combination of circumstances. (b) Whether the standard of mechanical design, after allowing for any corrosion and erosion that are to be expected, is such that there is a negligible probability of rupture. (c) Whether under the most unfavorable conditions the normal process outlets are sufficient to relieve the effect produced by the maximum possible inflow of energy or fluid. (d) Whether tube rupture may be ignored on the basis that it would not cause the low-pressure side to be stressed to a greater extent than it was during its pressure test, making due allowance for the actual shell temperature perhaps being very significantly different from the test temperature. Any decision to avoid the need for a relief system on the basis of test pressure rather than design pressure shall be made only with the full agreement of the vessel/equipment design engineers. See Part C, Section 2 of this Guide.

Note 1: The "API 2/3 rule" is based on this philosophy (see API RP 521, 1979 para 3. 16.A). Assuming that the hydrostatic test pressure was 150% of design pressure, this rule states that "the necessity for a pressure relief device need not be investigated whenever the design pressure for the low-pressure side is equal to or greater than 2/3 of the operating pressure of the high pressure side ",



However, it makes no allowance for operating temperature being different from test temperature or the pressure (H. P, side) at the time of failure being greater than the normal operating pressure. Only when the temperature conditions are acceptable and the vessel has been designed to a code that calls for the appropriate test pressure can this rule be applied, Note 2: In the blocked-in condition any overpressure resulting from tube rupture will affect only the process equipment system defined. This may not be so should the event occur in a closed or restricted outlet condition. Note 3: For position of rupture to assume refer to the relevant calculations section. See Part C, Section 2 of this Guide.

13.1.2.2 Coils in Vessels Heating and cooling coils can fail in much the same way as tubes in a shell and tube exchanger and the consequences of failure should be assessed in a similar manner. It is more likely (in this case) that account will have to be taken of small leaks (e.g. pinholes caused by corrosion) because of the danger of secondary effects (particularly chemical).

13.1.2.3 Plate Exchangers Plate exchangers may suffer from gasket failure or from pitting of the plates by corrosion causing interstream leakage. However, the design pressure of both sides of the exchanger is the same and one or both sides may be provided with a relief system for other reasons. Relief to protect specifically against interstream leakage is therefore not generally necessary unless mixing of the two fluids would cause a rise in pressure requiring relief at a rate more than the capacity of any other relief system. Leakage to atmosphere is a much more likely fault than interstream leakage.



13.1.2.4 Spiral Plate Exchangers These exchangers can fail at the longitudinal rim weld between the two spirally wound plates. Also, the supporting spacer studs between the plates can fail by fatigue and cause leakage. For structural reasons the design pressure of both sides is usually the same though there may be a significant pressure difference at the moment of failure. (See 13.1.2.2 with respect to pin-holing).

13.1.2.5 Plate Fin Exchangers Like other plate type exchangers especially spiral plate types, finned exchangers are likely to suffer only minor interstream leakage. Therefore only nominal relief is needed, provided that: (a) The duty is clean and the contents are known to be non-corrosive (also check for any risk of exposure to corrosive materials during occasional wash-out or warm-up operations). (b) Each side is separately leak tested after manufacture and shown to be completely leak-tight.

13.1.2.6 Double Pipe Exchangers The inner pipe of such exchangers is frequently made from pipe of the same schedule as specified for the process equipment system of which the exchanger forms a part. In that case the inner pipe is no more likely to rupture than any other pipe in the system. Thus, tube rupture need not normally be considered. The possibility of a small amount of interstream leakage due to pin-holing at welds etc. should be considered, especially when there are welds on the inner pipe and, when the outer pipe can be "blocked-in", the situation may call for a relief device if there are no other reasons for providing one. It may be inadmissible to discount tube rupture if a significant amount of corrosion can be expected on either side of the pipe wall. However, as with shell and tube exchangers, if the pressure differential is such that interstream leakage would not seriously overstress the low-pressure side (see 13.1.2.1) then tube rupture need not be considered.



