Pressure Relief Systems Vol 2

GBH Enterprises, Ltd.
Process Safety Guide:

GBHE-PSG-008
Pressure Relief Systems

Causes of Relief Situations Vol.2 of 6
Process Information Disclaimer
Information contained in this publication or as otherwise supplied to Users is

believed to be accurate and correct at time of going to press, and is given in
good faith, but it is for the User to satisfy itself of the suitability of the information
for its own particular purpose. GBHE gives no warranty as to the fitness of this
information for any particular purpose and any implied warranty or condition
(statutory or otherwise) is excluded except to the extent that exclusion is
prevented by law. GBHE accepts no liability resulting from reliance on this
information. Freedom under Patent, Copyright and Designs cannot be assumed.
Refinery Process Stream Purification Refinery Process Catalysts Troubleshooting Refinery Process Catalyst Start-Up / Shutdown
Activation Reduction In-situ Ex-situ Sulfiding Specializing in Refinery Process Catalyst Performance Evaluation Heat & Mass
Balance Analysis Catalyst Remaining Life Determination Catalyst Deactivation Assessment Catalyst Performance
Characterization Refining & Gas Processing & Petrochemical Industries Catalysts / Process Technology - Hydrogen Catalysts /
Process Technology – Ammonia Catalyst Process Technology - Methanol Catalysts / process Technology – Petrochemicals
Specializing in the Development & Commercialization of New Technology in the Refining & Petrochemical Industries
Web Site: www.GBHEnterprises.com

Process Safety Guides: Causes of Relief Situations
INDEX
VOL. I BACKGROUND TO RELIEF SYSTEM DESIGN

(This includes principles of pressure relief and use of this Guide, alternatives,
statutory and mandatory requirements, and reporting).
VOL. II CAUSES OF RELIEF SITUATIONS
VOL. III CALCULATION OF REQUIRED RELIEF RATE
VOL. IV SELECTION, SIZING, AND INSTALLATION OF PRESSURE

RELIEF DEVICES
(This includes the pressure setting in relation to the design pressure of the
protected equipment).
VOL. V DISCHARGE AND DISPOSAL SYSTEM DESIGN
VOL. VI REFERENCE SECTIONS
DOCUMENTS REFERRED TO IN THIS PROCESS GUIDE
It is emphasized that this document is only a Guide, describing good practice at

the date of issue, and is not itself mandatory (although some mandatory
instructions are quoted). When used in this Guide, the words "must", "shall", and
"should" have no legal force and are not mandatory, except where they are part
of a quoted mandatory instruction from another source.
The word" must" has not been used, except when part of a quotation.
"Shall" is a strong recommendation of GBHE based upon experience or upon the

position adopted by recognized authorities, and the engineer may quote
compliance with this guide only when that recommendation has been followed.
"Should" is a recommendation based upon the judgment of experienced people

but recognizes that some discretion may be appropriate.
Note:
This Guide includes references to and quotations from external and British
Standards. The reader should always check if the Standards have been updated
since the last issue of this Guide.

Volume 2: Causes of Relief Situations
SECTION 1: IDENTIFICATION OF EVENTS LEADING TO OVERPRESSURE /

UNDERPRESSURE
1 INTRODUCTION
1.1 General Statement

1.2 Hazard and Operability Studies and Hazard Analysis
2 METHOD OF IDENTIFICATION
2.1 Potential Causes of System Overpressure

2.1.1 Principles and Terminology
2.1.2 Plant or Process Conditions
2.1.3 Prime Events
2.2 Procedure
2.2.1 Tabulation of Potentially Hazardous Events
2.2.2 Stepwise Procedure for Each System
3 DEFINITION OF A PROCESS EQUIPMENT SYSTEM (PES)
SECTION 2 : EXTERNAL FIRE
4 INTRODUCTION
5 FACTORS TO CONSIDER
5.1 Nature of Material Inside Equipment

5.2 Extent of Fire Zone
5.3 Type of Fire
5.4 Loss of Structural Strength
5.5 Radiation from Adjacent Fires
5.7 Thermochemical and/or Decomposition Effects
5.8 Small Vessels
6 PITFALLS WITH FIRE

SECTION 3: PROCESS ABNORMALITIES
7 INTRODUCTION
8 SYSTEM BLOCKED-IN (CONDITION 1)
8.1 General Considerations

8.2 Mal-operation
8.3 Process Aberration
8.4 Pitfalls with Blocked-in Equipment
9 RESTRICTED OUTLET (CONDITION 2)
9.1 Mal-operation
9.1.2 Outlets Closed or Restricted
9.1.2 Outlets too Small
9.2.1 General Considerations
9.2.2 Causes of Blockage
9.3 Pitfalls with Restricted Outlet Condition
10 RESTRICTED INLET (CONDITION 3)
10.1 Equipment at Risk

10.2 Events Leading to Underpressure (Vacuum)
10.3 Pitfalls with Restricted Inlet
11 CHEMICAL REACTION (CONDITION 4)
11.1 Normal and Abnormal Chemical Process

11.2 Runaway Reaction
11.3 Chemical Reaction in Relation to Prime Events
11.3.1 Fire
11.3.2 Mal-operation
11.3.3 Process Aberration
11.3.4 Equipment Failures
11.3.5 Service Failures
11.4 Underpressure Relief
SECTION 4: EQUIPMENT AND SERVICES FAILURES
12 INTRODUCTION

13 EQUIPMENT FAILURE
13.1 System Blocked-in or Restricted Outlet (Conditions 1 and 2)

13.1.1 Factors to Consider
13.1.2 Failures Involving Inter-stream Leakage (Heat Exchangers and Similar Items)
13.1.3 Fired Heaters
13.1.4 Control System Failure
13.1.5 Machines (and Ejectors)
13.2 Restricted Inlet (Condition 3)
13.2.2 Failures Involving Inter-stream Leakage
13.3 Chemical Reaction (Condition 4)
13.4 Pitfalls with Equipment Failure
14 SERVICES FAILURE

14.2 Principal Services
14.2.1 Cooling Water
14.2.2 Electrical Power
14.2.3 Instrument Air
14.2.4 Steam: HP, IP, LP
14.2.5 Fuel Gas and Fuel Oil
14.3 Secondary Services
14.3.1 Heat Transfer Fluids (hot oil, "Thermex", hot water)
14.3.2 Hydraulic Oil
14.3.3 Inert Gas and Nitrogen
14.3.4 Refrigerant
14.3.5 Water (other than cooling water)
14.4 Pitfalls with Service Failures
SECTION 5 : AMBIENT CHANGES
15 INTRODUCTION
16 ENVIRONMENTAL CHANGES
16.1 Atmospheric Conditions

16.2 Plant Environment
17 EXPANSION/CONTRACTION OF VAPOR INVENTORY
17.1 Low-Pressure Storage Tanks

17.2 Low Temperature Atmospheric Pressure Storages and Equipment
17.3 Sealed Containers (IBC)
18 HYDRAULIC EXPANSION - PIPELINES AND VESSELS

TABLE
1 IDENTIFICATION OF EVENTS LEADING TO OVER / UNDERPRESSURE

SECTION 1.0 IDENTIFICATION OF EVENTS LEADING TO
OVERPRESSURE/UNDERPRESSURE
1 INTRODUCTION
1.1 General Statement
In every pressure relief study the first and often most difficult step is that of
recognizing every potential cause of overpressure in the process
equipment system being studied. This Guide does not, however, include
any consideration of dust, gas/air or vapor phase explosions where the
speed of reaction is such that the equipment will be vented directly to the
atmosphere. See also Part C, Section 5 of this Guide.
This Part B is a guide to the qualitative identification of common causes of

overpressure in process equipment. It cannot be exhaustive; the process
engineer and relief systems team should look for any credible situation in
addition to those given in this Part which could lead to a need for pressure
relief (a relief situation).
Note 1:
OVERPRESSURE: Following common usage, the term "overpressure" or
"system overpressure" is used in this Guide to refer to any excess of
pressure in a system over its design pressure. It should be distinguished
from the more specific term "relief valve overpressure" defined in Vol. 1
of this Guide in relation to the set pressure of a relief valve.
Note 2:
UNDERPRESSURE: The corresponding term "underpressure" (system
under pressure) is used for any situation where the absolute pressure is
reduced below that at which the equipment might be damaged or collapse
(an under pressure relief situation).
To create a relief situation, there must be an energy source. Pressure

relief may be needed when either:
(a) T he normal mass balance is disturbed;
or
(b) The energy balance, is disturbed.
An example of each of these situations is given below:

(1) Outlets from vessel are blocked or restricted while inlets remain
open to source of fluid at a pressure higher than design pressure.
(2) Reaction goes out of control (runaway) leading to energy release

too great for normal equipment to handle.
Sections 1 through 5 are intended to lead the user through the process of
identifying all situations that need to be considered, at an early stage in
the development of engineering line diagrams. It is recognized that the
individual user needs an introduction to the recommended method though
he may or may not require detailed technical advice, dependent upon his
own level of experience.
ALL USERS ARE STRONGLY RECOMMENDED TO READ THIS

SECTION 1.
1.2 Hazard and Operability Studies and Hazard Analysis
It is essential that engineers and/or teams responsible for pressure relief

systems (sometimes referred to as Relief and Blowdown Teams) identify
possible causes of system overpressure and hence the main relief system
equipment early in the project so that design and ordering may proceed.
Every attempt should be made to ensure that every significant risk is
considered. Further examination in the form of detailed Hazard and
Operability Studies provides a check that no causes have been missed.
Quantitative Hazard Analysis can be used to assist in deciding for what

combinations of hazards a relief system needs to be designed or whether
a particular event is sufficiently remote to be discounted.
In high risk situations, Hazard Analysis may be essential to determine the

level of integrity required of the relief system itself.

2 METHOD OF IDENTIFICATION
2.1 Potential Causes of System Overpressure
2.1.1 Principles and Terminology
When reading this Section, refer to Table 1.
Inadvertent pressure rise (or fall) leading to the need for pressure (or
vacuum) relief is caused by certain EVENTS occurring while the plant or
process is in a susceptible CONDITION. An EVENT (e.g. thermal energy
input) may arise from:
(a) A fault or defect (e.g. control system failure).
(b) Normal process mass and heat flows.
(c) Changes in ambient conditions.
(d) External fire.
Faults or defects may arise from human error, design limitation, equipment
failure or external factors. Many faults can occur without a potential hazard
arising because the conditions are not appropriate at the time.
Of a number of possible approaches, the GBHE Process Engineering

(Relief Systems Team) recommends the method given in this Guide for
the identification of inadvertent causes of pressure rise or fall. The plant
items are first grouped together into one or more process equipment
system(s) for the purpose of the pressure relief study. All events likely to
cause the pressure to rise or fall are identified by considering the plant
and/or process to be in each of four PLANT/PROCESS CONDITIONS in
turn. To help the user to carry out this procedure a number of common
faults, defects etc. have been assembled in Table 1 under the column
headings of four PRIME EVENTS.
Note:
To avoid duplication in the Table, some events are listed in a box only
under the CONDITION under which they would be most likely to occur.
They may, however, be relevant to other CONDITIONS and so it is
imperative to consider the contents of all other boxes in the same
column. The user should also consult the corresponding Sections of Part
B of this Guide.

