PRV % .

To flare header

FIGURE 1. Even
a relatively sim
ple f ractionation
system, such as
the one shown
here, can have
many potential
overpressure
scenarios, in-
eluding blocked
outlets; full and
partial power fail
ures; external
fire; control-
valve and con
trol-loop failures;
loss of Instru-
- ment air, cooling
water or steam;
thermal expan
sion and many
more. The sce
PRV Pressure-relief valve
nario with the
TRC Temperature-record control
largest required
LIC Level-indication control
relief load should PRC Pressure-record control
be used to size CW Cooling water
the pressure- re FRC Flow-record control
lief valve
sure scenario during PRV design, then
the existing PRV may be undersized.
The list of overpressure causes on p.
66 should be used to guide the PRV
audit. However, this list should not be
considered all-inclusive. Plant man
agers and design engineers should use
their own engineering judgement to
carefully assess site-specific hazards
or uncommon factors that might also
constitute an overpressure source.
Ask a lot of questions during such a
system evaluation, particularly when
you are aware of particular overpres
sure scenarios that you think should
be included in the PRV audit, but are
not. Never take for granted "common-
sense things." For instance, question
why a large PRV is specified for a
small vessel, and vice versa.
Before getting into the detailed
analysis of common overpressure sce
narios, we must clarify three related
concepts — double jeopardy, auto
matic process control, and administra
tive procedures.
Double jeopardy. The concept of
"no double jeopardy in overpressure
assessment" is very important. The
American Petroleum Inst.'s (API) Rec
ommended Practice RP 521 Section
2.2 12] states that the causes of over
pressure are typically unrelated. Ac
cording to API, "The simultaneous oc
currence of two or more conditions
that could result in overpressure will
not be postulated, if the causes are un
related." Even external fire, one of the
overpressure causes, is considered to
Feed
Bottom product
CW
be unrelated to other causes "if no
process or mechanical or electrical
linkages exist among them," or "if the
length of time that elapses between
possible successive occurrences of
these causes is sufficient to make
their classification unrelated." This
means that one does not need to as
sume that every contingency case
being analyzed during system design
would occur simultaneously.
However, some contingency cases
are obviously related by cause and ef
fect. For instance, a "liquid-blocked
outlet" can be the consequence of an
"inadvertent valve operation" that
was probably caused by "human
error." When one is performing the de
tailed overpressure analysis, such in
terrelated overpressure scenarios can
be summarized as a single potential
overpressure scenario. Other oc-
curences, such as a "general power
failure," will cause reflux interrup
tions if the reflux is driven by an elec
tric pump, and may cause the cooling
duty of an air condenser to be lost, too.
The bottom line is that when per
forming an overpressure analysis, en
gineers must consider these cumula
tive effects, to deal with a ciencies of conventional failsafe sys
representative cause of potential over
pressure. For instance, the possibility
of reflux failure should be analyzed in
terms of a number of potential causes,
including power failure, reflux pump
failure, control valve failure, or a con
denser blanketed by non-condensible.
If the reflux failure is included in
the consideration of the power failure,
the contingency case should be called
a power failure. Similarly, if the reflux
failure is caused by condenser failure,
the contingency case should be called
a condenser failure.
As a general rule of thumb, if the
potential outcomes of a given failure
are not likely to occur simultaneously,
then the PRV should be sized sepa
rately for these two individual cases
— not oversized by adding together
the two relief capacities required for
different potential outcomes of a given
failure mode. By way of example: if
the pressure-relief capacity calculated
for a single reflux failure case is
80,000 lb/h for a given unit, and the
required relief load for a power failure
at the same unit is 150,000 lb/h, then
to properly size the PRV, one should
assume that the power failure case in
cludes the effect of reflux failure. In
other words, the PRV needed to re
spond to a potential reflux failure
should be sized for the larger of the
two values (in this case 150,000 lb/h;
not a cumulative 230,000 lb/h).
Automatic process control Gener
ally speaking, reliance on so-called fail
safe instruments or control loops is not a
suitable substitute for installing a prop
erly designed pressure-relief system.
Ideally, with the use of failsafe instru
ments or control loops, any abnormal
conditions will prompt an automatic ad
justment of flowrate, pressure, tempera
ture or other factors. However, given the
potential unreliability or unpredictabil
ity of electronic signals — especially
during upset conditions — such protec
tion cannot be relied on in lieu of pres
sure-relief devices. Similarly, auto
matic-startup, equipment should not
replace the use'of pressure-relief valves
as protection against overpressure.