The possibility of collapse of the inner tube may have to be examined in extreme cases of high pressure in the jacket.

13.1.2.7 Lamella heat exchangers (Alfa-Laval) These exchangers are seldom used and each situation calls for special study. The lamella tubes are seam welded along their entire length and welded to the headers. Weld failure is the most likely form of defect. They should be treated like other plate exchangers noting that minor leakage along the seam weld is the most likely defect and will give rise to interstream leakage.

13.1.3 Fired Heaters

In a fired heater, overpressure can occur in either the heater tubes or the firebox. The problems are quite different and should be considered separately.

13.1.3.1 Overpressure of the Heater Tubes

There are three potential causes of tube failure: (a) Overpressure at or below design temperature: This problem can be caused either by material trapped in the heater tubes and exerting a high vapor pressure or by fluid entering the heater tubes from a high pressure source. Pressure relief should normally be provided by means of a relief valve which should be located on the heater exit to ensure that when the device opens, flow through the tubes is maintained. It is vital that the relief device is not located at the heater inlet where it would divert flow from the heater tubes though maintaining a flow through the low flow trip sensor - thereby maintaining unwanted firing of the furnace. (b) Overheating: Moderate overheating over a long period can cause tube rupture as a result of creep failure. Gross overheating for a short period of time may lead to rapid failure.



The major causes of overheating are: (1) Loss of process flow through the tube. (2) Flame impingement on the tube. (3) Coke formation on the tube. (4) Incorrect assessment of heat flux or operating temperature.

Note: Low flow trips to shut off fuel to the heaters together with various combinations of tube skin thermocouples and other high temperature alarms are fitted to all fired heaters. Nevertheless, any possibility of failure should be considered. Visual inspection of the firebox is used to detect flame impingement on tubes.

(c) Corrosion, erosion and mechanical damage: Consideration should be given to the possibility of enhanced rates of corrosion on surfaces exposed to local high temperatures (usually due to high heat transfer rates) and also to the effect of two-phase flow on erosion. Pipe supports should not rub on the tubes so as to cause mechanical damage.

13.1.3.2 Overpressure of the Firebox/Combustion Chamber There are three main causes of over pressuring the firebox/combustion chamber: (a) High discharge pressure from an air fan (often at start up air condition). (b) Burst tube (as discussed in 13.1.3.1 often followed by ignition of the leaking hydrocarbon (or other fluid). (c) Explosion due to excess fuel or low air flow to the firebox. This condition is usually protected against when the fired heater is on line, but may occur at start up or by residual heat/thermal inertia after a trip. See Part C, Section 3 of this Guide.



Elimination of (b) and (c) often requires a more detailed Hazard and Operability Study to ensure that the trip systems and operation sequences give adequate protection. This is needed because explosion doors and weak floors (furnace bases) cannot be relied upon to ensure the safety of people working near fired heaters.

13.1.4 Control System Failures

The failure of controllers and of control (instrument) valves should be considered individually while recognizing the chance of more than one simultaneous failure.

13.1.4.1 Controller Failure Heated vessels and pipelines are usually temperature controlled and the controller may fail to limit the heat input while the system is blocked-in. This could be due to a design error such as poor positioning of the sensing element or to a temporary fault such as a switching failure. In such cases the maximum energy input should be taken into account. To identify any failure that could lead to a relief situation, every possible controller failure should be considered.

13.1.4.2 Control Valve Failure A mechanical fault can cause a control valve to fail either open or shut irrespective of the direction of its response to a motive power failure. Normal control loop action cannot be assumed since the controller could be on manual control or in some cases on bypass. A few examples of the more common faults are: (a) A control valve in the outlet from a vessel fails shut while the inlet is open to a source of pressure higher than the vessel design pressure. Mass inflow continues and pressure increases possibly to the extent of causing a relief situation. (b) A control valve on a cooling system fails shut so that the process system overheats with consequent overpressure.