Sometimes a condition in which the system becomes prone to
overpressure generation is not a normal condition of operation but is itself
caused by a fault. For example, a blocked-in condition may be caused by
solidification of process material as a result of a heating failure.
Overpressure may then be generated either by normal or abnormal
events.
2.1.2 Plant or Process Conditions
The four conditions tabulated and to be considered in turn are:
CONDITION 1 : SYSTEM BLOCKED-IN

A process equipment system having both inlets and outlets closed but
which can still be subject to energy input especially by heat transfer. The
closing of blocking valves may be intentional or accidental so CONDITION
1 may be normal or occur as a consequence of an operational fault.
CONDITION 2 : RESTRICTED OUTLET

The situation where, because of restriction of flow through the outlets, the
maximum rate of discharge from the system at its design pressure is less
than either the potential inflow from all sources or the rate of expansion of
the contents. The outlet(s) may be closed, restricted unintentionally or too
small.
CONDITION 3 : RESTRICTED INLET

The situation where the potential inflow to the system is less than either
the maximum outflow or the rate of contraction of the contents because of
restriction of inlets. This condition is only a hazard for equipment not
designed for operation under vacuum. The inlet(s) may be closed,
restricted unintentionally or too small.
CONDITION 4 : CHEMICAL REACTION

The potentially hazardous situation when a chemical process (usually, but
not necessarily, exothermic) is capable of causing the pressure to rise if
outflow of fluid or removal of heat from the system is restricted;
alternatively a chemical reaction may also cause the pressure to fall when
inflows are restricted.
In some cases the chemical reaction itself may go out of control if the
operating conditions deviate from normal. Either the basic chemical
reaction rate then accelerates uncontrollably or undesirable side reactions
are initiated which rapidly predominate. In either case heat may be

evolved at a rate that cannot be dissipated, or gas/vapor may be
generated at a rate that cannot be discharged via the normal routes
available. When chemical absorption of gas occurs, the process
has potential for creating an underpressure relief situation. Thus the
involvement of chemical reactions with potential for causing overpressure
(or underpressure) is defined as a PROCESS CONDITION; an abnormal
reaction is an EVENT which can be triggered by various faults.
CONDITION 4 can occur in combination with either 1, 2 or 3.
Note:
Clearly overpressure can arise under CONDITIONS 1, 2 or 4 and
underpressure can arise under
CONDITIONS 1, 3 or 4.
2.1.3 Prime Events
The four PRIME EVENTS tabulated and whose effect has to be examined
for each one of the PLANT/PROCESS CONDITIONS are:
PRIME EVENT A : EXTERNAL FIRE

A plant fire is treated as a PRIME EVENT rather than as an effect of some
other EVENT which started it because:
(a) Direct quantitative relief requirements follow from considering the

heating effect of fire.
(b) Secondary effects are sometimes caused by fire.
(c) The initial cause of the fire does not affect the relief systems study.
(d) It is established practice in pressure relief studies.
PRIME EVENT B : PROCESS ABNORMALITY

Abnormalities include both mal-operation and process aberration. Mal-
operation means that the process is inadvertently operated in an abnormal
way. Process aberration is an abnormality which may occur within the
process itself as a result of factors outside normal control - such as
deviations in chemical or physical state of materials.

PRIME EVENT C : EQUIPMENT AND SERVICES FAILURE
Equipment failure (or breakdown) of mechanical systems, machines or
control systems.
Services failure is that of ordinary services (steam, water, electrical power,

etc.) supplied from outside the process unit. It may be partial or total.
PRIME EVENT D : AMBIENT CHANGES

Usually this means a change in the atmospheric conditions (temperature,
rainfall, wind, etc.) that can cause problems due to pressure changes in
low-pressure storage tanks and in pipelines. Other environmental changes
have to be included (e.g. heat radiation from nearby installations) in some
plant studies.
2.2 Procedure
2.2.1 Tabulation of Potentially Hazardous Events
Table 1 is a tabulation of possible events caused by faults and other

factors in design and operation that constitute the PRIME EVENTS as
defined in 2.1.3. All relevant listed items plus any others that may be
suggested should be considered by the team or engineer responsible for
relief and blowdown studies.
The Table serves as a check list to be used in conjunction with the more
detailed advice in Sections 2 through 5 to which cross reference is made.
These Sections are intended to lead the user to recognize possible
hazards other than those given in the Table.
It is not only important to identify all the potential causes of a relief

situation but also to establish whether each source will affect the design of
the relief system; hence it is necessary to calculate the required relief rate
for each source as it is identified and consider whether:
(a) The various sources are either independent and their effect simply
additive or whether they are subject to more complex interactions.
(The effect can be either less or more than simply additive).
(b) Any lesser sources, either alone or in combination, are significant

after designing the relief system for the major causes.

2.2.2 Stepwise Procedure for Each System
The general procedure for identification of causes of overpressure and

calculation of the total required relief rates is as follows. Recommended
methods for performing the calculation of individual rates are covered in
Part C of this Guide.
(a) For each process equipment system mark a boundary on the line
diagram for the system such that all equipment within the boundary
can be effectively served by one pressure relief device or
combination of devices.
(b) Consider the process equipment system to be in each of the four

PLANT/PROCESS CONDITIONS that are relevant, in turn.
Whatever the CONDITIONS, think carefully about the events listed
under all other CONDITIONS in Table 1 to identify every event
that could lead to a relief situation.
(c) With the help of Sections 2 to 5, try to recognize any other

significant event which has not already been considered.
(d) Check whether the effect of a fault could pass either forwards or
backwards through the train of plant items and cause a relief
situation at a remote location.
(e) Consider whether the effect of any significant cause can be easily
reduced in magnitude or eliminated, by changes either in design or
operating procedures.
(f) Determine the total required relief rate as follows:
(1) calculate the required relief rate for each individual event;
Note:
With large projects, because of long delivery times for main
plant items and relief devices, it is sometimes necessary to
estimate relief rates before detailed equipment data are
available. It will be necessary to check these calculations
later, when sufficient data are available, and make any
necessary modification to the relief system design.

(2) select the highest individual or highest credible combination
of relief rates (determined by hazard analysis if necessary);
(3) if the total required relief rate is excessive, consider in detail

any way by which it may be reduced.
Note 1:
It may be necessary to do this after considering the
combined relief requirements of a number of process
equipment systems. For instance, the combination may
affect the design of a flare system more than the size of the
relief device.
Note 2:
The effect of some events cannot be precisely defined for
the purpose of calculating relief rate and may seem to be
unlikely occurrences. Such events may only be ignored if
they can be made acceptably remote (checked by hazard
analysis if necessary). Otherwise, the best possible
calculation should be made and an appropriate factor of
safety applied.
(g) With large plants, to facilitate the subsequent design of common disposal
systems and also as an aid in reporting, it is recommended that a code
number be allocated to each fault or defect identified as a potential cause
of a relief situation.
The code number can be used to rapidly identify anyone fault that could
affect more than one process equipment system at the same time.
Note:
For a large plant the required relief rate resulting from services failure (for
instance electrical power) is often the sum of a number of relief rates
produced by coincident effects in more than one process equipment
system. All these rates contribute to a combined relief discharge to flare,
scrubber or other disposal system.

3 DEFINITION OF A PROCESS EQUIPMENT SYSTEM (PES)
(For Relief and Blowdown Studies)
Items or groups of items of equipment which will be connected by

pipework to an appropriate pressure relief device, and not containing any
means of internal isolation, are considered to be one system for the
purpose of protection from overpressure or underpressure. If any item or
part of the system can be isolated by mechanical means or by an
abnormal process condition, such as accidental blockage (ice, etc.) then
that system must be subdivided into separate systems each of which may
require protection against overpressure or underpressure. See Part D of
this Guide.
Note:
It is important to ensure that at all times the interconnecting pipe work and
ducts within items of equipment are capable of passing the relevant fluids
at the required relief rate to the relief system.
Isolatable sections of pipework within the plant often do not require

pressure relief. (This normally refers to fire or thermal relief). However,
long pipelines, some large diameter pipes and pipes containing liquid with
high vapor pressure at ambient temperature may require protection and
should be treated as a process equipment system. See Section 5.
Sometimes, Administrative Safety Procedures can be proposed by the

Relief and Blowdown Team or the Project Team with regard to isolation
practices. Isolation valves between two systems can be locked open in
certain circumstances to allow the two systems to be regarded as one for
pressure relief purposes. Any such proposals should be agreed by the
appropriate Works authority. It should be remembered that isolation valves
even when fully open might impair the safe operation of a relief system.
Note:
The preceding statement does not refer to the isolation of relief devices
from the equipment they protect - a practice which is only permitted in a
very limited number of circumstances and which shall be approved by the
appropriate authority. See Part A.
When defining a PES the isolation of equipment by means of slip-plates,

blanks, or bobbin pieces need not be taken into consideration provided
that the operation is part of the normal maintenance procedures and
equipment is drained/vented until its return to on-line duty.

However, the precise siting of slip-plates and blanks is important in
ensuring that pipework and items of equipment still in service do not
become isolated from their normal relief systems. Thus, the position of any
isolating device should be clearly identified on the engineering line
diagram when the PES is defined.
It is essential to take into consideration any specification breaks in

pipework when defining each PES.

TABLE 1: IDENTIFICATION OF EVENTS LEADING TO OVER /
UNDERPRESSURE


SECTION 2:
EXTERNAL FIRE
4 INTRODUCTION
At an early stage in a project, any areas in the plant in which a significant fire could
occur for a prolonged period need to be identified as a fire zone. Any vessel located
in a fire zone could be subject to energy input from a fire either by direct contact with
the flame or by radiation from a nearby fire. This may be sufficient to generate
excessive pressure in the vessel so that pressure relief ("fire relief" being the
generally accepted term) will be necessary. Alternatively, although a fire is possible,
the amount of available fuel may be insufficient to raise the temperature and hence
the vapor pressure of the vessel contents to the extent that makes pressure relief
necessary.
When assessing the need to provide either fire relief, vapor depressring facilities or
any other protection of process equipment against overpressure, all the
consequences of failure of the equipment (by rupture or other major breakdown)
should be borne in mind, for example:
(a) Release of flammable material increasing the scale of the fire.
(b) Discharge of toxic substances to the atmosphere.
(c) The cost of damage to the plant (repairs and outage).
(d) Risk to personnel and plant from fragmenting vessel.
(e) Vapor explosion as a result of external ignition of material released as a

result of the failure.
When fire is the main hazard, in addition to a pressure relief system, it is usually
prudent to provide protective equipment such as:
(1) Use of fire resistant lagging or other materials resistant to fire to protect
appropriate areas.
(2) Vapor depressurizing systems to reduce the system pressure below the relief
set pressure - especially when there is a risk of weakening the metal by
overheating (See 5.4).
(3) Liquid release systems discharging to an appropriately protected dump tank -

particularly for toxic or flammable materials.
Even when fire is a lesser hazard, consideration should still be given to such
measures.

When considering external fire the plant condition is always considered to be
"Blocked-in" except when it is physically impossible to block it in. In all cases, decide
whether fire should be considered together with other PRIME EVENTS (e.g.
equipment failure).
5 FACTORS TO CONSIDER
5.1 Nature of Material Inside Equipment
Examine the properties of the process materials that can be present at any time and
establish the effect of overheating. The commonest pressure hazard due to fire
arises with vessels containing:
(a) Volatile liquids whose vapor pressure might exceed the design
pressure when heated by fire.
(b) Materials that can undergo abnormal chemical reaction with

evolution of gaseous products when overheated in a fire. See Part
C, Section 5 of this Guide.
5.2 Extent of Fire Zone
A very broad guideline is that a fire hazard exists in equipment which:
(a) Contains more than about 2 t of flammable liquid;
and/or
(b) Is continuously fed at a rate of about 2 t/h or more of flammable

liquid, gas or vapor unless it is safe to assume that the flow can be
reliably stopped in the event of a fire. See Process Safety Guide
No.2.
The space surrounding a fire hazard constitutes a "fire zone". Subject to

accepted limitations based on experience, the zone should be taken as
either 12 m by 12 m square or 6 m laterally from the boundary of the
equipment constituting the fire hazard unless special provision is made to
limit the spread of fire. Suitable fire resistant walls and screens or the plant
drainage layout may be considered as limiting the extent of the fire zone.