One exception is the use of a High
Integrity Protective System (HIPS).
Using triple redundant signals, the
HIPS avoids the aforementioned defi
tems for electronic process control.
Consider a control loop designed to
maintain the liquid level in a tank or
reactor when feed increases or de
creases. The level signal may fail or de
viate for some reason. To make sure
the signal would not be lost, a HIPS
uses three independent signals in-

CHEMICAL ENGINEERING WWW.CHE.COM JUNE 2001 67

 Cover Story ;;':%
stalled in the same vessel. In addition,
it uses a two-out-of-three logic system
(such a system relies on two out of
three voting systems to determine if
the signal received is reliable), and ei
ther an emergency-power-supply
(EPS) or an uninterrupted-power-sup
ply (UPS) system. Using an UPS, when
the normal power supply is inter
rupted, a standby power supply would
automatically start, in a fraction of a
second, to support critical equipment
or units.
HIPS is not a pressure-relief sys
tem, but rather an automatic control
system that can be used to guard
against overpressure. It is now widely
accepted that the use of a HIPS, with
either EPS or UPS, can eliminate
some (not all) potential overpressure
scenarios, and hence greatly reduce
the use of unnecessarily large relief
valves and flares, which then reduces
both capital and operating costs .
However, operators should consult an
expert before relying on a HIPS, and if
the facility chooses this route, it must
implement a strict maintenance
schedule for the HIPS, along with rig
orous training for operators.
Administrative procedures.
Some refineries believe that reliance
on strict administrative procedures is
enough to prevent some overpressure
scenarios, and, thus, they cite such
procedures to justify reducing the
number of PRVs in the facility. While
strict administrative procedures are
commendable, one should assume
that the possibility of human error
can never be completely eliminated;
thus they should not be used in place
of a pressure-relief system.
API RP 520 and-521 do allow engi-
■ neers to take credit for so-called "car
seals open (CSO)" or "car seals locked
(CSL)" valves., With the installation of
CSO block valves, operators do not
have to drain the equipment after sys
tem shutdown, since the valve main
tains an open position all the time.
However, API RP 521 does not allow
engineers to take credit for standby
pumps, because they cannot be con
sidered to be totally reliable.
Full or partial credit may be taken
for normally operating, parallel, in
strument air compressors and electric
generators, whose drivers use two un
68 CHEMICAL ENGINEERING WWW.CHE.COM
related sources of energy. The most
common example is the use of a steam
turbine as standby for an electric
motor that is driving a pump to trans
port fluids.
Since operator intervention (such as
reliance on manual cut-in of auxil
iaries by an operator) is time depen
dent, the potential impact of the time
lag required for the standby equip
ment to get into normal position, and
the potential impact of human error,
should be analyzed.
Common overpressure sources
Discussed below are each of the over-
pressue scenarios listed on p. 66.
1. External fire. Fire is a common
cause of overpressure in pipes and
vessels. According to API RP 520 [3]
and 521 [2], operators should assume
that the effective fire-exposed area in
cludes an area of 2,500 to 5,000 ft2
(this assumes a circle with a diameter
of 58-80 ft) [6], with an effective fire
height no more than 25 ft above the
grade. In contrast, National Fire Pro
tection Assn. (NFPA) [4,6] guidelines
recommend that operators should as
sume a fire-exposure area with a fire
height of 35 ft above grade (details on
how to determine the area of a poten
tial fire zone can be found in a previ
ous article by this author, [6]).
Analyzing for an external fire case
assumes that the vessel exposed to the
fire is blocked in. Potential vapors re
sulting from the fire must be relieved
using a PRV on the vessel, or via a
vent path that remains in a locked-
open position between the vessel in
question and an adjoining vessel 16}.
These issues need be considered:
• Pressure-relief valves alone cannot
protect vessels filled with gas or
high-boiling-point liquids, so engi
neers must carefully evaluate other
protective measures [SI. Tradition
ally, design engineers use two ap
proaches to size PRVs for gas-filled
vessels. One is to use unwetted-sur-
face equations, as shown in API RP
520. Another is to assume the pres
ence of some liquids in the vessel, so
that wetted-surface equations can
be used to size the PRV (for a de
tailed discussion of this, see [5])
• The wetted surface areas of con
nected piping and accessories
JUNE 2001
should be added to the wetted sur
face area of the main vessel when
calculating the potential vapor gen
erated from an external fire. Be
cause of the difficulty of calculating
the wetted surface areas of con
nected piping and accessories, engi
neers should add 15% to the overall
wetted surface area of the vessel [61
• Even if a vapor-depressuring sys
tem is installed along with the PRV,
the required fire-relief load through
the PRV should not be reduced. The
vapor-depressuring system is basi
cally used to rapidly reduce the in
ternal pressure to a level where
stress rupture would not occur
• Tanks and vessels with design pres
sure less than 15 psig need to follow
API Standard 2000 [8]
2. Blocked outlets. The closure of a
block valve on the outlet of a pressure
vessel can cause the vessel's internal
pressure to exceed its MAWP, if the
source pressure exceeds the vessel de
sign pressure. However, if the MAWP
of a vessel is higher than the source
supply pressure, the vessel has no
blocked-outlet case.
