Sabp Z 079

Best Practice
SABP-Z-079 24 May 2016

Equipment Overpressure Scenario Identification
Document Responsibility: Flare Systems Design Standards Committee
Contents
1 Introduction ...................................................... 2
2 References ...................................................... 2
3 Definitions ........................................................ 3
4 Instructions ...................................................... 5
5 Study Data ....................................................... 5
6 Deliverables ..................................................... 6
7 Scenario Identification Process ....................... 7
8 Scenario Identification Philosophy ................. 10
9 Standard Scenarios ....................................... 10
Previous Issue: New Next Planned Update: TBD

Page 1 of 26
Contact: Khaldi, Muhammad Mutlag (khalmm0q) on +966-13-8808084
Copyright©Saudi Aramco 2016. All rights reserved.

Document Responsibility: Flare Systems Design Standards Committee SABP-Z-079
Issue Date: 24 May 2016
Next Planned Update: TBD Equipment Overpressure Scenario Identification
1 Introduction
The purpose of this Best Practice is to provide a framework for identifying overpressure
scenarios thereby enabling engineers to systematically check and capture the potential
overpressure scenarios.
Industry standards API STD 520, API STD 521 and API STD 2000 discuss good
engineering practices for scenario identification; however, they leave significant room
for subjective interpretation. This document clarifies areas of interpretation in the API
standards to identify specific overpressure relief scenarios.
1.1 Scope
This Best Practice provides guidance on minimum requirements for

overpressure scenario identification for every study or project in new and
existing onshore and offshore oil and gas installations including revamps and
capacity increases.
1.2 Conflicts
In the event of a conflict between this Best Practice and other Mandatory Saudi
Aramco Engineering Requirements, the Mandatory Saudi Aramco Engineering
Requirement shall govern.
2 References
The determination of pressures and corresponding overpressure analysis of equipment

covered by this Best Practice shall comply with the latest edition of the references listed
below, unless otherwise noted.
2.1 Saudi Aramco References
Saudi Aramco Engineering Procedure

SAEP-354 High Integrity Protective Systems Design
Requirements
Saudi Aramco Engineering Standards

SAES-B-058 Emergency Shutdown, Isolation and Depressuring
SAES-D-001 Design Criteria of Pressure Vessels
SAES-F-007 System Design Criteria of Flares
SAES-J-600 Pressure Relief Devices
SAES-L-140 Thermal Expansion Relief in Piping
Page 2 of 26
Saudi Aramco Materials System Specification

32-SAMSS-022 Manufacture of Components for Flare Systems
Saudi Aramco Engineering Report

SAER-5317 Relief System Evaluation
2.2 Industry Codes and Standards
American Petroleum Institute

API STD 521 Pressure-Relieving and Depressuring Systems,
6th ed., 2014
API STD 526 Flanged Steel Safety-Relief Valves, 5th ed., 2002
API RP 14C Recommended Practice for Analysis, Design,
Installation, and Testing of Basic Surface Safety
Systems for Offshore Production Platforms
API RP 14E Specification for Subsurface Safety Valve Equipment
API STD 2000 Venting Atmospheric and Low-pressure Storage
Tanks 7th ed., 2014
International Society for Measurement and Control

ISA S84.01 Application of Safety Instrumented Systems for
Process Industries
3 Definitions
Administrative Controls: Procedures intended to ensure that personnel actions do not

compromise the overpressure protection of the equipment.
Common Cause Failure: Two independent events that may occur due to a single
preceding event. For example, a single transmitter malfunction results in failure of
multiple level controls.
Consequential Failure: Scenario caused by an event that is generally deemed as

independent of the scenario. For example, external fire results in a loss of instrumentation.
DCS: Distributed Control System
Design Pressure: Pressure together with the design temperature, used to determine the
minimum permissible thickness or physical characteristics of each component, as
determined by the design rules of the pressure-design code. Note: Design pressure is
the basis for the pressure setting of the pressure-relief devices that protect the vessel.
The design pressure is equal to or less than the MAWP.
Page 3 of 26
Double Jeopardy: Scenario caused by two independent and unrelated events.

An operator’s lack of intervention to alleviate an overpressure situation is not a condition
that makes an event a double jeopardy. Likewise, double jeopardy inquiry should not
consider a failure of normal process control instrumentation. Latent failures (e.g., a single
check valve failure) should be considered as existing conditions and should not enter in a
double contingency analysis as an independent overpressure scenario.
Equipment: Pressure vessels, piping, heat exchangers, reactors, tanks, fired heaters,
rotating equipment
FEED: Front end engineering and design
Maximum Allowable Working Pressure (MAWP): Maximum gauge pressure

permissible at the top of a completed vessel in its normal operating pressure at the
designated coincident temperature specified for that pressure.
Maximum Allowable Operating Pressure (MAOP): This term refers to the

maximum pressure at which a piping system can be operated within the provisions of
the applicable ASME B31.4 and/or B31.8 codes. It is the maximum internal pressure
permitted in the piping system for continued operation at the most severe condition of
coincident internal or external pressure and temperature (minimum or maximum)
expected during service.
Non-condensable Gases: Gas or vapor that remains in the gaseous state at a given
temperature and pressure
Opening Pressure: Inlet gauge pressure at which a relief device should open under
service conditions. This pressure is equal to the set pressure plus a constant back
pressure that device should overcome for it to open.
Overpressure: Condition where the design pressure of a piece of equipment is exceeded.
P&ID: Piping and Instrument Diagram
PFD: Process Flow Diagram
Process Hazard Analysis (PHA): A structured process safety methodology used to