(c) A control valve, linking a high pressure source to a low-pressure system, fails open. In a restricted outlet situation, the available outlet(s) become overloaded and the pressure on the low-pressure side rises. (d) A control valve or trip valve fails shut against a long or fast flowing liquid column. If the closure is rapid, surge pressures (water hammer) may be sufficient to rupture vessels and lines unless relieved; See Part C, Section 9 of this Guide. (e) A similar fail shut valve closure at the inlet to a liquid column can cause cavitation and underpressure surges. The effect is the same as the sudden stoppage of a pump. See 13.2.4 and Part C, Section 9 of this Guide.

13.1.4.3 Common mode failures It is particularly important to identify every possibility of the so called "common mode effect" which occurs when a single fault or event can initiate two or more potential relief situations simultaneously. These situations are often associated with control system faults. Hence, all potential control system faults should be studied with the possibility of common mode effects in mind. It is not normally necessary to consider more than one coincidental control failure unless the failures can be directly related. The loss of instrument air as a result of which several control valves open fully, thereby causing several simultaneous flows into a vessel, is a simple example. Simple common mode effects like this are easily recognized and should be "designed out" or allowed for in the relief system design. It may be less easy to recognize others. For instance, duplicated trip valves or non-return valves are often installed when higher reliability is sought but remember that all valves could fail simultaneously if solids deposition occurred in the line. Similarly, separate impulse lines can be provided for separate flow or level instruments but if all lines can be blocked simultaneously by carry-over or build-up of some contaminant, then the expected increase in reliability will not be achieved.



13.1.4.4 Group Failures

The possibilities of failure of a group of control systems should be considered. Local motive power failure might close several outlets or inlets or both; site power failure would affect all control valves. One or more of these control errors may cause over pressuring of the process equipment system and the relief system will have to be designed for the total effect of all the related events.

13.1.5 Machines (and Ejectors) The sudden stopping of a pump or similar equipment can have the same or similar effect to that of wholly or partially closing an inlet or exit valve. Hence, the possible creation of surge pressures should be examined. See Part C, Section 9 of this Guide. Note: The isolating effect of certain positive displacement machines will influence the proper division of the plant into process equipment systems. See Clause 3. Some of the factors to consider with respect to machine failures are as follows.

13.1.5.1 Centrifugal Pumps/Compressors Because very large pressure differences may exist across a centrifugal pump or multi-stage compressor, there are a number of aspects, stated below, which need to be considered to ensure that no part of the system is over pressured. (a) In a multi-stage compressor, the design pressure rating for each stage is different and the points where the design pressure changes need to be clearly defined. See Part C, Section 4 of this Guide. (b) The maximum power input of the drive shall be specified whether it is limited by a control on speed, electrical power input, steam flow rate to a turbine or by any other mechanism.



(c) The full spectrum of operating conditions should be considered against the design specification. These include unsteady conditions at start up and the occurrence of a flow of abnormal fluid into the suction side of the machine. All the implications of different pressures and flow rates occurring in the machine should be considered. (d) In a multi-stage machine the effect of a relief valve lifting could cause significant changes in the flow pattern within the machine which can result in flow and pressure surges capable of damaging it. (e) Any recycle line from the high pressure to the low-pressure side of a machine to prevent the compressor surging (known as a "kickback line") and also minimum flow kickback lines on pumps have to be sited correctly in relation to the non-return valve(s) on the delivery side of the machine to prevent overpressure of the low-pressure side of the machine. (f) To prevent mechanical damage, many high level trips may be required to limit such conditions as:

(1) temperature on process side and of the lube oil; (2) level in liquid knock-out pots; (3) discharge temperature; (4) power input to the drive; (5) machine speed; (6) pressure surge. Any of these limits may affect the sizing and design of the relief system.

