DEP SPECIFICATION
OVERPRESSURE AND UNDERPRESSURE - PREVENTION
AND PROTECTION
DEP 80.45.10.11-Gen.
February 2011
(DEP Circular 67/11 has been incorporated)
ECCN EAR99
DESIGN AND ENGINEERING PRACTICE
DEM1
© 2011 Shell Group of companies
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, published or transmitted, in any form or by any means, without the prior
written permission of the copyright owner or Shell Global Solutions International BV.
This document contains information that is classified as EAR99 and, as a consequence, can neither be exported nor re-exported to any country which is under an
embargo of the U.S. government pursuant to Part 746 of the Export Administration Regulations (15 C.F.R. Parts 746) nor can be made available to any national of such
country. In addition, the information in this document cannot be exported nor re-exported to an end-user or for an end-use that is prohibited by Part 744 of the Export
Administration Regulations (15 C.F.R. Parts 744).
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 2
PREFACE
DEP (Design and Engineering Practice) publications reflect the views, at the time of publication, of Shell Global
Solutions International B.V. (Shell GSI) and, in some cases, of other Shell Companies.
These views are based on the experience acquired during involvement with the design, construction, operation and
maintenance of processing units and facilities. Where deemed appropriate DEPs are based on, or reference
international, regional, national and industry standards.
The objective is to set the recommended standard for good design and engineering practice to be applied by Shell
companies in oil and gas production, oil refining, gas handling, gasification, chemical processing, or any other such
facility, and thereby to help achieve maximum technical and economic benefit from standardization.
The information set forth in these publications is provided to Shell companies for their consideration and decision to
implement. This is of particular importance where DEPs may not cover every requirement or diversity of condition at
each locality. The system of DEPs is expected to be sufficiently flexible to allow individual Operating Units to adapt the
information set forth in DEPs to their own environment and requirements.
When Contractors or Manufacturers/Suppliers use DEPs, they shall be solely responsible for such use, including the
quality of their work and the attainment of the required design and engineering standards. In particular, for those
requirements not specifically covered, the Principal will typically expect them to follow those design and engineering
practices that will achieve at least the same level of integrity as reflected in the DEPs. If in doubt, the Contractor or
Manufacturer/Supplier shall, without detracting from his own responsibility, consult the Principal.
The right to obtain and to use DEPs is restricted, and is typically granted by Shell GSI (and in some cases by other Shell
Companies) under a Service Agreement or a License Agreement. This right is granted primarily to Shell companies and
other companies receiving technical advice and services from Shell GSI or another Shell Company. Consequently, three
categories of users of DEPs can be distinguished:
1) Operating Units having a Service Agreement with Shell GSI or another Shell Company. The use of DEPs by
these Operating Units is subject in all respects to the terms and conditions of the relevant Service Agreement.
2) Other parties who are authorised to use DEPs subject to appropriate contractual arrangements (whether as part
of a Service Agreement or otherwise).
3) Contractors/subcontractors and Manufacturers/Suppliers under a contract with users referred to under 1) or 2)
which requires that tenders for projects, materials supplied or - generally - work performed on behalf of the said
users comply with the relevant standards.
Subject to any particular terms and conditions as may be set forth in specific agreements with users, Shell GSI
disclaims any liability of whatsoever nature for any damage (including injury or death) suffered by any company or
person whomsoever as a result of or in connection with the use, application or implementation of any DEP, combination
of DEPs or any part thereof, even if it is wholly or partly caused by negligence on the part of Shell GSI or other Shell
Company. The benefit of this disclaimer shall inure in all respects to Shell GSI and/or any Shell Company, or companies
affiliated to these companies, that may issue DEPs or advise or require the use of DEPs.
Without prejudice to any specific terms in respect of confidentiality under relevant contractual arrangements, DEPs shall
not, without the prior written consent of Shell GSI, be disclosed by users to any company or person whomsoever and
the DEPs shall be used exclusively for the purpose for which they have been provided to the user. They shall be
returned after use, including any copies which shall only be made by users with the express prior written consent of
Shell GSI. The copyright of DEPs vests in Shell Group of companies. Users shall arrange for DEPs to be held in safe
custody and Shell GSI may at any time require information satisfactory to them in order to ascertain how users
implement this requirement.
All administrative queries should be directed to the DEP Administrator in Shell GSI.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 3
TABLE OF CONTENTS
1. INTRODUCTION ........................................................................................................5
1.1 SCOPE........................................................................................................................5
1.2 DISTRIBUTION, INTENDED USE AND REGULATORY CONSIDERATIONS .........5
1.3 DEFINITIONS .............................................................................................................5
1.4 CROSS-REFERENCES .............................................................................................7
1.5 SUMMARY OF MAIN CHANGES...............................................................................7
1.6 COMMENTS ON THIS DEP .......................................................................................8
1.7 DUAL UNITS...............................................................................................................8
2. DESIGN PHILOSOPHY..............................................................................................9
2.1 PRESSURE SYSTEM SAFETY STUDY ....................................................................9
2.2 DESIGN PRESSURE .................................................................................................9
2.3 DESIGN FOR PUMP SHUT-OFF HEAD....................................................................9
2.4 PRESSURE SYSTEM ENVELOPE............................................................................9
2.5 UNIT TURNDOWN CONSIDERATIONS..................................................................10
2.6 IMPACT OF UPSTREAM CONDITIONS ON DOWNSTREAM SYSTEMS .............10
2.7 MIXING OF HOT MATERIALS WITH VOLATILE MATERIALS ...............................11
2.8 INTERFACES WITH THIRD PARTIES ....................................................................11
2.9 FAILURE POSITION OF CONTROL VALVES.........................................................11
2.10 ROLE OF INSTRUMENTATION IN OVERPRESSURE PROTECTION ..................11
2.11 ROLE OF CHECK VALVES (NON RETURN VALVES) IN OVERPRESSURE
PROTECTION ..........................................................................................................14
2.12 DESIGN AND REMOTE CONTINGENCY SCENARIOS .........................................20
2.13 ALLOWABLE ACCUMULATION AND UNDERPRESSURES .................................20
2.14 OPERATOR INTERVENTION ..................................................................................20
2.15 ADMINISTRATIVE CONTROLS...............................................................................21
3. DESIGN SCENARIOS..............................................................................................23
3.1 GENERAL .................................................................................................................23
3.2 POWER FAILURE ....................................................................................................23
3.3 STEAM FAILURE .....................................................................................................24
3.4 COOLING WATER FAILURE ...................................................................................24
3.5 GENERAL INSTRUMENT AIR FAILURE.................................................................25
3.6 INDIVIDUAL CONTROL VALVES – OPEN AND CLOSED .....................................25
3.7 VAPOUR BREAKTHROUGH ...................................................................................25
3.8 MANUAL VALVE OPERATION ................................................................................30
3.9 FIRE ..........................................................................................................................30
3.10 THERMAL RELIEF/THERMAL EXPANSION RELIEF .............................................36
3.11 REACTIVE HAZARDS..............................................................................................38
3.12 VACUUM...................................................................................................................38
4. REMOTE CONTINGENCY SCENARIOS ................................................................39
4.1 GENERAL .................................................................................................................39
4.2 HEAT EXCHANGER TUBE RUPTURE ...................................................................39
4.3 INEFFECTIVE OPERATOR INTERVENTION .........................................................42
4.4 BOTH CONTROL VALVE AND BYPASS WIDE OPEN...........................................42
4.5 VAPOUR BREAKTHROUGH ...................................................................................42
4.6 IMPROPER VALVE SEQUENCING.........................................................................42
4.7 BLOCKED OUTLET DUE TO CHECK VALVE FAILURE ........................................43
5. SPECIFIC PROCESS EQUIPMENT GUIDANCE ....................................................44
5.1 FRACTIONATING COLUMN RELIEF ......................................................................44
5.2 FURNACES AND FIRED PROCESS HEATERS .....................................................49
5.3 HEAT EXCHANGER – DIFFERENTIAL PRESSURE DESIGN ...............................50
5.4 ROTATING EQUIPMENT .........................................................................................50
5.5 LUBE-OIL SYSTEMS ...............................................................................................52
5.6 EJECTORS...............................................................................................................52
5.7 INTERFACES WITH PIPELINES .............................................................................52
5.8 DOUBLE-SEATED VALVES.....................................................................................53
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 4
5.9 INSTRUMENTATION ...............................................................................................53
6. STORAGE TANKS...................................................................................................54
6.1 GENERAL .................................................................................................................54
6.2 NORMAL VENTING..................................................................................................54
6.3 FIRE CASE ...............................................................................................................54
6.4 RELIEF CRITERIA....................................................................................................55
7. DOCUMENTATION ..................................................................................................56
8. REFERENCES .........................................................................................................57
9. BIBLIOGRAPHY ......................................................................................................59
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 5
1. INTRODUCTION
1.1
SCOPE
1.2
This DEP specifies requirements and gives recommendations for the protection of
1.3 equipment against overpressure and underpressure. This DEP is a supplement to ISO
1.3.1 23251 and ISO 28300.