identify hazard scenarios for a process that could adversely affect people, property, or
the environment.
Protected Equipment Envelope: All pieces of equipment which are in open

communication, have s similar pressure rating, and require an overpressure protection.
The envelope may contain a single piece of equipment or multiple pieces of equipment.
Relieving Condition: Inlet pressure and temperature at a pressure relief device during
an overpressure condition. Note: The temperature at the relieving conditions could be
Page 4 of 26
lower than the normal operating temperature.
Saudi Aramco Engineer: Supervisor of the Flare and Relief Systems Unit or designee
of the Downstream Process Engineering Division, Dhahran
Set Pressure: Inlet gauge pressure at which a relief device is set to open under service
conditions. This is also the stamped set pressure on a relief device.
Tank: Low pressure or atmospheric storage tanks built under API standards, e.g., API
STD 620, API STD 650.
4 Instructions
Overpressure scenario analysis depends on the availability of engineering information.

For grassroots projects, most of the basic study data (P&IDs, PFDs and Heat and
Material Balance) should be available at the FEED stage. Therefore, detailed
overpressure scenarios identification should be conducted at the FEED stage.
These calculations will be further updated at the Detailed Engineering stage with
changes in designs, if any.
The design engineer must identify all causes of overpressure for a given piece of
equipment. Further calculation would reveal the worst case for the design of various
components of a pressure relief device and the flare system.
The project document should include a detailed overpressure philosophy.

Any identified overpressure scenario that was not mentioned in this document,
should be reviewed by a Saudi Aramco engineer.
For revalidation or brownfield projects, all of the study data should be available.
Therefore, detailed overpressure scenario identification should be conducted after
acquiring the study data.
5 Study Data
Similar to a PHA package, an overpressure scenario analysis requires a set of study data
at the start. A process safety analysis requires an engineer to thoroughly understand the
process and operations through the study data. Assumptions should be reviewed by the
Saudi Aramco Engineer. The study data includes:
(a) Piping and Instrumentation Diagram
(b) Process Flow Diagram
(c) Process Description or Process Design Details
(d) Heat and Material Balances with all alternative modes of operations
Page 5 of 26
Note: Maximum and minimum operating conditions may only be available from data
historians instead of simulations. In some instances, such conditions must be used
for overpressure scenario analysis instead of data from a plant simulation.
(e) Plot Plans including elevation plans

(f) Process Safety Flow Diagrams (if available)
(g) Operating Procedures including start-up, shutdown and emergency procedures
(h) Utility Operating Conditions
Note: Utilities include but are not limited to instrument air, plant air, steam systems,
cooling water, hot oil header, Nitrogen, and lube oil.
(i) List of existing relief devices (pressure relief valves, rupture disks, depressuring
valves and vents) and data sheets
(j) Instrument and Controls data sheet
(k) Data Sheets for equipment to be protected
(l) Equipment data sheet for sources of overpressure and mitigating devices.
This includes pumps, compressors, heat exchangers, blowers, furnaces, restriction
orifice, control valves
(m) Mechanical piping details including sketches of the inlet and outlet piping of the
relief devices. Inlet piping is from the protected equipment to the inlet nozzle of
the device. Outlet piping is from the outlet nozzle of the device to the main flare
header or atmosphere.
(n) Piping design drawings including designations and ratings
Note: Designations should show details of letter designations. Such designations include
insulation codes, thickness data, etc.
(o) Electrical one line diagrams
6 Deliverables
The deliverables for identifying an overpressure scenario should include:

 Summary of the process unit description, unit capacity, and feedstock definition that
show the design basis for the relief study
 Heat and Material balances with composition and boiling point characterization
assays
 Flare and relief system design guidance, if any supplemented
 Equipment identifier and description
 P&IDs and PFDs
Page 6 of 26
 Equipment design condition including, but not limited to, design pressure,
temperature and mechanical data
 Code of construction
 Range of normal operation condition, including pressure, temperature, levels, fluid
composition and phase
 List of overpressure scenarios for each piece of equipment and comment whether a
scenario applies. Scenarios that do not apply should be documented explaining the
reason for inapplicability. See Scenario Identification Process below.
Note: For scenarios that are obviously inapplicable, a full rationale is not required.
For example, a tube rupture scenario is not applicable to analysis of pieces of
equipment that do not contain an exchanger.
 All calculations related to overpressure scenario calculations, e.g., pump dead head
or vessel overfill/drain calculations
 All equipment and control valve specification sheets and pump/compressor curves
discussed in the overpressure scenario analysis
7 Scenario Identification Process
The process of scenario identification requires careful planning and review of the
documents with multiple brainstorming sessions and reviews. The four basic steps of
the process are:
1. Define the protected equipment envelope
2. Identify overpressure sources
3. Explain how protected equipment is over-pressured
4. Document the rationale and conclusion
The steps are described in detail below.
7.1 Define the Protected Envelope