A blocked outlet can be caused by
control valve failure, inadvertent
valve operation, instrument-air or
power failure, and other factors. In
general, a pressure-relief valve must
have sufficient capacity to pass a fluid
flowrate that is equivalent to the dif
ference between those of the incoming
fluids and the outgoing fluids.
a. Blocked liquid outlet. When the
liquid outlet is blocked, the liquid
level in the vessel may rise. If the
surge time for liquid overflow from the
vessel is less than 15-20 min, then a
blocked liquid-outlet is a valid poten
tial overpressure scenario. When the
required surge I time is longer than
15-20 minutes, then operators pre
sumably have sufficient time to take
action to avoid an overflow, so a
blocked liquid outlet is not considered
to be a potential overpressure source.
For any pressure-relief valve in
stalled on the liquid-feed line, the re
quired relieving capacity (in units of
volume per time) should be the accu
mulated liquid capacity of the vessel.
When the feed input is a two-phase
fluid (i.e., the feed input for a separa
tor, or flash or-, surge drum), the re-
A tank-farm fire and explosion at
Thai Oil resulted in 8 fatalities and
13 injuries
quired pressure-relief capacity for the
. blocked-liquid-outlet case is not for
just the liquid. In this case, a two-
phase scenario should be considered,
because the liquid level rising to a cer
tain height may make liquid and vapor
separation impossible. Too often, engi
neers fail to recognize the potential for
two-phase separation, and hence, they
inadequately size the PRV in a
blocked-liquid-outlet case to accommo
date just the liquid capacity [7].
6. Blocked vapor outlet. When the
vapor outlet is blocked, the vapor in
the vessel needs to be relieved. If
there is another available vent outlet
on the vessel that would not be
blocked by the same cause, the credit
for this relief capacity can be taken.
3. Utility failures. Unlike other
scenarios that can only affect one ves
sel at one time, utility failures, such
as loss of power or cooling water or
those shown in the list on p. 66, can af
fect all the equipment using power or
cooling water at same time. To be safe,
the flare header should be designed
and sized based on the maximum re
lief load that could result by a poten
tial utility failure.
a. General power failure (both an in
terruption of power, and total power
failure in a plant). The immediate
consequences are that:
• Electrical motor-driven pumps and
compressors — and hence, feed
input, product output and reflux —
will stop
• Motor-driven fans for air coolers,
cooling water towers and combus
tion air will stop
• Motor-operated valves will fail
• Instrument air will be interrupted
Due to the risk of power failure, API
RP 521 does not permit credit to be
taken for pumps with standby and au
tomatic startup, even when the pump
has a separate power supply. In the
event of a utility failure, such a setup
cannot be considered reliable. How-
When polymer deposits Inside this col
umn caught fire accidentally, the heat
of the fire was sufficient to melt the col
umn and cause it to collapse
ever, if a HIPS is installed for the au
tomatic startup, and the time differ
ence between the power outage and
the standby system getting up and
running is insignificant for process
conditions deviating into the upset re
gion, it might be possible to take the
credit for such an installation.
b. Partial power failure. Partial
power failure is limited to one process
unit, or may refer to the failure of ei
ther low-voltage or' high-voltage
power. Credit can be taken for contin
uous parallel power-supply services if
they have unrelated energy sources.
In the partial-power-failure case,
one can assume that the general util
ity supply would not to be affected.
The feed, heating or cooling from
other units would also not be affected.
c. Loss of instrument air. As men
tioned before, instrument-air failure
may be caused by power failure, con
trol valve failure or other reasons. Me
chanical equipment failure can also
result in the loss of instrument air.
Engineers should be cautious with
the emergency electric power supply
(EPS) used to ensure uninterrupted
instrument air supply. As discussed,
only reliable EPS systems can take
credit for overpressure protection.