NOTES: 1. API Std 521 is identical to ISO 23251.
2. API Std 2000 is identical to ISO 28300
For pressure relief facilities of liquefied petroleum gas in bulk storage installations,
DEP 30.06.10.12-Gen. shall also apply.
For LPG supply/distribution facilities (for retail and commercial distribution), the relieving
facilities for vessels with capacities not greater than 135 m3 (4800 ft3) shall be in
accordance with NFPA 58.
Design of pressure relief, flare and vent systems shall be in accordance with
DEP 80.45.10.10-Gen.
Emergency depressuring and sectionalizing shall be in accordance with
DEP 80.45.10.12-Gen.
This DEP contains mandatory requirements to mitigate process safety risks in accordance
with Design Engineering Manual DEM 1 – Application of Technical Standards.
This is a revision of the DEP of the same number dated January 2010; see (1.5) regarding
the changes.
DISTRIBUTION, INTENDED USE AND REGULATORY CONSIDERATIONS
Unless otherwise authorised by Shell GSI, the distribution of this DEP is confined to Shell
companies and, where necessary, to Contractors and Manufacturers/Suppliers nominated
by them. Any authorised access to DEPs does not for that reason constitute an
authorization to any documents, data or information to which the DEPs may refer.
This DEP is intended for use in facilities related to oil and gas production, gas handling, oil
refining, chemical processing, gasification, distribution and supply/marketing. This DEP
may also be applied in other similar facilities.
When DEPs are applied, a Management of Change (MOC) process should be
implemented; this is of particular importance when existing facilities are to be modified.
If national and/or local regulations exist in which some of the requirements could be more
stringent than in this DEP, the Contractor shall determine by careful scrutiny which of the
requirements are the more stringent and which combination of requirements will be
acceptable with regards to the safety, environmental, economic and legal aspects. In all
cases the Contractor shall inform the Principal of any deviation from the requirements of
this DEP which is considered to be necessary in order to comply with national and/or local
regulations. The Principal may then negotiate with the Authorities concerned, the objective
being to obtain agreement to follow this DEP as closely as possible.
DEFINITIONS
General definitions
The Contractor is the party that carries out all or part of the design, engineering,
procurement, construction, commissioning or management of a project or operation of a
facility. The Principal may undertake all or part of the duties of the Contractor.
The Manufacturer/Supplier is the party that manufactures or supplies equipment and
services to perform the duties specified by the Contractor.
The Principal is the party that initiates the project and ultimately pays for it. The Principal
may also include an agent or consultant authorised to act for, and on behalf of, the
Principal.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 6
The word shall indicates a requirement.
The capitalised term SHALL [PS] indicates a process safety requirement.
The word should indicates a recommendation.
1.3.2 Specific definitions
Term Definition
Administrative operational and maintenance procedures that, along with proper
Controls training and/or supportive measures, ensure that personnel
actions do not compromise overpressure protection. Refer to
(2.15).
Car Seal band or wire that has to be broken in order to change the valve
position. Car seals installed on a valve inhibit unauthorized
valve operation. Refer to (2.15).
Class 1 Check check valves that are inspected to assure reliable operation.
Valves (also known These check valves are used to prevent backflow to suction
as Critical check vessels and tanks, prevent reverse overspeed on
valves) turbomachinery, and minimize damage from furnace tube
ruptures.
Double Jeopardy scenario caused by two unrelated events.
Scenario
Equipment pressure vessels, piping, heat exchangers, rotating equipment,
tanks, and fired heaters.
HEMP Hazard and Effects Management Process – overall work
process for identifying, assessing, and managing hazards.
LOPA Layers of Protection Analysis – a quantitative method to
determine the frequency of a scenario outcome
Maximum Allowable maximum internal pressure allowed by this DEP during a
Accumulated pressure relieving event. This is equal to the Design pressure
Pressure (MAAP) (or Maximum Allowable Working Pressure) plus the maximum
allowable accumulation by the relevant pressure vessel code.
Refer to (2.13) for allowable accumulations.
Overpressure pressure increase over the set pressure of a pressure relief
device during discharge and is usually expressed as a
percentage of the set pressure.
Pressure System structured examination of each pressure system for all potential
Safety Study (PSSS) overpressure and underpressure scenarios.
Process Engineering pictorial representation of a process or utility unit which shows
Flow Schemes all the equipment, including installed spares and the associated
(PEFS) piping and piping components, instrumentation, heat tracing and
insulation.
E: These are also known as Piping and Instrument Diagrams (P&IDs) and
Engineering Flow Diagrams (EFDs).
Process simplified flow diagram that highlights all pressure systems and
Safeguarding Flow their elements and those elements that protect the system
Scheme (PSFS) against overpressures. This diagram is included as part of the
Safeguarding Memorandum.
E: The requirements for the PSFS are specified in DEP 01.00.02.12-Gen.
Relief Pressure set pressure plus the overpressure. Also known as the relieving
pressure.
Safeguarding Document that summarizes the PSSS and other related issues.
Memorandum
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 7
Term Definition
Memorandum
Pressure System E: The requirements for the Safeguarding Memorandum requirements are
specified in DEP 01.00.02.12-Gen.
Thermal Relief or
Hydrostatic Relief single equipment item or group of equipment items including
associated piping that is protected by a common pressure
Very toxic protection device or set of devices.
(substances)
pressure relief for systems that are liquid full and, when blocked
in, can generate hydrostatic overpressures due to heat ingress
either from a source or from the environment. Thermal
relief/hydrostatic relief can often be provided via a small PRV
(often called a thermal expansion relief valve or TERV).
substances that are very hazardous for the environment or
human health, as specified in DEP 01.00.01.30-Gen. (which
also identifies "toxic" substances by reference to chemical
substances databases).
1.4 CROSS-REFERENCES
Where cross-references to other parts of this DEP are made, the referenced section
number is shown in brackets. Other documents referenced by this DEP are listed in (8).
1.5 SUMMARY OF MAIN CHANGES
This DEP is a revision of the DEP of the same number dated January 2010.
The following are the main non-editorial changes:
SECTION COMMENTS
4.5
Fixed typo. Was referencing “case 2” when it should have
been referencing “case 3”
3.9.2 Reworded for clarity. Moved “not” away from the term “very
toxic” .
global Clarified. Put “very toxic in quotes since this is a defined
3.9.4 term and that may not be obvious to the reader.
Added units (ft2) to equation definitions
5.3 Added guidance for exchanger differential pressure design
4.2.1.7 Provided guidelines for printed circuit heat exchangers.
2.10.4 Clarified use of instrumentation in pressure relief design.
Clarified UG-140 applications
2.11 Updated backflow prevention guidance. Simplified and
clarified.
2.9 Clarified failure position options when valves are in series.
2.10 Provided clearer guidance on applications of ASME Code
UG-140 (where instrumentation or other measures can be
used to reduce relief loads and/or eliminate the relief device)
2.11 Revised and clarified backflow prevention guidance further.
Eliminated the option to “by inspection” judge that the PRV
on suction vessel is large enough for the backflow.
Eliminated the option to size PRV for partial failure of a
single check valve since that is not consistent with ISO-
23251.
5.1 Provided guidance on when to consider dynamic modelling
f f ti t t li f l d l l ti
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 8
SECTION COMMENTS
3.10.7 for fractionator tower relief load calculations.
Thermal relief mitigation options were consolidated into
3.10.6
1.6 COMMENTS ON THIS DEP
Comments on this DEP may be sent to the Administrator at standards@shell.com, using
the DEP Feedback Form. The DEP Feedback Form can be found on the main page of
“DEPs on the Web”, available through the Global Technical Standards web portal
http://sww.shell.com/standards and on the main page of the DEPs DVD-ROM.
