Manuale Sicurezza - 1000-MU-2005 - E - 0

Project N° Unit Document Code Serial N° Rev.
Page
1000 MU 2005 0 2/48
The present document or drawing is property of TECHNIP ITALY S.p.A. and shall not, under any circumstances, be totally or partially, directly or indirectly, transferred, reproduced, copied, disclosed or used, without its prior written consent, for any purpose and in any way other than that for which it is
INDEX
Page
1. SCOPE 4
2. FIELDS OF APPLICATION 4
3. CORRELATED DOCUMENTS 6
4. DEFINITIONS 7
4.1. General note 7
5. ACRONYMS 7
6. DETERMINATION OF EMERGENCY SCENARIO LEADING TO OVERPRESSURE 8
6.1. Blocked Outlet 9
6.2. Cooling Water Failure or Coolant Failure 11
6.3. Fan Failure 12
6.4. Reflux Failure (Top of Column or Side Stream) 13
6.5. Accidental Mixing 13
6.6. Overfilling 13
6.7. Accumulation of Non-Condensables 14
6.8. Control Valve Failure 14
6.9. Failure of Automatic Control 16
6.10. Abnormal Heat or Vapor Input 16
6.11. Pressure Surge or Internal Explosion 17
6.12. Chemical Reaction 17
6.13. Thermal Expansion 17
6.14. Cold Side of Exchanger Blocked In 20
6.15. Fire 20
6.16. Exchanger Tube Failure 28
6.17. General Power Failure and Local Power Failure 29
6.18. Blocked in Fired Heater 31
6.19. Loss of Heat 31
6.20. Loss of Absorbent 31
6.21. Inadvertent Loss of Segregation 32
6.22. Other 32
specifically furnished or outside the extent of the agreed upon right of use.
6.23. Special Consideration 32

7. ASSUMPTION IN EXCLUDING/LIMITING EMERGENCY SCENARIO 38
8. PRESSURE RELIEF DEVICES 39
8.1. Orifice Sizing 39
8.2. Design Condition 40
8.3. Pressure Relief Device Typology 40
8.4. Pressure Relief Device Outlet Piping 40
8.5. Large Pressure Relief Valve 43
TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

9.
9.3.
9.2.
9.1.
8.6.
DISPOSAL SYSTEM
Accumulation - Overpressure
Selection of Disposal System

Design of Open Disposal System
Design of Closed Disposal System
1000
Project N°
Unit
MU 2005
Document Code

Serial N°
0
Rev.
Page
3/48
45
45
44
43
43
Project N° Unit Document Code Serial N° Rev. Page
1000 MU 2005 0 4/48
1. SCOPE
Scope of this document is to provide the criteria for the design and the selection of the
devices used to protect equipment and related accessory from over pressurization.
2. FIELDS OF APPLICATION
Present Manual applies to all components being part of overpressure protection

system.
Since some aspects of the matter are already defined by national or international
regulation and/or standard the content of present manual are addressed to give:
• clarification with respect to aspect less clear and that were experienced to be
misunderstood,
• indication for those assumptions not stated in mentioned regulation/standard,
• practices to be followed in the design which derive from internal knowledge and
experience.
In the main field of TPIT work, the current legislation and standard applicable to the
overpressure protection are the following.
International:
ISO 4126 (all parts) Safety devices for protection against excessive pressure
ISO 23251 Petroleum, petrochemical and natural gas industries -

Pressure-relieving and depressuring systems (note: not jet
issued, under development based on API RP 521 which will
be superseded)
Federal (European):
Directive 97/23/CE Pressure equipment directive
Federal (USA):
API RP 520 (part I and II) Sizing, selection, and installation of pressure-relieving
devices in refineries
API RP 521 Guide for pressure-relieving and depressuring systems
API Std 2000 Venting atmospheric and low-pressure storage tank
ASME VIII Div. 1 Rules for construction of pressure vessels
ASME I Rules for construction of power boilers

1000 MU 2005 0 5/48
National (Italian):
D.Lgs. 25 Febbraio 2000 Attuazione della direttiva 97/23/CE in materia di

attrezzature a pressione
Circolare ex ANCC 15 novembre 1979 n°38468 Raccolta E
The design of equipment, piping and related accessories, must avoid as much as
possible the chance of over pressurization; in any case the use of pressure relief
device must be duly considered for those scenario which could be not avoided or for
those where the avoidance is not practical.
National legislation must be followed for the provision of pressure relief device to
protect equipment, piping and accessories.
Following exceptions clarifications derive from applicable standards.
Italian regulation - ISPESL

• The vessel falling under article 4) of Regio Decreto 12 maggio 1927 n°824 (as
amended by DPR 13-2-1981n°341 and taking into consideration explanation by
circolare protocollo 649 15.03.1943 and circolare tecnica n°67/85 protocollo 6822)
are not in ISPESL scope of work - thus are excluded from application of requirement
deriving from Raccolta E-. Particularly the following are excluded:
- fixed vessel under gas of vapour pressure, different from steam, having
capacity less that 25 litres;
- vessel having the product of internal diameter (or cross section diagonal) and
maximum allowable working pressure not greater than 3000 mm kg/cm2g;
• The vessel filled only by liquid and subjected only to hydrostatic are not in ISPESL
scope of work -thus are excluded from application of requirement deriving from
Raccolta E- if the maximum expected temperature does not determine vapour
pressure greater than 0.5 kg/cm2g
Note 1: to exclude high temperature the vessel must be not located in areas where
fire could be experienced.
Note 2: present exclusion derives from the fact that only vessel under vapour or
gas pressure is subjected to ISPESL.
ASME
All pressure vessels in ASME section VIII division 1 shall be provided with pressure
relief device as per part UG-125 and following.
Vessels which do not fall into ASME section VIII division 1 part U-1(c) are exempted
from requirement of UG-125; particularly the following are excluded:

• vessel having an inside diameter, width, height, or cross section diagonal not
exceeding 6 inch (152 mm), with no limitation of length of vessel or pressure;
• vessels having an internal or external operating pressure not exceeding 15 psi (100
kPa) with no limitation on size;
• pressure containers which are integral parts or components of rotating or
reciprocating mechanical devices, such as pumps, compressors, turbines,
generators, engines, and hydraulic or pneumatic cylinders where the primary design

1000 MU 2005 0 6/48
considerations and/or stresses are derived from the functional requirements of the
device;
• piping components, such as pipe, flanges, bolting, gaskets, valves, expansion joints,
fittings, and the pressure containing parts of other components, such as strainers
and devices which serve such purposes as mixing, separating, snubbing,
distributing, and metering or controlling flow, provided that pressure containing parts
of such components are generally recognized as piping components or accessories;
• a vessel for containing water under pressure, including those containing air the
compression of which serves only as a cushion, when none of the following
limitations are exceeded:
- a design pressure of 300 psi (2 MPa);
- a design temperature of 210°F (99°C);
• a hot water supply storage tank heated by steam or any other indirect means when
none of the following limitations is exceeded:
- a heat input of 200,000 Btu/h (58.6 kW);
- a water temperature of 210°F (99°C);
- a nominal water containing capacity of 120 gal (450 l).
All Boilers in ASME section I shall be foreseen with pressure relief device as per part
PG-57 and following.
Notes:
• Superheaters, economizers, and other pressure parts connected directly to the
boiler without intervening valves shall be considered as parts of the boiler proper.
• A pressure vessel in which steam is generated by the application of heat resulting
from the combustion of fuel (solid, liquid, or gaseous) shall be classed as a fired
steam boiler (thus falling within ASME Section I).
• Unfired pressure vessels in which steam is generated shall be classed as unfired
steam boilers with the following exceptions:
- vessels known as evaporators or heat exchangers,
- vessels in which steam is generated by the use of heat resulting from
operation of a processing system containing a number of pressure vessels
such as used in the manufacture of chemical and petroleum products.
• Unfired steam boilers shall be constructed under the provisions of ASME Section I
or Section VIII.
3. CORRELATED DOCUMENTS
1000 JI 2000 Job Instruction for Settling Out Pressure and Design Pressure
Evaluation for Typical Reaction Loops
1000 JI 2502 Safety Integrity Level (SIL) Classification and Implementation

in Safety Instrumented System (SIS)
XXXX JSD 0000.02 Basic Process Design Requirements and Criteria

1000 MU 2005 0 7/48
SP1545 Data Sheet for Safety Valve and Rupture Disk
NM 0006 Pressure Relief Device Summary of Rates
CN 1545 Summary Calculation Sheet for Pressure Relief Device
4. DEFINITIONS
4.1. General note
For appropriate definition refer to relevant code; for present document purpose the
definitions could be derived from API RP 521 and API RP 520 except for those
specifically listed below. It has to be pointed out that for the time being definition of
overpressure protective devices is different between ISO, API and PED (particularly:
safety valve, safety relief valve, relief valve could assume different meaning into
different codes).
Combustible liquid: for the purpose of present document combustible liquid is any
material classified as liquefied flammable gas, flammable or
combustible liquid, according to any of the following: national
and international regulation relevant to the project site, project
standards, internationally recognised practices such as NFPA,
MSDS.
Maximum allowable
working pressure maximum gauge pressure permissible at the top of a
completed vessel in its normal operating position at the
designated coincident temperature specified for that pressure.
Pressure relief device device designed to relieve excess pressure.
Vessel tower/columns – vessel/drum – heat exchanger – reactor –

filter – pressurised storage.
5. ACRONYMS
ANCC Associazione Nazionale per il Controllo della Combustione

API American Petroleum Institute
ASME American Society of Mechanical Engineers

ISO International Organization for Standardization
ISPESL Istituto Superiore per la Prevenzione e la Sicurezza sul Lavoro
MSDS Material Safety Data Sheet
NFPA National Fire Protection Association
PED Pressure Equipment Directive
P&ID Process and Instrumented Diagram
SIF Safety Instrument Function
SIL Safety Integrity Level
S/T Shell and tube

1000 MU 2005 0 8/48
TPIT Technip Italy S.p.A.

TRA&EP Technological Risk Assessment and Environmental Protection
6. DETERMINATION OF EMERGENCY SCENARIO LEADING TO OVERPRESSURE
Overpressure is the result of an unbalance or disturbance of the normal flows of

material and energy that causes the material or energy, or both, to build up in some
part of the system.
Determination of emergency release scenario has been based on previous experience;
efforts have been made to identify all major circumstances.
Nevertheless the designer user is cautioned not to consider the conditions described
as the only causes of overpressure.
Any circumstance that reasonably constitutes a hazard under the prevailing
conditions for a system should be considered in the design.
The causes of overpressure, in the main field of TPIT work, could be derived from
those listed in API RP 521 and or API Std 2000.
It has to be highlighted that in the design of industrial complex, it is mandatory to

identify possible simultaneity of different contingencies, having potential impact on
determination of relieving capacity. The causes of overpressure shall be completely
independent also considering the basic events which are the initiating steps of the
events which concur to the cause of overpressure.
Two or more causes of overpressure are considered unrelated if among them no

linkage exists and if the length of time between the successive occurrences of these
causes is enough to permit to consider these causes still unrelated (refer to para 6.23.1
for additional consideration).
It is not practical to list all the initial causes of an emergency, because these causes
(“Primary” causes) can be extremely various.
Therefore, rather than the “Primary” causes, is more effective to list only the final
causes that have as direct consequence, the emergency condition leading to
overpressure.
As an example, reflux failure is considered cause of emergency for the distillation
column. But reflux failure is only the effect of several other “Primary” causes like loss of
electric power, reflux pump failure, loss of liquid in the reflux accumulator etc.
In this way it is possible to limit the number of the causes leading to an emergency
situation and it is possible for each of these causes to determine the relevant relieving
rate.
Causes of overpressure are classified as deriving from operating or from fire
contingencies, and as single, multiple or generalised scenario knowing that the
scenario will cause the intervention of one or more pressure relief device (note that
multiple or generalised scenario is not affecting the pressure relief device design itself
but the abatement or control device (e.g. flare) which has to be designed taking into
consideration simultaneous relieves).