1. Define the protected equipment envelope. When considering multiple
pieces of equipment in open communication, ensure that if intervening
valves exist between equipment then the valves are car-sealed open.
Exception:
Under certain administrative controls and potential overpressure scenarios,

maintenance isolation valves need not be designated as car-seal open.
2. Define the boundary of equipment and piping protected by the relief device.
Page 7 of 26
3. Validate the set pressure of the relief against the design pressure and
MAWP/MAOP of each piece of equipment and pipeline as defined by
Saudi Aramco engineering standards.
4. Where a relief device protects multiple pieces of equipment, account for
any pressure drop in the system to ensure that the opening pressure of the
relief device is at or below the Design Pressure of each protected piece of
equipment.
Note: Account for static liquid head or pressure drop across towers when
selecting the opening pressure of the relief device.
5. Identify equipment that does not have a relief device but may be inherently
protected by design. Example: The design pressure of the equipment may
be higher than any overpressure sources. Also, a piece of equipment may
be isolated or away from hydrocarbon sources so is inherently protected
against external fire cases.
Note: A protected equipment envelope may be depicted through a simplified flow
diagram. This drawing facilitates the identification of overpressure
scenarios and modification by future engineering studies.
7.2 Identify Overpressure Sources
Identify overpressure scenarios for protected systems that may accumulate

energy, thereby experiencing high pressure. Energy may be provided by two
general types of sources.
A. Heat may be produced by the following in a protected system:
 Exchanger hot side
 Furnaces
 Direct contact with hot process fluid
 Utility streams (e.g., steam, hot oil)
 Chemical reaction producing heat
 Fire
 Solar thermal radiation
B. Fluid motion by the following may increase pressure in the protected system:
 Pumps
 Compressors
 Blowers
 Upstream high pressure operations
 Utility streams (e.g., nitrogen)
Page 8 of 26
 Chemical reactions producing vapors

 High pressure tie-ins
 Accumulation of vapor
7.3 Explain How a Protected System is Overpressured
A useful way to picture how a root cause results in an overpressure is through a

how-why dimensional drawing (see Figure 1). The diagram shows the logic of
how an event occurred when read from left to right. Similarly, it shows logic of
why an event occurred when read from right to left. The root cause is at the
leftmost box with intermediate effects in the middle and the overpressure event
on the rightmost box.
Figure 1: How-Why Dimensional Diagram
Example: A level indicator malfunction results in a level rise in the vessel.

The operator is not aware of the malfunction. The vessel overfills to the top.
The upstream pressure from the pump exceeds the Design Pressure. The vessel
overpressures. See Figure 2.
Figure 2: How-Why Example
Page 9 of 26
8 Scenario Identification Philosophy
For individual systems, no credit for favorable instrumentation will be taken.

This means any favorable instrumentation response (e.g., level control valve closes
before gas blow-by occurs) or auto-start of machines (back-up reflux pump starts) will
not be used. Conversely, instrumentation response that worsens the relieving conditions
will be assumed to operate as designed.
Double jeopardy refers to simultaneous occurrence of two independent events. It may

not be considered when identifying overpressure scenarios. However, one should
distinguish double jeopardy scenario from a consequential failure. Similarly, double
jeopardy should be distinguished from common cause failure.
Check valves are backflow prevention devices that have a history of leakage. Failure or
leakage of the check valve should be considered as an overpressure contingency even if
multiple check valves are present to prevent backflow.
Credit for administrative controls and operator intervention are allowed in specific cases.
Credit for open or outflow paths may be taken but with attention to alternative modes of
operation (start-up, shutdown, etc.) whereby the outlet may be closed when a particular
contingency occurs.
A contingency table should tabulate all the contingencies listed in this document.
Such tabulation ensures that each piece of equipment is thoroughly investigated for
potential overpressure.
Overpressure scenarios during maintenance should be reviewed. Administrative

controls to prevent overpressure during maintenance should be identified. F or example,
potential overpressure may occur during steam out, purging of the vessels, or
inadvertent closure of isolation valves.
For multiple modes of operations, consider overpressure during each mode of operation.
Example drying and regeneration modes should be evaluated separately for potential
overpressure due to mix-up of service lines, which may expose equipment and piping to
an unintended mode of operation.
9 Standard Scenarios
API STD 521 lists scenarios that form a good starting basis for identifying and
documenting overpressure scenarios associated with a piece of equipment. Following is
a description of each of the scenarios in API STD 521 as well as additional common
overpressure scenarios encountered at facilities. See Table 1.
Page 10 of 26
Table 1: Common Overpressure Scenarios
9.1 Closed Outlet
To determine whether a blockage of normal outlet flow from a piece of

equipment could overpressure the equipment, perform this two-step process:
1. Check all the piping downstream of the equipment for potential blockage.
Consider the following:
A. Manual valve that may be closed or shut
B. Single failure to closed position of a control valve regardless of its fail
safe position
C. Closure of valve due to actuating system. Consider multiple valves
closing to a fail position due to, for example, an instrument air failure
D. Mechanical failure of rotating equipment or vessel internals
Page 11 of 26
E. Fouling or plugging (e.g., due to hydrate formation)

F. Loss of vacuum e.g., ejector system failure
G. Loss of condensing or accumulation of non-condensable gases
H. Internal failure of a check valve
I. Inadvertent closure of a lock open valve in a process line
2. Check whether any of the incoming streams can overpressure the piece of
equipment. Consider the following:
A. Inlet stream feed from equipment with higher design pressure than the
subject piece of equipment
Rotating equipment may have a dead pressure higher than the subject
piece of equipment. Specifically for centrifugal pumps, three different
discharge pressures should be calculated to check against the design
pressure of the subject piece of equipment. For positive displacement
pumps, a relief valve is always required. Also, internal relief valves
supplied by the vendors are acceptable for overpressure protection.
The discharge pressures for centrifugal pumps are calculated as
follows:
a) Maximum suction pressure based on an upstream relief device set
pressure and pump normal operating head
b) Normal suction pressure based on upstream equipment normal
operating pressure and pump dead head
c) Maximum suction pressure, pump dead head and maximum
impeller size, as applicable
Case c should only be considered when the blockage of the subject
piece of equipment results in the pump suction pressure to rise to the
set pressure of an upstream relief device.
Note: Pump performance curve should be based on the installed impeller
size and normal pump speed except for steam turbine drivers where
125% of the normal speed should be used. (The pump curve is not
available until after the equipment order has been placed, normally
during detailed engineering phase of a project. If the estimated pump
shut-in head pressure is used, this needs to be revisited when the
pump curve is available).
B. Energy sources (heaters, furnaces, etc.) that may cause vaporization or