1.7 DUAL UNITS
Amended per
Circular 67/11
Dual units have been incorporated throughout this DEP.
This DEP contains both the International System (SI) units, as well as the corresponding
US Customary (USC) units, which are given following the SI units in brackets. When
agreed by the Principal, the indicated USC values/units may be used.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 9
2. DESIGN PHILOSOPHY
2.1 PRESSURE SYSTEM SAFETY STUDY
2.1.1
A structured examination of all potential overpressure and underpressure scenarios
2.1.2 SHALL [PS] be performed during design. This examination is called a Pressure System
2.1.3. Safety Study (PSSS). Management of Change procedures SHALL [PS] assure that
process modifications are assessed and the PSSS updated as required.
The PSSS shall verify that all equipment is adequately protected against overpressure and
underpressure
Protection against overpressure/underpressures shall be implemented by the use of any or
all of the following:
Mechanical Design Selection of design pressures. See (2.2).
Mechanical Safeguards Pressure relief devices.
Instrumented Safeguards See (2.10) for restrictions.
Emergency Procedures Emergency depressuring and emergency isolation.
Administrative controls See (2.15).
2.1.4. The PSSS shall reference the design premise. This premise shall include, as a minimum,
2.1.5. the design flow rate used for the analysis and the composition and temperature of each
2.1.6. feed stream.
Design of the relief system shall be based on a heat and material balance that reflects the
intended range of unit operation. This shall include unit start-up and shut-down conditions
since they can be more severe than at design operating conditions.
A summary of the PSSS shall be documented in the Safeguarding Memorandum
conforming to DEP 01.00.02.12-Gen.
2.2 DESIGN PRESSURE
2.2.1
A structured method for determining the upper and lower design pressure of pressure
2.2.2 equipment shall be used. For Shell installations, DEP 01.00.01.30-Gen. provides
requirements on establishing the upper and lower (vacuum) design pressure for
equipment.
If the MAWP is used in the PSSS in lieu of the equipment design pressure, the MAWP
shall be added to the PEFS and PSFS where applicable.
2.3 DESIGN FOR PUMP SHUT-OFF HEAD
2.3.1
For new pumps for which the Vendor's curves are not yet available, the pump's maximum
2.3.2 differential pressure (usually at shut-in pressure or deadhead conditions) shall be
estimated by multiplying the rated differential pressure by 1.3. When Vendor curves
become available, they shall be used to determine the pump's maximum expected
pressure.
All head calculations shall be based on the expected process conditions. Where there are
two liquid phases present (e.g., oil/water) or if water washing is an expected operating
mode, then the specific gravity of the heavier liquid shall be included in the evaluation.
2.4 PRESSURE SYSTEM ENVELOPE
2.4.1
See DEP 01.00.01.30-Gen for definition of pressure system envelope and pressure relief
considerations in specifying pressure system equipment design pressures.
A pressure system is an individual equipment item or groups of equipment including
associated piping that, within its boundaries, remains open under all conditions, and it can
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 10
2.4.2 be demonstrated that blockage due to freezing, solidification, fouling, sublimation, damage
2.4.3 of internals, scale, debris, foreign objects, etc. cannot occur within that system.
2.4.4 If pressure relief devices are set up to protect a pressure system, the system design
2.4.5 pressure SHALL [PS] not be higher than the pressure rating of any system component.
2.5 The effects of static head shall be taken into account.
2.6
2.6.1 If a systems approach is taken, the hydraulics shall be evaluated to assure that no
equipment exceeds its design pressure before a pressure relief device activates and
2.6.2 during relieving conditions no equipment exceeds its Code-allowable accumulation (2.13).
Pressure drop in a system shall be considered when determining the proper relief valve set
pressure. For example, if all equipment items in a system have equal design pressures
with the PRV located on the last piece of equipment, then due to the pressure drop the set
pressure of the PRV shall be below the design pressure to ensure that the upstream
equipment is not overpressured before the PRV opens.
If a systems approach is taken and the interconnecting piping's normal flow is very low
relative to the relieving flow (creating a possibility of undetected line fouling), then the relief
device should be located upstream of this potential restriction.
If parallel vessels or exchangers are valved in order to permit on-stream isolation for
maintenance, and both are normally on-line, the increased pressure drop shall be aligned
with the design operating window.
UNIT TURNDOWN CONSIDERATIONS
Taking credit for the normal flow leaving a system is allowed in accordance with ISO 23251
and this DEP. Such credits, however, shall be based on the minimum turndown operating
limit for the equipment/process unit and such credits shall be clearly documented in the
PSSS and the Safeguarding Memorandum, if applicable.
NOTE: In new designs, such credits should not normally be taken, in order to keep the analysis simple.
IMPACT OF UPSTREAM CONDITIONS ON DOWNSTREAM SYSTEMS
The impact of upstream systems at relieving pressure on downstream systems shall be
considered when evaluating overpressure scenarios. Criteria for evaluation are:
a) The upstream system's relieving pressure compared with the downstream
equipment's design pressure.
NOTE: Flows to downstream systems can be higher than normal when the upstream system is at
relieving pressure because:
(i) Open piping can pass more flow if the upstream pressure is higher.
(ii) Control valves (e.g., flow control valves) between the upstream and downstream systems,
which would normally react to maintain a normal condition in the downstream system, are
assumed to not respond (see 2.10.1). Thus with a higher differential pressure and the
control valve in its "normal" position, more flow will enter the downstream system.
(iii) Control valves (e.g., pressure control valves) between the upstream and downstream
systems, which would normally open to maintain the upstream conditions, are assumed to
function as designed (see 2.10.1). Thus with both a higher differential pressure and a
potentially wide-open control valve, more flow will enter the downstream system.
b) Common-mode failure scenarios shall be taken into account to evaluate their impact
on the supply to the downstream common system and their effect on the consumers
from the system, in order to determine any resulting overpressure condition and
pressure relief capacity of the common downstream system.
c) The potential reduction of flows leaving the downstream system due to
instrumentation/operator response shall be taken into consideration.
Common-mode relief scenarios shall be considered when the flows into and out of the
downstream system are evaluated. This can be a significant relieving scenario for
downstream systems tied to multiple upstream flow sources.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 11
For example, this applies to gas collection systems which collect gas streams from tanks or
vessels that are routed to a common facility for compression, treatment, incineration,
flaring, etc. These may have one or more sources of gas going into the downstream system
and typically one avenue out. Any scenario that increases the pressure in upstream
systems will likely result in their vent valves (typically on pressure control) to open as
designed. This flow can be substantially higher than normal and higher than the flow
through one wide-open control valve with normal upstream pressure. The amount of flow
leaving the downstream system should be evaluated, as it can vary from normal depending
on the system design and the common-mode failure under study.
Moreover, fuel gas collection systems can have very high relief loads since during power
failure the vent valves feeding the fuel gas collection vessel can be wide open (as
described above) and many, if not all avenues, out of the downstream vent gas collection
vessel will automatically shut because the furnace fuel gas system trips are assumed to
function as designed.
2.7 MIXING OF HOT MATERIALS WITH VOLATILE MATERIALS
2.7.1
Mixing of hot materials with volatile materials, such as water and hot oil, can result in
2.7.2 transient vapourization rates that are difficult to quantify. Guidelines for preventing these
2.7.3 scenarios as described in ISO 23251 should be implemented where possible.
Overpressure protection shall be provided for the steady state mixing of hot materials with
volatile materials (for any valid single jeopardy scenarios).
Overpressure risks associated with transient vapourization shall be mitigated by one or
more of the following:
a) System design (increased design pressure)
b) Inlet nozzle locations
c) Minimization of pockets in hot process piping
d) Low point drains to remove all water prior to starting up
e) Swing elbows, double block and blind, and other safeguards for utility connections
f) Equipment startup and operating procedures
g) Bursting disk
2.8 INTERFACES WITH THIRD PARTIES
Managing source pressures from third parties shall be covered by contractual agreements.
