Special Report Plant Safety and Environment
D. SMITH and J. BURGESS, Smith & Burgess LLC,
Houston, Texas
Relief valve and flare action items:
What plant engineers should know
When most companies implement the process safety man-
agement standard, they routinely or periodically review the
relief systems and flare systems design bases to ensure compli-
ance with corporate, industry and/or government standards,
hereafter referred to as Recognized And Generally Accepted
Good Engineering Practices (RAGAGEP). To mitigate con-
cerns before implementing projects, it is advisable for plant
engineers to consider several items when reviewing a con-
cerns list:
1. Relief systems review methodology
2. Relief systems review priorities
3. The process designer’s familiarity with the process and/
or plant when concerns are being reviewed
4. The plant engineer’s understanding of the differences
between compliance and best-in-class practices.
An article published in 2000 concluded that up to 40% of
the installations evaluated had unidentified concerns.1 Since
the publication of this article, many of these concerns have un-
dergone a more detailed review showing that modifications to
the facility were not required to address these concerns.
The purpose of this article is to help the plant engineer re-
view the concerns developed by the design engineer. Imple-
menting field modifications without performing such a review
is costly and exposes a facility to unjustified risks.
For the purposes of clarity, the following terms used
throughout this article are defined as such:
• Plant engineer—The facility or owner’s engineer who
is responsible for reviewing the concerns and determining if
facility modifications should be implemented
• Process designer—The individual who is responsible
for analyzing the relief device and overpressure protection sys-
tem and developing the concerns
• Concerns—Items that are listed (prior to being fully re-
viewed and accepted) as deviations from industry or company
standards.
At the end of the relief systems design basis project, the
process designer typically identifies many concerns. As most
facilities want to comply with RAGAGEP, there is a mandate
to resolve these concerns, and their resolution can be costly.
Generally, most facilities seek to comply with regulations
for existing facilities and to potentially build new equipment
and facilities to a higher standard. This article includes exam-
ples of how to review existing systems to determine if concerns
justify field modifications.
RELIEF SYSTEMS REVIEW METHODOLOGY
Relief systems design basis reviews are typically performed
by contractors that assist in developing project guidelines and
then collect the necessary information. After these initial ac-
tions, the contractors analyze the system’s design basis per the
project guidelines and present a list of identified concerns to the
plant’s engineers and management. Prior to spending money to
upgrade the relief systems, a plant engineer familiar with the pro-
cess unit should review the concerns list to ensure that:
• Details of the study are reasonable
• Assumptions of the study are reasonable
• Facility upgrades, not based on minimum compliance,
have been thoroughly reviewed.
By reviewing the concerns list with these suggestions, a
plant engineer can ensure that costly changes have a basis in
sound engineering and that the expense is justified. Note that
no hierarchical order is implied in this list.
Typically, when a relief systems design basis project is un-
dertaken, the goal is to produce compliant documentation ef-
ficiently and consistently. To do this, process designers must
base the analysis on a framework to minimize effort and ensure
consistency. This is a practical method for performing a large-
scale relief systems analysis; however, for any particular con-
cern, the framework may break down and suggest items that
are not actually concerns.
In a recent review project, approximately 40% of the listed
concerns were later found to be acceptable based on a detailed
review. The following sections help walk a plant engineer
through a systematic process and give insight into how to re-
view the listing of concerns.
Reviewing relief system study details. When the concerns
are reviewed from the perspective of the process designer, the
plant engineer can understand how the framework may have
generated potential concerns. Understanding this process can
help the plant engineer identify resolvable concerns by review-
ing the design basis.
Understanding the process. When completing large-scale
relief systems design basis documentation and design pro-
cesses, the process designer is usually quite familiar with relief
systems design but may not be familiar with the particulars of
the process or unit. The process designer, therefore, may make
unrealistic judgments about process upsets. The following are
examples of these items:
Hydrocarbon Processing | NOVEMBER 201241
 Plant Safety and Environment
• When process flows can be blocked, or if the normal rate
is possible under upset conditions
• Use of the normal/design duty from a reboiler for relief
rate estimation
• Equipment that is no longer in service is not properly
protected.