(g) Potential leaks within the machine, shaft seal failures and internal leaks to lower pressure sections of the machine (including the lube oil systems) need to be considered in detail. The identification and quantification of this cause of overpressure should usually be based on the machine manufacturer's experience. However, they cannot be entirely relied upon and their advice should be taken together with an independent assessment.



13.1.5.2 Positive Displacement Pumps and Compressors These machines effectively place a complete blockage in the line whenever the drive fails - thereby creating a blocked-in condition.

13.1.5.3 Ejectors or Mechanical Vacuum Pumps

When failing to maintain vacuum they should be regarded as a closed exit.

13.1.5.4 Cooling Fans on Air-cooled Heat Exchangers Removal of heat can cease as a result of mechanical failure. On air-coolers where independent operation of the louvers can be maintained, credit can be taken for the cooling effect obtained by natural convection to still air at ambient conditions. The performance data of the heat exchanger under these conditions should be obtained from the manufacturer. On a still or any system dependent on condensation to maintain control of the pressure, loss of condensation capacity should be treated as either a closed outlet or restricted outlet condition.

13.2 Restricted Inlet (Condition 3)

13.2.1 Factors to Consider Reduced pressure may normally occur or be generated in some parts of the plant due to condensation, gravity draining or operation of the vacuum system. Equipment which is not designed for vacuum or capable of withstanding it should be protected against accidental connection to a low-pressure zone or any other cause of internal reduction of the pressure. Equipment may sometimes be exposed to pressures below minimum design values as a result of mechanical equipment failure. See 13.1.5.

13.2.2 Failures Involving Interstream Leakage Failures of this type have been covered in 13.1.2 except that there the hazard was overpressure.



In certain cases such failures can lead to an underpressure relief situation where the leak is to a low-pressure zone and the equipment system is not designed for reduced pressure.

13.2.3 Control System Failures Unintended closure of inlets while discharging liquid can reduce the system pressure to a value well below atmospheric. (It may reach the vapor pressure of the liquid discharged and result in flash boiling with the risk of entrainment that can cause blockage of lines). See Section 3. The failure of a control system to open nitrogen valves which maintain blankets on low-pressure vessels is a common cause of the need for vacuum relief on storage vessels.

13.2.4 Machines The momentum of a moving column of liquid can be such that when a pump is stopped suddenly it can cause reduced pressures and possibly cavitation on its downstream side and when the pumped liquid has a low enough vapor pressure the effect of full vacuum in the pipe and downstream equipment should be considered. This is usually unimportant except for some piping materials such as GRP or concrete which are much less resistant to vacuum than conventional steel pipe. See Part C, Section 9 of this Guide.

13.3 Chemical Reaction (Condition 4) 13.3.1 Factors to Consider

A number of mechanical equipment failures can cause a process involving chemical reactions to behave abnormally and some of the more common ones are given below. All possible ways by which a chemical process could be affected by an equipment failure should be examined - especially for those processes involving exothermic chemical reactions which might go out of control (See 11.3).



13.3.2 Failures Causing Abnormal Chemical Behavior 13.3.2.1 Agitators

Stoppage of an agitator can result in poor heat transfer and lead to an imbalance between heat generation and removal. Agitator failure can also be dangerous if it leads to phase separation of reactants. Local concentrations of unreacted material then become abnormally high. Subsequent mixing of the two layers, either due to natural convection, interface boiling or especially restarting of the agitator, may initiate a sudden increase in reaction rate and heat generation. The increased heat output may well be in excess of the capacity of the heat removal system and lead to a relief situation. Many semi-batch processes are operated by the addition of one reactant to another in an agitated vessel, the addition rate being determined either by the heat removal or the off-gas venting capacity. Under normal well agitated conditions no appreciable accumulation of the added reactant occurs. However, under conditions of poor agitation or no agitation (or inhibition of the reaction by any cause) a potentially dangerous accumulation of unreacted material can be built up. Restarting the agitator or other disturbance may initiate an excessive reaction rate.