When applicable, the Principal shall verify that maximum source pressures comply with the
contractual limits. For example, there should be an understanding of how the third party is
limiting the source pressure (e.g. whether it is limited by pump deadhead or by the use of
relief devices). Relief valves owned and operated by third parties shall be assumed to be
sized appropriately under the applicable design codes, and the reliability of these relief
devices shall be assumed equal to those of the Principal. If the Principal's facilities provide
the source of pressure for third parties, then the Principal shall take measures as described
in this DEP to prevent overpressure to the third party.
2.9 FAILURE POSITION OF CONTROL VALVES
The failure position of control valves shall allow each system to reach an inherently safe
condition (e.g. stop flows and process heat) during a total instrument air failure scenario.
2.10 ROLE OF INSTRUMENTATION IN OVERPRESSURE PROTECTION
2.10.1
Basic process control
In some cases the Principal may choose to specify Instrumented Protective Functions to
eliminate a relief scenario or, in rare cases, eliminate the relief device. See (2.10.3) for
details.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 12
2.10.2 1. Pressure relief due to instrumentation malfunction (either single- or common-mode) is
covered in (3.5) and (3.6). When these or any other relief scenarios are evaluated, the
assumptions described below shall be made as to how the other instrumentation in the
system might respond.
2. Unless otherwise specified in this DEP, when determining relief loads for a single
pressure system, credit SHALL [PS] not be taken for favorable instrumentation
response. Favorable instrumentation response is any expected normal response (the
instrument's intended function) that would reduce the relief loads on the pressure
system under study. Any instrumentation that could provide favorable response
SHALL [PS] be assumed to be frozen (or on "manual" mode). Examples of favorable
instrumentation response that shall not be used to eliminate or reduce relief loads
include:
a) Pressure control valve opens to relieve vessel pressure.
b) Level control valve closes to prevent vapour break-through.
c) High level trip opens dump valve.
3. Instrumentation response that increases relief loads within the pressure system under
study SHALL [PS] be assumed to function properly.
Reduction of calculated relief loads
The following table summarizes methods that may be used to further analyze the calculated
flare and relief loads and that could result in a reduction of the calculated loads.
PRV sizing Flare system sizing
Method ISO 23251 DEP Section ISO 23251 DEP
Assessment of System Yes - Yes 80.45.10.10-Gen.
Dynamics
Beneficial Control No - Yes 80.45.10.10-Gen.
System Response
Safety Instrumented No 2.10.3 Yes 80.45.10.10-Gen.
Systems
(Note 1)
Operator Intervention Yes 2.14 Yes 80.45.10.10-Gen.
NOTES: 1. High Integrity Protective Systems may be used if it is impossible or impractical to size
the relief device for the scenario.
2. There are different methods allowed for PRV sizing and flare system sizing.
3. ISO 23251 describes various analytical methods and assumptions that may be used in
some cases to reduce calculated relief loads.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 13
2.10.3 Instrumented Protective Functions (and other measures) to eliminate the relief
device
1. When protection against overpressure only cannot be exclusively designed by a relief
system, alternative design criteria may be considered.
Note: For guidance on mitigating flare loads see DEP 80.45.10.10-Gen.
2. A core principle in relief system design is to not take instrumentation credits. To deviate
from this principle it shall be demonstrated that designing or re-designing the equipment,
the relief devices, or relief stream disposal system is not possible or practicable. Criteria
for such designs are given below.
Equipment design capability issues:
a) The equipment cannot practicably be designed for the overpressure scenario
conditions.
Relief design capability issues:
a) There is no relief device that can reliably cope with the conditions of the scenario.
b) The required relief capacity cannot practicably be achieved with relief devices.
c) The relief load for reactive systems cannot be determined with confidence due to
lack of reactive chemistry knowledge or physical property data.
Relief stream disposal capability issues:
a) The capability of the flare/disposal system could be exceeded (this includes liquid
knock out capability, or temperature limits). Refer to DEP 80.45.10.10 if the
hydraulic capacity of the disposal/flare system could be exceeded.
b) The relief stream composition from this system creates a hazard for the
flare/disposal system (this includes introduction of incompatible materials that
result in violent chemical reactions, introduction of oxidizers, and materials that
can plug the relief system.)
c) The discharge to atmosphere would be a significant safety, environmental, or
reputation issue
3. When the overpressure scenario cannot be covered by traditional relief system design,
mitigation measures SHALL [PS] meet all of the criteria below. The use of
Instrumented Protective Functions is the most commonly used mitigating measure but
other measures (e.g., mechanical interlocks, basic process controls) may be used as
well.
a) Mitigation measures shall be valid as defined by HEMP/LOPA design criteria (i.e.,
independent, effective, and auditable).
b) Except for the fire scenario, the combined probability of failure upon demand
(PFD) of valid measures used to prevent the scenario (e.g., prevent the relief,
prevent exceeding allowable accumulations, prevent exceeding design
temperatures, etc.) shall be at least equivalent to the PFD achieved by a relief
valve in clean service.
c) If the scenario, without taking credit for mitigation measures as described above
will result in pressures exceeding 150% of design pressure, then in addition, the
risks shall be demonstrated to be ALARP using applicable HEMP methodology
(e.g., perform LOPA if required).
d) For fire scenario, the risk shall be demonstrated to be ALARP using applicable
HEMP methodology.
e) Operating above the certified pressure range (e.g., above the MAWP) is not
permitted. Conditions that result in pressures exceeding the MAWP shall be
corrected in a timely manner.
f) For applications involving ASME Section VIII equipment, the technical and
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 14
documentation requirements in UG-140 of Division 1 shall also be followed and
mitigated accumulations shall be limited to 16%. For applications involving other
vessel design codes mitigated accumulations shall be limited to Code Allowables
(generally 10%).
g) For individual pressure systems that have design challenges with a particular
relief scenario (as described in 2.10.3.2) and are mitigated as described above,
the calculated relief load that would result if the mitigation measures failed does
not need to be included for relief disposal system design for that particular relief
scenario.
Note: When mitigation measures are used to eliminate the scenario (no relief at all) then assume no
load from this system during that specific scenario.
Note: When mitigation measures are used to reduce the system’s relief load (the PRV relieves but
does not have sufficient capacity if mitigation measures fail), then for relief disposal system
design use the calculated relief load assuming the mitigation measures function properly.
4. Scenarios and mitigating measures are subject to approval of the Principal.
2.10.4 Instrumentation for flare load management
Flare loads may be reduced using IPFs. See DEP 80.45.10.10-Gen. for details.
2.11 ROLE OF CHECK VALVES (NON RETURN VALVES) IN OVERPRESSURE
2.11.1 PROTECTION
General
In considering backflow from a high pressure source, it is evident that a check valve will not
protect against overpressure due to its inherent mechanical design. A check valve will
always have some fluid passing, the quantity of which is not possible to determine precisely
and verifiably. The restriction of the backflow and the measures coping with the resultant
quantities can vary and are based on engineering assumptions.
1. The consequences of backflow (reverse flow) include but are not limited to:
overpressure of upstream equipment, reverse overspeed of mechanical equipment and
their drivers, system contamination, and relief or atmospheric release of undesirable
process streams. For example, loss of power to the pump could cause backflow which
could result in overpressure of the equipment on the suction side of the pump and
damage to the pump or motor.
2. Since check valves in practice reduce the likelihood of gross backflow, the presence of
check valves can be taken into account in the design of any instrumented safeguards
(see DEP 32.80.10.10-Gen. for IPF design requirements). Specifically, check valves
may reduce the demand rate on an IPF.
3. Alternatively, where sites have established HSE Management Systems to manage
check valve reliability, credit for these check valves (Class 1 check valves) in
overpressure design may be considered. See (2.11.2) for requirements and guidelines.
4. For the purposes of overpressure design due to backflow, check valves, regardless of
design or class, shall not be considered tight shut-off. If the piping upstream of the
check valve is blocked in, it is assumed that this will eventually be pressurised to the
discharge side pressure.
5. Where relief devices will be sized for reverse flow, the following assumptions shall be
made:
a) Where there is no check valve, base reverse flow on hydraulics.
b) Where there is a single Class 1 check valve or regular check valve(s), do not take
any flow restriction credits for the check valves (either ignore the flow resistance
of the valves or assume the check valves are wide open)
c) Where there are dual Class 1 check valves, calculate the backflow assuming a
check valve flow area of 10 % for new facilities. For existing facilities, use 1 % of
the check valve flow area.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 15
2.11.2 d) Where a vapour cap is driving the backflow, the vapour flow may control the relief
2.11.3 device sizing after vapour breakthrough.