Note:
Engineers responsible for specifying fire zones should satisfy themselves
that these guidelines are appropriate to the particular situation in question
because local environmental factors often affect the demarcation.
5.3 Type of Fire
Experimental and other research work has shown that the heat input can
vary with the type of fire surrounding the vessel. Vessels completely
enveloped by flames are subject to much greater heat fluxes than those in
situations where the heat transfer is reduced by air currents, smoke, etc.
See Part C, Section 1 of this Guide.
More specifically, at heights of more than 15 m above the fire source, heat
transfer is considered to be drastically reduced by smoke, eddies and
wind currents. Normally fire relief need not therefore be considered for
vessels and other equipment that are more than 15 m above the
source of the fire except for the following:
(a) Equipment in buildings or other locations where a "chimney" effect

can be created.
(b) Any vessel where the heat input can be increased by conductive
heat transfer (usually via heavy structural steelwork).
(c) Equipment in locations where some induced airflow could increase

the height of the fire (e.g. fire near an up draught air cooler).
5.4 Loss of Structural Strength
A process vessel that is heated above its design temperature may fail at a
pressure well below its design pressure. Hence, a relief valve set at
design pressure cannot be relied upon to protect a vessel subjected to fire
for a prolonged period. This risk is greatest to parts of the vessel not
internally wetted by liquid.
Vessels sited in a fire zone may therefore need to be provided with

remotely operated independent systems to guard against such failure by
discharging some or all of the vessel contents in order to lower the
pressure in the vessel to a safe value below the design pressure and
usually less than the relief set pressure.

This can be achieved by discharging vapor ("vapor depressuring") or
liquid ("liquid dumping"). Refer to Process Safety Guide No.2 for more
detailed guidance.
Localized flame impingement may also lead to failure at pressures below

design pressure and should, if possible, be prevented by lagging, screens,
etc. Otherwise provide a depressuring system.
In cases where supercritical temperature will be reached before the relief

pressure, loss of evaporative cooling by boiling inside the equipment will
allow the metal to overheat and lose its strength much sooner than when it
is in contact with liquid. This is, therefore, another possible case for
providing depressuring facilities.
Radiation may affect equipment in a neighboring area not designated as a

fire zone. Fires may spread to other areas including non-fire zones if the
plant layout and arrangements for drainage are not designed with this
hazard in mind.
5.6 Reduction of Heat Absorbed by Equipment
Measures taken to reduce heat absorption can significantly reduce the

size and number of protective devices required for fire relief. Such
measures include the use of fire resistant lagging and sloping the ground
beneath the plant. The reduction that may be allowed depends on the
specific actions and the prevailing situation. See Part C, Section 1 of this
Guide.
Sometimes it is possible to design out completely the need for fire relief by
such measures as:
(a) Use of very thick fire resistant insulation.
(b) Use of fire resistant concrete protection for plate-fin exchangers.
(c) Separation of air coolers by concrete floors.
(d) Burying pipes underground.

5.7 Thermochemical and/or Decomposition Effects
Materials on hot surfaces may well undergo side reactions which generate
much heat simultaneously with that from the external fire. Consideration
shall therefore be given to all possible side reactions and the temperature
at which such effects would begin.
5.8 Small Vessels
Some vessels may be sufficiently small for rupture in a fire to be regarded

as a minor risk so that pressure relief need not be provided. The following
hazards should be examined before making any decision not to provide
pressure relief:
(a) Pressure energy (depending on pressure at failure and volume of

vessel).
(b) Nature of contents likely to be released.
(c) Damage likely to be caused by fragmentation, blast, etc.
In the case of pressure energy, guidance is given in SI 2169 - "The

Pressure Systems and Transportable Gas Containers Regulations 1989"
for exemption from registration. Exemption may be granted for equipment
which meets both the following criterion:
The product P x V is less than 0.25 bar g m3
where: P = design pressure (bar g)

V = vessel volume (m3)
These regulations come into force in July 1994.
The existing regulations granted exemptions if:
P x V is less than 1 bar g m3
and design pressure less than 7 bar g.


These remain valid until July 1994.
It is strongly recommended that the criterion of P x V < 0.25 bar g is used

for all new designs and modifications.
Provided that the vessel is not greatly overdesigned (i.e. it would only
rupture at many times the design pressure) the same criteria may be used
when considering the possible elimination of pressure relief devices on a
small vessel.
Caution shall be exercised, however, when using these criteria to justify

that there is no need for pressure relief where:
(i) very high -pressure can be generated in a fire (e.g. cylinders

containing LPG);
(ii) brittle fracture can be a possibility;
(iii) any potential cause of metal failure such as corrosion can be

recognized.
6 PITFALLS WITH FIRE
During stand by, start up or shut down the fluid in the equipment may be
totally different from that during normal operation. The relief system shall
be designed to cope with the worst case identified by a study of all
possible normal and abnormal operating conditions.
Often, many items subject to different events are included in the process
equipment system for which fire relief will be provided and this means that
careful attention should be given to the following aspects:
(a) Fire relief should not be assumed to be the limiting case for
pressure relief. The required relief rate for each event should first
be evaluated.
(b) High pressure losses can be built-up within the process equipment
system itself if each item and all interconnecting pipework are not
adequately designed so that material can flow without restriction to
the relief outlet. This is a very important aspect in the case of fire
relief. Typical examples of the effect of restrictions are:

(1) condensers that can become flooded;
(2) overhead pipework connected to a reflux drum on ground level that

can be liquid-logged.
British Standards govern the provision of fire relief on certain vessels such
as air receivers, refrigeration units and steam boilers or receivers. See
Part A of this Guide.
SECTION 3:
PROCESS ABNORMALITIES
(Mal-operation and Process Aberration)
7 INTRODUCTION
Whenever intervention by operators is used in the operation of a process

plant or any other equipment, mistakes can and do occur; any such event
is called "mal-operation". If there is a potential for pressure rise such mal-
operation would be serious unless its effects are considered and provided
for at the design stage. Similarly, pressure rise may be caused by
malfunction of the process as a result of:
(a) Unusual operating conditions.
(b) Inconsistent raw materials.
(c) Unknown features inherent in the process.
Any such event is called II process aberration II •
All credible events of either type that could occur should be examined.
The study is applied to continuous process plant while on line, starting up
or shutting down and during shutdown periods; it is also applied to batch
operations at all phases of the operating cycle. These events should be
considered for each of the previously given PLANT OR PROCESS
CONDITIONS that is possible in the given situation. See 2.1 & Table 1.
The aim is to identify any combination of factors that can lead to a relief
situation. Hence, both those events that can directly cause overpressure
(or underpressure) in the existing CONDITION of the plant or process and
those that create a new CONDITION in which the system is prone to
overpressure (or underpressure) are included in this Section.

8 SYSTEM BLOCKED-IN (CONDITION 1)
This condition can arise with any equipment which can be isolated or shut
down whilst containing liquids or gases. With continuous processes, the
blocked-in condition usually arises from mal-operation but with many
batch processes the equipment is deliberately isolated and blocked-in
during normal operation. When blocked-in, the contents can be subject to
energy input from:
(a) A heating service.
(b) Stored up thermal energy.
(c) Sources of mechanical energy.
(d) Chemical reaction.
The following typical situations are some that can occur when a plant is
shut down or put on standby:
(1) Vessels isolated while containing liquid - as occurs during many

batch processes. If partially filled, consider the vapor pressure; if
completely filled, see (2).
(2) Pipelines and vessels isolated while full of liquid. They may require
relief protection from hydraulic expansion; consideration should be
given to the need for relief whenever liquid can be trapped between
isolation valves. See Section 5 and Part C, Section 8 of this Guide.
(3) Machinery (pumps especially) left full of liquid when shut down.
With very large pumps or those handling cryogenic liquids the
pump casing may need to be fitted with a pressure relief device;
thermal relief via the seal may be adequate in some cases but
not always acceptable. See Section 5 and Part C, Section 8 of this
Guide.

8.2 Mal-operation
After a blocked-in CONDITION has been created a number of EVENTS

can subject the equipment to energy input; any such event which is a mal-
operation may cause overpressure. Note the following examples:
(a) Heat exchange equipment continuing to transfer heat into the

system after the heat sink has been isolated.
(b) Electric heaters, if not switched off, may raise the temperature
sufficiently to weaken metal walls as well as heat the contents. This
could create a need for relief at a pressure lower than the design
pressure.
(c) An agitator or pumped circulation system left running after a vessel

has been isolated can be a source of energy input that would raise
the temperature sufficiently to cause appreciable hydraulic
expansion, initiate abnormal chemical reactions or significantly
increase vapor pressure.
(d) Circulation pumps running on total recycle (kickback) can similarly

heat the contents of the process equipment system with the same
effects.
Note:
Shaft seals may be damaged by a pressure which is within the safe
working pressure for the pump body and other parts of the
equipment.
(e) Chemical reactions may be:
(1) operated intentionally under blocked-in conditions, See 11.3;
(2) accidentally blocked-in by mal-operation (e.g. wrong closing

of valves);
(3) blocked-in by malfunction (e.g. blocking of lines by

inadvertent solidification).

Blocking of lines and equipment is covered under RESTRICTED OUTLET

and also RESTRICTED INLET. Apart from abnormal chemical reactions
there are other instances of unusual behavior that can cause a pressure
rise in either the blocked-in or restricted outlet condition. See Clauses 9
and 10.
The following is one such case that should be examined when

appropriate.
Roll-over is a phenomenon originally experienced with many large

liquefied natural gas (LNG) storage tanks due to the formation of an
unstable system of liquid layers of various densities and temperatures.
Such instability may be caused in several ways, particularly by:
(a) Feeding of a higher density liquid on to (or near to) the surface of a
lower density liquid.
(b) Feeding of a lower density liquid to the bottom of a vessel

containing a higher density liquid. This cause of unstable layering is
less likely than (a) because of the upward displacement resulting
from the inflow.
(c) Evaporation of more volatile components from the upper layers,

following heat input from the environment so that these layers
become more dense than the lower layers.
(d) Heat input to lower layers (e.g. by base heating) that can increase
the temperature and decrease the density to a value less than that
of upper layers.
The result may be that an unstable condition is set up in which the

hydrostatic head temporarily prevents the boiling of the lower layers. If this
unstable condition is disturbed, the higher density layers begin to sink and
lower density layers to rise; once this happens, mixing of the layers can
rapidly accelerate.
The subsequent attainment of new equilibrium conditions may be

accompanied by a violent boil-off of LNG.

This is due to material containing more volatile components suddenly
achieving a higher temperature by mixing and/or material rapidly reaching
a zone where the hydrostatic head is lower. Such boiling is capable of
generating considerable overpressure.
Similar phenomena have occurred in atmospheric storage tanks and

should be considered wherever liquids of different densities and boiling
points can be layered and stored for long periods of time.
Every effort should be made to design out the likelihood of roll-over. There
are two principal approaches available:
(1) Design to ensure adequate mixing at all times (e.g. by provision of

jet mixing facilities).
(2) Assume that layering will occur and where there is a risk of
subsequent mixing being caused by thermal effects, minimize the
risk by use of effective insulation.
8.4 Pitfalls with Blocked-in Equipment
(a) Heat exchangers have two sides and need to be treated as two
vessels one of which is an energy source to the other.
(b) A relief situation can be generated in heated pipes irrespective of

ambient conditions. Estimation of maximum achievable
temperature followed by a consideration of resultant pressure
effects is required for all heated lines (including steam-traced,
jacketed and electrically heated pipes).
(c) Internal rupture can occur in canned motor pumps and certain other
items having a weak internal wall despite the fact that the outer
casing may be adequately designed. Take the maximum differential
pressure into account.
(d) The layering of two immiscible liquids may be a potential cause of a

relief situation if boiling would occur when the layers are mixed.
See 9.1.2.3.