increase the volume in the piece of equipment.
The above analysis should cover outside battery limits sources as well.
For example, a feed from one operating unit may impact another
Page 12 of 26
operating unit.
Account for other scenario resulting from closed outlet. For example,
blockage of a column overhead line would result in a loss of cooling
through the overhead condensing system.
9.2 Overfilling
This is a special case of closed outlet where liquid or two-phase may overfill or
pack a piece of equipment and consequently cause an overpressure. Overfill
could also occur because of a loss of level in an upstream vessel such that
incoming liquid rate is higher than the normal outflowing liquid in the affected
vessel. Also, liquid may accumulate during start-up cases when the affected
vessel is outflow is at a turndown rate. Two key inquiries for applicability of
overfilling scenario are:
(a) Whether the upstream source pressure (e.g., pump or pressure in the
upstream system) could exceed the design pressure of the affected pieces of
equipment
(b) Whether the liquid in the affected piece of equipment completely fills the
equipment
Exception:
Credit for operator intervention time may be taken if all of the following conditions
are met:
 An independent high liquid level alarm is present with its instrumentation and
elements independent of normal level control instrumentation
 All the valves in the level bridles of the high level instrumentation are locked
open
 Level instruments for safeguard against overfilling will use separate process
taps
 At least two independent and diverse (different types) liquid level

measurement are present
 Operator may intervene and take corrective action within 20 minutes from the
annunciation of a high level alarm until the level reaches the top of the
equipment.
9.3 Loss of Cooling
Total loss of cooling should be considered where cooling is lost while heat input
or other overpressuring source would exceed the design pressure of a piece of
equipment.
Page 13 of 26
9.4 Reflux Failure at Tower Overhead
Reflux failure could occur due to shut down of reflux pumps or closure of
control valves.
9.5 Reflux Failure at Pump Around/Side Reflux
Reflux failure scenarios apply when cooling is interrupted while heat input
continues in a given piece of equipment.
Check for spots where heat is removed from the process system. For instance,
cooling water pump shut down, fin fan cooling failure or reflux pump shut down
would result in a loss of cooling while the reboiler continues.
Systems frequently encountering this scenario include:

 Distillation columns: Loss of cooling while the reflux continues and loss of
cooling without reflux should be considered as two distinct scenarios.
Also, distinct side stream reflux failures may also apply.
 Low pressure tanks: Product coolers may lose cooling resulting in additional
vapor to the low pressure storage tanks
 Reactor loop coolers: Loss of cooling in reactor loops (e.g., hydrocracker)
may result in additional vapor generation.
9.6 Loss of Absorbent
Consider cases where a loss of absorbent results in excess vapor flow which
otherwise is absorbed in the solvent. These cases may arise in acid gas removal
units, lean oil absorbents or pressure swing absorption unit.
This scenario applies when the upstream pressure from the feed gas exceeds the
design pressure of the column. The process may be re-simulated at relief
pressure to check the amount of excess vapor that would require relief.
9.7 Accumulation of Non-condensables
Two scenarios are typical of accumulation of non-condensables.

A. A loss of condensing (e.g., columns overhead or reactor circuits) may result
in accumulation of vapor in the overhead. Specifically, condensers designed
for total condensing are susceptible to this scenario. Heat and material
balance may indicate whether a condenser is a total or partial condenser.
Overpressure may occur during start-up where the vent valve may remain
closed while the column pressure is being increased to normal operating
Page 14 of 26
pressure.
Non-condensable gases may blanket off the overhead condenser resulting in

a loss of cooling to the column system.
B. The light ends ‘weathering off’ from a liquid in the storage tank may
accumulate in the vapor space of the tank. Check storage vessels
(e.g., butane).
Note: Other cases like thermal outbreathing or external fire may dominate unless
an unusually high concentration of light ends is present in the stored liquid.
9.8 Accidental Mixing
In one variation of accidental mixing, a hot stream accidentally mixes with a

cold volatile fluid (or vice versa) resulting in potentially large quantity of
vapor generation. Examples include hot oil liquid mixing with volatile fluid,
e.g., water; coke drum accidentally receiving water or lighter fluid
(e.g., propane) mixing with butane or pentane in a storage tank.
In particular, check for immiscible fluids that may be in a vessel that is subject to
heating. Liquid ‘rollovers’ are a special case of accidental mixing. Here, liquids
may be stratified in two layers because of a volatility difference. The density may
change over time due to ‘weathering off’ lighter fluid from the top layer resulting
in high diffusion and mixing between the two layers. This could lead to a high
vapor generation. Examples: LNG and ammonia storage tanks.
9.9 Failure of Automatic Controls
Failure of automatic controls refers to the valves that may fail in either position
(fully open or fully close). Regardless of the fail position of the valve, the
scenario should consider the valve to be stuck or instrumentation to feed an
incorrect signal that leads to a valve failure.
Four configurations of valves may be considered here:

A. Inlet feed valve closes: Loss of feed occurs and possibly an overpressure
may occur in the downstream system, for example, if the feed is a quench
system that removes heat from downstream equipment
B. Inlet feed valve opens: If the normal pressure upstream of the valve exceeds
the Design Pressure of the equipment, the downstream system may
overpressure due to excess flow. The extent of overpressure depends on the
ability of downstream to accommodate excess flow. As a first pass, assume
that overpressure would occur and the scenario applies.
Page 15 of 26
Note: In some cases, the upstream pressure may be significantly higher than
normal pressure reported in the heat and material balance. If the normal
operating pressure in the upstream equipment is 1/3rd or less than the
MAWP of the upstream equipment, check historical pressure trend in the
upstream equipment.
A special case of inlet feed valve occurs when the inlet feed valve is also a
level control valve for the upstream equipment. Here, the liquid from the
upstream system may drain out and a vapor may follow into the
downstream equipment. This is referred to as a “gas blow-by” case.
C. Outlet product valve closes: This is similar to a closed outlet or overfilling
situation. For special case of a reflux valve, a closure of the valve would
result in overfill of the reflux drum and potential flooding of the overhead
condensers. This is similar to a reflux failure at tower overhead.
D. Outlet product valve opens: This scenario would result in drainage of the
product from the affected equipment to a downstream system. Typically,
the concern lies with the downstream system and the scenario should be
analyzed with the downstream system.
Consider simultaneous failure of valves if a common failure mode exists for

a system of two or more valves. Examples: DCS hardware component
failure or instrument air failure.
Check the operating mode of the control valve and bypass valve.
Operations may crack open the bypass during start-up, shut-down or normal
operating modes. The bypass should be assumed to stay in its position
when the control valve failure occurs.
Notes: Locked (car sealed, chained, padlocked, etc.) bypass valves are
considered in identified position unless pressure can exceed hydrotest
when analyzing relief scenarios.
Bypass valve may be locked closed to ensure that valve is not

simultaneously open with a full open control valve. Further, shall have a
capacity at least equal to the required Cv of the control valve, but not
greater than twice the selected Cv of the control valve.
Valves may have a slave and a master control. No credit for the controller
to mitigate the relief load should be taken even if both the slave and master
control tend to move the valve that results in a reduced relief load.
Notes: Credit may be taken for the presence of a restriction orifice in lines
downstream of control valves, only for existing installations.
Downstream valves that after a piping spec break to a lower design

pressure should be evaluated for the need to lock open to mitigate a risk
of overpressure.
Page 16 of 26
9.10 Abnormal Heat or Vapor Input
Abnormal heat or vapor input occurs when excess heat input in the process
results in additional vapor generation. Check process locations where heat is
added in the system. Examples include control valves that permit excess heat
via process streams, steam or fuel gas; steam coils in tanks that may be
inadvertently left on after a start-up.
Abnormal vapor input may occur due to a fully open upstream control valve or
inadvertent opening of an upstream manual valve (e.g., bypass of a control
valve). A special case is of a tube rupture or a tube leak that may feed directly
into the cold side of a heat exchanger. Example: A steam reboiler where steam
may directly feed into the column upon tube rupture or tube leak.
9.11 Exchanger Tube Rupture or Leak
Generally, heat exchanger internal failure applies when:

 The hydrotest pressure of the low pressure side is less than the maximum
operating pressure of the high pressure side
or
 The high pressure side of the exchanger operates above 1,000 psig with
vapor or two phase fluid and the low pressure side contains liquid
or
 The difference in pressure between the high pressure and low pressure side
Design Pressure is equal to or greater than 1,000 psig.
In particular, the low pressure side is not limited to the exchanger shell or tube.
Other equipment connected to the low pressure side including piping should be
considered in the analysis. For example, utilities such as hot oil or cooling water
may overpressure in heat exchanger internal failure even if the shell or tube side
of an exchanger.
Additional analysis may be required for shock effects when the ratio of
hydrotest pressure and low pressure side is not less than four or when the high
pressure side operates above 1,000 psig.
Relief valves may be inadequate to provide protection in such cases and a fast
reacting rupture disk or buckling pin may be required upon further analysis.
 Types of Exchangers
Shell and Tube Exchanger: The internal failure may occur due to many
causes including thermal shock, vibration and corrosion. The result may be
Page 17 of 26
a pinhole leak on a single tube to multiple tube failures, most likely at the
tube sheet. For the purposes of scenario identification, a heat exchanger
internal failure is equivalent to a complete one single tube resulting in a
potential flow from two orifices.
Double Pipe Exchanger: The internal failure may not apply if both the
high pressure side and low pressure side of the exchanger are constructed out
of schedule piping instead of tubes. The scenario is considered because a
break in a double pipe exchanger is similar to a break in a pipe which is
typically not considered in the design of a relief system.
Note: Hairpin heat exchangers with tube bundles are not double pipe exchangers.
Plate and Frame Exchanger: These exchangers tend to leak at the external
gaskets than in the plates. General corrosion, cracking or pitting may result
in a leak or failure internally. For this scenario to apply, check the
inspection history of past failures or leaks. The low pressure in these
exchangers may be limited by the gaskets instead of the hydrotest pressure
of the low pressure side; therefore, specific attention should be given to
gasket failures especially where the relieving fluid is toxic or flammable.
Heating or Cooling Coils and Jackets: Generally, a failure of a single pass

coil failure or jackets is not considered. However, an approach similar to the
analysis of Plate and Frame Exchanger may be applied on a case-by-case basis.
9.12 Internal Explosion/Pressure Surge
Normally, a pressure relief valve is not adequate to suppress an internal explosion