Instrument air supplies that have a
large air reserve and high air pressure
may, after a power failure, be able to
maintain an adequate air supply for a
short period of time. The time frame
should be carefully evaluated. Nor
mally the air receiver should be able to
maintain 10-15 min of air supply after
the air compressor has stopped. To be
safe, engineers are advised not to take
the credit unless the air supply is suffi
cient to last long enough for some cor
rective action to be taken. Generally, in
strument air failure will cause all
control valves to assume their failsafe
positions (either air-fail-open; air-fail-
CHEMICAL ENGINEERING
closed; or air-fail-last-position).
If a plant is well-designed, an in
strument air failure holds relatively
little risk of generating overpressure.
For instance, with proper care, it is
possible to design most control valves
so they will be locked in a safe position
in the event of instrument-air failure.
However, instrument-air failure
can cause many other problems re
lated to such things as the alarm or
shutdown system. The air-fail position
should not be designed as overpres
sure-relief protection. The reason is
obvious — other outcomes might re
sult from the same instrument-air
failure. For instance, other failures in
an instrument system could cause a
control valve to move to a position op
posite from its originally designed air-
fail position, though not very often.
d. Loss of cooling water. During the
case analysis for cooling-water fail
ures, engineers often make mistakes
in adequately defining the required
overpressure-relief capacity. Using a
heat balance approach to calculate the
relief capacity for a fractionation sys
tem is a must; nevertheless, without a
detailed analysis for both normal op
erating and relieving conditions, it is
easy to end up an oversized PRV.
A common mistake is the inappropri
ate use of the extra heat accumulation
in the system (which can vaporize liq
uid in the system) when calculating the
required relief load. La some cases, if
the cooling is not normally used for con
densing vapor, the extra heat buildup
in the system may not be enough to
cause a pressure relief.
When the cooling is used to con
dense vapors, the required relief ca
pacity must-be equivalent to the total
vapor load being condensed. The im
portant point i§ that the calculation be
based on the relieving conditions, not
the normal operating conditions.
Unlike normal operating condi
tions, at the overpressure-relief condi
tions, more vapor may become con
densed because of higher pressure. A
rigorous simulation is typically re
quired to help engineers quantify the
required vapor-relief capacity. Simply
using the normal condensed-vapor
quantity may result in an oversized
pressure-relief valve.
One more point needs be empha-
WWW.CHE.COM JUNE 2001 69
 Cbver Story
sized here. API RP 521 suggests that
the required relief capacity is the total
vapor capacity (typically measured as
weight/time, such as lb/h) to the con
denser at relieving conditions. Actu
ally, it should be the difference be
tween vapor entering and leaving the
condenser at relieving conditions. If
there is an existing vapor outlet in the
system, and that outlet would not be
blocked during a cooling-water fail
ure, then the available normal vapor
flowrate through the vapor outlet
should be taken as a credit to reduce
the required relief load.
e. Loss of steam. In general, steam
has the following functions at a plant:
• It is a driving force for pumps, tur
bines, compressors, air blowers, and
so on. When steam supply is inter
rupted, inlet flow and fluid dis
charge will be interrupted
• When used as a heating source for
reboilers, exchangers and direct in
jection, loss of steam will interrupt
heating functions
• When used for stripping in fraction-
ation columns, the loss of steam can
have a similar impact as the loss of
cooling duty. Neglecting this might
lead to an undersized PRV
f. Loss offuel gas or fuel oil. Except for
fuel gas or fuel oil that is used for dri
ving pumps or turbines that provide
cooling duty, the loss of fuel gas or fuel
oil would not generally cause over
pressure in a system. If fuel gas or fuel
oil is used for generating power, loss of
such fuels should be evaluated as a
power failure when sizing the PRVs.
For fired heaters, the loss of fuel gas
or fuel oil supply does not mean the
clear cutoff of heat input to the sys
tem. The flow of the residual heat in
the fired heater can significantly con
tribute to a heat imbalance and over
pressure in the system. This state of
affairs is especially significant when
the heat duty is large. Generally,
25-40% of normal heating duty shall
be used as the residual heat input to
the fired heater, once power fails and
fuel gas or fuel oil input has stopped.
4. Loss of cooling duty. There are
several different types of cooling du
ties (including the above-mentioned
cooling-water failure), as shown here:
a. Loss of quench stream. Normally,
a quench stream is used to cool a
70 CHEMICAL ENGINEERING WWW.CHE.COM
vapor flow in a column or vessel, so
the loss of quench means a loss of cool
ing duty. A heat balance at the reliev
ing condition must be performed, to
determine the required relief capacity.
b. Air-cooled exchanger failure \14\.