9 RESTRICTED OUTLET (CONDITION 2)
9.1 Mal-operation
9.1.1 Outlets Closed or Restricted
Equipment items often suffer the total loss of one or more outlet paths due
to closed valves and mechanical equipment. This condition may be either
normal to the process or result from a mal-operation or failure.
Examples of such mal-operations are:
(a) Inadvertent closure of valve(s), or valve(s) incorrectly remaining

closed during or after start up.
(b) Incorrect closure of more than one valve at the same time during
changeover operations of spare equipment or during batch
operations.
Note:
Non-return valves on inlets operating the way they are intended ad
in same way as a blockage and should not be disregarded. See
Part C, Section 3 of this Guide.
(c) Sudden stoppage of machinery, for instance a compressor. This is

frequently accompanied by backflow from the downstream high
pressure source through the bypass or through the machine itself.
(d) Incorrect setting of a controller causing partial or total control valve

closure. There is a high risk of these events during start up and
shutdown operations.
Most EVENTS which lead to pressure rise under BLOCKED-IN

CONDITIONS also apply to RESTRICTED OUTLET and will not be
repeated here. See 8.2.
Note:
Pressure surge (over or under pressure) may be caused by any of the
above mal-operations and sometimes by normal operation, in which case
special design considerations may be invoked. See Part C, Section 9 of
this Guide.

9.1.2 Outlets too Small
There are also process mal-operations which generate or admit to the

equipment so much vapor or liquid that although it is on-line with its
normal outlets functioning, fluid accumulates so that the pressure rises
above normal. The events listed below can also occur while the outlets of
the vessel are closed, for instance during start up, stand by or shutdown.
9.1.2.1 Gas Breakthrough
Liquid is frequently transferred under gas pressure into another vessel

(often a low-pressure storage tank) through a regulating valve or other
device. The valve may fail to close when all the liquid has been transferred
and gas will pass through the line so that the low-pressure vessel can
be subjected to the higher (blowing) pressure. If its design pressure is less
than the blowing pressure it will require relief protection.
Deliberate line blowing is often used to empty pipelines completely after

movement of material into a storage tank - especially when the material
solidifies easily. Always consider the risk of over pressuring the receiving
vessel.
9.1.2.2 Liquid Overfilling
Liquid overfilling of storage tanks is often possible, and an overflow large

enough to accommodate the "pump in" rate of liquid feed is needed.
Whenever such an overflow is not practicable, the pressure relief system
shall be sized to pass this flow.
Liquid overfilling of process vessels is less often recognized as a potential

demand on the relief system. However, repeated operating experience
has shown that it is quite possible to fill even the largest distillation
columns with liquid and for it to take many hours for operating teams to
establish what is happening.
Liquid overfilling is a particular problem during start-up, when instruments

are being brought into commission and when the plant is far from steady
state. Accidental misrouting of streams and the unavailability (or mis-
calibration) of instruments may result in incomplete or misleading
diagnostic data which can take hours or even days to resolve.

The consequences of a major ingress of liquid into a relief system which is
not designed for it can be very serious: the pipework and its supports may
not be designed for the weight; the pipework may be damaged by
slugging; the liquid knock-out and pump-out systems may be
overwhelmed; the relief system capacity may be reduced to the extent that
other demands cannot be handled. In the worst case, a loss of
containment may occur, followed by a possible fire or toxic release.
For the design of the relief system, it should be assumed that ANY
process vessel, regardless of size, is capable of being flooded with liquid.
This requirement should only be relaxed following a hazard analysis of the
installation, or if an assessment of the inventories in the system shows
that overfilling is not a credible event. For potential relief cases with liquid
flowrates, designing out the relief case is strongly recommended. This
requires a combination of suitable instrumentation and operator action.
To "design out" liquid overfilling as a relief case, at least an independent,

diverse, extra-high level alarm will be required and on critical applications
an independent third instrument may be needed. The alarms shall be
allied to suitable operator training so that immediate action can be taken.
Consideration should be given to hard-wiring important alarms (as
opposed to routing them solely through a Distributed Control System) so
that the alarms remain effective if the DCS loses power.
There are a number of pitfalls in considering liquid overfilling of process

vessels:
(a) The belief that a particular vessel is too big to overfill is misguided.
Experienced operating teams have overfilled distillation columns of
over 500 rn3 volume.
(b) Many level instruments rely on an assumed liquid density to convert

the measured parameter into an equivalent liquid level. During
actual operation, and particularly during start-up, a range of
densities may be experienced by the instrument. If the actual
density differs from the calibration density, the level the instrument
indicates will not be the true level. This can result in alarms and
trips coming in at the wrong level (if at all).
(c) A realistic view should be taken of the actions an operator can take
to prevent overfilling. In particular, allowance should be made for
the increased response time of an operator when under stress as
well as the practical limitations on what the operator can do.

Sufficient instrumentation should be available to help the operator
to diagnose the problem and effective action should be possible
(e.g., by using an alternative disposal route or by stopping a feed
stream).
(d) Any instrumentation provided should be located to give a realistic

amount of time for action. On some distillation columns, the extra-
high level alarm is located half way up the column to indicate that a
very serious problem is developing which needs immediate
attention. Instrumentation for instrumentation's sake is not good
enough.
(e) Normal disposal routes may not be available, especially if loss of

the normal disposal route is the cause of the problem. The
proposed disposal route needs to be able to handle not only the
rate, but also the quantity of material. Problems can be particularly
acute during start-up of new equipment when construction debris
can result in the rapid blockage of pump suction strainers. If the
duty is hot, these may take several hours to cool before cleaning
can commence. A similar blockage on the spare pump, during this
time, will result in a loss of pump-out capability.
(f) Large vapor duty designed to protect reboilers on a distillation

column can pass considerable quantities of liquid if the column
overfills. While this may occur at any time, there is an increased
risk of it happening during a start-up or shut-down. The designer is
cautioned to pay particular attention to the composition of the liquid
which may be discharged, as this may be very different from the
normal flowsheet.
(g) In general, care needs to be taken over the composition of the

liquid discharged by the safety valve: during start-up, compositions
may be very different from design and this can cause problems in
the disposal system. Unexpected corrosive materials, materials
which cause chilling as they flash or materials which may undergo
chemical reactions or phase changes may enter the disposal
system with unforeseen results.

9.1.2.3 Contact Between Immiscible Liquids
Hot heavy "oil" added to water or vice versa can cause violent boil-off with
the release of large volumes of steam as a result of heat transfer to the
water layer if the oil is above 100 o C.
A similar effect may occur as a result of contact between any two

immiscible or partially miscible liquids even if the resultant temperature is
below the boiling point of both liquids. If the sum of the two vapor
pressures is greater than the design pressure, relief will be required for
vessels where such liquids are mixed. (Ref 5).
9.1.2.4 Low-Pressure Storage Tanks
Low-pressure storage tanks are very susceptible to process mal-operation

as they are frequently operated intentionally in the closed outlet condition.
Such tanks should be fitted with a pressure/vacuum relief system which
can be expected to operate frequently unless the vessel is also provided
with a gas blanket control system. Their low design pressures (normally
less than 100 mbar g positive pressure and less than 10 mbar g negative
pressure) make them vulnerable to overpressure or underpressure by
more events than are other vessels.
Note:
The mal-operations listed as 9.1.2.1, 9.1.2.2 and 9.1.2.3 tend to occur
most frequently with low-pressure storage tanks; the risk is, however, not
limited to these and should be considered for any type of equipment
where the design pressure might be exceeded.
9.2.1 General Considerations
Some aberrations in the process can cause the total loss or partial
restriction of one or more outlet paths from equipment.
Consider the behavior of the process under normal and abnormal

operating conditions. Question whether blockages or other disturbances,
either total or partial, can upset the mass and energy balance within the
plant.

Side reactions which may be insignificant to the process yield can
sometimes produce small amounts of products that can cause blockages
(e.g. tars).
The presence of gas and liquid together can lead to choke flow velocities
much lower than the sonic velocity of the gas stream alone and so reduce
the effective outflow.
9.2.2 Causes of Blockage
Some examples are listed below:
(a) Freezing: to form a solid blockage or restriction is a danger in many

plants, particularly when an aqueous liquid is processed or steam
inerting of vessels or stacks is used.
(b) Solid Hydrates: are formed by certain process fluids, particularly

hydrocarbons, when contaminated with traces of water. These can
then collect in low points or low velocity areas and build up to form
a solid blockage.
(c) Degradation Accompanied by Polymerization: occurs with many

reactive chemicals with the formation of long-chain solid or jelly-like
polymers. This may occur when they are heated or contaminated or
simply stored for a long period. The addition of stabilizers may
prevent this but if there remains any risk of blockage it should be
considered.
(d) Iron Scale and other Corrosion Products: can also cause
blockages; opportunities for this to happen especially in carbon
steel lines of small diameter should be identified.
(e) Settling of Slurries/Suspensions: can cause blockages in low

velocity zones. Suspensions that are highly non-Newtonian can
become immobile as a result of a relatively small reduction in the
driving pressure.
(f) Sublimation: of many products which are stored hot can be a

problem because blockages may form where the vapor cools near
the exit of a tank or vessel.

(g) Entrainment: of liquid droplets is a frequent cause of blockages or
partial blockages. Entrainment is caused by high gas velocities,
especially where the gas stream impinges directly on to a liquid
surface. Coalescence and deposition is likely to occur in parts of
the system where the velocity is lower and may possibly give rise to
an hydraulic head. If the material can solidify in cooler zones
downstream it is likely to cause a blockage.
(h) Sparging of Gas: through a liquid in a vessel or evolution of gas

within it may cause the liquid to "swell", without disengagement of
the gas, enough for it to enter the gas/vapor off take line; this may
also lead to blockage or restriction of flow.
(i) Foaming: can also be a cause of entrainment and this possibility

should be examined in relation to any tendency of the liquid phase
to form a stable foam.
(k) Dust, Floss and Fine Solid Particles: are often carried over by gas
streams and may cause blockages downstream.
9.3 Pitfalls with Restricted Outlet Condition
(a) Positive displacement machinery is frequently provided by the

manufacturer with its own pressure relief protection against a
closed outlet. Check the capacity of the valve fitted against the
required relief rate taking account of:
(1) the increase in density of gas after compression;
(2) any significant difference between gas density under normal

operation and relief conditions.
(b) Pumping of liquid into a vessel expels gas/vapor. With inflow of

volatile liquids the outflow volume may be significantly more than
the incoming liquid volume due to saturation of the blanketing gas
with vapor. This is a normal operation for storage tanks and creates
a frequent demand on the relief system which should be designed
to discharge to a safe place.

(c) When pressure relief is provided on a system prone to blockages
caused by entrainment and solidification, the risk of blockage of the
relief system itself shall be considered and prevented.
(d) Flame arresters frequently have a tendency to get blocked. In many

countries the design requires statutory approval and some of these
approved designs are difficult to check for freedom from blockage
because of their mode of construction. Thus flame arresters fitted to
relief lines and vents can create more danger than they prevent.
Therefore, unless it is a mandatory requirement, arresters should
only be fitted after careful study of the risk of blockage. If it is
necessary to use a type which cannot be properly inspected,
ensure that an emergency relief path is provided in addition.
(e) Increased pressure drop may build up inside process equipment as

a consequence of liquid accumulation (e.g. by flooding of distillation
columns).
10 RESTRICTED INLET (CONDITION 3)
10.1 Equipment at Risk
In this case, the risk to be considered is the effect of system under

pressure or vacuum. Always examine the vessel design for the lowest
pressure that could be created. Large vessels are obviously more likely to
be unable to withstand reduced pressures since general mechanical
rigidity requirements usually provide ample strength with small vessels. If
the vessel would be damaged by the lowest pressure attainable, a
vacuum relief device will be required. In practice, low-pressure storage
tanks and many other vessels designed for positive pressures up to 5 bar
g. (but not specifically designed for vacuum) will usually require protection
against the effect of sub-atmospheric pressures. In many cases the event
likely to cause a vacuum situation is the reverse of that likely to cause
overpressure, i.e. outflow of mass or energy rather than inflow.

