RECOMMENDED PRACTICE FOR THE RISK-BASED INSPECTION (RBI) OF RELIEF VALVES

STANDARD DATA PAGE

REPORT NO. ESR.97.ER.089 ISSUE DATA: OCTOBER 1997

SECURITY CLASSIFICATION: UNRESTRICTED

MAIN TITLE: Recommended Practice for the Risk-based Inspection (RBI) of Relief Valves.

CLIENT: PRINCIPAL RECIPIENT(S): COMMISSIONED BY:

Multi Business J Rigden Production Facilities, MTL, BPX

ISSUING DEPARTMENT/DIVISIONS: MATERIALS & INSPECTION ENGINEERING RESEARCH & ENGINEERING CENTRE BP INTERNATIONAL LIMITED PREPARED BY: APPROVED BY:

..................................................
David Ray Edwin Smith

.................................................. DAVID RAY Team Leader MATERIALS & INSPECTION

ABSTRACT:

DISTRIBUTION:

SEE SEPARATE LIST

KEYWORDS:

Copyright BP International Limited 1997 All rights reserved. None of the information contained in this document shall be disclosed outside the recipients own company and no part of this document may be reproduced or transmitted in any way or stored in any retrieval system without prior written permission of General Management, Engineering Shared Service, BP International Limited.

RECOMMENDED PRACTICE FOR THE RISK-BASED INSPECTION (RBI) OF RELIEF VALVES

1. INTRODUCTION Relief valves in BP have traditionally been inspected and endorsed using the guidelines in the BP Inspection BPs, 32-3 and 32-4. Although these RPs encourage a risk-based approach to be adopted, no RBI models have been provided to date. Relief valves are considered to be particularly suitable equipment items for RBI because their criticality in major installations can be expected to vary from the profound to the relatively trivial, and the numbers of valves is usually large, many hundreds or even thousands. The concept of risk-based inspection (RBI) of relief valves was first considered in detail by BP Relief Valve Working Group, a multi-business team of relief valve experts and users. The Working Groups report, ESR.96.ER.059 dated 8th July 1996, included a draft methodology for the endorsement of relief valves using essentially qualitative RBI principles. After the publication of this report, numerous Assets in all 3 BP Businesses tested the methodology and, in general, reported it to be workable and beneficial. The main benefits were seen to be: a clearer identification of high criticality valves extended endorsements for significant numbers of low criticality valves an increased understanding of the design intent of valves by inspectors. Comments from the Assets about the methodology have been reviewed by members of the original Working Group, and have been incorporated into this Recommended Practice, where appropriate.

2. SCOPE This Recommended Practice is applicable to all spring loaded relief valves of conventional and pilotoperated design, capable of having their set-point verified by testing. Other over-and-under pressure protection devices such as bursting discs, buckling pins, vacuum breakers, pressure-vacuum valves and anti-surge valves are outside the scope. In the context of this Recommended Practice no distinction is made between relief valves, safety relief valves, pressure relief valves and pressure safety valves as defined in API RP 520. The RP is applicable to all types of process plant installations, whether onshore or offshore, and for all duties. Both new and used valves are within its scope. Relief valves protecting installations such as a transmission pipelines and pressurised storage tanks, which represent major investments protected by relatively few valves, are outside its scope. The risks associated with these valves are considered to be best assessed on individual basis using a methodology which models the consequences of failure-to-operate-on-demand in a more rigorous way.

3. OBJECTIVE The objective of the RP is to provide a methodology for the relatively fast and qualitative risk assessment of large relief valve populations in order that inspection and maintenance resources can be allocated in the most cost effective way. The RP is a risk management tool which has been designed to provide a higher level of analysis than that required by the existing BP Inspection Code, RP 32-3.