13.3.2.2 Control Systems Faults can cause over/under-charging of reactants to batch reactors giving abnormal reactant concentrations, with the possibility of initiating an abnormal or a runaway reaction. Similarly, in continuous or semi-continuous reactors the same effect may be produced by feed rate variations resulting from defects in the feed control loops.

13.3.2.3 Machines Failure of a subsidiary system, such as cooling water, can also lead to loss of coolant and consequent failure to maintain the reaction temperature and subsequently other conditions.



13.4 Pitfalls with Equipment Failure 13.4.1 Tube Rupture

Before deciding that relief protection is unnecessary not only the exchanger design pressure itself but also that of associated equipment (pipelines, instruments, condensate traps, etc.) should be compared with the maximum pressure achievable.

13.4.2 Leaks in Heat Exchangers Phase change or multi-phase effects with sudden pressure surges can arise, especially in liquid-filled exchangers. It may be necessary to increase the design pressure of the vessel(s) so that it (they) can withstand the surge pressure rather than to provide a relief system. A particular example of this is the leakage of water into hot oil, which can result in a pressure surge in excess of the design pressure of either shell or tube.

13.4.3 Slip Plates Ensure that their positions do not create subsystems (which would require separate relief), for example, by being placed too far from pipe specification breaks - particularly important when the pressure rating changes.

13.4.4 Plant Maintenance Hazardous situations can occur following maintenance work on the plant. Some of these can lead to unforeseen pressure build-up or prevent the operation of a pressure relief system unless additional safeguards are provided. Examples are: (a) Slip plates in wrong position. (b) Lockable valves in wrong mode. (c) Accidental blockage by trash.



Such risks should be considered and every attempt made to eliminate them by appropriate design or procedural arrangements.

14 SERVICES FAILURE 14.1 General Considerations

Any service supplying energy or materials can fail at any time and may, directly or indirectly, cause overpressure. For example, power or air failure to a pressure controller would directly affect the pressure while a temperature rise following a coolant service failure may ultimately cause overpressure through an increase in vapor pressure. It is necessary to consider the effect of failure of each service in turn and any coincidental failure that can occur for all possible CONDITIONS in order to identify any combination of events that could lead to a relief situation. The following sub clauses give advice about the possible effect of failure of the principal and some secondary services (See 1.2).

14.2 Principal Services 14.2.1 Cooling Water

Failure of cooling water over the whole plant can result from a pump or drive failure or blockage. It can occur on sections of plant or individual items, as a result of local isolation / blockage. Increased temperature is likely to result from cooling water failure and directly cause an increase in the vapor/gas pressure; an increase in reaction rate and/or initiation of abnormal chemical reactions may also ensue. Loss of condensation capacity may give rise to overpressure since excessive vapor flows have a similar effect to that of restricted outlets.

14.2.2 Electrical Power Power failure may be either total, in which all items of electrically operated equipment are simultaneously affected, or local, where one item of equipment or a group of items is affected.



14.2.2.1 Local Power Failure The resultant effects should be evaluated with respect to the function of individual items of equipment, such as pumps, fans or solenoid valves. Some general comments, however, can be made: (a) No credit should be taken for voltage dip protection (VDP) on electric drives as power failure should be assumed to be prolonged (but see (b) below). (b) In the event of marginal voltage dip some, but not all, electric drives may cut out. This can give rise to more serious relief problems than total power failure; for example, such possibilities as:

(1) the voltage dip being sufficient to bring stand by pumps into operation but not sufficiently long to trip out running pumps, has the effect of substantially increasing flows; (2) coincident relief from various sources being sufficient to cause overloading of relief headers.

Note: When sizing a combined relief header for several relief systems, hazard analysis will show the extent to which credit may be taken for voltage dip protection facilities.