10.2 Events Leading to Underpressure (Vacuum)
The following events are usually the result of mal-operation:
(a) Removal of Liquid: by pumping out or gravity drainage.
Note:
Drainage of low-pressure tanks after hydrostatic test is a special
case of this situation; it is usually covered by special operating
procedures intended to eliminate the risk. However, the possibility
of mal-operation may need to be considered.
(b) Removal of Gas: by connection to a low-pressure system - e.g.

vacuum pump.
(c) Cold Liquid Injection: into any vessel containing hot vapors can
cause a very sudden and rapid condensation; this will lead to a
severe drop in pressure unless the volume of vapor is replaced. A
smaller but significant drop may be caused by gas cooling,
without condensation.
(d) Gradual Cooling: of any plant equipment items containing

condensable vapor for example during a plant shutdown, or the
loss of steam to a reboiler may cause a reduced pressure relief
situation as a result of condensation.
(e) Absorption, either Chemical or Physical: can remove gas from the
system and cause a fall in pressure possibly leading to a low-
pressure relief situation. This might occur as a result of process
aberration - e.g. unexpected reaction or emergency cooling of
some associated vessel.
Examples of this situation are:
(1) rapid pressure reduction due to absorption of vapor when

washing out a column filled with a water-soluble gas - e.g.
ammonia or amine vapor;
(2) slow pressure reduction following oxygen absorption by

rusting or oxidation processes in items out of service and
containing water.

(f) Ambient Temperature Fall: with consequent condensation of vapor
and/or contraction of gas causes an inbreathing requirement. For
further guidance on vacuum relief requirements refer to Part C,
Section 7 of this Guide. See also Section 5.
10.3 Pitfalls with Restricted Inlet
In systems where air ingress could result in formation of an explosive

mixture and there is a risk of ignition, the vacuum breaking medium
supplied to the relief system should be an inert gas. It may be preferable
to design the system to withstand full vacuum.
11 CHEMICAL REACTION (CONDITION 4)
11.1 Normal and Abnormal Chemical Process
Many chemical reactions have a potential for producing gas or vapor

especially when the temperature rises. Excessive pressure will be
generated in the system whenever the volume rate of the gas/vapor
evolution exceeds the (single or two-phase) volume outflow. In a blocked-
in system the pressure may rise simply because of an increase in vapor
pressure with temperature rise caused by any exothermic reaction or it
may be due to evolution of a gas during the normal process - i.e. no
chemical abnormality. The reactions involved may be either the main
process reaction or unwanted side reactions. Some circumstances in
which a need for pressure relief may arise are given below:
(a) Limitation of normal gas/vapor outflow from the system due to

BLOCKED-IN or RESTRICTED OUTLET CONDITIONS.
(b) Heat balance disturbed so that the temperature rises (e.g.

excessive heat input or decreased heat removal via heat
exchangers).
(c) Reaction rate greater than design rate as a result of other abnormal
conditions or materials.
(d) Initiation of side reactions which generate more gas or heat than
the normal process.
(e) Any combination of (a), (b), (c) and/or (d).


11.2 Runaway Reaction
A special case of 11.1 (b) is that of an exothermic reaction that

accelerates until it is out of control - the so called "runaway condition".
This situation can arise with many reaction mixtures where the rate
increases with temperature. Irrespective of the cause of an initial increase
in rate above normal, the reaction will accelerate if the corresponding heat
of reaction is not removed. Extremely high rates of vapor evolution may
then be achieved which demand very large relief system capacities
particularly when a large proportion of the mixture is volatile. Very large
relief capacities are also needed when a two-phase vapor-liquid mixture is
likely to enter the relief system as a result of rapid evolution of vapor. See
11.3 and Part C, Section 5 of this Guide.
Some processes that involve evaporative cooling of exothermic reactions

and are normally overall heat-absorbing processes may self-heat and
accelerate if outflow of vapor from the reactor is restricted.
There is a noteworthy potential for generation of overpressure in the case

of reactions involving materials (particularly polymers) having a tendency
to break down into smaller molecules when overheated. When the
breakdown products are volatile (as is often the case) there is bound to be
a large increase in pressure within any confined system.
Thus the CHEMICAL REACTION CONDITION should be examined in

relation to other CONDITIONS obtaining at the time. Abnormal reactions
can be initiated by numerous mal-operations and process aberrations
(See 11.3).
The assessment of potential for a chemical process to become self-

accelerating should always be based on relevant chemical information
obtained from internal records, published information or new
investigations; the information needed is primarily:
(a) Kinetic and thermodynamic data for the normal reaction.
(b) Possible mechanisms for reactions other than the normal ones and
also kinetic and thermodynamic data for these (either known from
experience or deducible from the chemistry).

When doubt exists, an experimental investigation will be necessary to
determine the effect of any abnormal conditions that can be envisaged.
11.3 Chemical Reaction in Relation to Prime Events
11.3.1 Fire
Overheating by fire may be local or general and cause gross chemical

abnormalities and degradation of materials. See Section 2.
11.3.2 Mal-operation
Many errors can lead to abnormal reaction in both continuous and batch
processes. For general guidance a few of these are given below:
(a) Cooling system: wrong setting of temperature controller or manual

valves on coolant circulation.
(b) Evaporative cooling: restriction of vapor outflow, reflux flow or

vacuum control as a result of a faulty controller or setting.
(c) Vapor/Gas outflow: restriction as in (b) when vapor or gas is

normally removed from the system as part of the process.
(d) Abnormal reactant, catalyst or solvent: wrong material or

concentration due to incorrect charging or rate of feeding of the
reactants. Question whether catalyst can be charged twice and
whether incompatible materials in use close by could be a source of
contamination.
(e) Abnormal or Irregular feed rates: many batch processes where

reactant(s) are added semi-continuously or stepwise are sensitive
to this fault - rapid overpressure generation may result from a surge
in reactant feed.
(f) Agitator or mixing reclrculator switched off: this fault is a common

cause of loss of cooling, abnormal local concentrations and
conditions, phase-separation or layering. See Section 4.

11.3.3 Process Aberration
Many process aberrations are possible and it is essential to identify those

EVENTS that can lead to overpressure. The effect of all feasible
irregularities on the chemical reaction should be examined. Some frequent
causes are given as examples:
(a) Inadequate agitation: an agitator design incapable of handling all

possible forms of the mixture that can be present throughout the
cycle (especially with highly viscous or highly non-Newtonian
material) can lead to the situations given in 11.3.2(f) and also
create an agitated inner core surrounded by static material. Large
concentration and temperature differences may accompany such a
condition. See 11.3.1.
(b) Abnormal concentration or activity: a gross abnormality in the

quality of the reactants, solvent, or catalyst can lead to exceptional
reaction rate or unintended chemical changes.
(c) Abnormal chemical behavior: a local hot spot or abnormal local

temperature can also initiate abnormal reactions, decomposition,
etc. Heating systems should be designed to avoid this possibility.
(d) Inflow of Incompatible reactant: an event that can happen in many

situations such as backflow from associated equipment - e.g.
irrigant from an off-gas scrubber after the scrubber outlet has
become blocked or restricted
(e) Temperature control system: the normal system may not be

capable of removing sufficient heat under some unusual conditions
- e.g. abnormal reactivity (as above) or as a result of fouling of
cooling surfaces.
11.3.4 Equipment Failures
These are covered in Section 4 but some are mentioned here

because so many equipment failures can affect chemical reactions
in such a way as to lead to overpressure. Such failures include:
(See Section 4, sub-clause 13.2)

(a) Metal exposure: in the case of a non-metallic protective lining,
contact with metal following breakdown of the lining material can
initiate abnormal chemical reactions and possibly very high rates.
(b) Control systems: loss of effective cooling is an obvious possibility

for initiating abnormal reactions as mentioned earlier. Many other
control failures can lead to abnormal chemical process behavior.
11.3.5 Service Failures
There are many circumstances when failure of a service can upset the
chemical process, some of which are quoted in Section 4. A service failure
may cause overpressure directly but it may also initiate abnormal chemical
changes or rates of reaction. Every such possibility should be considered
in relation to the sensitivity of the materials and process to changed
conditions. See Section 4, Clause 14.
11.4 Underpressure Relief
Underpressure can occur in many circumstances as a result of chemical

reaction in low-pressure equipment following mal-operation or plant
failures. It is only a problem when coincident with closed or restricted
inlets and for pressure relief purposes it is no different from physical
absorption; this problem was therefore covered earlier. See 10.2 (e).

SECTION 4:
EQUIPMENT AND SERVICES FAILURES
12 INTRODUCTION
Relief situations may result from a variety of failures outside the control of
the designers or operators. Such a failure may:
(a) Directly cause a relief situation (e.g. escape of high pressure fluid
from a burst heat exchanger tube into lower pressure equipment).
(b) Indirectly cause a relief situation (e.g. failure of temperature

controller or sticking of control valve allowing temperature to
increase).
(c) Start a chain of events leading to a relief situation (e.g. steam

supply failure allowing pipeline to cool thus causing solidification of
process materials and hence blockages).
Relief situations can be caused by failure (partial or total) of mechanical or

electrical equipment, instruments and any service supplied from outside
the plant. This Section is, for ease of reading, subdivided into equipment
failure and services failure. The designer should bear in mind that any
such fault may cause other prime events (e.g. overheating due to cooling
water failure can initiate many forms of process abnormality). See Table 1.
13 EQUIPMENT FAILURE
13.1 System Blocked-in or Restricted Outlet (Conditions 1 and 2)
The process equipment system may be normally blocked-in or restricted.

It may also be put into one of these conditions by the loss of one or more
exit paths as a result of mechanical failure (e.g. control valve failure). On
the other hand, a failure can cause a sudden increase in mass inflow
from a high pressure source which overloads normal outlets (e.g. burst
tube).

The possibility of overpressure resulting indirectly from any credible failure
of equipment should be examined even if the direct effect of the failure
would not be hazardous.
13.1.2 Failures Involving Interstream Leakage (Heat Exchangers and Similar

Items)
Equipment failure is particularly important in the case of heat exchangers.

Because the two sides of the common types of heat exchanger usually
operate at different pressures, the principal hazard is interstream leakage
into a low-pressure system. Any interstream leakage, especially a major
leakage following tube rupture, may overpressure both the low-pressure
side of the exchanger and any associated equipment.
The heat exchange surface may be contained in a vessel which has other
functions - such as a coil in a reactor; in that case the leakage will
commonly pass from coil to vessel contents but may well pass into the coil
from a vessel at higher pressure.
The source of high pressure fluid may be contained in either upstream or

downstream equipment.
Minor internal leaks can be important when equipment is blocked-in but

are much less likely to be so in the restricted outlet condition. When
assessing the need for pressure relief take account of factors such as :
(a) Whether a relief system is required for any other reason, the
additional effect of interstream leakage being small by comparison.
(b) Whether the size of the leakage path is likely to be so small (e.g.
pinholes) that the leakage can be neglected provided there is no
danger of secondary effects of fluid mixing.
(c) Whether leaks can give rise to more significant secondary effects,
e.g. abnormal chemical reaction, swelling or explosive boiling.
The mode of failure to expect depends upon the type of heat exchanger;
thus advice on the types of exchanger commonly used is given as follows.