6. Selection of an adequate check valve type shall be part of the design. Certain process
or operating conditions may lead to malfunctioning of the check valve (due to fouling,
corrosion, construction, location and flow path of the backflow, etc.).
Class 1 check valves
1. Class 1 check valve design concept requires the site's HSE Management Systems to
manage check valve reliability as follows:
a) Class 1 check valves shall be included in an inspection programme, as follows:
i. Class 1 check valves should be subjected to internal inspection to detect
gross deficiencies such as a stuck flapper, corroded seats, damaged hinge,
or galling.
NOTE: Failure to close due to fouling might not be detected.
ii. Inspection interval philosophy for Class 1 check valves should be
consistent with that for PRVs. Unless otherwise specified by applicable
regulations, the inspection intervals should be condition-based. These
should, but might not necessarily, correspond to the planned shutdown
(turnaround) intervals.
iii. Class 1 check valves should have a unique number assigned for tracking
purposes, and each valve should be labelled or tagged in the field with this
identifying number.
iv. Inspection records for each Class 1 check valve shall be maintained.
b) Class 1 check valves shall be shown in the PEFS, PSFS, Safeguarding
Memorandum, and SHALL [PS] be included in the site's HSE-MS documentation
for critical barriers/tasks.
c) Class 1 check valves may be single or dual (two in series). In many applications
two Class 1 check valves are used but, as described in this DEP, there are
applications where only one Class 1 check valve is warranted.
d) Class 1 designation does not dictate a specific valve design, but the Principal may
do so. Class 1 check valves shall be sized and specified so that under the range
of design forward flow conditions the valve will have stable performance (i.e., not
flutter) as specified by the check valve manufacturer.
Backflow overpressure protection of equipment excluding low pressure and
atmospheric storage tanks
1. The steps below SHALL [PS] be followed to provide overpressure protection against
backflow. See Figure 1 for the overall logic. Other risks caused by the backflow (e.g.
environmental releases, contamination, etc.) shall be considered and evaluated on a
case-by-case basis. Sizing the upstream relief device for the backflow is only required
where specifically stated in the steps below.
NOTE: If backflow is mitigated by sizing the relief devices for the reverse flow, the consequences of
potential reverse overspeed damage to mechanical equipment shall be considered.
2. If there is no check valve to stop the reverse flow, size the relief device for the backflow
and stop.
3. If there is a check valve to stop the reverse flow, an assessment of the backflow
scenarios shall be carried out. If the analysis demonstrates that the upstream system
will not exceed 150% of the design pressure during the backflow, then a single check
valve is adequate as a minimum. Typically backflow from a higher pressure system
requires vapour or a large liquid volume to sustain a backflow. The analysis may
consider settle out pressures, calculated backflow (see 2.11.1.5) and PRV capacity, etc.
If the backflow introduces a reactive hazard that can generate a pressure greater than
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 16
the backflow source pressure, this will be evaluated separately as part of a reactive
hazard scenario.
4. If the backflow scenario assessment is not able to demonstrate that that the upstream
system pressure will not exceed 150% of design pressure during the backflow, then
calculate the pressure ratio (the backflow source gauge pressure divided by the
equipment design pressure).
NOTE: This process takes the pressure ratio as an indicator of how severe a "sustained" backflow into the
upstream equipment could be. In order for a sustained backflow to occur, the high pressure system
needs stored energy (e.g., a vapour cap or a large volume of compressible liquid). Typically, liquid
full systems rapidly lose pressure and backflow potential once the source of forward flow is stopped.
5. If the pressure generating equipment is a centrifugal pump or compressor and the
pressure ratio is less than 5, then consider single Class 1 check valve, dual Class 1
check valves, PRV sized in combination with dual Class 1 check valves, and/or an
instrument safeguard that stops the backflow. This instrument safeguard can be an IPF
or a basic process control trip. Assume only asset damage. Design to risk tolerability
and ALARP.
NOTE: Experience has shown that pressure ratios less than 5 can lead to pump or motor damage.
6. If the pressure generating equipment is a centrifugal pump or compressor and the
pressure ratio is greater than 5, then provide dual Class 1 check valves and an IPF.
Assume potential vessel rupture when evaluating the IPF SIL requirements. Use 1E-2
as the probability of failure upon demand for the pair of Class 1 check valves.
7. If the backflow is caused by a tube rupture in a fired heater see 5.5.4.
8. Backflow involving other equipment (utility connections, PD pumps and compressors,
etc.) should be evaluated on a case by case basis if no other guidance is provide in the
applicable DEP.
9. When quantifying the likelihood of backflow through check valves, use the probability of
failure on demand data shown below when using LOPA.
Probability of failure on
demand
Independent Protection Layer Clean Dirty or
Single Class 1 check valve for back flow service corrosive
service
1 × 10-1
1
Note: a regular check valve would not be considered a valid barrier
using DSM LOPA rules since it is not audited.
Class 1 dual check valves for overpressure due to backflow per the 1 × 10-2 1 × 10-1
flow chart.
Class 1 dual check valves including pressure relief device sized to 1 × 10-3 1 × 10-2
pass the backflow For existing equipment assume check valve
opening equivalent to 1 % of the check valve area. For new
equipment assume check valve opening equivalent to 10 % of the
check valve area.
Note: 1. Clean service can be regarded as gas or liquid streams that contain no components with a tendency to
foul. Process streams like LNG, H2, NG, treated LPG, pure products as isopentane, butane, hexane,
benzene, toluene and the like would be considered clean. Fouling tendency substances can be
hydrocarbons with high pour points above lowest ambient temperature, coking services, polymerizing
services, etc.
2. Credit for more than two (2) check valves should not be taken since common cause failures may result
in diminishing effectiveness.
2.11.4 Backflow overpressure protection of low pressure and atmospheric storage tanks
1. The steps below shall be followed to provide overpressure protection against backflow.
See Figure 1 and 2 for the overall logic.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 17
NOTE: If backflow is mitigated by sizing the relief devices for the reverse flow, the consequences of potential
reverse overspeed damage to mechanical equipment shall be considered
2. Where backflow results in a vapour relief coming from the downstream equipment, the
relieved vapour is flammable and has the potential to develop a vapour cloud that could
accumulate at grade, size the tank relief devices for the full backflow (per 2.11.1.5) and
install at least a single Class 1 check valve.
If the vapour released from the tank will not likely accumulate at grade, size the tank
relief devices for the full backflow (per 2.11.1.5) and install a single check valve (a Class
1 check valve is not required).
If the sizing of the relief device for the full backflow is impractical, then install dual Class
1 check valves and an IPF. Assume potential tank rupture when evaluating the IPF SIL
requirements.
3. If the tank relief device is sized for the full backflow, the relief device discharges to
atmosphere, and the relief stream is “very toxic”, then assess the consequences and
mitigate as needed.
NOTE: Very toxic releases may require additional safeguards (IPF) to meet risk criteria.
4. If the tank relief device is sized for the full backflow, the relief device discharges to
atmosphere, and the tank is located close to occupied buildings or process units, then
assess the environmental and safety consequences and mitigate as needed.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 18
Is there a backflow scenario ? No Size relief device for other cases
Yes No
Stop
Is there a scenario that backflow can cause
overpressure (above design pressure )?(1)
Yes No Size the relief
device for backflow
Is a check valve present to stop backflow?
(2)
Yes
Stop
Does the assessment of backflow scenarios result in No
See Figure 2
exceeding 150% of the design pressure ? (3)
Yes
Is the pressure generating equipment a centrifugal Yes
compressor or pump ?
No
Single Class 1
Check Valve
Yes
Is it a furnace? Is pressure No
Yes greater than 35
No Stop
Bar (500 psi)?
(4)
Other Equipment , e.g. Utility connections to process;
positive displacement Pumps /compressors , etc.
1. follow DEPs if available
2. Evaluate Case by Case
NOTES: (1) This should include overpressure caused by reactive hazards scenarios, contamination reactions
that cause “very toxic” releases, etc. Subject matter experts should be consulted to determine the
appropriate evaluation technique required.
(2) When assessing, consider the potential for the phase of the backflow stream to change from liquid
to vapour if vapour is driving the backflow. The installed relief device is assumed to be routed to a
closed system (i.e. flare). If to atmosphere, further assessment is required.