due to a mixture of hydrocarbon/air and an ignition source because the reaction
time for the valve to release the fluid is insufficient. Explosion relief systems,
including rupture disks or explosion vent panels, are used for such cases.
Note: Equipment may be designed to handle internal deflagration pressure.
Also see SAES-D-001.
Check for hydrocarbon systems where air may inadvertently be added or air
systems where hydrocarbon may inadvertently be added.
Inert gas may be required to purge a piece of equipment taken out of service.
Instead of relief device, purge procedures, coupled with administrative control

and venting procedures, mitigate the potential of an internal explosion.
A pressure surge may occur due to a rapidly closing valve. Examples include
water or steam hammering. Long pipelines with liquid (incompressible) fluid
are especially susceptible for water hammering. Relief valves may not be
suitable to protect against such pressure surges. Other preventative devices,
Page 18 of 26
e.g., an accumulator or surge relief valve, should be used where a relief valve
could not provide protection.
9.13 Chemical Reaction
Exothermic chemical reactions that cause a runaway are of particular concern.

This scenario mostly arises in petrochemical complexes because few refinery
operations are exothermic in nature. The sources of overpressure should be
reviewed with care or evaluated by a specialized contractor and reviewed by the
Saudi Aramco Engineer.
Where cryogenic fluids are being processed or exothermic reactions are occurring,
brittle failure or overpressure from thermal run-away should be considered.
Typical pressure-relieving devices cannot protect against these situations.
In refineries, particular attention should be paid to exothermic reactions that may

cause a temperature runaway before causing a spike in pressure. For example,
the hydrocracking process may result in high temperature excursions (over
1000°F). Depressuring devices in conjunction with emergency shutdown
systems are used to reduce a potential of vessel failure that may occur due to
temperature excursions.
9.14 Thermal Expansion
An increase in temperature causes an increase in volume. Any piece of

equipment including piping which could be exposed to high temperature while
blocked in should be assessed for thermal expansion. Refer to SAES-L-140 for
Thermal Expansion Relief in Piping.
Thermal expansion specifically refers to an incompressible fluid (liquid)

expansion without any vaporization. Therefore, determine whether the
temperature rise would cause the vapor pressure to be above the Design Pressure
of the affected equipment. If vaporization is possible then this scenario is better
referred to as a Blocked Outlet case.
Thermal expansion applicability on different types of equipment:
Vessels: Liquid full vessels should be evaluated for thermal expansion scenario.
Typical examples include liquid filters that operate liquid full.
Heat Exchangers: Thermal expansion occurs when a liquid full cold side is
blocked in while heat input from the hot side or solar radiation continues.
Refer to blocked outlet if vaporization of liquid occurs.
Blockage of the cold side may occur due to a full closure of a control valve or a
check valve, whether upstream or downstream of the exchanger. In cases where
Page 19 of 26
only maintenance isolation valves are present upstream and downstream of the
exchanger, no credit for administrative controls should be taken unless the site
has developed and documented specific procedure, routine practice and
experience to manage the operation of exchanger maintenance isolation valves.
The hot side of the exchanger may operate below ambient temperatures.
For example, exchangers in refrigeration or cryogenic service operate below
ambient conditions. Therefore, thermal expansion due to solar radiation should
be analyzed for both hot and cold side of the exchanger.
Piping: A thermal expansion for a piping segment due to solar radiation and
ambient heat applies if the following screening criterion is met:
 Line is full of liquid. This means the volume of liquid occupies 95% of the
volume of empty pipe
 Line could be blocked-in
 Drainage of the line within a few hours is not practical
9.15 External Fire
This scenario applies to many types of equipment including low pressure tanks,
pressure vessels and exchangers.
A pool fire may apply to a piece of equipment containing liquid even if the
content of the equipment are not flammable. The result of a fire is a
vaporization or expansion of liquid.
A two phase relief from a piece of equipment is not required.
Only pool fires are considered; jet fires are not considered as jet fires produce
local hot spots and relief valves are not effective means to prevent overpressure.
Fire case applies for pieces of equipment where the equipment is within 25 feet
of height from the surface that may pool a flammable liquid. Often elevated
platforms have solid decks which may pool liquid.
Fire case on spheres and spheroids applies up to 25 feet or up to the maximum

horizontal diameter, whichever is greater.
Fire case on low pressure or atmospheric tanks applies up to 30 feet.
Fire case impacted area may not be less than 2,500 ft2, unless specific drainage
study shows otherwise.
Page 20 of 26
The following exclusions apply to the external fire case:
Unless external fire can be specifically excluded, the ASME Boiler and Pressure
Vessel Code and NFPA 30 require consideration of a fire scenario for
equipment.
Fire protection is not required for non-ASME SEC VIII vessels fabricated from
schedule piping.
External fire case may not apply to vapor filled vessels where fire is the only
applicable overpressure scenario.
For double pipe exchangers, external fire may not apply if it is the only
applicable contingency.
Maintenance isolation valve may be assumed to remain open for fire

contingency provided administrative procedures in in place to drain the
equipment upon isolation.
Piping does not require external fire protection. However, design should avoid
potential blockage of long sections of large diameter pipe.
Fire protection on the tube side of exchanger in non-toxic service may not be
required because a nominal area around the channel is exposed to fire. The risk
with provision of relief valves and associated small bore piping outweigh the
risk of limited release of the content from the tube side in an external fire case.
9.16 Power Failure
Power may fail due to, but not limited to, individual breaker, transformer,
switchgear, motor control center or line. As such, a combination of power
failure cases should be thoroughly reviewed. In some cases, partial power failure
may be more severe than a total power failure case.
Individual power failure to a piece of equipment should be reviewed,

e.g., recycle compressor loss in a hydrocracker unit.
Impact on and by other utilities on the power supply should be considered.