When air-cooled exchangers fail, nat
ural convection continues. Therefore,
a credit for 20 to 30% of normal duty is
often taken, to reduce the required re
lief capacity. However, louver closure
is considered to be total loss of the
cooling duty.
c. Loss of cold feed. Loss of cold feed
is similar to the loss of quench. This
item is often overlooked when no heat
balance is performed.
d. Loss of reflux (top and intermedi
ate). Reflux failure is a common cause
of overpressure in fractionation
columns. Power failure, pump shut
down, pump mechanical problems and
control valve failures are among the
causes of reflux loss, which can result
in receiver and condenser flooding.
The loss of reflux will cause the tem
perature in the column to rise, leading
to a vapor buildup and an increase in
pressure drop in the column and over
head receiver. Such failure often leads
to a loss of total condensing duty.
Nevertheless, exceptions do exist.
One example is when the receiver has
a vapor outlet that would not be
blocked by the same reason that
caused the reflux failure. In this case,
the condenser duty may be reduced to
a certain extent, or not even affected,
depending on the system configura
tion. Furthermore, if the receiver has
enough surge time, say, more than 15
min from its normal liquid level as a
safe assumption, one could assume
that the condenser would not flood.
In general, loss of cooling duty, by
any of these mechanisms, can cause
heat buildup, which can result in
vapor buildup and system overpres
sure. The loss of non-condensing cool
ing will not generally lead to an over-
pressre situation. However, loss of
cooling in a partial or total condenser
would generally lead to a system un
balance, and potential overpressure.
When condensing duty is stopped, if
the condensed liquid inventory has
more than 15 min to deplete, one can
assume that the operator has ade
quate time to take corrective action.
JUNE 2001
The potential impact of human error on
plant safety should never be underesti
mated. Wherever possible, the process
should be designed to be free from op
portunities for human error
The required relieving capacity for
the failure of total condensing duty
can be calculated by performing a heat
balance on the system, based on the
loss of the condensing duty. The con
sequences of losing partial condensing
duty should also consider the possibil
ity of non-condensible blanketing in
the condenser. When this occurs, all
the condensing duties will be lost.
The consequence of partial condens
ing failure can be more severe than
that of total condensing failure. The
relief-capacity calculations might
have to reconsider loss of upstream
cooling duty if they were related.
5. Thermal expansion (some'
times call hydraulic expansion).
Pressure-relief valves for the case of
thermal (or hydraulic) expansion, are
relatively easy to analyze and size. It
is rare that a vapor-filled pipeline or
vessel would be overpressured by ex
ternal heat sources, other than fire.
Therefore, no vapor thermal expan
sion is discussed here.
When liquid is blocked in a vessel or
pipeline, external heat input can
cause liquid temperature, and hence
volume, to rise. Common causes are:
• The pipeline "is filled with liquid
that is blocked in and heated by
steam or electrical heat tracing
• A heat-exchanger cold side is filled
while the hot side is still flowing
• A pipeline or vessel is filled with liq
uid at ambient temperature, and is
heated by direct solar radiation
Usually, a nominal thermal-relief
valve is adequate for most cases, ex
cept for large vessels and long piping.
Backpressure should be assessed
when the thermal-relief valve is dis
charging to another pressured
pipeline or process vessel [11]. When

the backpressure exceeds 10% of the
valve set pressure, or is variable, a
balanced bellows may be required.
The case of blocked-in liquid with
thermal vaporization has not been
widely discussed. When the liquid
being blocked in has a vapor pressure
higher than the PRV set pressure,
thermal vaporization is a potential
cause of overpressure. The PRV
should be sized so that it can relieve
the vapor-generation rate, and should
be installed on the top of the equip
ment, so as not to block the vapor dis
charge. Liquid displacement should
also be avoided.
6. Abnormal heat input. This case
is not commonly discussed, but it
should be analyzed if the following in
cidents might happen:
• The supply of heating medium, such
as fuel oil or fuel gas to a fired
heater, can be switched from
medium heating value to higher
heating value
• Heat transfer occurs in a new and
clean heat exchanger after a revamp
• The control valve for the fuel supply
fails fully open
• The supply pressure of the heating
steam is changed from its normal
range to its nnnrimiim pressure
In general, when considering this case
for sizing a PRV, the maximum heat
duty assumed for the abnormal case
should be ho more than 125% of the
normal heat duty.
7. Abnormal vapor input. Abnor
mal vapor input to the process can
occur when the upstream control
valve fails fully open. Upstream re
lieving or inadvertent valve opening
can also cause abnormal vapor input
to a reactor, vessel or pipeline.