To ensure the best possible analysis, each study should be
reviewed by personnel familiar with the process operation to
confirm that unique process characteristics are captured in the
relief systems documentation.
Credibility of scenario or relief rate. For each overpres-
sure scenario that generates a concern, the plant engineer
should give particular attention to ensure the credibility of the
scenario or required relief rate. Many times, an overpressure
scenario or the estimated rate may not be credible. The follow-
ing are some examples:
• Pumps that can only pump to relief pressure if the up-
stream system is also upset (however, a simultaneous upset
would be considered double jeopardy)
• Systems where overpressure derives from heat input,
such that the relief temperature of the process fluid exceeds the
relief temperature of the utility fluid
• Control valve failure calculations that are based on the ca-
pacity of a control valve instead of on another limitation (e.g., a
long section of piping or a pump).
To ensure an accurate analysis, each concern should be re-
viewed to verify that consideration has been given to the de-
termination of the scenario applicability and that the relief rate
estimate is reasonable for the particular process or unit.
Gathering facility data. The relief systems analysis process
typically limits the amount of places and time that the process
designer can search for process and equipment data. This limi-
tation is usually defined as a project scope item and is used to
ensure that the project has boundaries. When reviewing con-
cerns, the plant engineer must ensure that the process designer
has not identified concerns that can be readily resolved by fur-
System relief devices
4 x 8-in. inlet flange,
10-in. outlet flange, T orifice
External system feed
Pmax = 200 psig
CSO
Top pumparound Top reflux
Bottom pumparound
Fractionator
Other process
heaters
Feed furnace
FIG. 1. Flow diagram of an example fractionator.
42NOVEMBER 2012 | HydrocarbonProcessing.com
ther searching for process and/or equipment data. Often, this
requires a call to an external supplier or technical body (e.g.,
the equipment manufacturer or national board).
Other execution issues. The relief systems process typical-
ly uses a consistent basis that is often documented and referred
to as site or project guidelines. These guidelines are beneficial,
as they provide a means for efficient and consistent execution
and help ensure that both the process designer and plant en-
gineer are in agreement on the details of the analysis. When
these generic and prescriptively conservative guidelines gener-
ate concerns, it is imperative that the team generating the docu-
mentation reviews the fundamentals of the analysis to confirm
that the concern is a legitimate deviation from RAGAGEP and
not just a result of the project execution process.
Reviewing relief system study assumptions. The typi-
cal execution method of a project tends to enforce consistent
assumptions. For most of the project, this ensures that the re-
lief systems design basis is conservative and compliant with
RAGAGEP. To ensure that field modifications are for items
that must be addressed, these assumptions may need to be
challenged when concerns are raised.
Standardization assumptions. Standard and generally
conservative assumptions are specified to ensure consistency
and efficiency. These assumptions help the relief systems
documentation process run efficiently; however, if generic as-
sumptions result in concerns, they should be revisited and up-
dated. The following are some examples of these items:
• Liquid levels for equipment
• Control valve flow coefficients and trim sizes
• Utility pressures (e.g., steam, nitrogen, cooling water)
• Heat exchanger or pump capacities.
To ensure the best possible analysis, the assumptions asso-
ciated with each concern should be reviewed and, if possible,
refined to be specific for that system.
‘Conservative’ assumptions. The authors of this article
have been carrying out relief systems analysis for multiple de-
CSO
cades and believe that “conservative assumption” is frequently
To flare
used as a phrase for a simplifying assumption that the process
Overhead
designer invoked. Furthermore, this phrase typically has noth-
cooler ing to do with being conservative. The following are examples
Offgas product of conservative assumptions:
• Normal flowrate was used instead of a reduced estimate
• Column tray or overhead flowrate was used instead of
performing a simulation
Overhead • Multiple unrelated failures occurred simultaneously.
product
As previously stated, each “conservative assumption” should
be reviewed and refined so that it is specific for each system.