(3) An assessment of the backflow scenarios shall be carried out. If the analysis demonstrates that
the upstream system will not exceed 150% of the design pressure during the backflow, then a
single check valve is adequate. Typically backflow from a higher pressure system requires
vapour or a large liquid volume to sustain a backflow. The analysis may consider settle out
pressures, calculated backflow (see 2.11.1.5) and PRV capacity , etc. Resulting pressures may
not be limited by the source. Examples of this include reactive hazards and hot oil/water contact .
(4) Scenario for a furnace is a ruptured tube where back flow would also result in back pressure to the
furnace tubes.
Figure 1 Flow chart – Design/system review for relief valve sizing and backflow
prevention
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Is the upstream equipment Page 19
a pressure vessel?
No Is the backflow into a low No Evaluate on a case
Yes pressure or atmospheric by case basis
storage tank ?
Yes
Can the PVV handle the
backflow?
No Yes
Dual class 1 check valves
Calculate Delta (6)
pressure ratio (5). Yes AND
Is the pressure ratio IPF - evaluate SIL class
greater than 5? assuming rupture
No Is the release to
atmosphere a Very Toxic
For New or existing substance (8) or is tank
equi pment , design to a
residual risk of 1E-3/year No located close to occupied
using IPF, Basic Process
Control Systems, dual Class buildings or process
units?
1 check valves or a
combination thereof (6,7) Will tank release result in Yes Install single Yes
a flammable cloud at class 1 check
grade ? valve as a
minimum .
No Based on release
modeling and risk to
Install regular personnel , decide on
check valve
level of backflow
protection. Dual Class 1
check valves (6) and/or
IPF (7)
NOTES: (5) Calculate the delta pressure by dividing the high-pressure system's operating pressure by the
design pressure of the system that the backflow is flowing into.
(6) For axial and centrifugal compressors, dual Class 1 check valves should be considered to
ensure that the compressor will not rotate in reverse when shut down.
(7) The PFD of dual class 1 check valves depends on whether the valves are in clean or dirty
service and whether the upstream relief device is sized for the calculated backflow. See Table 1
for PFD values.
(8) See DEP 01.00.01.30-Gen. for the definition of “Very Toxic” substances.
Figure 2 Continuation from Figure 1
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 20
2.12 DESIGN AND REMOTE CONTINGENCY SCENARIOS
2.12.1
With the exception of the tube rupture scenario, all scenarios listed in ISO 23251 as
2.12.2 causes of overpressure shall be considered a design scenario. In design scenarios, the
accumulations allowed by the vessel design code shall not be exceeded. See (3.) for
2.12.3 design scenarios.
Tube rupture and other scenarios that are not required by ISO 23251 shall be considered
to be “Remote Contingencies”. For Remote Contingencies, accumulations allowed by the
vessel design code may be exceeded since the likelihood of these scenarios is very low.
See (4.).
Design scenarios shall be based on single jeopardy events. Double jeopardy shall not be
used for design because the probability of two unrelated overpressure events occurring
(e.g. loss of power while there is a blocked outlet) is very remote.
2.13 ALLOWABLE ACCUMULATION AND UNDERPRESSURES
2.13.1
Single jeopardy, Code-allowable accumulations
2.13.2
1. No accumulation is allowed for some storage tanks due to potential damage to the
frangible roof weld, and lower safety factor in design.
2. 10 % accumulation is allowed by the ASME Code for a single relief device and for all
design scenarios for vessels built to EN 13445
3. 16 % accumulation is allowed by the ASME Code for multiple relief devices under
operational overpressure scenarios (i.e., non-fire). Note: other design Codes may limit
this to 10% accumulation.
4. 20 % accumulation is allowed for API 620 tanks under the fire case.
5. 21 % accumulation is allowed for ASME Code equipment under fire exposure. Note:
other design Codes may limit this to 10% accumulation.
6. 20 % or 33 % accumulation is allowed for piping designed in accordance with
ASME B31.3, depending on the accumulation frequency and duration. Depending on
the design concept of a project (particularly in relation to its required expandability,
operability and maintainability) the Principal may specify lower, or even zero, allowable
accumulation.
Remote Contingency accumulations
A maximum of 50 % accumulation is normally allowed for Remote Contingencies, including
tube rupture. For equipment made of non-metallic materials or aluminum, any Remote
Contingency accumulation shall be subject to the approval of the Principal.
2.14 OPERATOR INTERVENTION
2.14.1
Operator intervention can be considered if all of the following are satisfied:
1. An alarm can alert the operator: The alarm SHALL [PS] be independent of the
overpressure scenario (i.e. the cause of the overpressure must not also disable the
alarm instrumentation.)
2. There is sufficient time for the operator to stop the overpressure. This time includes the
time to diagnose the alarm, to take action, and for the action to take effect. There
SHALL [PS] be clear, unambiguous, and effective operator actions specified for
responding to this alarm. The Principal shall establish the amount of time that is
considered sufficient for operator intervention. The criterion will typically be 30 min but
no less than 15 min. A range is provided since the types of facilities that this DEP can
be applied to may vary and the ability of operators to diagnose an alarm and take
corrective action may vary. The distance to and the ability to physically access the
equipment/instrumentation shall be considered when assessing operator intervention
time.
3. The consequences of no or ineffective operator intervention SHALL [PS] be assessed.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 21
2.14.2 4. The allowable accumulation for no or ineffective operator intervention is the same as
that for a Remote Contingency. The accumulation shall be determined by calculating the
pressure required to pass this relief load via the relief area defined by the governing
relief scenario.
If there is not sufficient time for operator intervention, then the scenario is a design
scenario and the overpressure shall be mitigated by engineering controls such as a
pressure relief device sized for the scenario or an increase in design pressure.
2.15 ADMINISTRATIVE CONTROLS
2.15.1
General
2.15.2
1. Administrative controls may be applied where other over- underpressure protection
2.15.3 cannot be used. Where applied, administrative controls SHALL [PS] consist of
mechanical elements (Locks, interlocks, etc.) plus clear and effective operational and
maintenance procedures plus training of relevant personnel on these procedures, and
management systems to assess overall effectiveness.
2. The use of engineering controls is preferred to the use of administrative controls to
prevent overpressure, underpressure and equipment damage. Administrative controls
shall not be used for normal operation (except where this would otherwise be
impractical, as described below). The use of administrative controls is often relied upon
for commissioning and maintenance activities.
3. The use of specific administrative controls SHALL [PS] be documented as part of the
site's HSE-MS and the Safeguarding Memorandum.
Removing/isolating equipment from operation
1. Fire exposure of equipment removed/isolated from operation is not considered a
credible overpressure scenario, subject to approval by the Principal, if both of the
following conditions are met:
a) Procedures are in place for promptly draining and depressuring equipment that is
isolated for maintenance.
NOTE: This credit is typically taken only for spared equipment such as heat exchangers, reactors,
filters, driers, etc. that are intended to be put into operation at a pre-determined frequency.
b) Fire relief load can be relieved elsewhere in the system during normal operation
(when the equipment is lined up again). Refer to (3.9).
Valve operation control applications
Valve operation controls are controls that limit and clarify the use of the valve in a
pre-defined position: open or closed. Valve operation controls are valves with a
key/mechanical lock, or chained and locked, or a car-seal based system, instrumented
interlock or 3-way valve.
Criteria for valve operation controls are:
1. Valve locks are not allowed if closure of the valve will result in an immediate
overpressure.
2. ASME Code Section VIII, Division 1, Appendix M allows the use of valve operation
controls to prevent overpressure in equipment upstream of stop valves. For new
designs, valve operation controls shall not be used to avoid overpressure.
3. See DEP 80.45.10.10-Gen. for valve operation controls on relief device isolation valves.
4. All valves in the flow path of a relief header (e.g., a flare header battery limit isolation
valve) SHALL [PS] be key locked or car-sealed open.