1000 MU 2005 0 9/48
The “Final” causes that more frequently lead to overpressure condition are
the following:
Emergency scenario Single Generalised

Blocked (closed) outlet yes note
Cooling water failure yes yes
Coolant failure (other than cooling water) yes note
Fan failure yes
Reflux failure (top of tower) yes
Reflux failure (side stream) yes
Accidental mixing yes
Overfilling yes
Accumulation of non-condensables yes
Control valve failure yes
Failure of automatic controls yes note
Abnormal heat or vapor input yes
Pressure surge or internal explosion yes
Chemical reaction yes
Thermal expansion yes
Cold side of exchanger blocked in yes
Fire yes note
Exchanger tube failure yes
General power failure yes yes
Local power failure yes note
Blocked-in fired heater yes
Loss of heat yes
Loss of absorbent yes note
Inadvertent loss of segregation yes
Note: scenario can potentially involve multiple pressure relief device even if it is not
reasonable it will affect whole or large portion of plant/complex.
6.1. Blocked Outlet
System has to be protected against overpressure when in case all the outlets of the
system are blocked, the system will be over pressurized.
The pressure relief device capacity shall be based on the capacity of the pressure
source (upstream pumps, compressors, hydrostatic head, differential pressure, etc.
plus, in case, source of gas or vapour generated into the system) at the relieving
conditions.
If the system is closed downstream heat exchangers, to the above relieving capacity it
shall be added the capacity required for fluid thermal expansion.
It should be noted that “blocked outlet” is one of those scenarios where is preferable to
avoid as much as possible the emergency by adequate design of the system rather
than pressure relief device design especially for condition which will lead to liquid fluid
discharge.
If not all outlets are blocked, the capacity of the unblocked outlets may be considered
according to para. 6.23.6.

1000 MU 2005 0 10/48
The outlet complete blockage can be determined by one of those listed in para 6.23.13.
Some examples of blocked outlet emergency are given here below:
6.1.1. Reaction section of desulphurization unit (two phase fluid)
In the high pressure system of desulphurization unit the dimensioning emergency of

the safety valve is often the closure of the liquid outlet valve of the separator
downstream the reactor.
The separator becomes liquid filled and the relieving flow rate is the maximum total
incoming flow, at the relieving conditions, minus the liquid eventually flowing from the
unblocked gas outlets.
In the case, taking into account the involved pressure drops, it is necessary to check
the pressure of the equipment located upstream the pressure relief device during the
emergency conditions.
6.1.2. Pump discharge
Rotary and reciprocating pumps:

The pressure relief device capacity shall be based on the pump capacity.
Centrifugal pumps:
Scenario is not applicable when system design pressure is selected according to
criteria given in para 6.1.3.
If not, the pressure relief device capacity shall be based on the pump capacity at
relieving pressure (pressure relief device set pressure plus accumulation).
The use of the pump characteristic curve is necessary.
6.1.3. Compressor discharge
Reciprocating compressor:
The pressure relief device capacity shall be based on normal operating flow of the
machine. Less conservative considerations should be done taking into consideration
the possible increasing of the suction pressure or in case of the modification of some
operating parameter as consequence of the increased discharge pressure.
Centrifugal compressor:
Scenario is not applicable when system design pressure is selected to withstand the
maximum compressor discharge pressure (note: pressure relief device could be
necessary to protect against overspend scenario in case of turbine driven compressor).
The pressure relief device capacity shall be based on the compressor capacity at
relieving pressure (pressure relief device set pressure plus accumulation).
Note for compressor system design: it is necessary, in any case, to check that the
suction or interstage pressures will not exceed the relevant design pressure.

1000 MU 2005 0 11/48
6.1.4. Steam turbines
Back pressure turbines:

In case of steam outlet line blocked, the pressure relief device shall be sized to
discharge the steam flow necessary for turbine normal developed power considering
the steam inlet at operating pressure.
Condensing turbines:
The emergencies to be investigated are the operating error (condenser valve blocked)
or loss of cooling medium of the condenser.
Pressure relief device valve sizing should be according to para S.31 and Table ST-6 of
“Standards for steam surface condensers” (Heat Exchange Institute).
Note: the pressure relief device is normally included in the supply of the package under
consideration.
6.1.5. Column overhead line closed
It has to be highlighted that normally column overhead line is not provided with any
device which could lead to flow blockage.
The valve is necessary when for process reasons a spare overhead condenser has
been installed or as in the case of the main fractionator of an ethylene plant two
columns in parallel have been provided for two different operating cases of the plant.
The starting emergency flow will be the normal overhead vapor flow.
It should be noted that after few minutes the overhead line valve is closed, also the
reflux will be lost and the new emergency should considered in addition to overhead
line blocked emergency scenario. Therefore for scenario consideration see also para
6.4.
6.2. Cooling Water Failure or Coolant Failure
All the relevant cooling and condensation services will be lost; general approach is as
follow:
General loss of cooling water (or - Coolers and condensers for process and
refrigerant) utility service (surface condensers etc.)
- Coolers for auxiliary service (lubricating oil,
seal oil etc.)
- Cooling jackets for various equipment
(compressors, reactors etc.)
Sometimes this emergency – as generalised emergency involving more section of plant

- can be reduced providing for the critical users, different energy source that can
assure the required service even if the main energy source fails.
Loss of cooling for a distillation system can lead to the loss of condensation.
The rigorous calculation of the relieving flow for these scenarios requires the material
and heat balance of the system at the relieving conditions. These last conditions
frequently are quite different than operating conditions.
At relieving conditions for a distillation system the higher pressure means higher boiling
point of bottom liquid and less exchanged heat in the reboiler.

1000 MU 2005 0 12/48
Also overhead vapour composition is altered, in particular if the considered emergency

includes reflux failure.
However, taking into account the difficulty of a rigorous calculation, first of all it is timely
worth to estimate how much a rigorous calculation could lead to smaller dimensions of
the pressure relief device and, in case, of the relief header with respect to a simplified
calculation.
6.2.1. Total condensation
In case of complete loss of cooling in a total condenser the flow and the composition of
the vapor to be relieved correspond to the flow and to the composition of the total
incoming vapor to the condenser.
Rigorous calculation could be performed considering the vapor flow and composition
corresponding to the column at the relieving conditions. In particular the pressure
should be the set pressure of the pressure relief system and the exchanged heat at
reboiler is affected by the same consideration on 6.1.5 above.
If the condensation failure exceeds the hold up time of the overhead accumulator, also
column reflux failure should be considered.
In this case the flow, composition and temperature of the vapor to be relieved are those
of the vapor below the reflux tray, as obtained by recalculation of the involved section
of the column in the new pressure condition considering the effect of feed and or pump
around and without top reflux.
6.2.2. Partial condensation
The relieving flow is the difference between the incoming vapor to the condenser and
the vapor leaving the system from the un-condensable vapor line (see para 6.23.6).
For the incoming vapor to the condenser are valid all the considerations given in the
previous para 6.2.1.
If the incoming vapor to the condenser is calculated at the emergency conditions as
indicated in the para 6.2.1, the same conditions will be applied to the calculation of the
vapor leaving the system.
6.3. Fan Failure
6.3.1. Fan motor stoppage
In this case it can be taken into account a residual air cooled heat exchanger capacity,
due to heat transfer by the natural convection.
For API this partial capacity is of 20% to 30% of normal duty (see API RP 521 point
3.6.4).
In the article “How to protect air cooled heat exchangers against overpressure” of
hydrocarbon processing – August 1975 – it is suggested for the residual condensing
capacity to consider 10% to 30% of the design duty.
Missing different clear indications, it is suggested to consider a residual capacity
condensation of 20% of the condenser normal duty.
In case of completely independent two or more fans fed by different power sources
only one fan (or one group of fans) can be considered out of service at time (note: this
is not applicable when the scenario is general electric power failure see para 6.17).

1000 MU 2005 0 13/48
6.3.2. Louver closure
The closure of the louver, if installed, is depending on several causes: automatic

control failure, mechanical failure, etc. This emergency is equivalent to complete loss
of condensation therefore for relieving rate see para. 6.2.1. and 6.2.2.
6.4. Reflux Failure (Top of Column or Side Stream)
In case of reflux failure (due to pump shutdown, control valve closure or operating
error) an upset in the column occurs. This will lead to column pressure increase as the
result of the additional vapor pressure drop in the column overhead line, but it could not
determine the reaching of the set pressure of the pressure relief device if the
condenser is adequate to handle such condition.
Nevertheless the reflux failure will cause the flooding of the condenser with the
consequent cooling failure (emergency previously discussed at the para. 6.2).
It should be noted that if the protected system is able to handle all the condensed
vapor (by pressure delivery or by a dedicated pump, different from the reflux pump,
under level control and with the consideration given in para 6.23.6) the scenario could
not lead to condenser flooding.
Note for distillation system design: particular attention is required by the location of the
pressure relief device because if the protecting device is installed on the overhead
accumulator or, in any case, downstream the condenser, liquid will be received.
6.5. Accidental Mixing
6.5.1. Cold liquid into hot system

The scenario depends on the rate-limiting mechanism of the cold stream inlet into the
system and on the heat exchange.
Since the expansion in volume from liquid to vapour is so great and the speed of
vapour generation is really rapid but unknown, it is questionable whether the pressure
relief device could open fast enough to be of value.
As a result pressure relief device is not recommended for this contingency, whereas
proper system design is deemed necessary to avoid such scenario: minimising
permanent connection, providing reliable interlock, ensuring adequate operating
procedure, or any other means to prevent the scenario to occur.
As the result of exchanger tube failure (refer to para 6.16) the assumption of
instantaneous thermal equilibrium is conservative but valid, thus the pressure relief
device relieving rate can be evaluated.
6.5.2. Mixing of reactive material

Mixing can lead to unexpected exothermic reaction (see para 6.12).
6.6. Overfilling
Overfilling derives from blocked outlet scenario (para 6.1).

The same general considerations apply; particularly it is preferable to avoid as much as
possible the emergency by adequate design of the system rather than pressure relief
device design.