Mid-tower product Other assumptions. The design and analysis of relief sys-
tems is an art. Much of the analysis is based on the assumptions
that form the overall basis. Mathematical errors are rarely the
cause of an incorrect analysis; usually, the cause is a problem
Bottom product with the basis. The basis for each system is stacked on top of a
basis for another system. Once the assumptions are flushed out
and determined to be correct, the mathematics are easy.
Fractionator example. In the past, the authors reviewed
a fractionator (FIG. 1), where the normal feed vapor rate was
specified as the relief rate for a power failure relief load (conser-
vatively assumed). When the capacity of the feed furnace was
 The world’s largest hydrogen
pipeline network delivers...
The world’s most reliable
hydrogen supply.

It’s the kind of massive project only a global leader would undertake.
Anticipating that hydrogen needs along the Gulf Coast of North America
will increase in the years ahead, Air Products expanded its hydrogen supply
network. By building a 180-mile (290-km)-long pipeline that connects our
existing Texas and Louisiana systems, we’ve united 22 hydrogen plants and
600 miles (965 km) of pipeline, with a total system capacity of over one billion
SCFD (1.3 million Nm3/hr). So if an event disrupts operations on one side of
the Gulf, hydrogen can keep flowing from the other, giving our refinery and
petrochemical customers the reliable, uninterrupted supply they need. With
this record-breaking network, Air Products continues to break new ground in
hydrogen supply. For videos and detailed information, visit our website.

tell me more
airproducts.com/H2pipeline

©2012 Air Products and Chemicals, Inc.

Select 67 at www.HydrocarbonProcessing.com/RS
 Plant Safety and Environment
confirmed, the feed furnace could barely vaporize the normal
amount at the normal production rate and fractionator pres-
sure. This particular power failure scenario specified the loss of
the pumparounds, which resulted in the loss of approximately
80% of the crude preheat train duty.
When properly reviewed, upgrades
to the flare and relief system from a
relief systems analysis can improve
the safety of an operating facility.
With the increase in pressure and cooler-than-normal feed
temperature to feed furnace, the maximum vaporization would
be around 50% of the normal vapor rate. The argument for
keeping the feed preheat was that it was conservative, as the
heat input may not be lost. If this turned out to be the case, then
pumparounds would have continued, leading to a significantly
different outcome. Assumptions need to at least be internally
consistent for each scenario. If the pumparound cooling is lost,
then so is the feed preheat, and vice versa.
Distinguishing minimum compliance from best
practices. The final items that need to be reviewed by the
plant engineer are any deviations from RAGAGEP (and not
just deviations from best practices). Often, when completing
relief system projects, the team responsible for the design will,
with the best of intentions, work into guidelines some require-
ments that go beyond RAGAGEP.
While extra requirements may be justified based on the in-
creased safety at nominal incremental costs in new construction,
these requirements can be quite expensive for existing facilities.
These additional requirements must be reviewed and possibly
excluded from items that need to be retrofitted. Regulatory re-
quirements may require additional documentation to ensure
that not making modifications presents an acceptable risk.2
Gray areas for modification. Often, items may not be ab-
solutely correct, but they also may not rise to a level requiring
field modification. An example is when current corporate stan-
dards exceed the standards to which a unit was built. This situ-
ation is particularly relevant when a facility is acquired, thus
creating a situation where a facility was constructed to one set
of corporate standards but is now operating with a new corpo-
rate standard in effect.
In these cases, a process designer should investigate any
deviations and document why these deviations are accept-
able. For cases where past designs do not meet the current
RAGAGEP standards, but the deviations are deemed to be mi-
nor, management at some facilities may choose to have more
regulatory risks than safety risks.
Consideration of risk to make changes. Fixing issues
with equipment design, especially when the facility is running
or even in turnaround, must be carried out with great care. In
the past three or four years of literature searches, the authors
44NOVEMBER 2012 | HydrocarbonProcessing.com
have yet to find a single case of a slightly undersized relief de-
vice resulting in an injury or loss of containment. There are,
however, countless records of injuries sustained from refinery
modifications that can be found via Internet search.
