Failed MOCs with Respect to Relief Systems

Jason E. Spearow, P.E.

Colin R. Coons
Smith & Burgess
Houston, Texas
Jason.Spearow@smithburgess.com
Colin.Coons@smithburgess.com
Abstract

The Management of Change (MOC) process has been valuable in increasing safety throughout
the oil and gas industry. However, the value of an MOC is dependent on accurately capturing
everything associated with the change. There are many MOCs that indirectly affect relief
systems. The indirect relief system alteration is often not captured, and the adequacy of the
system is compromised. There are also occasions when an MOC identifies a relief system
impact, but all the changes associated with the impact are not properly implemented. Failing to
identify indirect MOC relief system changes or incorrectly implementing MOCs may generate
additional concerns or exacerbate existing concerns. It is important for all of those involved in
the MOC review process to understand the impact on relief systems. The intent of this paper is
to provide examples of different types of MOCs and how they affect relief systems. Some case
studies of actual MOCs that have failed with respect to relief systems will also be evaluated.

Introduction

The MOC requirement is one of the aspects of Process Safety Management (PSM) defined in
OSHA §1910.119 - Process safety management of highly hazardous chemicals. §1910.119
(l)(1) states “The employer shall establish and implement written procedures to manage changes
(except for “replacements in kind”) to process chemicals, technology, equipment, and
procedures; and, changes to facilities that affect a covered process”. §1910.119 (l)(2-5) require
the MOC process to identify the impact of the changes, inform involved personnel, and
implement necessary updates to process safety information and procedures.

The relief systems design is an aspect of process safety information, which is described in OSHA
§1910.119 (d). It is stated in §1910.119 (l)(4) that “If a change covered by this paragraph results
in a change in the process safety information required by paragraph (d) of this section, such
information shall be updated accordingly”. That is, if a change affects the relief systems design
documentation, then the documentation is required to be updated.

207
Establishing procedures to manage changes and informing relevant personnel are elements of the
MOC process that are satisfied more frequently than other requirements. However, it is common
for the MOC process to unsuccessfully identify the impact of the MOC on relief systems. It is
also common for the MOC process to fail to update all relevant process safety information.
Identifying the impacts of an MOC on relief systems can be difficult if personnel with relevant
expertise are not involved. Properly updating the process safety information can be difficult as
there is a large amount of process safety information to update and resources are limited. The
following sections of this paper provide awareness and guidance to personnel who are involved
with MOCs, in order to enhance the effectiveness of the MOC process.

Typical MOCs that Affect Relief Systems

There are many MOCs that can potentially affect relief systems. Most MOCs require the
process safety information and relief systems documentation to be updated. Below is a list of
common MOCs and how relief systems are affected.

Addition or Removal of Check Valves

Check valves are utilized to prevent backflow through systems when the pressure source from
that system is lost. When backflow from the higher pressure downstream system occurs, the
upstream system that is designed for lower pressure may overpressure. The relief device sizing
on the low pressure system is often dependent on the number of check valves in the backflow
path, as well as the inspection requirements. If a check valve is removed, the systems upstream
of the removed valve may now be undersized for the backflow scenario (see API 521, 6th ed.
section 4.4.9.3.3). Some companies define check valves as “safety critical” (increased frequency
of testing / inspections). The removal of a check valve from the safety critical inspection list
may result in an increase in the backflow required relief rate (dependent on company guidelines).
Installing an additional check valve will increase safety, but failing to amend relief
documentation to indicate the reduced relief load may affect future system updates.

Control Valve Modifications

Several ways in which control valve alterations may affect relief systems analysis are listed
below:

Fail Position Change: The fail position of control valves is important in analyzing the
instrument air failure scenario. Changing the fail safe position could turn a previously
non-applicable scenario to applicable. For an already applicable instrument air failure
scenario, the fail position change may contribute to the required relief rate.

Removal of Limit Stops: Removal of limit stops will increase the required relief rate for
the control valve failure scenario for systems downstream of the relevant control valve.
Ensure downstream relief devices are sized correctly for the control valve failure scenario
before removing any limit stops.