In some situations, abnormal vapor
input may not cause system overpres
sure. However, if the system is not
In general, the loss of
cooling duty can cause
heat to accumulate In a
system, which can re
sult in vapor buildup
and system overpres
sure. This vapor accu
mulation needs to be
removed before system
pressure reaches its
MAWP
able to discharge the extra vapor,
eventually, the extra vapor will cause
system overpressure. The required re
lieving capacity must be equal to or
greater than the amount of the vapor
accumulation expected under the re
lieving conditions.
8. Loss of absorbent flow. In gen
eral, loss of absorbent will not result
in an overpressure situation. How
ever, when gas removal by an ab
sorbent is more than 25% of the total
inlet vapor flow, an interruption of ab
sorbent flow could cause pressure to
rise in the absorber.
In this case, the pressure-relief valve
should be sized based on the net accu
mulation of the vapor at the relieving
conditions. If the downstream equip
ment would not be blocked at the same
time the absorbent flow has stopped,
then the design capacity of that equip
ment can be used as a credit for reduc
ing the required relieving capacity.
Some absorption systems are
equipped with an automatic depres-
suring system (i.e., the use of an auto
matic vent that is electroncially trig
gered to open and relieve pressure
buildup caused by a rapid temperature
increase). However, credit for this can
not be used to reduce the required re
lief capacity needed for this case, be
cause such an auto vent cannot be
assumed to be completely reliable, un
less a HIPS is used to control the vent.
9. Entrance of highly volatile
material An example of this would
be water or light hydrocarbons enter
ing into hot oil during a process upset
— a situation in which the instanta
neous phase expansion can be enor
mous. Pressure-relief devices may not
open fast enough to relieve the rapidly
generated vapors. Instead, to mini
mize such risks, the facility should
rely on a properly designed process,
CHEMICAL ENGINEERING WWW.CHE.COM JUNE 2001
coupled with proper operator training.
During the design phase, the use of
double block valves, the avoidance of
water-collecting pockets, and the ap
propriate use of steam condensate
traps and bleeds on water connections
should be all considered. If the possi
bility of overpressure still exists, a
rupture disk may be the answer.
10. Accumulation of non-con
densibles. During normal operating
conditions, non-condensibles do not
accumulate in the system. They
should be discharged along with
process streams or through a vent.
Non-condensibles will accumulate
under the following conditions:
• The normal non-condensible vent is
blocked, or
• The piping configuration or equip
ment has a pocket in which non-con
densibles accumulate
The accumulation of non-condensibles
can blanket a condenser and result in
the loss of cooling duty. Thus, the
analysis should be no different from
that done for loss of condensing duty.
11. Valve malfunction. Only one
valve malfunction needs to be consid
ered at a time, if other valve malfunc
tions are unrelated.
a. Check-valve malfunction (back
flow). This is a rare case, but should
be considered when a high pressure
differential is present between the
inlet and outlet of a check valve, a
pump, or other piece of equipment. In
general, though multiple check valves
are installed for this application,
backflow does occur at huge pressure
differentials. When check valves mal
function, backflow can be from 5 to 25
% of the normal operating flowrate.
The required relief capacity is defined
based on eachcase.
6. Inadvertent valve operation
(open I close and bypass). This means
that a valve was wrongly operated to a
position that is opposite its intended
normal operating position. This is a
very common overpressure scenario,
and is the result .of human error.
Bypass valves can also be either
closed or opened inadvertently, due to
human error. If this malfunction can
cause downstream equipment over
pressure, it is a valid potential over
pressure scenario to consider.
Very often, a fully open bypass
71
valve can pass a greater fluid volume
than the main control valve. Analysis
shows that a fully open bypass block
valve, especially a control valve by
pass, can provide a larger relief load
compared to failure of the control
valve itself. During the design stage,
the bypass valve should be carefully
sized to avoid an oversized relief
valve.
b. Control valve fails fully open or
closed. This malfunction, caused by
mechanical or electronic-signal fail
ure, and it often results in heat or
mass accumulation in the system.
However, this case is often confused
with the air-failure position of the con
trol valve. Mostly, air-fail positions for
control valves are designed to protect
the process system.
Be aware that two overpressure sce
narios related to "control valve fails
fully open or closed" do not relate to
the cases of instrument-air-failure po
sitions discussed above. The analysis
of the instrument air failure is focused
on whether the valve, at air-failure
position, could cause overpressure in
the system. Furthermore, instrument
air failure shall affect all the control
valves in the system.