4. METHODOLOGY The methodology is based on the analysis of two failure scenarios: failure to open, fully or partially, on demand leakage across the seat in service It requires individual assessments of the probability and consequences of these failure scenarios for each valve in the population. The outpost of these two assessments are combined in a risk matrix, which provides recommendations for maximum valve endorsement periods. A more rigorous analysis would take account of the likely or historical demand rate on each valve. However, there does not appear to be an easy way to do this at the moment. Differences in site operations would make it difficult to develop or use a generic database for demand rate, and few sites keep records of relief valves lifting in service. Nevertheless, some account should be taken of the increased risks associated with valves which are known or expected to lift in service, and the guidance notes to the endorsement matrix in Figure 3 attempt to do this. Note also that failure to reseat at the specified pressure is not considered in this RP and, in most cases does not represent a hazard, there will be some applications where achieving the correct blowdown is important. Examples are steam boiler safety valves and relief valves in hazardous duties which relive to atmosphere. Such valves should be assigned a high consequence of failure rating (figure 2), and any historical reseating problems should be taken into account when allocating the probability of failure rating (Figure 1). Although the methodology is thought to be workable for most sites in the form presented in this RP, sites may wish to tailor some aspects in order to suit their local requirements and conditions.

4.1 Probability of valves failing to operate on demand or leak in service. This part of the assessment relies on historical reliability data, in particular the results of pre-pop testing and visual inspections of the valves and associated piping after previous periods of service. This part should be fairly easy to complete by inspectors working from inspection and maintenance records. Figure 1 shows the methodology, the output of which is a low, medium, or high probability ranking. Where historical data on the valve in question is not available, for example in the case of a new installation or application, it may be possible to utilise data from the BP RV database, maintained by the Reliability Group in GRE, Sunbury. For the purpose of this part of the assessment a clear understanding of the term defaulter is required. The normal recommended definition is that proposed by the Relief Valve Working Group, i.e. a valve which fails to lift to its required opening at a pressure less than or equal to 110% of the cold set pressure. Valves which lift light on the pre-pop test should not normally be considered to be defaulters except where a hazardous situation would arise by their lifting light in service. 4.2 Consequences of valves failing to operate on demand or leak in service. This part of the assessment attempts to rank the consequences of valve failures, as defined above, in terms of HSE. The process is shown in Figure 2, the logic of which is described below. Assessment of the consequences of failure will usually require specialist process engineering input, particularly with regards to the original design basis for the valve in question, the likely extent of overpressure in the case of failure to lift on demand, and the flammability and toxicity of the process stream.

It may be necessary to call on other specialist knowledge regarding the condition of the equipment being protected and the likely effects of overpressure. Appendices A and B provide information on typical causes and consequences of overpressure of equipment, and may therefore prove useful in carrying out this part of the assessment.

4.2.1 Notes to Figure 2 1. Pressure-vacuum valves on atmospheric storage tanks and relief valves protecting transmission pipelines are outside the scope of this RP and should be considered separately. Relief valves on pressurised storage tanks in non-hazardous duty should also be considered separately. 2. Any loss of containment is likely to have more serious consequences inside a process plant (inside battery limit) or on an offshore platform. 3. Hazardous fluid service - a fluid service which includes the following services and any other specified by the site concerned: (i) Liquids above their auto-ignition temperature (AIT), or 210oC if the AIT is not known.

FIGURE 1: PROBABILITY OF RELIEF VALVES FAILING TO OPERATE ON DEMAND OR LEAK IN SERVICE

IS THE VALVE IN A CLEAN, NON-CORROSIVE, NONCYCLIC DUTY?

NO YES YES

NO

NEW APPLICATION OR VALVE RELIEF VALVE?

YES

START HERE

DID THE VALVE DEFAULT AT THE LAST INSPECTION?

NO

YES

IS THERE SITE OR BP DATA OF VALVES OF THE SAME DESIGN, DUTY, MANUFACTURE, MATERIALS AND OF SIMILAR SIZE WHICH INDICATES SATISFACTORY PERFORMANCE AND HAS THE VALVE PASSED A PRE-SERVICE TEST?