Alteration of Reading Location: The alteration of the locations that a control valve uses
for input data could change the control valve’s response to other plant failures. Analysis

208
 should be conducted to determine whether the new reading location will cause the control
valve to respond differently in the event of an upset scenario.

Change or Re-rate of Maximum Allowable Working Pressure (MAWP)

An MOC that lowers the MAWP of equipment should be checked to determine whether the
equipment is still protected against overpressure. If the equipment is protected by a relief device,
check that the set pressure still provides protection to the relevant equipment. If the equipment is
currently unprotected by a relief device, check that the source pressures (normal and maximum)
feeding the equipment do not exceed the new MAWP. Although raising the MAWP of
equipment is inherently safer for that equipment, the documentation must be updated as it could
affect the analysis of other equipment. An example of this may be the evaluation of tube rupture
on the low pressure side of an exchanger where the high pressure side MAWP was re-rated.

New System Source or Alteration of an Existing Source

MOCs that add new pressure sources or altering an existing pressure source should be evaluated
to determine if the downstream equipment is still protected against overpressure. Adding
sources may contribute to the existing required relief load, which could result in an inadequate
relief device. Changes made to existing pressure sources may also increase or decrease the
required rate of existing scenarios (i.e. pump replacement) or increase the number of sizable
cases if the source pressure is increased. MOCs of this type may affect multiple downstream
systems. Proposed source pressure changes should first be checked to determine whether
overpressure of downstream equipment can occur. If overpressure is possible, the relevant relief
scenarios should be re-evaluated. Note that a new source line feeding a system, including some
that are normally closed, could result in additional upset scenarios such as control valve failure
and introduction of volatile materials.

Relief Piping Modification

The pressure drop in relief device inlet/outlet piping affects the stability of the valve as well as
the capacity. Changes made to relief systems piping alter the hydraulics of the relief system
scenarios, which can potentially result in an inadequate relief device. Proposed changes should
be analyzed to verify if the capacity of the relief device is still adequate, and that the inlet / outlet
pressure drops still comply with codes and standards. Common examples encountered include
the addition of isolation valves and bypasses or the installation of rupture discs at the relief
device inlet.

Set Pressure Changes

Changes made to the relief device set pressure may cause currently protected equipment to
become unprotected (if the MAWP < set pressure), alter the PSV capacity, and affect the
pressure drop at the relief device inlet and outlet. Plant documentation should be updated to
reflect the set pressure change. Relief device capacity and pressure drop calculations should be
updated along with relevant relief systems documentation. Note that the relief valve may have
been limiting the pressure to downstream systems, so systems downstream of the relief device
should be checked that they are still adequately protected once the set pressure change has been
implemented. If the set pressure is lowered, ensure with operations that the set pressure is not
approaching the maximum expected operating pressure.

209
Tag Changes on Equipment and Relief Devices
Relief systems documentation should be updated to reflect the relevant tag changes to comply
with the PSM standards. In addition, field tags should be updated to allow plant personnel to
easily identify relief devices and equipment. Failure to update relief systems documentation or
field tags could lead to problems with operations, maintenance or miscellaneous contractor work.
Although it may seem that documentation changes, such as tag names and identifiers, are not as
significant as other MOCs that require physical modification, those changes require awareness
and caution. There are a number of reported incidents that have occurred due to tag confusion.

Case Study 1 - Installation of Multiple Rupture Discs

This MOC involved the installation of rupture discs on the inlet of several relief valves to
prevent seeping of materials (environmental control) through the relief valves during normal
operations. As part of the MOC process, there is a list of questions for the initiator to complete.
One of the questions listed was “Does change significantly affect engineering safeguards?” For
this MOC, this question was answered “No”, resulting in the MOC being implemented without
further evaluation of the relief systems. However, the installation of the rupture discs will de-
rate the capacity of the relief device, potentially causing the relief system to be undersized. In
addition, the rupture discs contribute to the PSV inlet pressure drop, which is limited to 3% of
the PSV set pressure. This could further de-rate the respective capacities and potentially lead to
chattering (rapid opening / closing of the valve), causing damage to the valve. Due to neither of
these problems being identified as part of the MOC, the adequacies of the relief systems in
question were compromised. The table below shows the difference in PSV capacity and inlet
pressure drop before and after installing the rupture disc. The capacities were de-rated using a
combination correction factor (Kc) of 0.9 (per API STD 520 pt I). The pressure drop through
the rupture discs were calculated assuming a resistance coefficient (KR) of 2.4 (per ASME Sec.
VIII)