1000 MU 2005 0 14/48
In case the scenario could not be avoided the relieving capacity of the pressure relief
device shall be based on maximum liquid incoming rate at relieving capacity, taking in
case credit from the capacity of the unblocked outlets according to para. 6.23.6.
Rather than providing design pressure of system equal or greater than maximum
incoming pressure the “effect on operator response” (see para 6.23.5) could be
evaluated in excluding the overfilling scenario from those leading to overpressure; to
ensure operator intervention the following shall be ensured:
• the hold up time between the level at which the operator is alerted (note: alarm is
considered effective only if it is given at permanently manned location and if the
alarm is derived from an instrument completely independent from the one which
could cause the emergency scenario; e.g.: the high level alarm related on the level
controller acting on the outlet liquid rate is not effective for all failure cases) and the
overfilling shall be greater than the sum of:
- 10 minutes,
- time necessary to stop the flow to the system (note: if the operator from the
location where the alarm is given can stop the flow acting on pump, valve, etc.
and if the same operator can verify the effectiveness of the action by pump
running status, or complete valve limit switch closure or by flow indication, the
time necessary to stop the flow to the system can be neglected),
• operating procedure (refer to para 6.23.11):
- highlighting the risk of overfilling and the fact hat the safety relief system is not
designed for that scenario,
- describing the process parameter and the alarm foreseen to identify the upset,
- showing the maximum time available to intervene,
- listing the action to be done.
6.7. Accumulation of Non-Condensables
Non-condensables do not accumulate under normal conditions, because they are

released with the process streams. However, in distillation circuit with certain piping
configurations, non-condensables can accumulate leading to flooding of the overhead
condensed. This effect leads to complete loss of condensation therefore for relieving
rate (see para. 6.2. points (a) and (b)).
6.8. Control Valve Failure
When a fluid is let down from high pressure system to low pressure system, it is
necessary to analyse the consequences of the full opening of the control valve.
There may be single or multiple lines fitted with control devices. The scenario to
consider is that one valve will be in a fully opened position regardless of the control
valve failure position, unless there will be operating condition, upset or wrong control
which could lead to simultaneous complete opening of two or more valves.
For the assumption relevant to the other valves connected to the system, either inlet or
outlet valves, refer to para 6.23.6.
An important consideration is the effect of having a manual bypass on the automatic

control valve(s) at least partially open:

1000 MU 2005 0 15/48
• If during operation, the bypass valve is opened to provide additional flow, then this
total flow (automatic control valve wide open and bypass valve normal position) shall
be considered in the relieving scenario.
• The potential for the bypass valve to be inadvertently opened while the control valve
is operating shall also be considered unless bypass valve is blocked in closed
position and dedicated procedure is provided as per para 6.23.11. If not it is
recommended to assume the manual bypass opened at 50%.
If the bypass is used only during maintenance to permit the control valve to be blocked
in and removed from service, then to evaluate the flow passing through the control loop
and affecting the overpressure scenario, it is recommended to evaluate the maximum
flow between the one passing through the automatic control valve or its bypass valve
(wide open).
Important note:
In all cases, the maximum CV of the control valve and in case of its bypass, shall be
indicated on valve Data Sheet (refer to chapter 7).
Special case: gas blow-by

In case of a control valve in liquid service, in the upstream system the liquid level will
be lost allowing the flow of gas or vapor to the downstream system operating at lower
pressure. This scenario could lead to overpressurization of the lower pressure system
if the maximum operating system of the high pressure system is greater than the
design pressure of the lower pressure system.
Examples of systems in which fluid are transferred by pressure difference are:
• Reformer/Hydrofiner: liquid transfer from high pressure separator

• Gas washing/sweetening: transfer from absorber to stripper
• Liquid recovery from compressor discharge K.O. drum
The flow through the fully open control valve is calculated from the equation of the flow
coefficient Cv.
The flow coefficient Cv to be considered is the installed Cv of the valve (or 200% of the
max. calculated Cv if the installed Cv is not known and if a note is provided on process
data sheet of control valve explaining that installed Cv shall be less than 200% of the
calculated one).
The differential pressure to be used in the equation is the difference between the max,
operating pressure upstream the control valve and the accumulated pressure of the
pressure relief device.

1000 MU 2005 0 16/48
6.9. Failure of Automatic Control
Automatic control devices are used at inlets and outlets of vessels or systems to
regulate the process streams.
Failure of inlet control valve (in fully open position) may lead to system
overpressurization as detailed in para 6.8.
Failure of outlet control valve (in fully closed position) may lead to system
overpressurization as detailed in para 6.1 or to system overfilling as detailed in para
6.6.
Present paragraph specifically applies to the generalised or at least local loss of

automatic controls due to failure in instrument air system or related hardware/software
control system.
For a system of valves it shall be assumed that all affected valves move to their failure
position; for stationary valves since they may tend toward to open or closed position, if
not known the more conservative condition shall be assumed.
Operation of the manual bypass valve shall be considered as discussed in para 6.8;
similarly possible failure of the control device while the manual bypass valve is fully or
partially open deserves to be considered.
In evaluating relief considerations, the designer shall assume proper sizing of the
control valve and unit operation at worst operating condition including temporary start-
up or shutdown conditions when unit operators are using the control valve’s bypass
valve.
6.10. Abnormal Heat or Vapor Input
Higher than normal heat or vapor input can be a result of control valves that allow
excess flow of process streams (either directly to the system leading to higher vapor
inlet or to the process thermal exchanger leading to higher vapor formation) or excess
flow of utilities to heat sources (steam to exchanger or fuel to heater/furnace burners).
The scenario to consider is that one valve will be in a fully opened position regardless
of the control valve failure position, unless there will be operating condition, upset or
wrong control which could lead to simultaneous complete opening of two or more
valves.
For the assumption relevant to the other valves connected to the system, either inlet or
outlet valves, refer to para 6.23.6.
For the assumption relevant to the effect of manual bypass refer to para 6.8.
For the assumption relevant to the maximum flow capacity of the control valve refer to
para 6.8.
Typical case is the one related to “Failure of control on column reboiler”. To evaluate
the relieving rate:
• for the exchanger reboiler assume clean heat transfer coefficient,
• for heater reboiler assume design heat duty.

1000 MU 2005 0 17/48
6.11. Pressure Surge or Internal Explosion
6.11.1. Pressure surge

Rapid closure (in some cases even the rapid opening) of valves in long line can lead to
a pressure transient.
Phenomenon is possible either with liquid or vapor fluids.
Pressure relief devices such as valves (safety valve, relief valve) are not effective to
protect against the conditions; preventive measure shall be used limiting the speed at
which valves can be closed in long pipelines, providing pulsation dampeners or special
bladder-type surge valves.
6.11.2. Internal explosion

Ignition of vapour-air mixtures present inside closed equipment could lead to explosion.
The explosion could be:
• deflagration: explosion in which the flame-front of a combustible medium is
advancing at less than the speed of sound;
• detonation: explosion in which the flame-front of a combustible medium is advancing
at or above the speed of sound.
Only in case of deflagration the protective measures such as rupture disks or explosion
vent panels (not relief valves) should be used.
Design of explosion relief systems should follow recognized guidelines such as those
contained in NFPA 68.
Alternate means of explosion protection (including explosion containment, explosion
suppression, oxidant concentration reduction) are described in NFPA 69.
The preventive measures have to be in any case provided: preventive measure
focalizes on the avoidance of possible presence (even during upset) of combustible
mixture and by ignition source control. Ignition could be caused by spark, static
electricity, exothermic reaction, high temperature source (due to operating condition or
upset such us loss of lubricant). If the ignition source control cannot be considered
always in place (refer to the concept of latent failure in para 6.23.1) the possibility of
explosion is considered credible even in case that the combustible mixture is present
only during upset or emergency condition.
6.12. Chemical Reaction
In case of availability of reaction kinetics for runaway reaction the relieving rate can be
determined even if is not simple and requires special analysis.
For the TPIT scope of work, relieving rate for chemical reaction is provided by the
process Licensor.
6.13. Thermal Expansion
The thermal expansion is the increase of the fluid volume caused by the increase or
decrease of temperature.
The expansion can be originated from many causes the most common of which are the
following:
• Heating by electrical or steam tracing or by heating coils of the fluid trapped inside
piping or equipment.

1000 MU 2005 0 18/48
• Exchanger with the cold side blocked in while the hot side is in operation (see also
para 6.14 when heating can lead to vaporization).
• Heating by solar radiation of the fluid trapped inside piping or equipment.
For system containing entirely or partially gas or vapor, the thermal expansion
scenario, originated from causes different than fire (refer to para. 6.15), has to be
neglected.
The considerations given in this paragraph are intended to be applied to system filled
by liquid only, and the emergency related to heating by external fire is not analysed
since in all cases after the initial liquid expansion the liquid starts to vaporize and the
vaporization due to fire becomes the sizing scenario (refer to para 6.15).
The pressure relief device for thermal expansion is also called thermal relief valve; it
should be provided for piping and equipment filled by liquid that could be blocked in
during operation.
The need to install thermal relief valves on piping in which liquid can be trapped should
be evaluated accurately; in fact practical considerations supported by the experience,
suggest to limit the installation of such valves.
The reasons for limiting the number of installations are not due to direct cost of
installations but are supported by other considerations like the possible source of
leakage from the additional small bore fitting, the need to collect and if necessary to
recover the liquid blow down, the necessity to check internal leakage leading to
periodical maintenance etc.
It should be also taken into account that a piping blocked in has an intrinsic capacity to
absorb overpressure generated by thermal expansion, since a small increase of
volume can be absorbed by internal leakage by elastic modifications of the tight
components of the system or by small bubbles of vapor or non condensable gas
present in the line.
Therefore, as a general rule it is suggested to avoid the installation of thermal relief
devices for piping that is normally in service inside process unit.
Particular attention is required for transfer lines to and from tankage areas, decks, etc.
For these lines the need of a thermal relief valve installation should be always
considered.
With the aim to provide generic order of magnitude in understanding when it is

necessary to install a thermal relief valve and when it should be sized according to API
RP 521 criteria (formula (1) para 3.14.3), the following graphic (Fig. 2.3 A) is given.
The Fig. 2.3 A is based API RP 521 formula, uninsulated lines, containing gasoil,
exposed to solar radiation in the absence of wind.

The region of the graphic in which it has been not considered necessary to install a
thermal relief valve, was obtained taking into account the specific leakage (0.125 l/h
per inch of nominal diameter valve) through the seat and packing of the valve.
When the line could be intercepted by less of two valves (e.g. blind) and or with size
less than the line size, the applicability of graphic shall be duly considered.

1000
Project N°
Unit
MU 2005
Document Code

Serial N°
0
Rev.
Page
19/48
1000 MU 2005 0 20/48
6.14. Cold Side of Exchanger Blocked In
In case of presence of liquid blocked in the exchanger cold side, the vaporization due
to heating from the hot side could lead to significant cause of overpressure.
This type of scenario can occur:
(a) when there are two reboilers, one spare of the other,
(b) by operating error, during exchanger operation,
(c) by emergency isolation of the exchanger by process upset.
The final effect is the vaporisation of the exchanger process side blocked in.
The use of valve in blocked position (see para 6.23.12) or mechanical interlock (see
para 6.23.9) can allow to consider the scenario unrealistic only for case (b).
Administrative/procedural controls (elated to the valve in blocked position) are not
considered effective for case (a); for that case the only preventive effective measure is
the mechanical interlock.
In case of fluid that at relieving condition is not super-critical the relieving rate has to be
evaluated taking into consideration the following:
• Latent heat depends on relieving condition (near the critical point of fluid do not use
figure less than 115 kJ/kg),
• Heat transfer coefficient shall be considered as on clean tubes condition,
• Logarithmic mean temperature difference could lead to zero considering the boiling
temperature at reboiler process side design pressure.
6.15. Fire
Note: the following consideration apply specifically to process equipment thus for low
pressure storage falling into the applicability of API Std. 2000 (design up to 1.034 bar
gauge) refer to the mentioned standard.
6.15.1. General Considerations for Fire Scenario Applicability
Fire scenario is to be considered likely to occur if sufficient amount of combustible

material (solid or liquid) is present in the plant in such a way that can provide a source
of fire if ignited.
For the purpose on this document and with regard to plant in TPIT scope of work, any
equipment, line and related accessories which handle combustible liquid is considered
to be possible source of releases of sufficient amount of combustible liquid. As possible
source of release leading to fire, also the materials relevant to auxiliaries of equipment
(i.e. the lubricating oil associated to compressors, turbine, large pumps) has to be
taken into account if at least one of those materials is classified as combustible liquid.
It has to be highlighted that a pressure relief device is considered effective only against
liquid pool fire or solid bulk fire (API RP 521 refers to liquid fire and ISPESL refers to
liquid and bulk fire). The risk associated to gas fire are not intended to be
minimised/controlled by appropriate sizing of pressure relief device since it will not
protect for localised overheating and the flame impingement.
Thus equipment and lines containing only combustible gas are not intended as
possible fire scenario source for the purpose of present document.