Such combinations, once recognized, are usually better eliminated by appropriate electrical design. (c) Cooling fans and air·cooled heat exchangers stop on power failure has the same effect as mechanical failure. See 13.1.5.4. (d) Steam driven spare pumps should not be considered as substitutes, unless they are arranged to idle on-line and start to pump automatically on power failure. For cooling water duties, if the capacity of steam driven pumps is less than the normal rate, the effects of the reduced cooling water flow should be evaluated.



14.2.2.2 General Power Failure Additional effects that have to be considered are the failure of other services relying upon power for pumps, compressors, control functions, etc. particularly: (a) Cooling water. (b) Instrument air. (c) Heat transfer fluid. (d) Hydraulic oil. (e) Refrigerant. (f) Water services if pumped locally. Total power failure requires additional analysis of the combined effects of the multiple failures that result. Detailed considerations should be given to the effect of the simultaneous opening of several relief valves protecting different systems, particularly when more than one relief valve discharges into a common header system.

14.2.2.3 Restoration of Power Relief situations may arise when power supply returns and likely causes are the restarting of agitators and pump drives. Some factors to consider are: (a) Rapid mixing of liquid layers or solid liquid systems where abnormal concentrations have built up during stoppage of agitator; See 13.3.2. (b) Resumption of feed into vessel from which outflow has become restricted or closed during power failure. (c) Resumption of outflow from a low-pressure (weak) vessel to which inflow has become restricted.



(d) Reheating of trace·heated lines which have become blocked by solidification and also of electrically heated vessels whose outlets have been blocked. Note: Electrically powered drives mayor may not restart on restoration of power depending upon whether the contactor is: (1) Voltage sensitive without voltage dip protection (VDP). (2) Voltage sensitive with VDP. (3) Mechanical. If the uncontrolled restart of a drive could give rise to a relief situation it may be better to ensure that power to the drive will not be restored automatically than to provide a relief system.

14.2.3 Instrument Air Failure of air supply may apply to either the plant as a whole or areas supplied by a common instrument air header. It should be assumed that all control valves will fail open, closed or stay put as indicated on the engineering line diagram.

14.2.4 Steam: HP, IP, LP A prolonged failure may lead to solidification in lines which will result in blocked-in, restricted outlet or restricted inlet conditions after the supply is restored. Short failures of the energy supply are unlikely to cause relief situations but the restoration of supply following a short term failure can be hazardous. For instance, in a distillation column, when boiling ceases the contents "dump" into the re-boiler which then contains a more volatile mixture. On reheating, boiling starts at an abnormally high rate with transient over pressuring that may call for relief protection. Service steam may be generated in some part of the plant by removing heat in a secondary process loop.



The failure of such a steam system to operate may cause a relief situation: (a) In that part of the plant where heat is no longer being removed. (b) In another part of the plant as a result of loss of service steam (see above). Where steam systems at different pressures and levels of superheat are interconnected, failure in one system may affect another system.

14.2.5 Fuel Gas and Fuel Oil Prolonged and short term failures of fuel supply and the effects of restoration of supply (as for steam failures) should be considered. The main problems are likely to arise with direct fired heaters and re-boilers.

14.3 Secondary Services 14.3.1 Heat Transfer Fluids (hot oil, "Thermex", hot water)

These services should be treated in the same way as steam and fuel failures noting that any such failure may simply follow from power failure.

14.3.2 Hydraulic Oil

Some hydraulic equipment units (e.g. loading arms) are supplied complete with independent hydraulic control systems, consisting of accumulator, oil pump, reservoirs and control valves. The effect of failure of this hydraulic supply should be treated in a similar way to a partial failure of instrument air.

14.3.3 Inert Gas and Nitrogen Examples of situations when failure of inert gas or nitrogen supply may lead to a relief situation are as follows: (a) When nitrogen is used as the motive power for pneumatic control valves - failure can be treated in the same way as a local instrument air failure.