Table 1 – Pressure drop / capacity changes due to MOC implementation

Required PSV Area Installed PSV
Initial Final Initial Final Area
2 2
PSV 1 2.8% 12.0% 5.53 in 6.52 in 6.38 in2
PSV 2 2.2% 6.0% 0.43 in2 0.50 in2 0.50 in2
2 2
PSV 3 0.9% 3.1% 2.44 in 2.78 in 2.85 in2
PSV 4 0.9% 3.1% 2.44 in2 2.78 in2 2.85 in2
PSV 5 0.3% 4.1% 0.72 in2 0.86 in2 0.79 in2
2 2
PSV 6 0.3% 3.4% 0.72 in 0.83 in 0.79 in2

The installation of the discs required pipe modifications, purchasing of the rupture discs and
housings, and costs associated with updating plant documentation. After implementation, the

210
inlet pressure drop for all PSVs was greater than 3% of their respective set pressures, and the
capacities of PSV 1, PSV 5 & PSV 6 were insufficient. Thus, the listed issues will require
additional engineering hours and replacement costs to mitigate. Mitigations for this MOC may
include the replacement of one or more relief valves, replacing the rupture discs (larger size or
lower Kr value), and/or modification of the inlet piping.

If the impact of the MOC was properly identified, the facility would have saved a significant
amount of resources to maintain an adequate relief system as the engineering hours and
equipment costs would have been included in the original project. The fundamental failure with
this MOC example was with the questionnaire in the MOC generation. Identifying that this
change significantly affected engineering safeguards may have prevented these unnecessary
costs. The personnel involved would need to identify that the MOC affected relief analysis.
This would involve additional training in process safety related topics. The relief systems would
then need to be resized with the new rupture discs accounted for in the relief device capacity
calculations. If no relief system concerns (inadequate relief capacity, inlet pressure drops > 3%,
etc) are identified, personnel would then need to update previous relief system documentation to
reflect the MOC. If concerns were identified, personnel should consider other system
modifications (such as inlet piping modifications, or increased relief capacity) that would
mitigate the concerns.

Case Study 2 - Installation of a Vessel Bypass Line

This MOC involves the installation of a bypass line around a vessel in a desulfurizer unit. The
vessel is equipped with a relief device set at 75 psig, sized for the full throughput in the event of
a blocked outlet. There are equipment downstream of the vessel rated at 75 psig. Overpressure
of downstream equipment is possible as there are several sources upstream of the bypassed
vessel that exceed 75 psig (120 psig and 165 psig).

Pressure limiting PSV

(Set at 75 psig)

Downstream Equipment
(rated for 75 psig)
New Bypass Line
Bypassed Overpressure Sources
Vessel (up to 165 psig)

Figure 1: Bypass Installation Diagram

If the vessel is bypassed during some modes of operation, the downstream equipment will not be
protected in the event of a blocked outlet. For this example, the bypass line had a blind installed

211
to prevent flow from bypassing the pressure limiting PSV. However, the relief systems
documentation, MOC documentation, and operating procedures were not updated to identify the
potential for overpressuring downstream systems should the blind be removed.

Failing to identify the potential of overpressure may result in damaged equipment, loss of
containment, injury, or death of plant personnel. The system contains acid gas, which is
extremely toxic. Damage caused to this unit may result in the shutdown of the unit and routing
of acid gas to the flare instead. The facility could be fined should the EPA acid gas flaring limits
be exceeded. These consequences may be avoided by properly recognizing and documenting the
hazards inherent in installing the bypass line.

To properly implement this MOC, personnel would need to consider the potential for
overpressure of downstream equipment since the pressure-limiting PSV could be bypassed. The
installation of the blinds may prevent the vessel from being bypassed inadvertently while
operating, but personnel should have stated the purpose of the installed blinds in documentation,
including the potential to overpressure downstream equipment should the blinds be removed. If
personnel remove the blinds in the future, additional overpressure protection may be necessary to
protect downstream equipment.