NO

WERE ALL THE VALVE PARTS IN THE EXPECTED CONDITION, GIVEN THE SERVICE HISTORY OF THE VALVE?
YES

NO

DID THE VALVE DEFAULT AT THE LAST INSPECTION?

NO NO

WAS THE PROBLEM IDENTIFIED AND DESIGNED OUT FOR THE FUTURE?
YES YES

NO

HAS THERE BEEN ANY HISTORY OF IN-SERVICE INTERNAL LEAKAGE OR FOULING?

NO YES

DID THE VALVE DEFAULT AT ITS PREVIOUS ONE OR TWO INSPECTIONS?

YES

LOW

MEDIUM

HIGH

FIGURE 2: CONSEQUENCES OF FAILURE OF RELIEF VALVES TO OPERATE ON DEMAND OR PASS (LEAK) IN SERVICE
START HERE IS THE VALVE IN HAZARDOUS DUTY? (3) IS THE VALVE PROTECTING A TRANSMISSION PIPELINE OR AN ATMOSPHERIC STORAGE TANK? - OR IS THE VALVE PROTECTING AGAINST VACUUM? (1) NO IS THE VALVE LOCATED WITHIN A PROCESS AREA OR OFFSHORE? (2) NO YES IS THE VALVE IN HAZARDOUS DUTY? (3) NO YES IS THE VALVE PROTECTING A PRESSURISED STORAGE TANK? YES NO YES IS THE EQUIPMENT BEING PROTECTED KNOWN TO BE IN GOOD CONDITION AND LIKELY TO REMAIN SO? NO NO NO COULD THE DEMAND CASE RESULT IN INTERNAL PRESSURES EXCEEDING THE TEMPERATURE-CORRECTED HYDROSTATIC TEST PRESSURE OF THE LOWEST RATED PROTECTED EQUIPMENT? (12) DOES THE EQUIPMENT BEING PROTECTED INCLUDE PROPRIETARY EXPANSION DEVICES, BELLOWS, COUPLINGS, SPECIAL SEALS ETC? (7) YES SPECIAL ANALYSIS REQUIRED YES IS THERE ANY REASON TO SUSPECT THAT THE EQUIPMENT MIGHT NOT BEHAVE IN A DUCTILE MANNER IF SUBJECT TO OVERPRESSURE? (6) NO YES YES YES DOES THE VALVE RELIEVE TO ATMOSPHERE? (5) NO NO YES IS THE VALVE IN STEAM GENERATOR/FIRED BOILER DUTY?

YES

NO

NO

ARE THERE ANY SERIOUS CONSEQUENCES FOR PLANT ELSEWHERE IN THE SYSTEM?

YES IS THE EQUIPMENT BEING PROTECTED OF CONVENTIONAL FLANGED AND VALVED DESIGN, AND COULD A MINOR LOSS OF CONTAINMENT BE TOLERATED? (13) R/V DESIGN CASE PIPING THERMAL RELIEF (8) EXTERNAL FIRE, SHUT-IN, HP-LP UTILITY FAILURE, H/E TUBE INTERFACE RUPTURE, EQUIPMENT THERMAL PROTECTION RELIEF (10) (9)

YES

OTHER (11)

WOULD SEAT LEAKAGE IN SERVICE INEVITABLY RESULT IN AN UNACCEPTABLE OPERATIONAL OR ENVIRONMENTAL INCIDENT? (4)

NO YES WOULD SEAT LEAKAGE IN SERVICE INEVITABLY RESULT IN AN UNACCEPTABLE OPERATIONAL OR ENVIRONMENTAL INCIDENT? (4) NO

YES

NO

LOW

MEDIUM

HIGH

(ii)

Flammable liquids flashing on leakage to form a substantial vapour cloud. This shall include LPG, LNG and NGL condensate and others when specified by site. Fluids liable to cause a hazard by blockage due to hydrate formation or solids deposition. Fluids in which the potential for personnel exposure is judged to be significant and in which a single exposure to a very small quantity of a toxic fluid, caused by leakage, can produce serious irreversible harm to persons on breathing or bodily contact, even when prompt restorative measures are taken. Fluids in this category include substances classified in terms of occupational health risks as Very Toxic, Toxic and Corrosive Components of process streams which are known to cause serious irreversible harm include for example hydrogen sulphide (asphyxiant), hydrofluoric acid (corrosive) and sodium hydroxide (corrosive). Classification of fluids into this category should take into account both the health hazard of the individual component of the fluid and the concentration of these components within the process stream in question.