1000 MU 2005 0 21/48
To exclude the fire scenario for the selected plant area all the following shall be
foreseen:
• the included equipment and lines shall not contain at any operating or start-up
condition combustible liquid;
• the selected plant area shall be physically segregated from the adjacent ones which
could be source of liquid pool fire; the following are minimum requirements to be
satisfied:
- a free space of 15 meters from the selected plant area and any equipment or
line – handling combustible liquid - of the adjacent one,
- adequate means (drainage, sloping, curb, diversion wall, …) to ensure that any
combustible liquid spreading will not reach the selected plant area;
• the final user of the plant shall be alerted that the selected plant area is considered
not exposed to liquid pool or solid bulk fire risk (refer to chapter 7) thus no
combustible solid (e.g. wood pallets) or combustible liquid (e.g. solvent portable
drums) are allowed to be stored in that area without rechecking the overpressure
protective device; the same applies to any plant revamping which includes in the
area a new process or auxiliary equipment material which could be classified as
combustible liquid.
Important notes:
1. Equipment and lines containing liquefied flammable gas (to be conservative at
minimum pressure and temperature operating condition) could be considered as
not leading to liquid pool taking into account the liquid flash and the mist
entrapment in the high velocity resulting accidental release. This assumption has to
be evaluated critically taking into account also the chance that the release could
impinge a solid surface thus resulting in possible liquid pool formation by the liquid
rainout after flashing.
2. Any project document related to fire protection could be considered as supporting
document in the understanding of risk of fire development, but none of this
document has to be considered as the one showing where the fire scenario applies
for pressure relief device design; e.g.:
• Hazardous area classification drawing for electrical and non electrical
equipment selection (the purpose is to minimise the risk of ignition of a
combustible or dust cloud) are not pertinent since:
- some area could be related to combustible gas sources,
- some area could be not classified since the risk of ignition is almost always
present (furnace, heater, ..) thus not affecting the selection of the
surrounding low ignition source equipment;
• Passive fire protection drawing for fireproofing application are not pertinent
since:
- some standards do not consider as probable source of fires the
combustible liquid operated at temperature below their flash point (gasoil
at ambient temperature);
- some companies require active fire protection (water deluge on skirt, …)
instead of passive fire protection, thus some areas with fire risk could be
not shown in the fire protection drawing.

1000 MU 2005 0 22/48
Finally, an equipment inside the plot view of the fire scenario area is not included in the
calculation of the exposed surface (refer para 6.15.3) if any portion of the equipment is
located above the flame radiation impact height (exception: spheres or spheroids
surface up to flame radiation impact height or up to horizontal diameter, whichever is
greater, is always considered exposed to fire radiation).
6.15.2. Multiple Equipment Protection
When only a single (or group of) pressure relief device protects several connected
equipment that can be exposed simultaneously to the fire scenario, the heat
contribution of each equipment (and related lines see para 6.15.3.1) has to be included
in calculation of fire exposed surfaces.
Special case: Circuit comprising two sections having different design pressures.
Both sections (section A higher design pressure, section B lower design pressure)
could be isolated thus resulting in each section provided with pressure relief device
having different set pressure. However during the fire scenario, both sections could be
exposed simultaneously to fire and the two sections could remain interconnected
resulting in pressure equalisation (e.g. sections connected by control valve which fails
in position); in such case the pressure relief device on section B shall be capable to
handle the relieving rate generated by fire scenario on both sections.
Special case: Circuit comprising equipment having same or similar design

pressure
The circuit comprises two or more equipment connected together by piping not
containing means for isolation of an equipment from another.
The following are considered cases were the isolation during fire scenario is not
envisaged or effective:
• special case 2 detailed in para 6.23.13,
• manual block valve indicated as blocked in open position (see para 6.23.12),
providing adequate operating procedure (see para 6.23.11), to ensure that the
equipment is depressured and free of all liquids when isolated,
• control valve having a minimum operating condition opening not affecting the vapour
path in case of exposure of fire, ensuring that the control valve will not close in case
the control system is exposed to fire (e.g.: valve failing in closed position upon loss
of instrument, even not immediately, does not fulfil that requirement) and providing
operating procedure (see para 6.23.11) to do not close the valve in case of fire
exposure since this will result in equipment isolation from the pressure relief device
and to ensure that the equipment is depressured and free of all liquids when
isolated for maintenance.
6.15.3. Exposed Surface
As stated above the pressure relief device is considered effective to protect equipment
from overpressure due to fire exposure when the fire is associated to liquid pool or
solid bulk.
The source of the flame has to be referred to the grade or to any level at which
substantial material could be retained (e.g.: elevated platform provided with grating can
not sustain liquid pool).

1000 MU 2005 0 23/48
In determining the equipment surface exposed to the fire radiation, the “flame radiation
impact height” has to be defined.
Applicable standard (e.g.: API RP 521, ISPESL) and Company Engineering standard
are not congruent in assigning that figure, specifically:
• API RP 521 recommends to take into consideration, usually, only the portion of
equipment up to elevation of 25 feet (7.6 m) above grade or above any level at
which substantial material could be retained,
• ISPESL (Raccolta E, fascicolo E.1 para. E.1.D.1 punto 8.3) recommends to take into
consideration the equipment surface up to 8 m above grade or above any level at
which material could be retained.
In absence of specific and different local regulation or Project requirement (Company

Engineering Standard) it is recommended to consider as “Flame radiation impact
height” the figure of 8 m starting from grade or from any level which can sustain the
combustible material.
6.15.4. Piping
As general rule the contribute of piping exposed to fire is evaluated increasing by 20%
the exposed surface calculated for equipment.
In case of a highly congested area or when specifically required by project, or when it

is recognised that the piping has higher contribute (e.g.: very large size piping
compared with equipment size), the piping surface area is evaluated taking into
account that:
• the overall extension of piping is related to the piping present in the flame radiation
impact height with regard to a maximum plot extension of 500 m2;
• during the fire scenario piping operating normally in vapor service shall become full
of liquid;
• during the fire scenario piping operating normally in mixed phase service shall
become full of liquid, partially full of liquid or completely in vapour phase depending
on sloping and on piping interconnections.
Note: when the exposed surface of piping is accurately evaluated the applicability of
relevant formula for the determination of the contribute to the overall heat available for
liquid vaporization has to be duly considered since the fire area exposure ratio or factor
(refer to API RP 521 para 3.15.2.1.1) could not be applicable.
6.15.5. Liquid Service

In determining the relieving capacity of the overpressure relief device for equipment
containing liquid, only the contribute due to the liquid boiling vapour generation shall be
taken into account.
The equipment surface containing liquid (wetted area) up to the flame radiation impact
height or up to the sphere-spheroid horizontal diameter shall be calculated.

1000 MU 2005 0 24/48
General assumption for wetted area evaluation are given in table 4 of API RP 521
where for “normal operating level” it shall be considered the maximum operating liquid
level.
Note: the bottom head of vertical vessel, if protected by support skirts and if the skirt
internal ventilation is limited, could not be considered for wetted area calculation; it has
to be highlighted that this assumption shall be considered only giving evidence that the
ventilation is limited.
Additional assumptions for heat exchangers are given here below:
• S/T exchanger full of liquid: the wetted surface is the geometric surface of the shell
side or of the tube side distributor respectively exposed to fire and taking into
account the flame radiation impact height.
• S/T exchanger partially full of liquid (valid for both sides): when liquid level can not
be derived by instrumentation or layout, the wetted surface can be assumed as 50%
of the geometric surface and consideration shall be given with respect to flame
radiation impact height. Note: in some cases, such as condenser, the presence of
liquid into one side of the exchanger is created by the exchanger operation thus
during fire exposure the presence of liquid can be excluded if the condensation
stops and if there is adequate slope to eliminate any liquid accumulation into the
exchanger side when the fire scenario occurs.
• Exchanger kettle type (shell side): when liquid level can not be derived by
instrumentation or layout, the wetted surface can be evaluated assuming the liquid
level at 50 mm above tube bundle.
• Plate heat exchangers don’t require investigation (wetted surface neglected).
• Double pipe and multi- pipe exchanger: the wetted surface is estimated as per S/T
exchanger. Note: in some case equipment does not fall into ASME code application
as per para 2 Field of Application above.
6.15.5.1 Formula
Formulae for heat input for liquid vaporisation due to fire exposure are given in API RP
521 para 3.15.2.1.
Two formulae are given taking into account provision of active and passive protection:
adequate drainage and prompt fire fighting.
The adequacy of fire fighting facilities and drainage system has to be considered
always in place, when they are comprised in TPIT Project scope of work.
Unless specific written clarification by Client, for those cases where no information are
available about the drainage system (e.g.: when the equipment are installed in existing
area for unit revamping) or about fire fighting system and organisation in place, it has to
be assumed that the combination of adequate drainage and fire fighting equipment are
not fulfilled.
Note: there are cases where the drainage system is specifically designed to do not
divert away from the equipment the liquid spill since a valved containment area is
provided (e.g.: pressure storage of liquefied petroleum gases located within dedicated
diked/curbed area; corrosive/reactive chemicals located within their containment area);
in such case the formula relevant to inadequate drainage and fire fighting shall be
used.

1000 MU 2005 0 25/48
Where the Italian legislation applies, the formulae given in ISPESL Raccolta E have to
be used. It has to be noted that this formula is identical (taking into account the unit of
measures, the latent heat of the fluid and the F factor – see para. 6.15.3.8) to the one
given by API RP 521 related to adequate drainage and fire fighting systems.
Even in such case it is recommended to duly consider the effectiveness of drainage
and fire fighting facilities in place and in case to take sufficient margin in overpressure
relief device design.
6.15.5.1.1 High boiling temperature substance
At the conditions of pressure and temperature reached during a fire, in addition to the
normal liquid vaporization, cracking phenomena will take place, increasing the total
heat absorbed and therefore with possible decreasing of vapor developed.
Based on comparison between reaction heats and reaction products in thermal
cracking operations (confidential licensor information) the following criteria should be
followed:
Discharge temperature
For pressure relief valve sizing calculation the discharge temperature of 400 °C can be
assumed.
Thermal cracking is already present below 400 °C and at this temperature an increase
of 10 °C means an increasing of about 50% of the thermal cracking phenomena. Coke
formation start at 460 ÷ 495 °C.
Latent heat
It can be assumed the conservative value of 166 kcal/kg (300 Btu/lb).
This suggested value takes into account the contribution of cracking to vapor
formation.
Molecular weight
Residuum thermal cracking considerations suggest to assume for atmospheric and
vacuum distillation a molecular weight of 90 ÷ 110.
The same molecular weight can be assumed for similar situations with equipment
design pressures relatively low.
A molecular weight of about 50 seems to be better related to kerosene/gasoil
desulfurization and other similar process units with much higher design pressure.
6.15.5.1.2 Relieving conditions below but close to critical point
Refer to API RP 521 sect. 3.15.3.1.

6.15.5.2 Gas/vapor service and supercritical substance at relieving condition
When the equipment contains during all normal operation condition only vapor phase it
is questionable the fact that an overpressure relief device if effective in protecting from
collapse. In such case the effect of the rapid rise of the temperature of the pressurized
equipment will result in equipment collapse whatever is in place or not the
overpressure relief device.
Nevertheless the pressure relief device shall be applied unless client and local
legislation allow to do not consider the scenario.