5. For heat exchangers, valves in the fire relief path do not require car seals or locks.
6. Other applications of car seals/valve locks may be specified as an acceptable
safeguard on a case-by-case basis by the Principal
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 22
2.15.4 Valve locking administrative controls
1. To ensure that administrative controls consisting of procedures, training, management
systems, and valve locks are effective, the following administrative controls shall be
implemented:
a) The significance of valve locks SHALL [PS] be communicated to personnel
through training and procedures. In order to prevent any slackening awareness of
the importance of valve locking, judicious use should be made of valve lock
applications.
b) Locked valves shall be identified on the Process Engineering Flow Schemes
(PEFS) and the Process Safeguarding Flow Schemes (PSFSs) with the required
valve position specified as key locked-open (LO) or car-sealed open (CSO), etc.
c) An up-to-date list that documents the valve location, intended valve position (open
or closed) and purpose (safety, environmental, or operability, etc.) of each locked
valve SHALL [PS] be maintained.
d) Field verification of locked safety-related valves shall be performed on a regular
basis.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 23
3. DESIGN SCENARIOS
3.1
3.1.1 GENERAL
3.1.2
3.1.3 Pressure relief loads SHALL [PS] be determined in accordance with the applicable
3.1.4 sections of ISO 23251 and ISO 28300.
3.2
3.2.1 Relief loads shall be based on the features of the installed equipment, unless otherwise
specified by the Principal. Installed pump impeller size, not maximum pump impeller size,
3.2.2 shall be the basis for determining relief loads. Likewise, installed control valve trim, not
maximum valve trim, shall be used.
3.2.3
Relief loads shall be based on the physical properties of the process fluid at relieving
3.2.4 conditions for each specific scenario.
3.2.5
Some scenarios described in this section are Remote Contingencies. They are included
here for the sake of logical continuity.
POWER FAILURE
General
The extent of a power failure SHALL [PS] be based on the loss of any one component (e.g.,
feeder, bus, circuit, or line). Therefore the following power failure cases shall be
considered: total power failure, partial power failure, or individual power failure.
The determination of the relief quantities that may result from a power failure necessitates a
careful plant analysis to establish what equipment is affected and to what extent this affects
the plant as a whole.
Total power failure
1. The extent of total power failure SHALL [PS] be derived from the engineering analysis
described in (3.2.1). Depending on the system design, multiple process units could be
affected.
2. Total site-wide power failure SHALL [PS] be considered as a design scenario .
Partial power failure
1. If heat input into a process stops during total power failure, particular care shall be taken
to ensure that relief loads are not understated for a partial power failure.
NOTE: Systems that involve forced circulation through heaters/reboilers might lose heat input during general
power failure but maintain heat input during a partial power failure.
2. For pumped streams providing heat input to the system heat input SHALL [PS] be
assumed to continue if these pumps have auto-start spares that are steam-driven or
electrically-driven from a source not affected by the power failure.
3. If a pump and its spare (e.g., reflux pumps) are electrically independent (or one is
turbine driven), the resulting flare/relief load SHALL [PS] be calculated assuming the
pump failure that causes the largest relief.
4. More than one “partial power failure” scenario SHALL [PS] be considered for systems
that have motor drivers (for pumps, air coolers, furnace fans, etc.) fed from different
electrical buses.
Individual power failure
Loss of power to individual equipment SHALL [PS] be evaluated.
Credit for auto-starts
As described in ISO 23251, even if electrically driven equipment has a stand-by with
controls for automatic start-up and alternative drive such as steam or diesel, no credit
SHALL [PS] be given to this stand-by equipment for the purposes of pressure relief valve
sizing, as the automatic start is not considered sufficiently reliable and may even be
unavailable due to maintenance.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 24
3.2.6 Air cooler natural draught duty
3.2.7
During the loss fans, natural draught duty shall be assumed to be 5 % of design for air
3.3 coolers without louvers and 0% of design for air coolers with louvers.
3.4
3.4.1 Higher natural draught duties can be used if supported by analysis.
3.4.2
3.4.3 Fired reboiler/heater duty assumptions
3.4.4 1. Assume zero duty when evaluating the loss of flow through fired reboilers/heaters.
3.4.5
2. Assume zero duty when evaluating loss of furnace draught (loss of induced draught fans
in the absence of natural draught capability) or loss of firing (e.g., fuel gas trip) in those
cases where the vast majority of the reboiler/heater refractory is equivalent to blanket
insulation (low thermal mass). By the time the system reaches relieving conditions, the
amount of heat being supplied by the heater is negligible.
3. When evaluating the loss of furnace draught or loss of firing in those cases where a
significant portion of the reboiler/heater refractory is brick or cast materials (high thermal
mass), assume duty is 30 % of design.
STEAM FAILURE
Total, partial and individual steam failure SHALL [PS] be evaluated where applicable.
NOTE: Loss of steam can cause loss of turbine drives and/or loss of steam reboilers or vacuum ejectors.
COOLING WATER FAILURE
Total, partial and individual cooling water failure SHALL [PS] be evaluated where
applicable.
Total cooling water failure could be caused by for instance:
a) Power or steam failure that causes loss of all cooling water pumps
b) Sudden fouling (e.g., fouling of cooling water intake screens)
c) Loss of makeup water supply to a cooling tower
Partial cooling water failure could be caused by for instance:
a) Power failure to cooling water tower fans
b) Blocked valve in cooling water header
c) Loss of some pumps
d) Loss of on-site cooling water booster pumps
Individual cooling water failure could be caused by for instance:
a) Loss of on-site cooling water booster pump
b) Blocked valve in cooling water supply to the equipment
For applications involving cooling water towers, the relief loads are based on the following:
a) If multiple cooling water towers serve a process unit and the pumps and fans are
powered by separate electrical systems, pressure relief loads shall be based on the
loss of one cooling water tower at a time.
b) If fans in a single cooling water tower are powered by separate electrical systems,
consider the loss of power supplied to the most fans and take the ratio of the number
of fans still running to the total number of fans to obtain the cooling water tower
efficiency.
c) If a cooling water tower serves multiple process units and the cooling water pumps
and fans are powered by separate electrical systems, the more stringent of the
following two options shall be used:
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 25
3.4.6 i. Relief loads shall be based on total loss of cooling water, unless electrically
driven cooling water pumps that remain on-line have motors sized for the
3.5 end-of-curve conditions. In the latter case, relief loads are based on the next
3.5.1 option.
3.5.2
ii. Relief loads shall be based on an analysis of the resulting cooling water flows.
3.6 There is no direct correlation between the loss of cooling water and relief load,
since the consequence for each individual cooling water heat exchanger shall
3.6.1 be evaluated (e.g., elevated overhead condensers could be without cooling
3.6.2 water, while rundown coolers at ground level still receive adequate cooling).
3.6.3
The effect of loss of cooling on auxiliaries of rotating equipment shall also be considered.
3.6.4
3.6.5 NOTE: Loss of cooling water to rotating equipment (lube oil and seal oil systems) might cause it to
3.7 shut down.
3.7.1
GENERAL INSTRUMENT AIR FAILURE
The general instrument air failure scenario involves evaluating the consequences of
simultaneous movement of all the system's control valves to their failure positions.
For vapour breakthrough cases that may occur as part of this scenario, refer to (3.7).
For general instrument air failure scenario:
a) Emergency depressuring valves shall be assumed to remain closed if they have a
protected air reservoir as described in DEP 32.45.10.10-Gen
b) General instrument air failure for the plant (multiple process units) is a design
scenario.
INDIVIDUAL CONTROL VALVES – OPEN AND CLOSED
The scenario in which individual control valves open and close involves evaluating the
consequences of individual movement of each control valve to its open and closed position.
Air failure is assumed to take the valve to its fail position and a controller failure is assumed
to take the valve to the opposite of its fail position.
For vapour breakthrough cases that may occur as part of this scenario, refer to (3.7).
The consequences of each control valve going to its open and closed position
independently of other valves SHALL [PS] be evaluated.
Split range controllers require additional evaluation. A transmitter on a split range controller
could malfunction causing more than one valve to respond. Complex systems shall be
reviewed with the control systems engineer to identify the worst single jeopardy case.
One example of this type of malfunction may entail two valves on a split-range controller
going to the fail position. Another example of this type of malfunction may entail one valve
staying “stuck” in position with another valve responding.
If a controller failure on a valve can cause more than one valve to move, the worst case
scenario of the valve movements shall be considered.
Self-contained pressure regulators shall be treated the same as other control valves.
VAPOUR BREAKTHROUGH
General
The vapour breakthrough scenario occurs when an open valve causes the liquid level to be
lost to the downstream system followed by vapour flow (or two-phase flow) into that
downstream system. This scenario SHALL [PS] be evaluated.