(iii) (iv)

(v)

Hydrogen service defined as service in contact with hydrogen or gaseous mixtures containing hydrogen in which the partial pressure or hydrogen is 5 bar (abs), (72.5 psig) or more. Flammable fluids at class 900 flange rating and above.

(vi) 4.

Seat leakage may or may not be tolerable, dependent on operational and environmental consequences, ability to isolate and repair, and size of leak. Major leakage should not be considered here. Valves in hazardous duty which relieve to atmosphere should not suffer seat leakage. The ductile behaviour of materials when subjected to overpressure cannot necessarily be guaranteed if the normal operating temperature is below the hydrostatic test temperature. Other embrittling mechanisms may be operative e.g. creep, hydrogen charging, stress corrosion cracking. These proprietary devices are likely to be less robust than vessels, piping, etc. designed and constructed to the usual Codes. Thermal relief valves for piping (not pipelines) are usually only required to relieve small volumes. In liquid filled systems much of the effect of overpressure will normally be absorbed by strain in the piping system. In gas/vapour systems overpressure will also be absorbed by compressibility of the fluids. In both cases pressure rises are likely to be modest and self-limiting. This is recognised by ANSI B31.3 piping code which allows overpressures of 33% in the thermal relief case (para. 301.2.2). In practice, at least some relief is also normally available via leakage past valve seats, valve glands and at flanged joints. See also BP RP 44-1 para. 4.10.1. This group accounts for most valves in hazardous duty. The allocation of "medium" consequence rating and its maximum maintenance interval of five years (Figure 3) effectively means that these valves continue to be treated in line with RP 32-3 and so a more rigorous analysis is not thought to be necessary for the purposes of this risk ranking exercise. These valves are clearly associated with the avoidance of catastrophic overpressurisation of an LP system from HP system breakthrough. Other design cases might include uncontrolled reactions, mechanical failures (e.g. non-return valves, control valves, heat removal pumps, fans), hydraulic pressure surges. The logic here is a generalisation of (a) the "two-thirds" rule which applies to heat exchanger design, as explained in RP 44-1 (para. 5.2.2.1) and API RP 521, and (b) the requirements for relief provision in the event on non-return valve failure (API 521 para 2.3.4.) Loss of containment within battery limits or offshore of any volume of LNG or LPG, for example, is usually considered unacceptable. Individual sites may wish to add other duties e.g. hydrofluoric acid due to its extreme toxicity.

5. 6.

7.

8.

9.

10.

11.

12.

13

-4.3 Allocation of Endorsement Periods The output of the analyses from figures 1 and 2 should be combined using Figure 3, which provides guidance on maximum endorsement intervals for all the various combinations of probability and consequence of failure (i.e. risks).

Consequence of Failure
Probability of Failure
HIGH MED LOW HIGH 24 36 48 (2),(3) MED 36 48 60 LOW 60 (3) 72 96

Figure 3. Risk Matrix for Relief Valve Endorsements ( months ).

4.3.1. Notes to Figure 3 1. 2. All "high and medium consequence" endorsements are within the existing guidelines in RP 32-3. For "high consequence" valves the maximum recommended endorsement is reduced to 48 months form the 60 months in RP 32-3. Endorsement intervals are biased such that lower consequence events are considered to represent lower risk. Endorsements must reflect the previous inspection intervals upon which the probability of failure was assessed. For "high and medium consequence" valves it is recommended that increases in endorsements should be made progressively towards the maximum, subject to a developing history of satisfactory inspections and tests. The maximum recommended increase for these valves is 12 months at any one time. Account should be taken of the increased risks associated with valves which are known to be likely to lift in service, based on previous history or based on a prediction of plant operation. All such valves should be identified and consideration should be given to limiting their endorsement intervals to less than the maximum.