13.1.2.1 Shell and Tube Exchangers
In shell and tube exchangers the most severe failure is tube rupture in
which case the tube is assumed to have broken apart exposing two open
ends. Experience indicates that a likely form of failure is a longitudinal split
and checks have shown the leakage area to be equivalent to two open
ends. It is important to decide whether such failure is credible and whether
the relief system should be designed accordingly.
When making this decision the relief systems designer should consider:
(a) Whether the occurrence of a tube rupture while in either the

blocked-in or restricted outlet condition requires the coincident
failure of two independent items. If so, it may be possible to
discount the event as a sufficiently unlikely combination of
circumstances.
(b) Whether the standard of mechanical design, after allowing for any
corrosion and erosion that are to be expected, is such that there is
a negligible probability of rupture.
(c) Whether under the most unfavorable conditions the normal process
outlets are sufficient to relieve the effect produced by the maximum
possible inflow of energy or fluid.
(d) Whether tube rupture may be ignored on the basis that it would not
cause the low-pressure side to be stressed to a greater extent than
it was during its pressure test, making due allowance for the actual
shell temperature perhaps being very significantly different from the
test temperature. Any decision to avoid the need for a relief system
on the basis of test pressure rather than design pressure shall be
made only with the full agreement of the vessel/equipment design
engineers. See Part C, Section 2 of this Guide.
Note 1:
The "API 2/3 rule" is based on this philosophy (see API RP 521,
1979 para 3. 16.A). Assuming that the hydrostatic test pressure
was 150% of design pressure, this rule states that "the necessity for
a pressure relief device need not be investigated whenever the
design pressure for the low-pressure side is equal to or greater
than 2/3 of the operating pressure of the high pressure side ",

However, it makes no allowance for operating temperature being
different from test temperature or the pressure (H. P, side) at the
time of failure being greater than the normal operating pressure.
Only when the temperature conditions are acceptable and the
vessel has been designed to a code that calls for the appropriate
test pressure can this rule be applied,
Note 2:
In the blocked-in condition any overpressure resulting from tube
rupture will affect only the process equipment system defined. This
may not be so should the event occur in a closed or restricted outlet
condition.
Note 3:
For position of rupture to assume refer to the relevant calculations
section. See Part C, Section 2 of this Guide.
13.1.2.2 Coils in Vessels
Heating and cooling coils can fail in much the same way as tubes in a
shell and tube exchanger and the consequences of failure should be
assessed in a similar manner.
It is more likely (in this case) that account will have to be taken of small
leaks (e.g. pinholes caused by corrosion) because of the danger of
secondary effects (particularly chemical).
13.1.2.3 Plate Exchangers
Plate exchangers may suffer from gasket failure or from pitting of the
plates by corrosion causing interstream leakage. However, the design
pressure of both sides of the exchanger is the same and one or both sides
may be provided with a relief system for other reasons. Relief to protect
specifically against interstream leakage is therefore not generally
necessary unless mixing of the two fluids would cause a rise in pressure
requiring relief at a rate more than the capacity of any other relief system.
Leakage to atmosphere is a much more likely fault than interstream

leakage.

13.1.2.4 Spiral Plate Exchangers
These exchangers can fail at the longitudinal rim weld between the two
spirally wound plates. Also, the supporting spacer studs between the
plates can fail by fatigue and cause leakage.
For structural reasons the design pressure of both sides is usually the
same though there may be a significant pressure difference at the moment
of failure. (See 13.1.2.2 with respect to pin-holing).
13.1.2.5 Plate Fin Exchangers
Like other plate type exchangers especially spiral plate types, finned
exchangers are likely to suffer only minor interstream leakage. Therefore
only nominal relief is needed, provided that:
(a) The duty is clean and the contents are known to be non-corrosive
(also check for any risk of exposure to corrosive materials during
occasional wash-out or warm-up operations).
(b) Each side is separately leak tested after manufacture and shown to
be completely leak-tight.
13.1.2.6 Double Pipe Exchangers
The inner pipe of such exchangers is frequently made from pipe of the
same schedule as specified for the process equipment system of which
the exchanger forms a part. In that case the inner pipe is no more likely to
rupture than any other pipe in the system. Thus, tube rupture need not
normally be considered. The possibility of a small amount of interstream
leakage due to pin-holing at welds etc. should be considered, especially
when there are welds on the inner pipe and, when the outer pipe can be
"blocked-in", the situation may call for a relief device if there are no other
reasons for providing one.
It may be inadmissible to discount tube rupture if a significant amount of

corrosion can be expected on either side of the pipe wall. However, as
with shell and tube exchangers, if the pressure differential is such that
interstream leakage would not seriously overstress the low-pressure side
(see 13.1.2.1) then tube rupture need not be considered.

The possibility of collapse of the inner tube may have to be examined in
extreme cases of high pressure in the jacket.
13.1.2.7 Lamella heat exchangers (Alfa-Laval)
These exchangers are seldom used and each situation calls for special
study. The lamella tubes are seam welded along their entire length and
welded to the headers. Weld failure is the most likely form of defect. They
should be treated like other plate exchangers noting that minor leakage
along the seam weld is the most likely defect and will give rise to
interstream leakage.
13.1.3 Fired Heaters
In a fired heater, overpressure can occur in either the heater tubes or the
firebox. The problems are quite different and should be considered
separately.
13.1.3.1 Overpressure of the Heater Tubes
There are three potential causes of tube failure:
(a) Overpressure at or below design temperature: This problem can be

caused either by material trapped in the heater tubes and exerting
a high vapor pressure or by fluid entering the heater tubes from a
high pressure source. Pressure relief should normally be provided
by means of a relief valve which should be located on the heater
exit to ensure that when the device opens, flow through the tubes is
maintained.
It is vital that the relief device is not located at the heater inlet
where it would divert flow from the heater tubes though maintaining
a flow through the low flow trip sensor - thereby maintaining
unwanted firing of the furnace.
(b) Overheating: Moderate overheating over a long period can cause

tube rupture as a result of creep failure. Gross overheating for a
short period of time may lead to rapid failure.

The major causes of overheating are:
(1) Loss of process flow through the tube.
(2) Flame impingement on the tube.
(3) Coke formation on the tube.
(4) Incorrect assessment of heat flux or operating temperature.
Note:
Low flow trips to shut off fuel to the heaters together with various
combinations of tube skin thermocouples and other high
temperature alarms are fitted to all fired heaters. Nevertheless, any
possibility of failure should be considered. Visual inspection of the
firebox is used to detect flame impingement on tubes.
(c) Corrosion, erosion and mechanical damage: Consideration should

be given to the possibility of enhanced rates of corrosion on
surfaces exposed to local high temperatures (usually due to high
heat transfer rates) and also to the effect of two-phase flow on
erosion. Pipe supports should not rub on the tubes so as to cause
mechanical damage.
13.1.3.2 Overpressure of the Firebox/Combustion Chamber
There are three main causes of over pressuring the firebox/combustion

chamber:
(a) High discharge pressure from an air fan (often at start up air
condition).
(b) Burst tube (as discussed in 13.1.3.1 often followed by ignition of the
leaking hydrocarbon (or other fluid).
(c) Explosion due to excess fuel or low air flow to the firebox. This
condition is usually protected against when the fired heater is on
line, but may occur at start up or by residual heat/thermal inertia
after a trip. See Part C, Section 3 of this Guide.

Elimination of (b) and (c) often requires a more detailed Hazard and
Operability Study to ensure that the trip systems and operation sequences
give adequate protection. This is needed because explosion doors and
weak floors (furnace bases) cannot be relied upon to ensure the safety of
people working near fired heaters.
13.1.4 Control System Failures
The failure of controllers and of control (instrument) valves should be

considered individually while recognizing the chance of more than one
simultaneous failure.
13.1.4.1 Controller Failure
Heated vessels and pipelines are usually temperature controlled and the
controller may fail to limit the heat input while the system is blocked-in.
This could be due to a design error such as poor positioning of the
sensing element or to a temporary fault such as a switching failure. In
such cases the maximum energy input should be taken into account. To
identify any failure that could lead to a relief situation, every possible
controller failure should be considered.
13.1.4.2 Control Valve Failure
A mechanical fault can cause a control valve to fail either open or shut
irrespective of the direction of its response to a motive power failure.
Normal control loop action cannot be assumed since the controller could
be on manual control or in some cases on bypass. A few examples of the
more common faults are:
(a) A control valve in the outlet from a vessel fails shut while the inlet is
open to a source of pressure higher than the vessel design
pressure. Mass inflow continues and pressure increases possibly to
the extent of causing a relief situation.
(b) A control valve on a cooling system fails shut so that the process
system overheats with consequent overpressure.

(c) A control valve, linking a high pressure source to a low-pressure
system, fails open. In a restricted outlet situation, the available
outlet(s) become overloaded and the pressure on the low-pressure
side rises.
(d) A control valve or trip valve fails shut against a long or fast flowing
liquid column. If the closure is rapid, surge pressures (water
hammer) may be sufficient to rupture vessels and lines unless
relieved; See Part C, Section 9 of this Guide.
(e) A similar fail shut valve closure at the inlet to a liquid column can
cause cavitation and underpressure surges. The effect is the same
as the sudden stoppage of a pump. See 13.2.4 and Part C, Section
9 of this Guide.
13.1.4.3 Common mode failures
It is particularly important to identify every possibility of the so called

"common mode effect" which occurs when a single fault or event can
initiate two or more potential relief situations simultaneously. These
situations are often associated with control system faults. Hence, all
potential control system faults should be studied with the possibility of
common mode effects in mind. It is not normally necessary to consider
more than one coincidental control failure unless the failures can be
directly related.
The loss of instrument air as a result of which several control valves open
fully, thereby causing several simultaneous flows into a vessel, is a simple
example. Simple common mode effects like this are easily recognized and
should be "designed out" or allowed for in the relief system design.
It may be less easy to recognize others. For instance, duplicated trip
valves or non-return valves are often installed when higher reliability is
sought but remember that all valves could fail simultaneously if solids
deposition occurred in the line. Similarly, separate impulse lines can be
provided for separate flow or level instruments but if all lines can be
blocked simultaneously by carry-over or build-up of some contaminant,
then the expected increase in reliability will not be achieved.

13.1.4.4 Group Failures
The possibilities of failure of a group of control systems should be

considered. Local motive power failure might close several outlets or inlets
or both; site power failure would affect all control valves. One or more of
these control errors may cause over pressuring of the process equipment
system and the relief system will have to be designed for the total effect of
all the related events.
13.1.5 Machines (and Ejectors)
The sudden stopping of a pump or similar equipment can have the same
or similar effect to that of wholly or partially closing an inlet or exit valve.
Hence, the possible creation of surge pressures should be examined. See
Part C, Section 9 of this Guide.
Note:
The isolating effect of certain positive displacement machines will
influence the proper division of the plant into process equipment systems.
See Clause 3.
Some of the factors to consider with respect to machine failures are as

follows.
13.1.5.1 Centrifugal Pumps/Compressors
Because very large pressure differences may exist across a centrifugal

pump or multi-stage compressor, there are a number of aspects, stated
below, which need to be considered to ensure that no part of the system is
over pressured.
(a) In a multi-stage compressor, the design pressure rating for each

stage is different and the points where the design pressure
changes need to be clearly defined. See Part C, Section 4 of this
Guide.
(b) The maximum power input of the drive shall be specified whether it
is limited by a control on speed, electrical power input, steam flow
rate to a turbine or by any other mechanism.