To illustrate this point, in a 2009 Chemical Safety Board
(CSB) video requesting that the city of Houston,
Texas adopt the American Society of Mechanical
Engineers (ASME) Pressure Vessel Code, the CSB
was unable to find instances resulting in loss of con-
tainment for pressure vessels for undersized relief
devices.3 The video cites three examples of vessel
failures from undersized relief devices. The first ex-
ample is a low-pressure tank with an undersized re-
lief device, and the other two examples have plugged
or isolated vent lines.4, 5, 6
For a plant engineer responsible for increasing
overall facility safety, it may be possible to defer
modifications for the resolution of minor deviations until
other equipment changes are required. This would be at the
discretion of the facility, it would require a reasonable level
of risk, and it could open up the facility to regulatory action.
FLARE SYSTEMS REVIEW METHODOLOGY
The preceding section reviewed the typical methodology
that a process designer would use to generate a relief systems
design basis. This section is designed to help the plant engi-
neer understand how the individual relief systems loads are
developed and used to create an overall set of global scenarios,
which is then used to verify that the flare system and associated
equipment are adequately designed. Several key topics will be
further explored:
• Global load considerations
• Reasonable and consistent assumptions
• Advanced flare techniques.
By reviewing the flare systems design concern list from
these three angles, a plant engineer can ensure that the basis for
costly changes is justified.
Global load considerations. When a relief systems design
project is undertaken, the individual relief device loads are
typically gathered first. Once these loads are known, they are
entered into a hydraulic analysis tool, and then the flare system
is analyzed. However, as with the individual load determina-
tions, there are areas that a plant engineer should review.
Credibility of the scenario. In global scenarios, the process
designer typically will review power failures (both a total loss
of power and partial power failures), utility failures and large-
scale liquid pool fires. All of these scenarios affect multiple
systems of equipment and should be considered. The process
designer for each individual scenario looks at the underlying
scenario to ensure that it is credible. For example:
• Is a large-scale liquid pool fire possible, and to what extent?
• Is a total utility failure possible, or does the utility feed all
the listed equipment systems?
• Does one utility failure lead to another utility failure (e.g.,
loss of steam resulting in the loss of the turbine-driven instru-
ment air compressor)?
As previously stated, “conservative assumptions” for scenar-
ios that are not controlling or that do not have concerns may be

Regular Washers improve Torque and Tension Accuracy
Find out what’s new in Washers at www.HYTORC.com/Washer
Select 160 at www.HydrocarbonProcessing.com/RS
acceptable. A plant engineer should review the scenario basis
for any global scenarios with concerns. Additionally, the “con-
servative assumptions” associated with the sizing of the relief
device may not be consistent or even possible, given the spe-
cific global scenario being evaluated.
Credibility of the rates. Global overpressure scenarios are
often a compilation of relief rates specified as closely related
individual relief device scenarios. While these scenarios may
have been conservatively estimated and may have generated no
concerns, summing multiple systems with conservative rates
may result in problems.
In a presentation to the 6th Global Congress on Process
Safety, Dustin Smith reported on a refinery-wide review that
resulted in a 40% reduction in the design relief rate by review-
ing the specified relief loads and eliminating overly conserva-
tive assumptions.7 A plant engineer should ensure that the pro-
cess designer does not simply create a global scenario on the
basis of multiple conservative calculations; the designer must
also review the system to ensure that rates are reasonable and
defensible (and not excessive due to assumptions).
Reasonable and consistent assumptions. As with the in-
dividual relief systems analysis, the scenario assumptions and
those used to generate the relief rates make a tremendous impact
on the adequacy of the flare system and associated equipment.