3. 4.

5.

5. REFERENCES
API RP 520 Sizing, Selection and Installation of Pressure-Relieving Devices in Refineries Guide for Pressure-Relieving and Depressuring Systems Chemical Plant and Petroleum Refinery Piping Overpressure Protection Systems BP Relief Valve Work Group Report "Relief Systems Handbook"

API RP 521 ANSI-ASME B31.3 BP RP 44-1 ESR.96.ER.059 IChemE

APPENDIX A

COMMON CAUSES OF OVERPRESSURE

The most common causes of overpressure which are catered for by the design of plant relief systems are as follows:

A.1. External Fire External fire is often the most frequent design case for relief valves in major installations. Fires can potentially generate extremely high pressures, especially in closed liquid systems and, as the temperature of the metal is increased, its strength will be reduced such that the equipment might fail by overpressure without any demand being made on the pressure relief system. A.2 Ambient Effects Solar radiation can create overpressure in unprotected liquid filled systems by liquid expansion. Equipment types most commonly at risk are above-ground pipelines and pressure vessels. Changes in atmospheric conditions (e.g. rain storms) and solar radiation can also affect the internal pressure of large low pressure storage tanks and hence the rate of vapour venting. This can lead to either an under-or overpressure condition. A.3 Closed Outlet Inadvertant valve closure on the outlet of equipment or opening a valve on the inlet can cause overpressure by subjecting the equipment to the maximum upstream pressure. In the case of a pump this is the shut-off pressure, typically 20% above normal operating pressure for centrifugal pumps, but theoretically infinite for reciprocating pumps. In the case of compressors the overpressure from centrifugal machines may be limited to around 15% by the recycle setting. In the case of reciprocating compressors the degree of overpressure is again theoretically infinite. Inadvertant valve closure on both inlet and outlet may also cause overpressure if energy can still be absorbed into the equipment contents through, for example, internal heating coils, or externally from heat tracing or direct heating in the case of furnace coils. A.4. Instrument Failures The failure of an automatic control loop can cause overpressure by closing the outlet valve or opening the inlet control valve from a high pressure source, resulting in a similar situation to that described above. Loss of level control in a vessel may permit high pressure gas or vapour to flow into a downstream vessel designed for a lower pressure. This is known as gas breakthrough and can, dependent on the plant design, result in major overpressurisation. A.5. Valve Failures Mechanical failures of valves can produce the consequences described in A.3 and A.4. Additionally, the failure of a non-return valve can permitflow in the reverse direction and create overpressure upstream of the valve. A.6 Other Equipment Failures Failures of rotating machinery can create overpressure in a number of ways, e.g. failure of a pump extracting hot liquid from a distillation column in a pumparound system failure of an air cooler fan failure of a cooling water pump

Failures of heat exchanger tubes and floating head gaskets in shell-and-tube designs will result in direct communication between the tow sides which are likely to have different operating and design pressures.

A.7 Utility Failures Utility failures can result in overpressurisation in a number of ways, e.g. electric power failure causing loss of the same machinery described in A.6 cooling water failure causing loss of cooling for condensers etc instrument air failure causing, for example, control valve failure computer failure causing loss of automatic valve control steam failure causing loss of turbine-driven machinery fuel supply failure causing loss of engine-driven machinery

A.8 Other Effects A variety of process-related effects can result in overpressure, e.g. uncontrolled chemical reactions or internal explosions contamination of a hot heavy material with a lower boiling point component hydraulic pressure surge caused by a sudden stop or start of a long liquid column internal fouling causing blockage in relief valves, lines and vents.