1000 MU 2005 0 26/48
For vessel containing liquid that becomes supercritical at relieving condition the
scenario shall be always considered.
Refer to API RP 521 sect. 3.15.2.12 for details of calculation.
Note: API RP 521 gives indication on approach to be followed on relieving temperature

estimation; for fluid at supercritical condition it is suggested to estimate the relieving
temperature (API RP formula 7b) starting from critical condition instead of normal
operation condition where liquid/vapor equilibrium exists.
Note: Italian regulation (ISPESL point E1D2 - 8.4) clearly states that the scenario of fire
versus equipment containing only vapor has not to be considered; on the contrary
depressurisation system is to be considered.
QUOTE
Per i recipienti contenenti fluidi solo allo stato gassoso, nel caso di incendio, deve
essere prevista, a cura e sotto la responsabilità dell’utente, la depressurizzazione del
recipiente all’inizio dell’incendio.
UNQUOTE
6.15.5.3 Start/end relieving conditions
During relieving emergency significant differences can occur between the start and the
end of the relieving.
For liquid mixture vaporisation during the emergency the molecular weight of
discharged vapor is variable: it is lower at the start of the emergency and as the
emergency is progressing it is becomes heavier.
Also the relieving temperature together with all the chemical – physical properties (i.e.
compressibility factor, specific heat ratio Cp/Cv latent heat etc.) will vary during the
emergency.
This behaviour for multicomponent mixture is common for all the emergencies, but is
emphasised during a fire scenario.
For the correct sizing of the overpressure relief device and for the design of the
downstream system both the starting and the ending conditions should be analysed to
verify the sizing condition.
6.15.5.4 Air cooled exchangers
Fire scenario for air cooled exchanger shall be considered only when it appears
reasonable the possibility that the effect of flames reach the equipment during the fire.
To exclude this possibility the air cooler shall be located:
• at height not affected by fire exposure (see para 6.15.3),

or
• in area where fire scenario is not credible (see para 6.15.1).
For air cooled exchangers involved in fire scenario the designer should take into
account the following considerations:
• The probability that the relieving flow due to an air cooled exchanger could be
simultaneous to the relieving flows due to fire exposure from the other associated
equipment is very low.

1000 MU 2005 0 27/48
In fact the air cooled exchangers have large exposed surface and small liquid
inventory, contrary to the other associated equipment (as columns or vessels) that
have surfaces in contact with large liquid amount; so that the effects of fire
(vaporization of liquid) are experienced earlier in the air cooler with respect to the
ones related to other associated equipment.
• The liquid content, inside the air cooled exchanger, can be displaced by the
generated vapors and moved to other connected equipment.
• The air cooled exchangers when exposed to heated air, as during a fire, lose their
capability of cooling and condensing.
• The losing capability of air cooled exchanger, as indicated above, should be

considered simultaneous to fire exposure of the other connected equipment located
together with the exchanger in the same area exposed to fire.
Details for calculations are given in API RP 521 point 3.15.7.
6.15.5.5 Shell and tubes heat exchangers
Overpressure protection for both shell and tube shall be foreseen. Note: the equipment
falls into requirements explained in para 2 above.
Depending on liquid material and relevant pressure handled into the exchanger sides
the boiling temperatures of the two liquids could be significantly different.
In that case consideration shall be given to the heat transferred by one side to the
other while the emergency takes place; in such circumstance the lower boiling
temperature side shall be protected from overpressure considering also the heat
exchanged between the two sides (note: this heat is less than the one relevant to fire
exposure on the high boiling temperature exchanger side).
6.15.5.6 Jacketed vessels
In case jacket falls into the equipment to be protected (refer to para 2) Jacket
protection should follow the same criteria listed in previous paragraphs.
If the jacket contains vapor phase, it is reasonable to consider that the jacket will fail
during fire exposure; thus the jacket vessel shall be protected from fire exposure
considering its exposed surface.
If the jacket contains liquid phase depending on volume and on emergency actions it is
possible that after fire exposure it becomes empty of liquid thus leading to the jacket
failure. In such case the jacket vessel shall be protected as explained above.
6.15.5.7 Fire resistant insulation material
As described in detail by API RP 521 at point 3.15.2, the amount of heat absorbed by a
vessel exposed to external fire is depending on environment factor F (the environment
factor F is called by ISPESL point E1D2 - 8.3 fattore di isolamento termico).

1000 MU 2005 0 28/48
This factor is 1 for non-insulated vessels. For fire resistant insulated vessels the factor
F is less than 1 and depends on the thermal conductivity or on the conductance that is
the ratio of the thermal conductivity and the thickness of the insulating material.
Lower the conductance of the insulating material, lower is the heat absorbed by the
vessel.
Environmental Factor assumed figures are different in the two normative (API RP 521-
table 5 and ISPES ISPESL point E1D2 - 8. 3. Particularly ISPESL does not consider
figure less than 0.3 and depending on thermal conductivity and thickness the ISPESL
figure are much conservative than API’s.
The thermal conductivity should be taken at the mean temperature between the
exposure (external) temperature of 1660°F (904°C) and the process temperature
(temperature of the protected equipment fluid) at the relieving conditions.
The insulation shall effectively protect the equipment against the fire scenario, thus it
shall resist to the exposure temperature, relevant time and associated fire fighting
operation (e.g.: resist to the dislodgement by high pressure firewater streams). Refer to
API RP 521 para 3.15.5.2 for more details.
When insulation is computed in the overpressure relief device design, the relevant
protected equipment process data sheet/sheets shall clearly detail the requirement
applicable to the insulation (refer to chapter 7).
6.16. Exchanger Tube Failure
6.16.1. General
In shell and tube heat exchangers, tubes are subjected to internal failure from a
number of causes including thermal shock, vibration and corrosion.
From the above such circumstances failure has to be considered always credible, thus
the scenario is always applicable for possible overpressurization of exchanger or of the
connected circuit.
Taking into account the allowance in terms of resistance of the equipment against the
overpressurization, due to the fact that the equipment has successfully withstand the
hydrostatic test pressure, the exchanger shall not be protected by pressure relief
device for such scenario if the maximum operating pressure of the exchanger high
pressure side does not exceed the hydrostatic test pressure of the exchanger low
pressure side (refer to para 6.23.3). If it is not easy to determine the maximum
operating pressure of the exchanger high pressure side, than the design pressure has
to be considered instead.
When the maximum operating pressure of the high pressure side is used in excluding
the applicability of the scenario toward the low pressure side, this assumption has to be
listed and detailed in pressure relief device Summary Calculation Sheet and dedicated
operating procedure (refer to para 6.23.11) has to be provided explaining the risk of
operating for prolonged time at pressure exceeding the maximum operating assumed.
Important note: Proper selection exchanger low pressure side design pressure does
not allow to exclude the possibility of tube rupture.

1000 MU 2005 0 29/48
The exchanger internal failure has to be considered always credible according to the
above causes of internal failure, but the exchanger internal failure is considered not
dealing in exchanger low pressure side rupture/collapse.
When the exchanger low pressure side design pressure is selected in order to
determine the relevant hydrostatic test pressure adequate against the exchanger high
pressure side, the design of the low pressure side shall be extended as minimum up to
and including the exchanger low pressure side isolation valves.
In such circumstance the scenario is still applicable towards the equipment and lines
connected upstream and downstream the exchanger low pressure side isolation
valves. Thus the flow due to exchanger tube failure has to be evaluated and the
upstream and downstream circuit verified against the capability of managing or
relieving the incoming additional flow.
Refer to API RP 521 para 3.18.3 in determining exchanger tube failure flow rate.
6.16.2. Plate Exchanger, Double Pipe Exchanger, Vessel with external Jacket
If the corrosion phenomenon is not envisaged or not critical, the internal failure of the
plate exchanger is considered unlikely thus not applicable to pressure relief device
design. The same applies to vessel with external jacket.
If the double pipe exchanger are made of similar metals and if the exchanger inner pipe
is made from schedule pipe the scenario is not applicable to overpressure relief device
design (refer to API RP 521 para 3.18.6 for more details).
6.17. General Power Failure and Local Power Failure
The distinction between general and local power failure is only related to the number of
systems simultaneously affected by Power Failure.
All the relieve scenarios relevant to General Power Failure from all pressure relief
devices and other overpressure protective systems such as depressurising systems
will be taken into account for flare system design (refer to para 9). The local power
failure instead is assumed to affect only one or a limited number of circuit thus affecting
only the flare network sub-header sizing.
It is necessary, starting from the loss of an utility system, to analyse all the possible
linkages with other utility systems, so to understand if to the “Primary” loss of the first
utility system (cause) should be considered as a consequence (effect) also the loss of
additional utility systems. Particularly upon Power Failure, depending on plant
configuration, the following utilities could be affected at the same time or with minimum
delay:
• cooling water
• steam
• instrument air.

1000 MU 2005 0 30/48
Note: With regard to the loss of steam and to the loss of instrument air the scenario
can in such circumstances decrease (steam reboiler, hot oil reboiler, high flashing feed
under control valve which fails in open position upon loss of instrument air) or increase
(reflux pump stream turbine driven, sub cooled feed under control valve which fails in
closed position upon loss of instrument air) the relieving flow rate.
When no specific information exists on linkages and related delay in loss of the
relevant utility upon power failure it is recommended to evaluate the worst case for the
specific pressure relief device sizing leaving to the flare network sizing additional
consideration about applicability of the worst scenario concept to all the circuit
protected by different overpressure relief devices. With regard to specific utility the
worst case is assumed in any case applicable to the whole system; i.e. if the system
comprises a steam reboiler and a reflux pump steam turbine driven both system has to
be considered respectively working or not working at the same time upon the power
failure and the worst case between the above mentioned two will affect the reliving flow
rate.
The Power Failure is a typical scenario where the following consideration applies:
• effect of operator response (refer to para 6.23.5);
• effect of instrumented protective systems (refer to para 6.23.8);
• control system response (refer to para 6.23.6).
Specific consideration applies to furnaces (Process fired heaters or steam generators)

and related heat contribution during the power failure scenario:
• If upon the power failure the feed to the furnace is stopped, the turbulence into the
furnace tube due to vaporisation is sufficient to re-establish in rapid interval time the
heat transfer rate to the normal operating one; thus considering only the fact that the
feed is stopped the heat duty remains the normal operating (maximum operating
condition for conservative approach). In such circumstance the liquid into the
furnace tube is consumed during the vaporisation if no incoming rate (at a rate equal
or less of the vaporisation one) is considered feasible due to hydraulics/layout and
to the pressure drop. Dedicated calculation can be performed to evaluate if the
liquid available can be sufficient to achieve the overpressure protective device set
point; for preliminary and or conservative approach in pressure relief device design,
the liquid amount shall be considered always sufficient.
• As general rule the effect of instrumented protective system (trip of fuel to burner
upon process variable deviation or other sensor/transmitter) has not to be taken into
account for the pressure relief device design (see para 6.23.8).
• The effect of instrumented protective system is generally taken into consideration for
flare system design (refer to chapter 9).
• When the effect of instrumented protective system to stop the fuel to the furnace is
taken into account in estimating the relieving rate, the following apply:
- furnace having fluid passing through convective and radiant zones (e.g: normal
refinery process heater or steam generator): assume 30% of furnace design duty
except for Coking or Soaker into Visbreaking Unit or similar systems where due
to the accumulation of furnace effluents the normal (maximum) operating duty
has to be considered.
- furnace having fluid passing exclusively or almost exclusively through radiant
zone (e.g: craking fired heater): assume 70% of the furnace design duty relevant
to radiant zone.