In contrast, the "control valve fails
fully open or closed" situation may
only affect individual control valves in
the system. Thus, only one control
valve is considered at a time.
If a control valve on a feed line fails
fully open, it can result in overpres
sure in a surge drum, flash drum or
even distillation column. Tradition
ally, when the liquid outlet or the liq
uid inlet blocked valve fully opened,
engineers assumed that the required
relieving fluid would be liquid. In real
ity, this may not be true [71.
12. Process control failure. This
contingency case is important, espe
cially with the wide use of program
mable logic controllers (PLCs) and
distributed control systems (DCS), but
is often overlooked during overpres
sure analysis.
The potential impact of the failure
of every control loop — due, for in
stance, to the loss of the digital signal
for whatever reason — should be ana
lyzed, as should a situation in which
all other loops continue to operate nor
mally when one fails. As a general
72 CHEMICAL ENGINEERING WWW.CHE.COM JUNE 2001
rule, the required relief capacity must
be greater than the vapor generated
because of heat buildup in the system.
13. Exchanger tube rupture. API
states that complete tube rupture, in
which a large quantity of high-pres
sure fluid will flow to the lower-pres
sure side of the exchanger, is a remote
but possible contingency. Because the
test pressure normally is about 150%
of the design pressure, a two-thirds
rule is established from it. The rule is
this: pressure relief for tube rupture is
not required where the low-pressure
exchanger side (including upstream
and downstream systems) is designed
at or above the two-thirds criteria.
(Because ASMS changed the hydro
static test pressure for pressure ves
sels from the 150% design pressure to
a new standard of 130% design pres
sure, the existing two-thirds rule will
be changed to a ten-thirteenths rule
very soon. Many major oil companies
are already following this rule.)
As a general rule, the required relief
capacity is based on twice the tube
cross-section area, and the assump
tion that high-pressure fluid can flow
through both the tube stub and the
other end of the tube [9). These as
pects need to be analyzed:
• The battery limits for upstream and
downstream equipment
• When a high-pressure vapor gets
into a low-pressure vapor system,
the situation is different from, for
instance, getting into a low-pressure
liquid system
• When a high-pressure liquid enters
a low-pressure vapor system with
out flashing, if the velocity of the liq
uid is high enough, the liquid acts
like a piston, pushing away the
vapor until the liquid velocity has
slowed down. Full flow credit can be
taken for the vapor-handling capac
ity at the low-pressure side. Simi
larly, when a high-pressure liquid
enters into a low-pressure, liquid-
full system, the inlet liquid would
also initially act like a piston, dis
placing the lower-pressure liquid.
However, the high-pressure liquid
would slow down quickly. Therefore,
only the credit of the volumetric
flowrate of the low-pressure-side liq
uid at its normal operating condi
tions can be taken
• When high-pressure liquid could
flash into the low-pressure system,
the DIERS (Design Inst. for Emer
gency Relief Systems) methodology
should be considered [12]
• The impact of high-pressure fluids
flowing into a low-pressure system
should not be ignored, especially the
impact on the. manifold on the low-
pressure side when the pressure dif
ferential is too large
• If a steam reboiler tube ruptures,
consider the impact on the column
• For steam-generation systems that
use process fluids as a heating
medium, a tube rupture can have
environmental consequences
• Heat exchangers, in most cases,
have a design pressure that is
higher on one side than on the other.
If the design pressure of the low-
pressure side is less than 10/13 that
of the high-pressure side, one can
assume a tube rupture is a valid
overpressure scenario. The PRV
must be sized to handle the full
high-pressure flow from the tube
rupture [10]
14. Upstream relieving. The follow
ing two scenarios should be evaluated:
a. When an upstream vessel is re
lieving by discharging fluid into a
downstream vessel, the downstream
one should be designed to handle the
pressure and the volume of the incom
ing stream from the upstream vessel
without overpressuring itself.
If the upstream vessel does not have
adequate relief capacity, the down
stream vessel needs to have a PRV of
its own. The pressure drop between
the two vessels should be carefully
evaluated, along with the proper pres
sure settings for the two PRVs. If the
upstream vessel does have sufficient
relieving capacity, then the impact of
the upstream relieving pressure on
the downstream vessel should never
theless be evaluated.
b. Two vessels are connected by an
open path. The first has its own PRV
and it discharges to a flare header or
other location. The second will experi
ence the impact from the relieving pres
sure of the first vessel relieving. A pres
sure profile between the two vessels at
the time when the first vessel is reliev
ing must be carefully evaluated. The
second vessel must be well-protected
when the first vessel is relieving.