APPENDIX B EFFECTS OF OVERPRESSURE ON EQUIPMENT

B.1. General

Apart from the specific considerations mentioned below the effects of overpressure on equipment will depend on: (a) (b) (c) (d) (e) (f) (g) the amount of overpressure the temperature at which it occurs the frequency of application of overpressure (i.e. fatigue effect) the general condition of the equipment (corrosion, remanent creep/fatigue life etc.) the degree to which structural materials and welds are free from defects the original assumptions made in design (degree of conservatism etc.) the rate of pressure build-up

For these reasons it is clear that, except in the case of new plant, any risk based overpressure protection policy must take into account the actual equipment and its condition rather than the equipment shown on P & IDs and piping isometrics. Future deterioration should also be taken into account. It is also important to realise that equipment which has been subjected to significant overpressure is no longer in the same condition as it was previously (e.g. material properties may be different) and that any decision to continue operation must take this into account. Equipment which is intended to operate at elevated temperature is usually hydrostatically tested at a pressure which is increased to take account of the higher strength of the material at the (ambient) test temperature. It is important to realise that the capacity of such equipment to withstand overpressure at design temperature is not indicated by the cold hydrostatic test pressure. B.2. Pipework

Most of the pipework under consideration will have been designed to ASME B31.3. This does not involve calculation of actual stresses so the margin available in any particular arrangement is difficult to determine. In practice, where standard type flanged joints are used, the most likely failure mode is leakage at the flanges. When dealing with flammable (and sometimes toxic) fluids, this is obviously a significant failure. Structurally, the most vulnerable components are expansion bellows followed by mitred elbows and standard elbows which have a high bending moment applied (resulting in ovality of cross section). Items such as filters, which are frequently provided with large diameter, flat covers, are also vulnerable. (It should be noted that flat sections generally are not easy to analyse so that the effects of a specific amount of overpressure are difficult to predict) Where high operating temperatures exist, ultimate failure would often be due to creep, and significant increases in pressure in such circumstances would reduce the time to failure by accelerating the rate of accumulation of microstructural damage. Most piping systems will have been hydrostatically tested to a pressure of 1.5 x design pressure, factored to take account of elevated temperature. This gives some confidence that joints will not leak excessively at pressures up to 1.5 x design, and that any local areas of plastic deformation will have shaken down so that there will be no gross deformation. In this case, occasional excursions to pressure <1.5 x design are unlikely to have a detrimental effect. However, if the design is such that shakedown has not been achieved in the hydrotest, repeated applications of overpressure may cause ratcheting, leading to ultimate collapse. Such circumstances are likely to be rare but, as explained above, it would be difficult to identify likely danger zones. There are two other possible test pressures which may have been applied: pneumatic testing at 1.1 x design pressure and, where piping is tested along with a connected vessel, 0.77 x 1.5 x design pressure (min). It should be possible to determine from records which systems fall into these categories. The response of a piping system to overpressure will also depend to some extent on flexibility e.g. a pipe bend which has to withstand a large bending moment will have less capacity available to absorb overpressure.

B.3.

Flanged Joints

In an uncorroded piping system flanged joints are usually the weak link and will tend to fail first. Structural failure will usually be preceded by leakage (as a result of distortion and loss of gasket compression force) which, despite tending to reduce pressure, may be unacceptable. However, more sudden failures (e.g. due to gasket blowout or excessive bolt strain) are also possible and badly made joints are likely to suffer most. Such failures are not very likely with relatively minor pressure increases. The type of flange has a bearing on the pressure at which leakage or failure might occur. Generally, slip-on welded flanges can be expected to fail before weld neck flanges and also will be more liable to problems if fatigue or pressure fluctuations are involved. Compact flange connectors (Grayloc etc.) will often continue to seal up to the pressure at which gross structural failure occurs. B.4. Valves