For example, steam and instrument air may continue for a few minutes before
total shutdown in a plant wide power failure event. Also, cooling water supply
may be interrupted upon power failure.
Loss of reflux pump may eventually flood the condensers. In this case, no
cooling credit from the overhead condensers is allowed.
Page 21 of 26
Depressuring from some process systems may be automatic or manual.

Operating philosophy for manual depressuring should be considered.
Impact of the fuel gas system should be studied if the fuel gas system receives
flow from process units while fuel gas consumers (burners, etc.) are shut down.
For grass roots projects, air coolers analysis should be allowed. For existing
installations Air Coolers analysis should be reviewed by a Saudi Aramco
engineer.
Non-electric drivers may continue to operate provided the motive source,

e.g., steam or instrument air is available during a power failure. However, credit
for any auto start may not be taken if an auto-start lessens the potential
overpressure for a given piece of equipment. Table 2 shows a typical analysis
for a power failure if motive source continues.
Table 2: Typical Power Failure Analysis
Normal Affected
Description Tag Driver Consequence
Service Equipment
P-1 Electric One steam driven
pump may continue;
Reflux Pumps P-2 Steam 2 out of 3 P-1
therefore 50% of reflux
P-3 Steam would continue.
P-4 Electric Product flow stops
because electric pump
Product Pumps 1 out of 2 P-4
P-5 Steam stops. No credit for
auto-start of P-5.
P-6 Electric Heat input continues
Reboiler Pumps 1 out of 2 P-6 assuming P-7
P-7 Steam continues to operate.
For partial power failure scenarios check the following:

 Heat input from furnaces and associated forced pump circulation system
continues while cooling is lost.
 Streams that provide heat into a system may continue unlike a total power
failure where the same streams may stop due to shut down of electric motor
driven equipment.
 Different permutations of partial power scenario should be reviewed when
multiple drivers are involved in a scenario, e.g., fin fan coolers or cooling
water pumps.
 If rotating equipment is fed from an independent source instead of the
affected electrical supply, use a combination of equipment failure that results
Page 22 of 26
in the highest relief from a process upset. For example, if reflux is supplied
from affected motor driven pump then assume reflux fails.
 Credit taken by emergency supply should be reviewed by a Saudi Aramco
engineer.
9.17 Steam Failure
Failure of each steam supply failure should be considered separately.

For example, a line rupture in a low pressure steam supply would result in a loss
of steam to all the low pressure steam recipients.
For a loss of high pressure steam system, a loss of low pressure supply may also
occur after some time. However, analysis should consider both loss of high
pressure steam supply with or without a loss of low pressure steam supply
because a more severe case between the two may not be obvious.
Loss of high pressure steam boilers in the plant may result in a loss of high
pressure steam supply.
9.18 Cooling Water Failure
Total or partial cooling water may be lost due to various reasons including
power failures, line ruptures, line fouling, and steam failure.
In particular, check for loss of each cooling tower separately due to line rupture
that could occur at individual cooling tower.
A combination of cooling tower is also likely if the cooling water pumps for the
cooling towers receive power from a common supply.
For a partial loss of cooling water pumps, there is no linear proportional

relationship, per se, between the number of operational pumps and the cooling
duty to a piece of equipment. A qualitative assessment may show a significant
loss of cooling to elevated condensers as opposed to coolers on ground level
when cooling water pump drivers are lost.
Active cooling water pump driver if designed for the end-of-curve operation
may supplant a loss in capacity.
Evaluate whether a loss of cooling water would result in a shutdown of rotating

equipment due to a high temperature in lube and seal oil systems.
Page 23 of 26
9.19 Instrument Air Failure
Failure may occur due to an instrument air supply line rupture; therefore, no
credit for a back-up supply is taken. In this scenario, instrument air supplied
control valves will move to their failure positions.
Consider release due to gas blow-by scenarios and fail open depressuring valves.
Instrumentation failure should be considered simultaneous with external fire

where fire could melt wiring or other sensitive elements.
9.20 Loss of Heat
This scenario is a special case of accidental mixing. For example, in a series

fractionation system (e.g., NGL column systems), a loss of heat in an upstream
column would result in a lighter, volatile feed in the downstream column.
The downstream column is not designed to handle this feed. Therefore,
overpressure due to accumulation of non-condensable gases and excess vapor
generation may require relief.
A downstream system may consist of storage tanks that are not designed to
handle light hydrocarbon inventory. Slippage of volatile material may result in
overpressure.
9.21 Check Valve Failure or Leakage
Regardless of the number, size, service and pressure ratio, a check valve failure
scenario should apply when the downstream operating pressure exceeds the
upstream pressure. Backflow due to leakage or failure of a check valve is
expected.
Note: A failure of check valve could trigger a flow through the spillback line via a
spillback control valve.
A single check valve (or similar check valves in service) may have latent
defects. Failure of such a valve (or valves) should not be considered as a
contingency in the double contingency analysis.
9.22 Emergency Depressuring
Emergency depressuring is required to release stored fluid from a high-pressure

system during emergency situations, such as fire or temperature runaway.
See SAES-B-058 for systems that require depressuring.
Hydrocracker units typically have depressuring valves that may be initiated

during any emergency scenario.
Page 24 of 26
Multiple depressuring valves may be installed on a given system depending on