(c) The full spectrum of operating conditions should be considered
against the design specification. These include unsteady conditions
at start up and the occurrence of a flow of abnormal fluid into the
suction side of the machine. All the implications of different
pressures and flow rates occurring in the machine should be
considered.
(d) In a multi-stage machine the effect of a relief valve lifting could

cause significant changes in the flow pattern within the machine
which can result in flow and pressure surges capable of damaging
it.
(e) Any recycle line from the high pressure to the low-pressure side of
a machine to prevent the compressor surging (known as a
"kickback line") and also minimum flow kickback lines on pumps
have to be sited correctly in relation to the non-return valve(s)
on the delivery side of the machine to prevent overpressure of the
low-pressure side of the machine.
(f) To prevent mechanical damage, many high level trips may be

required to limit such conditions as:
(1) temperature on process side and of the lube oil;

(2) level in liquid knock-out pots;
(3) discharge temperature;
(4) power input to the drive;
(5) machine speed;
(6) pressure surge.
Any of these limits may affect the sizing and design of the relief
system.
(g) Potential leaks within the machine, shaft seal failures and internal
leaks to lower pressure sections of the machine (including the lube
oil systems) need to be considered in detail. The identification and
quantification of this cause of overpressure should usually be
based on the machine manufacturer's experience. However, they
cannot be entirely relied upon and their advice should be taken
together with an independent assessment.

13.1.5.2 Positive Displacement Pumps and Compressors
These machines effectively place a complete blockage in the line

whenever the drive fails - thereby creating a blocked-in condition.
13.1.5.3 Ejectors or Mechanical Vacuum Pumps
When failing to maintain vacuum they should be regarded as a closed exit.
13.1.5.4 Cooling Fans on Air-cooled Heat Exchangers
Removal of heat can cease as a result of mechanical failure. On air-

coolers where independent operation of the louvers can be maintained,
credit can be taken for the cooling effect obtained by natural convection to
still air at ambient conditions. The performance data of the heat exchanger
under these conditions should be obtained from the manufacturer. On a
still or any system dependent on condensation to maintain control of the
pressure, loss of condensation capacity should be treated as either a
closed outlet or restricted outlet condition.
13.2 Restricted Inlet (Condition 3)
Reduced pressure may normally occur or be generated in some parts of

the plant due to condensation, gravity draining or operation of the vacuum
system.
Equipment which is not designed for vacuum or capable of withstanding it

should be protected against accidental connection to a low-pressure zone
or any other cause of internal reduction of the pressure. Equipment may
sometimes be exposed to pressures below minimum design values
as a result of mechanical equipment failure. See 13.1.5.
13.2.2 Failures Involving Interstream Leakage
Failures of this type have been covered in 13.1.2 except that there the
hazard was overpressure.

In certain cases such failures can lead to an underpressure relief situation
where the leak is to a low-pressure zone and the equipment system is not
designed for reduced pressure.
13.2.3 Control System Failures
Unintended closure of inlets while discharging liquid can reduce the

system pressure to a value well below atmospheric. (It may reach the
vapor pressure of the liquid discharged and result in flash boiling with the
risk of entrainment that can cause blockage of lines). See Section 3.
The failure of a control system to open nitrogen valves which maintain

blankets on low-pressure vessels is a common cause of the need for
vacuum relief on storage vessels.
13.2.4 Machines
The momentum of a moving column of liquid can be such that when a

pump is stopped suddenly it can cause reduced pressures and possibly
cavitation on its downstream side and when the pumped liquid has a low
enough vapor pressure the effect of full vacuum in the pipe and
downstream equipment should be considered. This is usually unimportant
except for some piping materials such as GRP or concrete which are
much less resistant to vacuum than conventional steel pipe. See Part C,
Section 9 of this Guide.
13.3 Chemical Reaction (Condition 4)
A number of mechanical equipment failures can cause a process involving

chemical reactions to behave abnormally and some of the more common
ones are given below.
All possible ways by which a chemical process could be affected by an

equipment failure should be examined - especially for those processes
involving exothermic chemical reactions which might go out of control
(See 11.3).

13.3.2 Failures Causing Abnormal Chemical Behavior
13.3.2.1 Agitators
Stoppage of an agitator can result in poor heat transfer and lead to an

imbalance between heat generation and removal. Agitator failure can also
be dangerous if it leads to phase separation of reactants. Local
concentrations of unreacted material then become abnormally high.
Subsequent mixing of the two layers, either due to natural convection,
interface boiling or especially restarting of the agitator, may initiate a
sudden increase in reaction rate and heat generation. The increased
heat output may well be in excess of the capacity of the heat removal
system and lead to a relief situation.
Many semi-batch processes are operated by the addition of one reactant

to another in an agitated vessel, the addition rate being determined either
by the heat removal or the off-gas venting capacity. Under normal well
agitated conditions no appreciable accumulation of the added reactant
occurs. However, under conditions of poor agitation or no agitation (or
inhibition of the reaction by any cause) a potentially dangerous
accumulation of unreacted material can be built up. Restarting
the agitator or other disturbance may initiate an excessive reaction rate.
13.3.2.2 Control Systems
Faults can cause over/under-charging of reactants to batch reactors giving

abnormal reactant concentrations, with the possibility of initiating an
abnormal or a runaway reaction. Similarly, in continuous or semi-
continuous reactors the same effect may be produced by feed rate
variations resulting from defects in the feed control loops.
13.3.2.3 Machines
Failure of a subsidiary system, such as cooling water, can also lead to

loss of coolant and consequent failure to maintain the reaction
temperature and subsequently other conditions.

13.4 Pitfalls with Equipment Failure
13.4.1 Tube Rupture
Before deciding that relief protection is unnecessary not only the

exchanger design pressure itself but also that of associated equipment
(pipelines, instruments, condensate traps, etc.) should be
compared with the maximum pressure achievable.
13.4.2 Leaks in Heat Exchangers
Phase change or multi-phase effects with sudden pressure surges can

arise, especially in liquid-filled exchangers. It may be necessary to
increase the design pressure of the vessel(s) so that it (they) can
withstand the surge pressure rather than to provide a relief system. A
particular example of this is the leakage of water into hot oil, which can
result in a pressure surge in excess of the design pressure of either shell
or tube.
13.4.3 Slip Plates
Ensure that their positions do not create subsystems (which would require
separate relief), for example, by being placed too far from pipe
specification breaks - particularly important when the pressure rating
changes.
13.4.4 Plant Maintenance
Hazardous situations can occur following maintenance work on the plant.

Some of these can lead to unforeseen pressure build-up or prevent the
operation of a pressure relief system unless additional safeguards are
provided. Examples are:
(a) Slip plates in wrong position.
(b) Lockable valves in wrong mode.
(c) Accidental blockage by trash.

Such risks should be considered and every attempt made to eliminate
them by appropriate design or procedural arrangements.
14 SERVICES FAILURE
Any service supplying energy or materials can fail at any time and may,
directly or indirectly, cause overpressure. For example, power or air failure
to a pressure controller would directly affect the pressure while a
temperature rise following a coolant service failure may ultimately cause
overpressure through an increase in vapor pressure. It is necessary to
consider the effect of failure of each service in turn and any coincidental
failure that can occur for all possible CONDITIONS in order to identify any
combination of events that could lead to a relief situation.
The following sub clauses give advice about the possible effect of failure
of the principal and some secondary services (See 1.2).
14.2 Principal Services
14.2.1 Cooling Water
Failure of cooling water over the whole plant can result from a pump or
drive failure or blockage. It can occur on sections of plant or individual
items, as a result of local isolation / blockage.
Increased temperature is likely to result from cooling water failure and

directly cause an increase in the vapor/gas pressure; an increase in
reaction rate and/or initiation of abnormal chemical reactions may also
ensue. Loss of condensation capacity may give rise to overpressure since
excessive vapor flows have a similar effect to that of restricted outlets.
14.2.2 Electrical Power
Power failure may be either total, in which all items of electrically operated
equipment are simultaneously affected, or local, where one item of
equipment or a group of items is affected.

14.2.2.1 Local Power Failure
The resultant effects should be evaluated with respect to the function of

individual items of equipment, such as pumps, fans or solenoid valves.
Some general comments, however, can be made:
(a) No credit should be taken for voltage dip protection (VDP) on

electric drives as power failure should be assumed to be prolonged
(but see (b) below).
(b) In the event of marginal voltage dip some, but not all, electric drives
may cut out. This can give rise to more serious relief problems than
total power failure; for example, such possibilities as:
(1) the voltage dip being sufficient to bring stand by pumps into
operation but not sufficiently long to trip out running pumps,
has the effect of substantially increasing flows;
(2) coincident relief from various sources being sufficient to

cause overloading of relief headers.
Note:
When sizing a combined relief header for several relief systems, hazard
analysis will show the extent to which credit may be taken for voltage dip
protection facilities.
Such combinations, once recognized, are usually better eliminated by

appropriate electrical design.
(c) Cooling fans and air·cooled heat exchangers stop on power failure
has the same effect as mechanical failure. See 13.1.5.4.
(d) Steam driven spare pumps should not be considered as

substitutes, unless they are arranged to idle on-line and start to
pump automatically on power failure. For cooling water duties, if the
capacity of steam driven pumps is less than the normal rate, the
effects of the reduced cooling water flow should be evaluated.

14.2.2.2 General Power Failure
Additional effects that have to be considered are the failure of other

services relying upon power for pumps, compressors, control functions,
etc. particularly:
(a) Cooling water.
(b) Instrument air.
(c) Heat transfer fluid.
(d) Hydraulic oil.
(e) Refrigerant.
(f) Water services if pumped locally.
Total power failure requires additional analysis of the combined effects of

the multiple failures that result. Detailed considerations should be given to
the effect of the simultaneous opening of several relief valves protecting
different systems, particularly when more than one relief valve discharges
into a common header system.
14.2.2.3 Restoration of Power
Relief situations may arise when power supply returns and likely causes
are the restarting of agitators and pump drives. Some factors to consider
are:
(a) Rapid mixing of liquid layers or solid liquid systems where abnormal
concentrations have built up during stoppage of agitator; See
13.3.2.
(b) Resumption of feed into vessel from which outflow has become
restricted or closed during power failure.
(c) Resumption of outflow from a low-pressure (weak) vessel to which

inflow has become restricted.

(d) Reheating of trace·heated lines which have become blocked by
solidification and also of electrically heated vessels whose outlets
have been blocked.
Note:
Electrically powered drives mayor may not restart on restoration of power
depending upon whether the contactor is:
(1) Voltage sensitive without voltage dip protection (VDP).
(2) Voltage sensitive with VDP.
(3) Mechanical.
If the uncontrolled restart of a drive could give rise to a relief situation it

may be better to ensure that power to the drive will not be restored
automatically than to provide a relief system.
14.2.3 Instrument Air
Failure of air supply may apply to either the plant as a whole or areas
supplied by a common instrument air header. It should be assumed that
all control valves will fail open, closed or stay put as indicated on the
engineering line diagram.
14.2.4 Steam: HP, IP, LP
A prolonged failure may lead to solidification in lines which will result in

blocked-in, restricted outlet or restricted inlet conditions after the supply is
restored. Short failures of the energy supply are unlikely to cause relief
situations but the restoration of supply following a short term failure can be
hazardous. For instance, in a distillation column, when boiling ceases the
contents "dump" into the re-boiler which then contains a more volatile
mixture. On reheating, boiling starts at an abnormally high rate with
transient over pressuring that may call for relief protection.
Service steam may be generated in some part of the plant by removing

heat in a secondary process loop.

The failure of such a steam system to operate may cause a relief situation:
(a) In that part of the plant where heat is no longer being removed.
(b) In another part of the plant as a result of loss of service steam (see
above). Where steam systems at different pressures and levels of
superheat are interconnected, failure in one system may affect
another system.
14.2.5 Fuel Gas and Fuel Oil
Prolonged and short term failures of fuel supply and the effects of
restoration of supply (as for steam failures) should be considered. The
main problems are likely to arise with direct fired heaters and re-boilers.
14.3 Secondary Services
14.3.1 Heat Transfer Fluids (hot oil, "Thermex", hot water)
These services should be treated in the same way as steam and fuel
failures noting that any such failure may simply follow from power failure.
14.3.2 Hydraulic Oil
Some hydraulic equipment units (e.g. loading arms) are supplied complete
with independent hydraulic control systems, consisting of accumulator, oil
pump, reservoirs and control valves. The effect of failure of this hydraulic
supply should be treated in a similar way to a partial failure of instrument
air.
14.3.3 Inert Gas and Nitrogen
Examples of situations when failure of inert gas or nitrogen supply may

lead to a relief situation are as follows:
(a) When nitrogen is used as the motive power for pneumatic control
valves - failure can be treated in the same way as a local
instrument air failure.