Complications with MOC process and Relief Systems Documentation

It is clear the importance of properly identifying an MOC’s impact on relief systems and making
necessary updates to the documentation. However, many PSM facilities are not properly
implementing MOC’s. Below are explanations as to why relief systems documentation is not
properly updated as part of the MOC process.

The personnel involved do not have proper relief systems training.

It is difficult for personnel to identify the impact changes have on overpressure scenarios if they
are not properly trained. Some facilities have an engineer on-site that is dedicated to updating
relief systems, answering relief system questions, and attending relevant relief system training
classes / conferences. Other facilities rely on the process and project engineers to review the
safety impacts. Although many process / project engineers may be familiar with relief systems,
it may be difficult to achieve and maintain relief systems expertise while executing other plant
responsibilities. There are also MOCs generated outside of engineering (i.e reliability,
operations, etc.) that may be identified as having an insignificant impact on engineering and
safety that are not reviewed in detail. It is important that each MOC is screened and reviewed by
an individual trained in relief systems analysis.

The existing relief systems documentation is inadequate or non-existent

The relief systems documentation consists of the related system equipment and relief devices, a
list of potential overpressure scenarios with rationale for applicability, and required relief rate
and relief device calculations. If the initial relief systems documentation is insufficient it may be
difficult to identify a MOC’s impact, increasing the chance that something is missed that will
affect cost or safety. Relief systems documentation acts as guidance and a reference tool for
non-experts to easily identify consequences of an MOC’s implementation. If relief systems
documentation is non-existent, the evaluator of the MOC will need to spend more time

212
understanding the system before making a decision on the consequences of implementing the
MOC. Having relief systems documentation that is sufficient and current will result in a lower
likelihood of implementing unsafe MOCs, and should decrease resources spent in the MOC
evaluation process.

Involved personnel are unaware of the relief systems documentation

A facility may have relief systems documentation that is thorough and meets all adequacy
requirements. However, the documentation is not useful if plant personnel are not aware of its
existence and trained how to utilize it. There may be only a few people that are qualified to
update the documentation, but there are a lot of personnel that need to know how to navigate
through it and use this information to adequately implement MOCs. The departments involved
with implementing an MOC include engineering, operations, inspections, drafting, management,
and more. Ensuring that relevant personnel are aware of how to utilize the relief systems
documentation is important in minimizing the amount of failed MOCs.

Conclusion

The Management of Change process is a requirement in the OSHA PSM standard that increases
safety throughout industry. However, there are many cases where the MOC process fails to
adequately capture all of the impacts that a change has with respect to relief systems. Failing to
identify all the impacts an MOC has on relief systems could result in wasted resources and
unsafe installations. There are many changes that are not easily recognized to affect relief
systems, and it is important for each MOC involved to be reviewed by an individual trained in
relief systems analysis. In addition to the OSHA PSM standard requiring relief systems
documentation to be updated as part of the MOC process, the documentation is a resource to aid
personnel in evaluating an MOC’s impact. It is important for all of those involved in the MOC
review process to understand the impact on relief systems. By providing proper training and
awareness to all personnel involved in the MOC process, the number of failed MOCs can be
minimized, resulting in a more efficient use of resources and increased safety at the facility.

References

I. U.S. Occupational Health and Safety Administration, “Standard for Hazardous Materials
— Process Safety Management of Highly Hazardous Chemicals,” 29 CFR 1910.119.
II. American Petroleum Institute. API STD 520 Part I - Sizing and Selection.
American Petroleum Institute, December, 2008.
III. American Petroleum Institute. API RP 520 Part II - Installation. American
Petroleum Institute, August, 2003.
IV. American Petroleum Institute. API STD 521 - Pressure Relieving and
Depressuring Systems. American Petroleum Institute, January, 2014.
V. American Society of Mechanical Engineers. 2013 ASME Boiler & Pressure Vessel Code:
Section VIII, Division 1

213