(b) When the inert gas supply to blanketed low-pressure storage tanks fails while inbreathing - vacuum relief will be needed. Note: PROTECTION AGAINST EXPLOSIONS DUE TO IGNITION OF FLAMMABLE GAS MIXTURES IS NOT COVERED BY THIS GUIDE.

14.3.4 Refrigerant Refrigerant systems fall mainly into two types: (a) Those where refrigerant fluid is supplied as a service from either a dedicated refrigeration unit or a central system; the system may circulate coolant directly or via a secondary loop (e.g. brine). (b) Those where a refrigeration or refrigeration-heating loop is integrated into the process. Case (a):- Partial or total loss may result from some other service or equipment failures such as:

Electrical power or machine (drive). Steam drive. Cooling water or air cooling fan.

The effects can generally be treated in the same way as loss of cooling water bearing in mind that heat may be rapidly absorbed into the process from the atmosphere. Loss of brine circulation should be treated in the same way as cooling water.

Note: Despite the relatively large inventory in the pool vaporizers of many refrigerator heat exchangers the response to compressor failure is fast because pressure on the fridge side builds up rapidly thereby inhibiting vaporization. Hence no credit should be taken for cooling by the residual refrigerant in the pool.



Case (b):-Failure may result from any process abnormality which leads to loss of heat removal from the refrigerant stream. The effect on the system being refrigerated may again be treated in a similar way to that of loss of cooling water. In case (b) it is also important to look for problems resulting from the failure of the refrigerator coolant circulation to supply heat to another part of the system. (For instance blockages could be caused by solidification) .

14.3.5 Water (other than cooling water) (process, demineralized boiler feed) (a) When used for once-through cooling or directly for condensing (for instance in a barometric condenser) the loss of process water can cause a relief situation the same way as the loss of cooling water service to an indirect condenser or cooler. (b) Water is fed to some processes as a diluent to control the process (e.g. certain polymerization processes). If the water supply fails so that the mixture is not diluted sufficiently, the temperature and pressure may rise excessively and in extreme cases a runaway reaction may ensue. (c) The loss of demineralized boiler feed water can cause increased temperatures downstream of a desuperheater when the incoming water is used as a coolant. Such a possibility should be considered.

14.4 Pitfalls with Service Failures 14.4.1 Temperature Control

Any service failure which causes increased temperature affects not only the equipment directly involved but also downstream and possibly upstream equipment. Any effect on the relief system itself should be considered.



14.4.2 Secondary Effects

Increased temperature can also cause secondary effects that can impair the functioning of the relief system itself. For instance, any possibility of corrosive fumes or vapors entering the system and causing deposition of solids shall be examined.

SECTION 5: AMBIENT CHANGES

15 INTRODUCTION

Pressure changes in plant equipment systems can result from changes in atmospheric conditions or the local plant environment. For the majority of items, the variation in ambient temperature and pressure is insignificant in comparison with the possible changes due to process conditions. There are, however, exceptions, such as atmospheric temperature and pressure storage tanks, low temperature atmospheric pressure storage tanks, sealed low pressure containers (e.g. some IBC) and hydraulically filled systems such as pipelines, which are vulnerable to minor environmental changes.

16 ENVIRONMENTAL CHANGES 16.1 Atmospheric Conditions

Any credible effect of the following factors on the process equipment system or materials contained therein should be examined: (a) Barometric pressure changes. (b) Temperature changes in the surrounding atmosphere. (c) Direct heat input by solar radiation. (d) Factors affecting heat transfer - rain, hail, snow, wind speed and direction, humidity.



16.2 Plant Environment Consideration should be given to heat input (or loss) that may be derived from associated equipment. (a) Trace heating (steam, electrical, etc.). (b) Radiation or conduction of heat from nearby furnaces or heated equipment or to refrigerated equipment.