All valves should have been hydrostatically tested in the fully assembled condition to 1.5 x cold rated pressure (i.e. as with pipework, testing is temperature related) and, in most cases, leakage through stem seals and body flanges is the most likely failure mode. There may be exceptions to this, however. High pressure valves having pressure seal body joints will simply continue to seal better as the pressure rises and valves with self energising body joint or stem seals (O rings, lip seals etc.) will often also be capable of retaining pressures much higher than 1.5 x design. In such cases, gross deformation and/or seal failure at high pressure are the likely failure modes. Low pressure systems often include oval bodied gate valves and these will generally suffer from gross deformation at lower pressures than cylindrical/spherical counterparts. However, since they are always provided with simple, flanged body/bonnet joints, leakage through these should be the primary failure mode. It should be remembered that, unlike most pipe joints, the flanged bonnets of valves are not restrained so that, if gross leakage does not lead to a pressure reduction, they are likely to become missiles in gas/vapour systems. B.5. Pumps and Compressors

The casings of pumps are hydrostatically tested to 1.5 x design pressure and the same considerations apply to leakage through flanged joints as for valves above. Although casings often depart considerably from the cylindrical/spherical ideal and sometimes contain significant stress raisers, many will have been subjected to extensive stress analysis to demonstrate acceptability. In most cases they are designed to achieve a high degree of rigidity and stability and this will usually result in an ability to withstand relatively high pressure loads. In the case of many centrifugal machines, automatic bypass/re-circulation arrangements will limit the overpressure to a modest amount. Seals are normally designed for suction conditions however, and are not normally tested other than for function under operating conditions. Oil seals will normally only have a 10% margin over design pressure. Seal failure is therefore by far the most likely failure mode resulting from overpressure and the quantity of fluid discharged as a result can represent a serious fire or other hazard. Rotating machines generally are sensitive to loads applied through the connecting flanges so if these are significantly increased by overpressure conditions loss of function could result. B.6. Pressure Vessels (including heat exchanger shells)

A vessel subject to overpressure will eventually reach a condition where it will either fail to fulfil its service function (e.g. through leakage or excessive deformation) or it is structurally unsafe (i.e. the ultimate limit of the design has been reached). Design Codes do not normally consider the former and so cannot guarantee protection against failures of this type. Within design codes there are different categories of construction (e.g. involving different levels of NDE) and different methods of design and analysis (involving more or less knowledge of the true pressure bearing capability of the vessel). In attempting to assess the effects of overpressure it is important to have the maximum possible information about the true condition of the vessel.

(a)

Serviceability limit/functional failure

Vessels with flanged joints are likely to exhibit leakage before gross deformation occurs but the comments made above regarding self energising seals apply here as well. Similarly, most vessel closures will be unrestrained in the event of catastrophic failure. Large flanges are the most vulnerable but operating temperature and gasket design are also important factors. Depending on the design code used vessels will have been hydrostatically tested at between 1.25 x and 1.5 x design pressure. In most cases the test pressure will have been factored to take account of temperature so having passed the hydrostatic test does not guarantee freedom from leakage when similar pressures are applied at elevated temperatures. Deformations may affect related equipment (e.g. by transmitting unacceptable loads to machinery) or internal components without running the risk of structural failure of the vessel. (b) Ultimate limit/structural failure