‘Buried’ assumptions. When sizing individual relief de-
vices, RAGAGEP require that the process designer assumes
that the worst case occurs and that all related failures, pump
lineups and control valve responses are either neutral or detri-
mental. For global scenarios, the process designer must assume
that the global failure occurs, but the requirement for neutral
Since 1968
2012
(ASME & TUV)
or detrimental effects is more muted. The following are some
examples of “buried” assumptions typically used:
• Heat exchanger duty based on service overall heat trans-
fer coefficient and area (UA) instead of the clean and new UA
• Level control valves hold level in process vessels
• Airfin coolers retain some fractional cooling capacity
• Operations personnel do not simultaneously open de-
pressuring valves with utility failures unless directed to in op-
erational procedures.
The plant engineer and process designer should work with
personnel that operate the units, and they should review sce-
nario basis and loads for any global scenarios with concerns.
Consistent assumptions. In the definition of global over-
pressure scenarios and associated rates, the need to ensure con-
sistency is paramount. Many times, the process engineer will as-
sume for one equipment system that a pump was in operation
and has failed, while, in the next equipment system, the failure
pump was spared and the alternative pump was in operation. For
these analyses, consistency across the facility is required, as the
goal is to analyze the flare system (vs. the individual relief devic-
es). Some assumptions can result in system-wide inconsistencies:
• When a pump is spared and used for multiple equipment
systems, the scenario should specify which pump has failed for
all systems
• The effects of the failures must be considered for systems
with heat integration
• Utility failures that result in cascading losses must be ex-
amined consistently.
The plant engineer should review the controlling global
scenarios to ensure that the assumptions used are internally
consistent.
Hydrocarbon Processing | NOVEMBER 201245
 Plant Safety and Environment
Advanced flare analysis techniques. API Standard 521 al-
lows for the consideration of positive action of instrumentation,
operations or other favorable items, as long as the failure of these or flare design and documentation process, the plant engineer
items is considered.8 Prior to making costly flare system modi-
fications, the plant engineer should review more complex flare
system analysis tools to ensure that modifications are justified.
Flare load probability analysis. In a presentation to the 6th
Global Congress on Process Safety, Dustin Smith reported on a
method to estimate the flare loading probability.7 This method
determines the likelihood of loads to the flare system,
and it can be used to target instrumented responses
and piping modifications. This method demonstrates By reviewing the concerns list, a plant
that analysis of the effects of safeguards and the proba-
bility of failure on demand (PFD) of these safeguards engineer can ensure that costly changes
can be used to develop the system loading as a func-
tion of probability/frequency. Using this information have a basis in sound engineering and
and given an acceptable time frame (e.g., 1 in 100,000
years), the expected flare load is lower than the worst-
that the expense is justified.
case scenario.
The authors recently reviewed a refinery where
the likelihood of a “worst-case” load, if a total power failure oc-
curred, was approximately 1 in 100 million years. The design
load for 1 in 100,000 years was a fraction of the total load, and
it was more consistent with the complexity of the plant, along
with the DCS programming and the safety instrumented func-
tions and interlocks recently installed.
Flare quantitative risk assessment. Flare quantitative risk
assessment is a way to review each scenario and the perturba-
tions of these scenarios to determine the likelihood of vessel
9 Board, Video, 2009.
overpressure as a function of frequency. This varies from the
flare loading probability in that the statistical analysis and hy-
draulic analysis are coupled; whereas, in the flare loading prob-
ability, the flare loading statistical analysis is separate from the
hydraulic analysis. In both cases, the plant engineer must en-
sure that the scenario initiating event frequencies and the PFD
of safeguards are reasonable and defensible.
Flare load dynamic simulations. Offering and requesting
dynamic flare system designs are becoming increasingly com-
mon. Like the other advanced flare analysis techniques, this one
increases the complexity of the analysis, thus requiring the facility
to increase its understanding of the effects of assumptions on the
final answer.10 The basic premise of dynamic simulation is that, by
combining the effects of the staged timing of releases and the dy-
namic pressurization of the flare system, the peak loads and back
pressures on system components are reduced. In this method, the
plant engineer must ensure that the fundamental assumptions af-
fecting the timing of each system or release are reasonable and
defensible, thereby ensuring that the system is properly modeled.