17 EXPANSION/CONTRACTION OF VAPOR INVENTORY 17.1 Low-Pressure Storage Tanks

The change in ambient temperature and pressure between day and night causes an expansion and contraction of the vapor (and liquid) in storage tanks and sealed containers. As the design pressures of storage tanks are very low (usually less than 100 mbar g) each expansion of the vapor might overpressure the tank and so lead to a relief situation. Conversely, the contraction of vapor may make vacuum relief necessary. See Part C, Section 7 of this Guide. In the case of tanks blanketed by inert gas, inbreathing and out breathing is controlled by the blanketing system control. However, pressure/vacuum relief shall be provided in case of failure of the blanketing system. See Sections 3 and 4.

17.2 Low Temperature Atmospheric Pressure Storages and Equipment 17.2.1 Pressure Changes

Low temperature atmospheric pressure storage systems are closed systems in which vapor is continually removed, compressed, liquefied and recycled. The pressure is controlled at a small fixed differential above atmospheric. Hence such systems are sensitive to changes in barometric pressure. A drop in barometric pressure will initiate an action by the compressor to extract and liquefy more vapor, thereby reducing the liquid temperature and hence its associated vapor pressure.



If the compressor/condenser capacity is insufficient to cope with the additional demand, then the differential pressure between the tank and the atmosphere will exceed that permitted and pressure relief will be necessary. For an increase in barometric pressure, the compressor flow will be reduced or stopped and the tank contents will begin to warm up. If, however, the barometric change is rapid, there may be a need for relief flow into the tank (i.e. vacuum relief) because the vapor pressure in the tank will increase more slowly. Consult local meteorological data for rate and range of pressure variation.

17.2.2 Temperature Changes Because of the high efficiency of insulation used on this type of storage, atmospheric temperature changes are never sufficiently rapid to cause either an overpressure or underpressure relief situation. Note 1: If the compressor fails or is inadequate, pressure relief will be necessary as the tank warms up. Note 2: In cases where liquid at a higher (or lower) temperature is fed into a tank, significant changes in the tank temperature may well be caused that could create a need for pressure relief.

17.3 Sealed Containers (IBC)

In the case of a sealed IBC containing liquid, a rise in ambient temperature causes expansion of the liquid thereby reducing the gas space and increasing the pressure rise that occurs as the gas tries to expand. Filling of containers that will be sealed, and not equipped with a relief stream, shall be controlled to allow sufficient usage for these compression/expansion effects not to cause the pressure in the container to exceed design pressure.



18 HYDRAULIC EXPANSION - PIPELINES AND VESSELS Various process abnormalities, equipment and service failures can lead to process equipment systems becoming blocked-in. If the system is full of liquid at or below ambient temperature, there can be a risk of over pressure as a result of hydraulic expansion as the liquid warms up to ambient temperature, or if an increase in ambient temperature occurs. Ambient temperature rises as high as 40-50° Cover 12 hours can occur in some locations. This can be a particular problem with liquefied gas pipelines and cryogenic systems. All causes whereby any liquid-filled system of pipes and vessels can become isolated shall be identified. In some cases it may be possible to set up administrative procedures in order to prevent the situation arising. See Sections 3 and 4 and Part C, Section 6 of this Guide. For pipelines outside the plant fence, it may be necessary to fit a relief device to protect against unacceptable overpressure from this cause. For systems inside the plant fence, it can often be assumed that the expansion will cause leaks (e.g. at flanges, valve spindles, shaft seals) that will prevent excessive pressure developing. However, it is not permissible to leak highly toxic nor more than a small amount of flammable materials; neither is leakage acceptable if damage to the seal would be caused. Mostly, the question of whether or not a relief device is needed can be answered by straightforward judgment, but sometimes careful consideration of many factors, together with calculation of the expansion volume, pressure etc. is necessary to reach a decision. A full treatment is given in Part C, Section 8 of this Guide.