the emergency scenario. All depressuring modes should be analyzed.
For compressor circuits, settle out pressure should be calculated and compared
against the design pressure of each piece of equipment.
9.23 Inbreathing/Outbreathing
Movement of air or blanketing gas into a tank when vapors in the tank contract
or condense as a result of weather changes (e.g., a decrease in ambient
temperature). Both thermal inbreathing and maximum outflow of liquid may
result in excessive vacuum in the piece of equipment.
Movement of vapors out of tank when vapors in the tank expand and liquid in
the tank vaporizes as a result of weather changes (e.g., an increase in ambient
temperature). Both thermal outbreathing and maximum inflow of liquid may
result in excessive pressure in a tank.
Revision Summary
24 May 2016 New Saudi Aramco Best Practice that provides framework for identifying overpressure
scenarios thereby enabling engineers to systematically check and capture the potential
overpressure scenarios.
Page 25 of 26
Appendix A Overpressure Scenario Matrix
11.7 – Accumulation of Non-condensables
11.12 – Internal Explosion/Pressure Surge

11.11 – Exchanger Tube Rupture of Leak
11.4 – Reflux Failure at Tower Overhead
11.21 - Check Valve Failure or Leakage

11.10 – Abnormal Heat or Vapor Input
11.9 – Failure of Automatic Controls
11.5 – Reflux Failure at Tower Side
11.23 – Inbreathing/Outbreathing
OVERPRESSURE
11.22 - Emergency Depressuring

11.18 - Cooling Water Failure
11.19 – Instrument Air Failure

11.14 – Thermal Expansion
11.13 – Chemical Reaction
SCENARIO
11.6 – Loss of Absorbent
11.8 – Accidental Mixing
11.20 – Loss of Heating

11.3 – Loss of Cooling
11.16 – Power Failure
11.17 - Steam Failure

11.1 – Closed Outlet
11.15 – External Fire

11.2 – Overfilling
EQUIPMENT
Blower    
Boiler     
Column - Packed                
Column - Trayed                
Compressor      
Dryer           
Filter          
Fired Heater     
Heat Exchanger - Aerial               
Heat Exchanger - Concentric Pipe         
Heat Exchanger - Plate and Frame         
Heat Exchanger - Shell and Tube                  
Pipe Segment       
Pump      
Reactor              
Storage Tank           
Turbine     
Solids Handling Equipment    
Vessel                 
Page 26 of 26

Sabp Z 079

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sabp Z 079

Uploaded by

Copyright:

Available Formats

Best Practice

SABP-Z-079 24 May 2016

Previous Issue: New Next Planned Update: TBD

Copyright©Saudi Aramco 2016. All rights reserved.

This Best Practice provides guidance on minimum requirements for

The determination of pressures and corresponding overpressure analysis of equipment

2.1 Saudi Aramco References

Saudi Aramco Engineering Procedure

Saudi Aramco Engineering Standards

Saudi Aramco Materials System Specification

Saudi Aramco Engineering Report

2.2 Industry Codes and Standards

American Petroleum Institute

International Society for Measurement and Control

Administrative Controls: Procedures intended to ensure that personnel actions do not

Consequential Failure: Scenario caused by an event that is generally deemed as

DCS: Distributed Control System

Double Jeopardy: Scenario caused by two independent and unrelated events.

FEED: Front end engineering and design

Maximum Allowable Working Pressure (MAWP): Maximum gauge pressure

Maximum Allowable Operating Pressure (MAOP): This term refers to the

Overpressure: Condition where the design pressure of a piece of equipment is exceeded.

P&ID: Piping and Instrument Diagram

PFD: Process Flow Diagram

Process Hazard Analysis (PHA): A structured process safety methodology used to

Protected Equipment Envelope: All pieces of equipment which are in open

lower than the normal operating temperature.

Overpressure scenario analysis depends on the availability of engineering information.

The project document should include a detailed overpressure philosophy.

(e) Plot Plans including elevation plans

(o) Electrical one line diagrams

The deliverables for identifying an overpressure scenario should include:

7 Scenario Identification Process

The steps are described in detail below.

7.1 Define the Protected Envelope

Under certain administrative controls and potential overpressure scenarios,

7.2 Identify Overpressure Sources

Identify overpressure scenarios for protected systems that may accumulate

 Chemical reactions producing vapors

7.3 Explain How a Protected System is Overpressured

A useful way to picture how a root cause results in an overpressure is through a

Figure 1: How-Why Dimensional Diagram

Example: A level indicator malfunction results in a level rise in the vessel.

Figure 2: How-Why Example

8 Scenario Identification Philosophy

For individual systems, no credit for favorable instrumentation will be taken.

Double jeopardy refers to simultaneous occurrence of two independent events. It may

Overpressure scenarios during maintenance should be reviewed. Administrative

Table 1: Common Overpressure Scenarios

9.1 Closed Outlet

To determine whether a blockage of normal outlet flow from a piece of

E. Fouling or plugging (e.g., due to hydrate formation)

B. Energy sources (heaters, furnaces, etc.) that may cause vaporization or

 At least two independent and diverse (different types) liquid level

9.3 Loss of Cooling

9.4 Reflux Failure at Tower Overhead

9.5 Reflux Failure at Pump Around/Side Reflux

Systems frequently encountering this scenario include:

9.6 Loss of Absorbent

9.7 Accumulation of Non-condensables

Two scenarios are typical of accumulation of non-condensables.

Non-condensable gases may blanket off the overhead condenser resulting in

9.8 Accidental Mixing