Other techniques. Other methods to analyze flare systems are
proprietary to operating companies. All of these methods are de-
signed to account for the probability that either operator interven- University and a licensed professional engineer in Texas.
tion or instrumentation will operate, or fail to operate, as desired.
Any method of flare header analysis that is not a worst-case
analysis must, therefore, establish some reasonable means of ac-
counting for the positive action of instrumentation or operator
intervention to mitigate the worst-case load. The delicate bal-
ance between realism and conservativism in flare header design
is paramount in creating a safely designed flare header at a rea-
sonable cost.11
46NOVEMBER 2012 | HydrocarbonProcessing.com
TAKEAWAY
When reviewing concerns generated from the relief system
must ensure that each concern is valid and that any resolution
requiring physical changes is a justified investment of a facil-
ity’s capital. To properly perform this task, it is recommended
that a plant engineer understand how a process designer per-
forms the study and review the concerns prior to making physi-
cal changes to the facility.
When properly reviewed, upgrades to the flare and relief
system from a relief systems analysis can improve the safety of
an operating facility.
LITERATURE CITED
1
Berwanger, P. C., R. A. Kreder and W. S. Lee, “Analysis Identifies Deficiencies in
Existing Pressure Relief Systems,” Process Safety Progress, Vol. 19, 2000.
2
Smith, D. and J. White, “Ensuring safe operations when fulfilling action item
requirements,” Hydrocarbon Processing, March 15, 2010.
3
“Without Safeguards, Pressure Vessels Can Be Deadly,” US Chemical Safety
4
Poje, G. V., A. K. Taylor and I. Rosenthal, “Catastrophic Vessel Overpressurization,”
US Chemical Safety and Hazard Investigation Board, Report No. 1998-002-I-
5
LA, 2000.
D. D. Williamson & Co. Inc., “Catastrophic Vessel Failure,” US Chemical Safety
and Hazard Investigation Board, Report No. 2003-11-I-KY, 2004.
6
“The Goodyear Tire and Rubber Company,” US Chemical Safety and Hazard
Investigation Board, Report No. 2008-06-I-TX, 2011.
7
Smith, D., “System Limited Flare Design: A Flare Load Mitigation Technique
(with a QRA Case Study),” 6th Global Conference on Process Safety, 2010.
8
ANSI/API Standard 521, “Pressure-Relieving and Depressuring Systems,”
American Petroleum Institute, 2008.
9
Kreder, R. A. and P. C. Berwanger, “Quantitative Analysis—A Realistic Approach
to Relief Header and Flare System Analysis,” 2005.
10
Chen, F. F. K., R. A. Jentz and D. G. Williams, “Flare System Design: A Case for
Dynamic Simulation,” Offshore Technology Conference, Houston, May 1992.
11
Burgess, J., “Flare Header Debottlenecking,” Design Institute for Emergency
Relief Systems, Spring Meeting, 2006.
DUSTIN SMITH, PE, is the co-founder and principal consultant of
Smith & Burgess LLC, a process safety consulting firm based in
Houston, Texas. As a consultant, Mr. Smith has extensive
experience with helping refineries and petrochemical facilities
maintain compliance with the PSM standard. He has more than a
decade of experience in relief systems design and PSM
compliance. His experience includes both domestic and
international projects. Mr. Smith is a chemical engineering graduate of Texas A&M
JOHN BURGESS, PE, is the co-founder and principal consultant
of Smith & Burgess LLC, a process safety consulting firm based
in Houston, Texas. Mr. Burgess is a consultant who specializes in
helping refineries and petrochemical plants meet the PSM
standard. His experience includes more than 10 years in relief
systems and PSM compliance, for both domestic and
international projects. Mr. Burgess has BS and MS degrees in
chemical engineering from both Texas Tech University and the University of
Missouri, and he is a licensed professional engineer in Texas.