1000 MU 2005 0 31/48
Note: The 30% figure derives from specific calculation on typical system.
Particularly it refers to the figure that remains available 1 minute after the furnace
fuel trip occurs.
There are non significant difference in that period against natural draught and forced
draught even if for the forced draught, due to the fact that the cooling by the flue gases
is limited, the heat available remains significant (close to the 30% figure) even in the
subsequent minutes. There are significant differences in the heat available after the
fuel trip takes place in furnace provided with refractory and furnace provided with
ceramic insulation; the first typology has greater sensible heat accumulated thus
resulting is longer cooling time. In any case even for the furnace with ceramic
insulation 1 minute after furnace fuel trip, the heat exchanged to the process fluid
remains in the range of 30% of the furnace design duty.
For the consideration relevant to residual cooling capability of Air cooler in case of
motor stoppage refer to para 6.3.
6.18. Blocked in Fired Heater
The scenario is related to the upset caused by blockage on the outlet of a fired heater
(for isolation consideration refer to para 6.23.13).
The upset is very dangerous for the furnace tube due to overheating.
For such instance the scenario shall be prevented and protected primarily by adequate
design, with the aim to minimise chance of flow interruption.
Nevertheless if the scenario of blocked in fired heater is feasible, the overpressure
protective device of the furnace shall be designed to relieve the flow due to liquid
vaporisation in tube considering the maximum operative furnace duty.
Note: the overpressure protective device protects against the overpressurization of the
furnace tube; nevertheless the flow into the tube due to vaporisation and relieving
through the overpressure protective device can be considered to cool for a short time
and amount the tube. If the emergency takes place for a prolonged time even
considering only the residual heat in the furnace refractory the tube will fail against the
overheating regardless of overpressure protective device effectiveness.
6.19. Loss of Heat
The loss of heat as general rule will determine pressure decreasing instead of
overpressure.
Nevertheless in series fractionator, the loss of heat to the first column will have the
chance to overpressure the second one.
Loss of heat to the first column will result in light components to the second one.
Depending on condensing capacity of the second column pressurisation can occur.
6.20. Loss of Absorbent
The loss of absorbent (e.g: amine, caustic, etc) could increase the vapour flow to the
overhead system.
The principle is applicable also to all process circuit where a significant amount of
vapour phase is absorbed into a liquid and also in case of malfunction in semi-batch
absorber (e.g.: PSA Unit - Pressure Swing Absorber).

1000 MU 2005 0 32/48
6.21. Inadvertent Loss of Segregation
The inadvertent loss of segregation (by opening a valve, by leaving turned in open
position a figure height, by leaving in place removable spool, …) between high
pressure and low pressure system can cause overpressurization of the low pressure
one.
The issue specifically applies to system provided with regeneration circuit.
The scenario is considered not applicable only when any of the following positive
isolation is in place (refer also to para 6.23.11 and 6.23.12):
• valve blocked in closed position and dedicated administrative procedure in place to
avoid undue opening while the risk exists and explaining the risk and the operation
to be followed;
• blind in closed position and dedicated administrative procedure in place to ensure
blind is in place while the risk exists and explaining the risk and the operation to be
followed;
• removable spool in place during particular circumstances and dedicated
administrative procedure in place to avoid undue positioning while the risk exists
and explaining the risk and the operation to be followed.
Note: the scenario is considered applicable when segregation system (valve or other)
are provided only with logic system to interlock (permissive linked to instrumented
software or electric circuit); refer also to para 6.23.10.
6.22. Other
On a case by case basis specific scenario can be envisaged different from the ones
previously listed and described.
For instance:
• centrifugal compressor stoppage (ref to JI 2000 “Job Instruction for Settling Out
Pressure and Design Pressure Evaluation for Typical Reaction Loops”)
• generalised loss of steam to one circuit; it can lead to overpressure cause: steam
ejectors, circuit where the pumps are foreseen with steam turbine driver.
• check valve malfunctioning (see para 6.23.2)
6.23. Special Consideration
6.23.1. Double Jeopardy

The causes of overpressure are considered to be unrelated if no linkages exist among

them, or if the length of time that elapses between possible successive occurrences of
these causes is sufficient to make their classification unrelated.
The simultaneous occurrence of two or more unrelated causes of overpressure (also
known as double or multiple jeopardy and in other cases as double contingency) is not
considered the basis for design. Examples of double jeopardy scenarios might be: fire
exposure simultaneous with exchanger internal tube failure, fire exposure simultaneous
with failure of administrative controls to drain and depressure the isolated equipment.

1000 MU 2005 0 33/48
On the other hand, instrument air failure during fire exposure may be considered single
jeopardy if the fire exposure causes local air line failures. The same applies to wrong
operator action during the emergency if specific and clear procedures are not in place.
It has to be pointed out that the double jeopardy concept applies only to unrelated
causes leading to the overpressure scenario.
An emergency scenario (e.g: electrical power failure) during a remote operation
condition (e.g: startup) is not a double jeopardy.
Special case: Latent failure

Double jeopardy does nor apply when the first contingency could be a latent failure (i.e:
failure unrevealed or time to intervene and means and time to re-establish the correct
operating condition, the first contingency can become a possible operating one, thus
resulting credible that its exists when the additional contingency takes place).
6.23.2. Check Valves
A single check valve is considered not effective means for preventing overpressure by
reverse flow from a high-pressure source.
When sizing the overpressure protective device to prevent exceeding the allowable
accumulation of the protected equipment for the latent check valve failure, the reverse
flow rate through a single check valve may be determined using the normal flow
characteristics (i.e., forward flow Cv) of the check valve. If the check valve Cv is
unavailable it has to be conservatively assumed that the check valve is not there by
taking no credit for its flow resistance.
If the single check valve is inspected and maintained to ensure its reliability and
capability to limit reverse flow, the check valve latent failure is considered unlikely. In
this case, overpressure protection should be provided where the maximum normal
operating pressure of the high-pressure system is greater than the upstream
equipment’s corrected hydrotest pressure (refer to para 6.23.3).
If this credit is taken in excluding the overpressure scenario dedicated operating
procedure shall be in place (refer to para 6.23.11).
Experience has shown that when inspected and maintained to ensure reliability and
capability to limit reverse flow, two back flow prevention devices in series are sufficient
to eliminate significant reverse flow.
If this credit is taken in excluding the overpressure scenario dedicated operating
If reliability of the series back flow prevention cannot be assured, then it may be
necessary to estimate the reverse flow. The quantity of back flow leakage through
check valves in series depends on the types of check valves, the fouling nature of the
fluid and other system considerations.
As general rule the reverse flow through series check valves can be estimated as the
flow through a single orifice with a diameter equal to one-tenth of the largest check
valve’s nominal flow diameter.

1000 MU 2005 0 34/48
6.23.3. Hydraulic Test Pressure
In some circumstances the fact that the equipment can withstand pressure greater than
their design pressure - but less than the corrected hydrostatic pressure - is taken into
account.
Hydrostatic pressure requirement can differ project by project, particularly they can be
affected by Local Legislation.
The hydrostatic pressure according to the main codes is the following:
ASME VIII Div.1: hydrostatic pressure at least 1.3 times the maximum allowable
working pressure multiplied by the lowest ratio (for the materials of which the vessel is
constructed) of the stress value S for the test temperature on the vessel to the stress
value S for the design temperature.
PED: the hydrostatic test pressure no less than:

• that corresponding to the maximum loading to which the pressure equipment may
be subject in service taking into account its maximum allowable pressure and its
maximum allowable temperature, multiplied by the coefficient 1.25, or
• the maximum allowable pressure multiplied by the coefficient 1.43, whichever is the
greater.
The corrected hydrostatic pressure to be taken into account for the purpose of present
document, in the above cases, is:
ASME: 1.3 times the maximum allowable working pressure
PED: 1.25 times the maximum allowable working pressure
6.23.4. Limit Stop
Credit on presence of limit stop (not allowing complete opening or compete closure) on
control valve should be done, provided that:
• the limit stop removal can not be performed since a locking device exists (similar on
those provided on manual valve - refer to para 6.23.12) and operating procedure is
in place to highlight the related risk (refer to para 6.23.11), or the limit stop is integral
or internal to valve thus it can not be removed unless the valve is dismantled,
• the presence of the limit stop, the scope and the risks associated to its removal are
listed in control valve data sheet (refer to chapter 7).
6.23.5. Operator Response
The effect of operator response in limiting the maximum relieving capacity or in

excluding the emergency scenario can be considered if all the following apply:
• there are sufficient means to alert the operator of the upset occurring (note: the
alarm initiator shall be independent from the one which could determined the cause
of the upset);

1000 MU 2005 0 35/48
• it is not expected that the upset raises in conjunction with another one (note: no
credit of operator intervention upon generalised scenario such as electrical power
failure, cooling water failure, loss of instrument air, …),
• operating procedure (see para 6.23.11) exists detailing the action to be performed
by the operator and the associated risk,
• there is enough time for the operator to intervene (note: the time starts when the
alarm is reached not when the cause of upset manifests unless they are mutually
related; e.g.: low level alarm is reached with time delay from the feed stoppage to a
separator, whereas the low flow alarm on feed line is simultaneous with the upset)
and to verify the effectiveness of the intervention.
The time which is considered sufficient to have an effective operator response depends
on process dynamics and on complexity of the process itself; API RP 521 para 3.4
suggest a figure whiting the range of 10 to 30 minutes.
E.g. the overfilling scenario is considered to be simple problem (refer to para 6.6), thus
having the alarm, the detailed instruction to be followed and means to detect the
effectiveness of the intervention the bottom range figure can be considered (10 minutes
for operator response time)
6.23.6. Control System Response
Credit for the effect of control system response in limiting the maximum relieving
capacity or in excluding the emergency scenario shall never be taken.
On the contrary control system negative effect can be considered when it is reasonable
that the control system react negatively to the overall scenario.
When the control system negative reaction upon the upset is not applicable, the effect
of normal flow (as per para 6.23.7 below) into the line which is not affected by the
emergency scenario under analysis should be considered in evaluating the pressure
relief device relieving capacity.
6.23.7. Operating process condition to be considered
The worst operating condition shall be considered in the emergency scenario and in
evaluating the related relieving capacity.
Note: the operating condition to be considered applies to the whole process circuit.
6.23.8. Effect of Instrumented Protective Function

As general rule no credit on instrumented protective function (trip or emergency

starting) is allowed in overpressure relief scenario evaluation.
To reduce the maximum relieving capacity of the overpressure relief device or to
exclude the emergency scenario, the use of instrumented protective function (in some
cases called also high integrity protective instrument systems) is allowed only if all the
following apply:

1000 MU 2005 0 36/48
• the use or the sizing of the overpressure relief device or of the downstream
collecting system is impractical, the instrumented protective function reliability shall
be greater than the reliability of a pressure relief device (failure of pressure relief
device assumed to be once every one thousand demands); note: the reliability of the
instrumented protective system can be treated also by methodology detailed in 1000
JI 2502 “Safety Integrity Level (SIL) Classification and Implementation in Safety
Instrumented System (SIS)”, in that case the instrumented protective function will
have SIL equal to 3;
• during the test interval time of the instrumented protective function the effectiveness
of the same instrumented protective function shall be ensured or the test shall be
performed when the emergency scenario shall not take place (e.g.: at unit
shutdown, at specific turndown);
• the instrumented protective function shall be always effective when the emergency
can take place, thus no override (process, maintenance, …) function shall be
foreseen,
• the scope of the system shall be highlighted in the interlock description or on P&ID
(see chapter 7).
In any case the use of instrumented protective function shall be agreed between the
TPIT Project Process Manager/Coordinator, the TPIT TRA&EP Section Head, and the
Process Department Director.
6.23.9. Effect of Mechanical Interlock
Credit on presence of mechanical interlock (e.g.: not allowing opening of one valve
unless another is closed) should be taken in limiting the maximum relieving capacity or
in excluding emergency scenario.
Note: some mechanical interlock are strictly mechanical not allowing operator
intervention; in some other case the interlock is achieved by a combination of
mechanical step and procedural/administrative one, in such case detailed operating
6.23.10. Effect of Interlock or Connection other than Mechanical
Credit on presence of interlock different from the mechanical one (e.g.: software or
electrical system not allowing opening of one valve unless another is closed) shall not
be taken in limiting the maximum relieving capacity or in excluding emergency
scenario.
6.23.11. Operating Procedure
Dedicated operating procedure shall be provided when:

• the Operator Response upon the upset is taken into account in limiting or in
excluding the emergency scenario,
• the correct operating action is computed in a specific procedural step operation.