(b) When the inert gas supply to blanketed low-pressure storage tanks
fails while inbreathing - vacuum relief will be needed.
Note:
PROTECTION AGAINST EXPLOSIONS DUE TO IGNITION OF
FLAMMABLE GAS MIXTURES IS NOT COVERED BY THIS GUIDE.
14.3.4 Refrigerant
Refrigerant systems fall mainly into two types:
(a) Those where refrigerant fluid is supplied as a service from either a

dedicated refrigeration unit or a central system; the system may
circulate coolant directly or via a secondary loop (e.g. brine).
(b) Those where a refrigeration or refrigeration-heating loop is

integrated into the process.
Case (a):- Partial or total loss may result from some other service or
equipment failures such as:
Electrical power or machine (drive).

Steam drive.
Cooling water or air cooling fan.
The effects can generally be treated in the same way as loss of

cooling water bearing in mind that heat may be rapidly absorbed
into the process from the atmosphere.
Loss of brine circulation should be treated in the same way as

cooling water.
Note:
Despite the relatively large inventory in the pool vaporizers of many
refrigerator heat exchangers the response to compressor failure is
fast because pressure on the fridge side builds up rapidly thereby
inhibiting vaporization. Hence no credit should be taken for cooling
by the residual refrigerant in the pool.

Case (b):-Failure may result from any process abnormality which
leads to loss of heat removal from the refrigerant stream. The effect
on the system being refrigerated may again be treated in a similar
way to that of loss of cooling water. In case (b) it is also important
to look for problems resulting from the failure of the refrigerator
coolant circulation to supply heat to another part of the system. (For
instance blockages could be caused by
solidification) .
14.3.5 Water (other than cooling water)

(process, demineralized boiler feed)
(a) When used for once-through cooling or directly for condensing (for
instance in a barometric condenser) the loss of process water can
cause a relief situation the same way as the loss of cooling water
service to an indirect condenser or cooler.
(b) Water is fed to some processes as a diluent to control the process

(e.g. certain polymerization processes). If the water supply fails so
that the mixture is not diluted sufficiently, the temperature and
pressure may rise excessively and in extreme cases a runaway
reaction may ensue.
(c) The loss of demineralized boiler feed water can cause increased
temperatures downstream of a desuperheater when the incoming
water is used as a coolant. Such a possibility should be considered.
14.4 Pitfalls with Service Failures
14.4.1 Temperature Control
Any service failure which causes increased temperature affects not only
the equipment directly involved but also downstream and possibly
upstream equipment. Any effect on the relief system itself should be
considered.

14.4.2 Secondary Effects
Increased temperature can also cause secondary effects that can impair
the functioning of the relief system itself. For instance, any possibility of
corrosive fumes or vapors entering the system and causing deposition of
solids shall be examined.
SECTION 5:
AMBIENT CHANGES
15 INTRODUCTION
Pressure changes in plant equipment systems can result from changes in

atmospheric conditions or the local plant environment. For the majority of
items, the variation in ambient temperature and pressure is insignificant in
comparison with the possible changes due to process conditions. There
are, however, exceptions, such as atmospheric temperature and pressure
storage tanks, low temperature atmospheric pressure storage tanks,
sealed low pressure containers (e.g. some IBC) and hydraulically filled
systems such as pipelines, which are vulnerable to minor environmental
changes.
16 ENVIRONMENTAL CHANGES
16.1 Atmospheric Conditions
Any credible effect of the following factors on the process equipment

system or materials contained therein should be examined:
(a) Barometric pressure changes.
(b) Temperature changes in the surrounding atmosphere.
(c) Direct heat input by solar radiation.
(d) Factors affecting heat transfer - rain, hail, snow, wind speed and
direction, humidity.

16.2 Plant Environment
Consideration should be given to heat input (or loss) that may be derived
from associated equipment.
(a) Trace heating (steam, electrical, etc.).
(b) Radiation or conduction of heat from nearby furnaces or heated

equipment or to refrigerated equipment.
17 EXPANSION/CONTRACTION OF VAPOR INVENTORY
17.1 Low-Pressure Storage Tanks
The change in ambient temperature and pressure between day and night
causes an expansion and contraction of the vapor (and liquid) in storage
tanks and sealed containers. As the design pressures of storage tanks are
very low (usually less than 100 mbar g) each expansion of the vapor might
overpressure the tank and so lead to a relief situation. Conversely, the
contraction of vapor may make vacuum relief necessary. See Part C,
In the case of tanks blanketed by inert gas, inbreathing and out breathing
is controlled by the blanketing system control. However, pressure/vacuum
relief shall be provided in case of failure of the blanketing system. See
Sections 3 and 4.
17.2 Low Temperature Atmospheric Pressure Storages and Equipment
17.2.1 Pressure Changes
Low temperature atmospheric pressure storage systems are closed

systems in which vapor is continually removed, compressed, liquefied and
recycled. The pressure is controlled at a small fixed differential above
atmospheric. Hence such systems are sensitive to changes in barometric
pressure. A drop in barometric pressure will initiate an action by the
compressor to extract and liquefy more vapor, thereby reducing the liquid
temperature and hence its associated vapor pressure.

If the compressor/condenser capacity is insufficient to cope with the
additional demand, then the differential pressure between the tank and the
atmosphere will exceed that permitted and pressure
relief will be necessary.
For an increase in barometric pressure, the compressor flow will be

reduced or stopped and the tank contents will begin to warm up. If,
however, the barometric change is rapid, there may be a need for relief
flow into the tank (i.e. vacuum relief) because the vapor pressure in the
tank will increase more slowly.
Consult local meteorological data for rate and range of pressure variation.
17.2.2 Temperature Changes
Because of the high efficiency of insulation used on this type of storage,

atmospheric temperature changes are never sufficiently rapid to cause
either an overpressure or underpressure relief situation.
Note 1:
If the compressor fails or is inadequate, pressure relief will be necessary
as the tank warms up.
Note 2:
In cases where liquid at a higher (or lower) temperature is fed into a tank,
significant changes in the tank temperature may well be caused that could
create a need for pressure relief.
17.3 Sealed Containers (IBC)
In the case of a sealed IBC containing liquid, a rise in ambient

temperature causes expansion of the liquid thereby reducing the gas
space and increasing the pressure rise that occurs as the gas tries to
expand. Filling of containers that will be sealed, and not equipped with a
relief stream, shall be controlled to allow sufficient usage for these
compression/expansion effects not to cause the pressure in the container
to exceed design pressure.

18 HYDRAULIC EXPANSION - PIPELINES AND VESSELS
Various process abnormalities, equipment and service failures can lead to

process equipment systems becoming blocked-in. If the system is full of
liquid at or below ambient temperature, there can be a risk of over
pressure as a result of hydraulic expansion as the liquid warms up to
ambient temperature, or if an increase in ambient temperature occurs.
Ambient temperature rises as high as 40-50° Cover 12 hours can occur in
some locations. This can be a particular problem with liquefied gas
pipelines and cryogenic systems. All causes whereby any liquid-filled
system of pipes and vessels can become isolated shall be identified. In
some cases it may be possible to set up administrative procedures in
order to prevent the situation arising. See Sections 3 and 4 and Part C,
For pipelines outside the plant fence, it may be necessary to fit a relief
device to protect against unacceptable overpressure from this cause. For
systems inside the plant fence, it can often be assumed that the
expansion will cause leaks (e.g. at flanges, valve spindles, shaft seals)
that will prevent excessive pressure developing. However, it is not
permissible to leak highly toxic nor more than a small amount of
flammable materials; neither is leakage acceptable if damage to the
seal would be caused. Mostly, the question of whether or not a relief
device is needed can be answered by straightforward judgment, but
sometimes careful consideration of many factors, together with calculation
of the expansion volume, pressure etc. is necessary to reach a decision.
A full treatment is given in Part C, Section 8 of this Guide.


Pressure Relief Systems Vol 2

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Pressure Relief Systems Vol 2

Uploaded by

Copyright:

Available Formats

GBH Enterprises, Ltd.

Process Safety Guide:

Pressure Relief Systems

Process Information Disclaimer

Information contained in this publication or as otherwise supplied to Users is

Web Site: www.GBHEnterprises.com

VOL. I BACKGROUND TO RELIEF SYSTEM DESIGN

VOL. II CAUSES OF RELIEF SITUATIONS

VOL. III CALCULATION OF REQUIRED RELIEF RATE

VOL. IV SELECTION, SIZING, AND INSTALLATION OF PRESSURE

VOL. V DISCHARGE AND DISPOSAL SYSTEM DESIGN

VOL. VI REFERENCE SECTIONS

DOCUMENTS REFERRED TO IN THIS PROCESS GUIDE

It is emphasized that this document is only a Guide, describing good practice at

"Shall" is a strong recommendation of GBHE based upon experience or upon the

"Should" is a recommendation based upon the judgment of experienced people

Web Site: www.GBHEnterprises.com

SECTION 1: IDENTIFICATION OF EVENTS LEADING TO OVERPRESSURE /

1.1 General Statement

2.1 Potential Causes of System Overpressure

3 DEFINITION OF A PROCESS EQUIPMENT SYSTEM (PES)

SECTION 2 : EXTERNAL FIRE

5.1 Nature of Material Inside Equipment

6 PITFALLS WITH FIRE

Web Site: www.GBHEnterprises.com

8 SYSTEM BLOCKED-IN (CONDITION 1)

8.1 General Considerations

9 RESTRICTED OUTLET (CONDITION 2)

10 RESTRICTED INLET (CONDITION 3)

10.1 Equipment at Risk

11 CHEMICAL REACTION (CONDITION 4)

11.1 Normal and Abnormal Chemical Process

SECTION 4: EQUIPMENT AND SERVICES FAILURES

Web Site: www.GBHEnterprises.com

13.1 System Blocked-in or Restricted Outlet (Conditions 1 and 2)

14.1 General Considerations

SECTION 5 : AMBIENT CHANGES

16.1 Atmospheric Conditions

17 EXPANSION/CONTRACTION OF VAPOR INVENTORY

17.1 Low-Pressure Storage Tanks

18 HYDRAULIC EXPANSION - PIPELINES AND VESSELS

Web Site: www.GBHEnterprises.com

1 IDENTIFICATION OF EVENTS LEADING TO OVER / UNDERPRESSURE

Web Site: www.GBHEnterprises.com

1.1 General Statement

This Part B is a guide to the qualitative identification of common causes of

To create a relief situation, there must be an energy source. Pressure

(a) T he normal mass balance is disturbed;

An example of each of these situations is given below:

Web Site: www.GBHEnterprises.com

(2) Reaction goes out of control (runaway) leading to energy release

ALL USERS ARE STRONGLY RECOMMENDED TO READ THIS

1.2 Hazard and Operability Studies and Hazard Analysis

It is essential that engineers and/or teams responsible for pressure relief

Quantitative Hazard Analysis can be used to assist in deciding for what

In high risk situations, Hazard Analysis may be essential to determine the

Web Site: www.GBHEnterprises.com

2.1 Potential Causes of System Overpressure

2.1.1 Principles and Terminology

When reading this Section, refer to Table 1.

(a) A fault or defect (e.g. control system failure).

(b) Normal process mass and heat flows.

(c) Changes in ambient conditions.

(d) External fire.