15. Runaway chemical reac
tions. During runaway reactions,
which tend to accelerate with rising
temperature, extremely high volumes
of non-condensibles with high energy
can cause the internal pressure of a
vessel or pipeline to rise rapidly. Un-
less properly controlled, the runaway
reaction cannot be controlled and ex
plosion will follow. Basically, PRVs
may not provide protection at all be
cause of their relatively slow response
time. In this case, vapor-depressuring
systems, rupture disks and emergency
vents are better [13].
16. Human error. The potential
impact of human error on plant safety
should never be underestimated.
When relying on operator interven
tion, the allowable time limit must be
long enough for the particular plant
situation. If operator intervention is
difficult or impractical, then it should
not be relied on at all. ■
Edited by Suzanne Shelley

References
1. Wong, W.Y., Improve PRV Audits, Hydrocarb.
Proc., November 1998, pp.133-146.
2 American Petroleum Institute, API RP 521:
Guide for Pressure-Relieving and Dcpressur-
ing Systems, 4th ed., Washington, D.C.,
March 1997.
3. American Petroleum Institute, API RP 620:
Sizing, Selection, and Installation of Pres
sure-Relieving Devices in Refineries, 6th ed.,
WashingtonTD.C., March 1993.
4 NFPA 30, "Flammable and Combustibles
Code," National Fire Protection Assn.,
Boston, 1981.
6. Wong, W.Y., Improve the fire protection of
pressure vessels, Chem. Eng., October 1999,
pp.193-196.
6. Wong, W.Y., Fire, vessels and the pressure-re-
liefvalve, Chem. Eng., May 2000, pp. 84-92.
7. Wong, W.Y., Consider two-phase relief for liq
uid blockage of flash drums, Hydrocarb.
Proc, December 1997, pp.76-78.
8. American Petroleum Institute, API RP 2000:
Venting Atmospheric and Low-Prcssure
Storage Tanks, 4th ed., Washington, D.C.,
September 1992.
9. Wong, W.Y., PRV sizing for exchanger tube
rupture, Hydrocarb. Proc., February 1992,
pp. 59-64.
10. Wong, W.Y., Capacity credit calculation for
exchanger tube rupture, Hydrocarb. Proc.,
December 1992, pp.89-92.
11. Emerson, G., The effect of back pressure on
pressure-relief valves, Hydrocarb. Eng., Oc
tober 1999, pp. 77-79.
12. Leung, J.C., and Nazario, F.N., Two-phase FEHLAB CHEHICAL ENGINEERING PROVIDES KEY FEATURES
flashing flow evaluations based on DIEKS,
API, and ASME methodologies, AIChE Loss A POWERFUL WAT OF MODELING equip- ■ Tanored interface for chemical
Prevention Symposium, April 2-6,1989.
13. Fauake, H.K., and Leung, J.C., New experi ment and processes in the field of
mental technique for characterizing tun- Simultaneous solving of arbitrary
away chemical reactions, Chem. Eng. Prog.,
August 1985, pp.39-46.
chemical engineering. It lets you easily
14. Brown, P.P.M., and France, D.W., How to
protect air-cooled exchangers from overpres
model mass, heat and momentum , fnMiaii ^^ for mmiam
sure, Hydrocarb. Proc., August 1975.
transport coupled to chemical reac hut and pats transport coupled to

Author chemical reactions

Wing Y. Wong of WYWong
tions in ID, 2D or 3D geometries.
Engineering (7420 Bates Rd.,
Richmond, B.C. Canada
V7A1C7; Phone: 604-272-
8198; E-mail: wywengineer-
ing @home.com) is an inde Order a free FEMLAB Chemical
pendent consultant who
provides services for design, Engineering Literature Pack!
audit and training related to
pressure-relief systems for
the petroleum, natural %aa
and petrochemical industries
He current-, r consulting service for
UOP LLC (Dca Plaines, 111.). Wong has written
many articles on pressure-relief systems, and
has developed several new concepts and proce
dures for pressure-relief valve calculations. He Vuitwww.comsol.com/chempack or call 781-273-3322 www.comsol.com
holds an M.Eng. in chemical engineering from
the University of Alberta (Canada), and a B.Sc.
from East China Inst of Chemical Technology.
He is a registered professional engineer in both
Alberta and British Columbia.
Circle 60 or Reply Online
CHEMICAL ENGINEERING WWW.CHE.COM JUNE 2001 73