1000 MU 2005 0 37/48
The summary of points of interest of the operating procedure which will be part of the
Operating and Maintenance Manual shall be listed in the specific document (refer to
chapter 7).
6.23.12. Use of Valve Blocked in Closed/Open Position
From the purpose of present document the use of valve blocked in position to exclude
or to limit the emergency scenario is allowed.
Nevertheless it has to be pointed out that the use of those valves shall be verified
against the Project site applicable code and legislation.
Depending on customer and on licensor those valves can be indicated as provided

with:
• locking device (lock with or without chain);
• car sealing (plastic or metal strap);
to stop valve hand wheel, lever or actuator.

In any case the risk associated with valve misuse and highlighted in dedicated
operating procedure (refer to para 6.23.11), and all these valves shall be indicated on
P&ID as blocked in position (refer to chapter 7).
To avoid misinterpretation those valves shall be indicated on P&ID differently from the
ones related only to the prevention of process upset. On the other hand all the valves
provided with the purpose of not exceeding the material allowable design limits
(overpressure, vacuum, high/low temperature) shall be indicated in the same way on
P&ID.
6.23.13. Element which can isolate one equipment from another
Equipment connected together by a system of adequate piping not containing means

which could lead to isolation, can be considered as one circuit in figuring the required
pressure relief device. In that case the pressure relief device is intended to protect all
the equipment against any applicable scenario.
Note for design of equipment: in such a case the design pressure of each equipment
shall take into account the pressure drop across the equipment and line during the
emergency relieving scenario.
Element which can isolate one equipment from the others are the following:
(a) blind or cap (this includes blind which can be inadvertently left in position after
maintenance);
(b) manual block valve or manual control valve (exception: valve blocked in open
position and provided with dedicated procedure as per para 6.23.11 and 6.23.12
can be considered not source of blockage);
(c) automatic control valve (note: closure of valve is always possible regardless its
failure mode);
(d) on/off valve;

1000 MU 2005 0 38/48
(e) volumetric machine internals (volumetric machine such as cylinder/piston

arrangement could result in isolation due to possible failures in piston, cylinder
valves, etc.);
(f) check valve (versus opposite the normal flow through check valve);
(g) check valve (same versus of normal flow through check valve);
(h) any device determining flow diversion into multiple restricted passages: cartridge or
mesh filter, strainer, grid, flame arrester, catalysts, molecular adsorbents, molecular
sieves, colaescer, …
Special case 1
For the consideration given in para 6.23.1 the above elements (g) and (h) can be
excluded from the ones resulting in causes of isolation which is at the same time the
causes of the overpressure scenario (e.g.: closed outlet, cold side of exchanger
blocked in, …), if all the following applies:
• they are normally in operation (normal process stream passes through them),
• sudden significant obstacle to the flow can not be envisaged (significant means the
one which could cause the overpressure scenario),
• the progressive increasing of the obstacle to the flow can be detected easily and
there is adequate time for the operator to intervene before the significant obstacle to
the flow occurs.
Being the operator intervention part of the protective approach, dedicated procedure
shall be ensured (see para 6.23.11).
Special case 2
For the consideration given in para 6.23.1 the above elements (g) and (h) can be
excluded from the ones resulting in causes of isolation leading to overpressure
scenario when an independent cause of pressure increase concurs (e.g.: fire,
exchanger tube failure, …), if all the following applies:
• they are normally in operation (normal process stream passes through them);
• the obstacle to the flow, developed during the normal operation of the equipment,
can be detected adequately and the operator will intervene to establish the original
working condition; being that condition in place in case the fire occurs it can be
always assumed that the element does not create significant obstacle to the
relieving path;
• the fire exposure does not create products which can determine the
plugging/blockage of the element due to decomposition, polymerisation, reaction,
…. ;
Being the operator intervention part of the protective approach, dedicated procedure
shall be ensured (see para 6.23.11).
7. ASSUMPTION IN EXCLUDING/LIMITING EMERGENCY SCENARIO
As detailed in previous paragraph the pressure relief device selection and sizing
comprises several assumptions.
All these assumptions have to be delivered to the final user to ensure proper
application and effectiveness.

1000 MU 2005 0 39/48
Many of these assumptions are relevant to operating procedures that have to be

included in the Operating and Maintenance Manual.
Thus, in conjunction with the pressure relief device design development, the designer
is responsible for implementation and for the assumption transfer to the final user.
The most important and frequent issues related in assumption excluding/limiting the
emergency scenario are the following (note: the document/deliverable, where the
assumption has to be highlighted, is given within brackets):
• maximum Cv of control valve (Data Sheet and P&ID)

• limit stop on control valve (Data Sheet and P&ID)
• valves to be in blocked -open/closed- position (P&ID)
• risk associated to operation of valves blocked in position (operating guidelines or
Operation and Maintenance Manual)
• isolation means to ensure high/low pressure circuit segregation (operating
guidelines or Operation and Maintenance Manual)
• areas where fire scenario is not considered credible (flare system design description
or Pressure Relief Devices Summary of Rates)
• equipment provided with fire resistant insulation material (Data Sheet)
• high integrity protective system (interlock description or P&ID)
• safety operation to be performed by the operator when it becomes part of the
protective system. E.g: time to intervene and operation to be performed to avoid
overfilling; drainage and venting of exchanger when not in operation to avoid fire
scenario (operating guidelines or Operation and Maintenance Manual).
8. PRESSURE RELIEF DEVICES
For general requirement refer to API RP 520 Part I and II or to ISO 4126.
8.1. Orifice Sizing
Depending on applicable regulation, the formulae relevant to orifice calculation are

given in:
• ISPESL raccolta E (only vapor critical flow, for sub critical flow and liquid flow it
remands to manufacturer; applicable to equipment above 0.5 kg/cm2g [0.49 barg]);
• API RP 520 Part I (steam, gaseous critical and sub critical flow, liquid and two-
phase flow; including and above 15 psig [1.03 barg]);
• ISO 4126 (steam, gaseous critical and sub critical flow, liquid and two-phase flow;
including and above 0.1 barg);
• API Std 2000 (up to 15 psig [1.03 barg]).
Note:
API RP 520 Part I and ISO 4126 formulae are similar; particularly they are identical for
safety valve (not provided in conjunction with rupture disk) for critical and sub critical
flow, except the fact that at denominator:
API has:
• Kb (back pressure correction factor) and Kd (effective coefficient of discharge)

1000 MU 2005 0 40/48
ISO has:
• Kdr where the Kdr (certified derated coefficient of discharge) is equal to Kd (certified
coefficient of discharge evaluated taking into account the back pressure) multiplied
by 0.9.
8.2. Design Condition
Design condition (pressure, temperature) are the same of those relevant to the
equipment where the pressure relief device is installed.
A note on pressure relief device data sheet shall indicate the maximum relieving
temperature among all the applicable scenarios if greater than the design.
A typical case is case where the relieving temperature exceeds the design temperature
is the one associated to fire scenario.
8.3. Pressure Relief Device Typology
As general rule the use of pressure safety valve is preferred instead of rupture disk due
to the fact that the valve goes to closed position when the emergency scenario ceases.
Rupture disk are used in special cases where the faster opening becomes mandatory.
In case of devices relieving into closed circuit (flare, common stack, closed drain
system) the use of pressure relief valve balanced or pilot operated is recommended.
In case of devices relieving to atmosphere the use of conventional pressure relief valve
is allowed.
In such circumstance rupture disk (non-fragmenting) at the inlet of the pressure relief
valve is recommended for those cases where the leakage to the atmosphere is not
tolerable (e.g.: environment hazardous material).
Rupture disk (non-fragmenting) at the inlet of the pressure relief valve is also
recommended in all cases where the pressure relief valve material is expected to be
damaged by the continuous exposure to the fluid present into the protected equipment,
or when plugging by solid deposition is expected.
When rupture disk (non-fragmenting) and pressure relief valve are used in
combination, the installation of pressure indicator (local indication or at centralised
location depending on site characteristic and client expectation) is recommended.
8.4. Pressure Relief Device Outlet Piping

Devices which could lead to isolation of the pressure relief device from the downstream
system shall be avoided much as possible.
Provision of manual valve blocked in open position or mechanically linked to another

one (ensuring one is always open) is allowed as per para 6.23.10 and para 6.23.9.

1000 MU 2005 0 41/48
Provision of filters, grid, flame arrester, check valve, block valve interlocked by system
different than mechanical is not allowed.
All pressure relief device outlet piping, when discharging to a common header in
vapour service, should be sloped towards the common header and no low point shall
be present along the pressure relief device outlet piping and along the header if there
is the possibility of presence of liquid directly released by the pressure relief device or
due to the condensation of the vapour present normally or in case of emergency.
When such kind of installation becomes impractical, and only in case of pressure relief
devices determining only vapour relief or leading to limited amount of liquid (e.g:
thermal relief device), the arrangement given in the following picture can be used.

1000
Project N°
Unit
MU 2005
Document Code

Serial N°
0
Rev.
Page
42/48
1000 MU 2005 0 43/48
8.5. Large Pressure Relief Valve
Use of large valves (such as Q and larger) should be minimized. When installation can
not be avoided for Q and larger pressure relief valve than note on P&ID shall indicate
the provision of reinforced supports to withstand chattering.
8.6. Accumulation - Overpressure
The Accumulation is the pressure increase over the maximum allowable working
pressure of the equipment.
The Overpressure is the pressure increase over the relieving device set pressure.
Both accumulation and overpressure are expressed in percentage of the related
pressure.
API/ASME allows accumulation of 21% in case of fire exposure, of 16% in case of

multiple pressure relief valve installation where the sizing case is different from the fire
case, of 10% in case of single valve installation where the sizing case is different from
the fire case.
As general rule PED allow the pressure surge of 10% of the maximum allowable
pressure during the relieving condition for any applicable scenario (Annex I section
2.11.2). The PED Guideline 5/2 specifies that the 10% limit is not applicable to fire
scenario.
Local legislation can provide different requirement; particularly Italian legislation falls
into ISPESL requirement:
ISPESL Raccolta E section E.1.D.2 point 9.2
“La pressione p1 corrispondente alla massima portata della o delle valvole di sicurezza,
non può superare la pressione di progetto dell’apparecchio. E’ consentito, tuttavia, di
superare di non più del 10% la pressione di progetto dell’apparecchio stesso a
condizione che:
• gli apparecchi appartengano alla prima o seconda categoria di cui alla
specificazione tecnica applicativa del D.M. 21 novembre 1972 Raccolta “S”
• le valvole di sicurezza siano del tipo specificato”.
The above specification does not make distinction between fire and operating scenario.
Note: the pressure relief device set pressure, the maximum allowable working
pressure, the maximum allowable pressure are expressed in pressure relative to
atmospheric pressure (i.e.: pressure gauge).
9. DISPOSAL SYSTEM
Disposal system design shall follow requirements in API RP 521 and API RP 520 Part
II.