The potential failure modes and the operating conditions under which each may occur are shown in Figure B1. As a general rule, the codes apply a minimum safety factor of 1.5 when designing against these, the limit state being defined by the lowest failure load. If there are any shape imperfections, the safety factor will be greatly reduced. This is particularly significant for spherical heads and for cylinders of vessels under the axial compressive stress. This is because they experience a different type of collapse known as snap-through buckling. Tensile failure takes the form of a component yielding due to tension or bending or both, and is the most likely failure mode for a sound vessel operating at moderate temperatures. An unperforated cylinder would be subject to uniform tension across its thickness but a dished head may fail at a plastic hinge created under the combined action of tension and bending. The presence of stress concentrations (e.g. at cone-cylinder junctions, nozzles and attachments) will cause individual regions of failure requiring elastic, plastic or elastic-plastic analysis for evaluation and would be of great significance in the case of fatigue loading (e.g. repeated applications of overpressure). Creep is a significant failure mode at elevated temperature. Code design rules are mainly based on applying a factor of safety to the rupture stress of the material at the design temperature and required lifetime for the vessel. This then equates to the permissible design stress. The relation between stress and time to rupture is logarithmic and, very approximately, a 100% increase in stress leads to a 50% reduction in the time to rupture. In the case of brittle fracture, failure is determined by the three main factors: the applied stress (including residual stress at welds), the size and orientation of defects and the fracture toughness of the material at the design temperature. Note that the latter is related to the material thickness (ductile/brittle transition temperatures for ferritic materials usually increase with increasing thickness). The significance of an increase in stress due to overpressure will depend on the material, temperature, quality of the fabrication (i.e. presence of significant defects) and whether the vessel was stress relieved. Collapse requires the presence of external pressure or an internal vacuum. The items most likely to suffer from the effects of overpressure are internals such as baffles and pipes/tubes under external pressure. Interstiffener collapse of cylinders may need to be checked and also overall collapse of stiffeners. Most vessels will conform to fairly standard configurations whose behaviour when subjected to high loadings is reasonably well understood and can be analysed. Where vessels may have undergone uprating to new operating conditions it is important to confirm that the factors of safety mentioned above have not been reduced. Possible failure modes for heat exchangers include leakage through the bolted closure and bending of the tubesheet. Heat exchanger tubes may burst or buckle when overpressurised resulting in LP system overpressure, undesirable fluid mixing and expensive repairs. The most serious case would be instantaneous tube rupture and recent studies have shown that transient overpressure of the LP side is dependent on both the speed of opening of the relief device and the volume of pipework between it and the heat exchanger shell. In addition to overpressure of the shell, slugging flow may occur in the connected pipework leading to excessive loading of pipe supports. The likelihood of tube failure will vary with design, material and condition. B.7 Column Reactors

Generally, similar comments apply as for pressure vessels. However, due to the influence of internal components such as trays, catalyst beds etc. failure modes involving pressure differences within the vessel itself may need to be considered and this is one area where collapse becomes a possible failure mode. Reactors are potentially at risk from overpressure failure where the internal reactions are exothermic, either during normal operation or during transient conditions such as catalyst regeneration. Local hot spots on the reactor wall can lead to local bulging of failure by ductile overload at the elevated temperature. B.8 Tanks

Fixed roof tanks will usually have very little margin for pressure increase and deformation will occur very quickly. Depending on construction, slight overpressure will tend to cause tanks to deform by lifting off the base at the annular ring, shell slightly bowing out and possible rippling (buckling?) or distortion near the roof top rim area. Tanks are normally designed to fail as a result of overpressure by rupture of the roof edge to top rim seal weld ("frangible joint") so that pressure relief is achieved without loss of contents. However, it is not always possible to guarantee this failure mode due, for example, to the effects of in-service corrosion having weakened the annular ring joint. In this case, loss of contents would be total and possibly catastrophic. Some tanks may have some redundancy of overpressure protection by virtue of dip-hatch covers, overflow vents and emergency vents. In this case the risk of overpressure could be greatly decreased. On the other hand, tanks containing products which tend to cause deposits may well have a dependency on cleaning routines for effective overpressure protection. Fixed roof tanks are also at risk from failure by underpressure, which usually results in inwards collapse of the roof and/or the shell. The nature of the failure will be largely determined by the tank height-diameter ratio, and the relative stiffness of the roof and the shell.

FIGURE B1

VESSEL FAILURE MODES

200

Pressure Bar Gauge

BRITTLE FRACTURE (FERRITIC)

TENSILE FAILURE

CREEP

Temp oC 1250oC

-250

C O L L A P S E
-40

Corrosion Erosion Fatigue

apply throughout

Stress Corrosion Cracking Tensile Failure

applies selectively applies at all positive pressures