1000 MU 2005 0 44/48
9.1. Selection of Disposal System
Selection of pressure relief devices discharge disposal system (closed system or open
to atmosphere) shall be determined in accordance with the following criteria.
In many situations, pressure relief vapour streams may be safely discharged directly to
the atmosphere if environmental regulations permit such discharges.
The first and main consideration in the selection of disposal system regards hazardous
characteristics of fluid disposed: if the material discharged is in gas/vapour phase, is
not combustible, not toxic, not environmental pollutant, than disposal to atmosphere
shall be selected.
In addition, disposal to atmosphere of hazardous material could be evaluated if release

to a closed system is impractical (for example on low pressure systems), with the
following constrains:
• frequency of emergency: emergency release scenario frequency can be reduced
introducing independent protecting layers such as instrumented protective functions
or operating procedures;
• released stream shall be in vapour phase not condensing;
• a dispersion model shall be developed to determine affected area for all applicable
emergency scenarios except fire case;
• for combustible material release temperature shall be below auto ignition;
• the impact related to possible neighbouring public issues (e.g.: odour, visual, …)
shall be evaluated and solved.
Note: particular attention in selecting disposal system shall be paid for circuit normally
handling not hazardous material (i.e. cooling water, steam, nitrogen, ...) where
emergency scenarios applicable in pressure relief device sizing are exchanger tube
failure or gas break through, that could lead to discharge of materials different from the
material handled in the system. In such cases, if routing the pressure relief device
discharge line to a closed system is impractical or not feasible, means for removing the
scenario leading to hazardous material release or minimizing its expected frequency of
occurrence shall be considered.
Special considerations
Consideration should be given to any phase change – either vaporization of liquid or
condensation of vapour – that occurs in the fluid when the pressure is reduced or as a
result of cooling. With auto refrigeration, vaporization of volatile liquids may be
incomplete unless facilities are provided to add the necessary heat for vaporization.
Caution should be exercised to avoid mixing chemicals that may react in flare headers.
Materials that react violently when mixed with water (such as, alkyls, sodium,
potassium, and silanes) should be routed to a segregated header which does not
contain water.
The monetary value of process wastes may warrant special means of collection for
return to the process (e.g, costly solvents). An economic engineering evaluation can
determine whether the recovery value of the material justifies the installation of a
recovery system.

1000 MU 2005 0 45/48
9.2. Design of Open Disposal System
Hazardous material discharge:

• the exit velocity at outlet piping tip shall be 30 m/s minimum for all discharges
scenarios except fire. This is to allow a better dispersion of flammable vapour/gas.
Special consideration shall be given to discharge scenarios with low relieving rates
(not design case), for which too high exit velocities could determine excessive build-
up back pressure
• location:
- Riser shall have 2 m minimum vertical length;
- Riser tip shall be 25 m minimum high from ground;
- Riser shall discharge vertically upward, at 3 m minimum height from every
platform, walkway, equipment within 15 distance;
- The riser tip shall be at least as high as any part of the vessel or its overhead
piping, to prevent discharge impingement;
- for combustible material 30 m minimum distance from possible open flame
ignition source (furnaces, boiler, …);
• for flammable/toxic vapours, adequacy of vent location shall be verified with
dispersion calculation.
9.3. Design of Closed Disposal System
9.3.1. General Considerations
Closed disposal systems collect the emergency discharges form several pressure relief
device.
In some cases it can also handle continuos or intermittent discharges from operating
vents.
System shall be designed taking into account the worst vapor and liquid flow rate
discharged to the system, taking into account the following:
(a) generalised scenario (refer to para 6)

(b) single scenario (particularly with regard to liquid release)
(c) depressurization
(d) operating vent (particularly during start-up operation)
In addition it has to be evaluated the possible simultaneity of case (a) or (b) with cases
(c) and (d).
Particularly with regard to the generalised scenario the following apply:
Power Failure it is considered generalised to the whole plant if a single point of
failure is recognised to lead to loss of power to the whole plant. It has to be

highlighted that independent separated sources of electric power are not often
provided, thus resulting the Power Failure affecting the whole plant.
For Cooling water failure there are often independent segregated circuit thus it is
reasonable to consider only the failure of one circuit at the time.
Fire scenario is considered not affecting the whole plant, but only a single Fire Area
at time. The criteria to identify a single fire area are the following:
- a free space of 15 meters on each side around the selected plant area (from
each equipment or line handling combustible liquid),

1000 MU 2005 0 46/48
- adequate means (drainage, sloping, curb, diversion wall, …) to ensure that any
combustible liquid spreading will not reach the plant area adjacent to the
selected one.
With the above criteria the Fire Area could have large dimension and also in that
case is not reasonable to considered that the whole area will be affected by the fire
at the same time. If the area is adequately paved and sloped and provided with
drainage system dimensioned to remove spillage and firewater the Flame Area of
500 m2 can be assumed as the area within a Fire Area affected at the same time by
fire exposure.
9.3.2. Effect of Instrumented Protective Function
Although the reliability of safety instrument functions (SIF) is of high level it is never
assured that all the instrument safety functions are 100% effective at the same time
during an emergency.
Thus a number of instrument safety functions shall be considered not effective while
the remaining are assumed to function properly.
The number of not effective instrument safety functions is related to the reliability of
each SIF and to the overall number of SIFs (NSIF).
As a general rule two main categories of instrument safety functions are considered.
Medium reliable instrument safety functions:
SIF classified as SIL 1
High reliable instrument safety functions:

SIF classified as SIL2 or SIL 3
For Projects where SIL classification is not performed, following conservative typical
configuration shall be considered.
Medium reliable instrument safety functions:

Initiator, one of the following configurations:
• one transmitter,
• three transmitters (logic 2oo3)
• two transmitters (logic 1oo2)
logic solver: certified as minimum for SIL 3 application
final element: one valve or switch that eliminate cause of overpressure by stopping fluid
or power.
Test interval time: six months.
High reliable instrument safety functions:

Initiator:
• three transmitters (logic 2oo3)
• two transmitters (logic 1oo2)
final element: two in series (logic 1oo2) that eliminate cause of overpressure by
stopping fluid or power
Test interval time: six months.

1000 MU 2005 0 47/48
For closed system design the application of instrumented protective function allows to
reduce the overall amount of simultaneous releases into the system as detailed here
below (calculations are made considering less than 50 total release scenarios – i.e.
number of pressure relief device or groups of them). In the designed of the closed
system for each section (sub header, unit KOdrum) the most critic combination of SIF
not functioning shall be considered.
Medium reliable SIF:
NSIF <= 2 then 1 SIF is assumed not functioning
2< NSIF <= 10 then 2 SIF are assumed not functioning
10< NSIF <= 25 then 3 SIF are assumed not functioning
NSIF > 25 then 4 SIF are assumed not functioning
High reliable SIF:
NSIF <= 25 then 1 SIF is assumed not functioning

NSIF >25 then 2 SIF are assumed not functioning
Note: a SIF is identified by the initiator (transmitter) together with all the final elements
activated by the initiator. A SIF failure will determine failure of activation of all final
elements, unless the initiator. If failure of initiator is considered extremely unlikely
(process or maintenance override is not allowed, initiator implemented as SIL 3), than
SIF failure will determine failure of activation of a number of final elements as detailed
in the Special Case discussed here below).
Special Case. Activation of general/ partial plant shut-down by push button.
Possible sources of overpressure generated by activation of general/partial plant shut

down when not required (i.e. plant in normal operation) shall be investigated, verifying
flare header system against the worst combination of final elements malfunction
Medium reliable system:

final element: one valve or switch that eliminate cause of overpressure by stopping fluid
or power
NFinal Elements <= 2 then 1 Final Element is assumed not functioning
2< NFinal Elements <= 11 then 2 Final Element are assumed not functioning
10< NFinal Elements <= 29 then 3 Final Element are assumed not functioning
NFinal Elements > 29 then 4 Final Element are assumed not functioning

1000 MU 2005 0 48/48
High reliable system:

final element: two valves in series (logic 1oo2) or switch in series (logic 1oo2)
NFinal Elements <= 29 then 1 Final Element is assumed not functioning
NFinal Elements >29 then 2 Final Element are assumed not functioning

Manuale Sicurezza - 1000-MU-2005 - E - 0

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Manuale Sicurezza - 1000-MU-2005 - E - 0

Uploaded by

Copyright:

Available Formats

Project N° Unit Document Code Serial N° Rev.

6.23. Special Consideration 32

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

Selection of Disposal System

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

Present Manual applies to all components being part of overpressure protection

ISO 23251 Petroleum, petrochemical and natural gas industries -

Directive 97/23/CE Pressure equipment directive

API RP 521 Guide for pressure-relieving and depressuring systems

API Std 2000 Venting atmospheric and low-pressure storage tank

ASME VIII Div. 1 Rules for construction of pressure vessels

ASME I Rules for construction of power boilers

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

D.Lgs. 25 Febbraio 2000 Attuazione della direttiva 97/23/CE in materia di

Circolare ex ANCC 15 novembre 1979 n°38468 Raccolta E

Following exceptions clarifications derive from applicable standards.

Italian regulation - ISPESL

from requirement of UG-125; particularly the following are excluded:

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

1000 JI 2502 Safety Integrity Level (SIL) Classification and Implementation

XXXX JSD 0000.02 Basic Process Design Requirements and Criteria

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

SP1545 Data Sheet for Safety Valve and Rupture Disk

NM 0006 Pressure Relief Device Summary of Rates

CN 1545 Summary Calculation Sheet for Pressure Relief Device

4.1. General note

Pressure relief device device designed to relieve excess pressure.

Vessel tower/columns – vessel/drum – heat exchanger – reactor –

ANCC Associazione Nazionale per il Controllo della Combustione

ASME American Society of Mechanical Engineers

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

TPIT Technip Italy S.p.A.

6. DETERMINATION OF EMERGENCY SCENARIO LEADING TO OVERPRESSURE

Overpressure is the result of an unbalance or disturbance of the normal flows of

It has to be highlighted that in the design of industrial complex, it is mandatory to

Two or more causes of overpressure are considered unrelated if among them no

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

Emergency scenario Single Generalised

6.1. Blocked Outlet

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

Some examples of blocked outlet emergency are given here below:

6.1.1. Reaction section of desulphurization unit (two phase fluid)

In the high pressure system of desulphurization unit the dimensioning emergency of

6.1.2. Pump discharge

Rotary and reciprocating pumps:

6.1.3. Compressor discharge

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

6.1.4. Steam turbines

Back pressure turbines:

6.1.5. Column overhead line closed

6.2. Cooling Water Failure or Coolant Failure

Sometimes this emergency – as generalised emergency involving more section of plant

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

Also overhead vapour composition is altered, in particular if the considered emergency

6.2.1. Total condensation

6.2.2. Partial condensation

6.3. Fan Failure

6.3.1. Fan motor stoppage

TECHNIP ITALY S.p.A. - 00148 ROMA - Viale Castello della Magliana, 68

6.3.2. Louver closure

The closure of the louver, if installed, is depending on several causes: automatic

6.4. Reflux Failure (Top of Column or Side Stream)