The vapour breakthrough scenario can also be a subset of general instrument air failure,
individual air failure, controller failure, inadvertent valve opening, or power failure.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 26
The design approach is to first ensure the design meets the Code-allowable accumulations,
assuming normal operating conditions and single jeopardy failures. This is followed by
evaluation of the scenarios occurring during abnormal operation and other Remote
Contingencies. This design approach requires evaluating the following four cases:
Case 1 – Single valve goes open
This is considered the standard vapour breakthrough scenario assuming normal
liquid levels in both the upstream and downstream vessels. An important part of
this analysis is to determine if there is adequate vapour/liquid disengagement in
the downstream vessel. Its final liquid level is a key aspect of that analysis.
Case 2 – Loss of liquid feed to the high-pressure system
Loss of feed (e.g. due to a power failure) will cause the high-pressure vessel to
lose level in the absence of a beneficial control response.
Case 3 – Both control valve and bypass wide open
This is Case 1 with the bypass wide open. It is a Remote Contingency.
Case 4 – Excess system inventory
This is Case 1 assuming this occurs while there are abnormal liquid levels in the
vessels (either the upstream vessel or the downstream vessel, or both). This
scenario is also known as the "liquid swell scenario." This is a Remote
Contingency.
3.7.2 Case 1 – Single valve goes open
3.7.2.1 General
The case of a single valve going open SHALL [PS] be considered as a design scenario.
3.7.2.2 Short-cut method
The following conservative shortcut method may be used as an alternative to the full
method described in (3.7.2.3).
1. Calculate the vapour breakthrough flow assuming that only gas is present in the
upstream vessel at maximum operating pressure. See Step 1 in (3.7.2.3).
2. Add the normal liquid volume in the high pressure vessel to the normal liquid volume in
the downstream vessel.
3. If the resulting liquid level does not exceed the criteria in Step 5 in (3.7.2.3), then size
the relief device for the vapour relief calculated in Step 1 in (3.7.2.3). Otherwise size for
two-phase relief or carry out the detailed evaluation in accordance with (3.7.2.3).
3.7.2.3 Full method
1. Step 1 – Establish initial conditions and assumptions
For this step, assume the following:
a) High pressure system at normal operating pressure.
b) High pressure system's bottom control valve wide open. Take the largest full open
Cv of the manual bypass valve or the control valve.
c) If the bypass valve is routinely open (partially or fully) while the control valve is in
operation, then both the control valve and the bypass are assumed wide open.
d) Low pressure system is at the single jeopardy Code-allowable accumulation
(2.13.1).
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 27
2. Step 2 – Calculate the flow into the low pressure system through the wide open valves.
For this step use the assumptions in Step 1.
a) This flow may be pure vapour or two phase. Hydrotreaters, for example, may
have a hot hydrogen sweep operating mode where there is no liquid flow from the
high-pressure vessel.
b) Evaluate any two-phase cases at the minimum liquid flow entering the high-
pressure system (i.e. liquid flow rate based on minimum operating rates).
c) The flow path through any power recovery turbine should normally be considered
open.
3. Step 3 – Calculate the volume gain rate in the low-pressure system.
a) Flash the fluid entering the low-pressure system at the allowable accumulation
b) Determine whether the normal overhead vapour flow leaving the low-pressure
system will continue during the scenario.
4. Step 4 – Determine the liquid level in the low-pressure vessel just prior to the vapour
breakthrough.
a) Assume that both the high and low-pressure vessels start with normal liquid
levels.
b) Since the normal liquid flow out of the low-pressure system typically continues,
simply add the liquid inventory in the high-pressure vessel to that in the low
pressure system. Ignore any reduction in liquid volume due to flashing at the
lower pressure.
5. Step 5 – Evaluate the possibility of a swelled liquid level affecting the required relief
capacity.
a) If the liquid level in the low pressure vessel (just prior to vapour breakthrough as
determined above) is excessive, the subsequent vapour breakthrough and liquid
vaporization due to lower pressure could push gas into the downstream liquid
level causing the liquid level to rise or “swell”. This possibility should be evaluated
regardless of the pressure difference between operating pressure on the
high-pressure side and the design pressure on the low-pressure side.
b) If the low-pressure vessel is a vertical vessel with a side inlet nozzle, assume
vapour-only relief during vapour breakthrough if the liquid level just prior to vapour
breakthrough is at least one vessel diameter below the top of the vessel on the
one hand and the side inlet nozzle is not submerged on the other.
c) If the low pressure vessel is a horizontal vessel, assume vapour-only relief during
vapour breakthrough if the liquid level prior to vapour breakthrough is less than
60 % (based on typical design rules for horizontal separators) of the vessel
volume and the inlet nozzle is not submerged. In some cases, higher liquid levels
may be tolerable if inlet devices (e.g., splash plates) are provided. Consult the
Principal to determine whether a more sophisticated analysis is appropriate.
d) If liquid levels meet the criteria for vapour-only relief (as described in b. or c.
above), then the relief load is the vapour passing through the wide-open inlet
valve, plus the vapour generated by flashing the liquid at the low pressure
system's allowable accumulated pressure, minus any continued overhead vapour
flow out of the low pressure system.
e) Where the liquid levels are higher than the above criteria, assume liquid relief.
See (3.7.2.4) for sizing and design options.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 28
3.7.2.4 Design options with liquid relief
3.7.3
The following are design options available to provide overpressure protection for Case 1
where the vapour breakthrough results in a liquid relief.
1. Size the relief device that is on top of the low pressure vessel (or on its vapour outlet
pipe) for the liquid swell relief.
a) The required relief is a volume of liquid equal to the volume gain in the low-
pressure system at relieving conditions immediately after vapour breakthrough.
b) Size the relief device taking into account any liquid flash by means of a
homogeneous equilibrium model (HEM) as developed by the Design Institute for
Emergency Relief Systems (DIERS).
NOTE: In many cases sizing for this condition will result in very large orifice sizes.
2. Install a relief device immediately downstream of the control station.
a) If the relief device is close-coupled to the control valve station (i.e., within 5 pipe
diameters from the valve with the controlling flow capacity), size the relief device
for the flow through the valve after the vapour breakthrough (i.e. the steady state
vapour or two-phase breakthrough load).
b) Close coupling will result in a smaller relief area requirement than that defined in
(3.7.2.4-1).
c) Since the relief device discharge shall be free draining, this option normally
requires elevating the control valve above grade. If the control valve is not
elevated to make the pressure relief device free draining, then two rupture disks
in series or a rupture disk and a safety relief valve may be used
i. The first rupture disk (and its block valve) shall be located as close to the
control station as possible to minimize the transient pressure.
ii. The safety relief valve or the second rupture disk discharge shall be
elevated so that it is free draining.
iii. Use of a rupture disk in series with another pressure relief device for this
application requires a pressure alarm between the rupture disk and the
second pressure relief device.
iv. Rupture disks sized for vapour, but normally in liquid service, may, upon
failure, flow liquid to the relief system. In these cases, the flare knockout
facilities should be sized to handle these liquid streams.
3. Other relief devices in the low pressure system may provide some capacity credits
reducing the required size of this pressure relief device. However, differences in the
physical location of the relief devices may result in liquid or two phase relief from
devices designed for vapour.
Case 2 – Loss of liquid feed to the high pressure system
1. The case of loss of liquid feed to the high-pressure system shall be considered as a
design scenario.
Although this relief load does not normally govern PRV sizing, it should be calculated for
determining overall flare loads since other PRVs may relieve during the scenario that
caused loss of feed.
2. If liquid feed is lost to the high-pressure system (e.g. during a power failure or pump
failure), vapour breakthrough to the downstream low pressure vessel can occur.
3. Relief load shall be calculated under the following assumptions:
a) High pressure system at normal operating pressure.
b) High pressure system bottoms control valve and bypass in their normal position.
c) Low pressure system is at the single jeopardy Code-allowable accumulation.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 29
3.7.4 4. There is a special case to consider for reactor trains in which a utility failure causes both
3.7.5 a loss of feed to the high pressure vessel and a loss of liquid flow out of the low
pressure vessel (e.g., the liquid in the low pressure vessel is pumped out, instead of
pressured out).
a) During the utility failure, the liquid inventory upstream of the high-pressure vessel
can continue to flow into the high-pressure vessel (albeit at a declining rate).
b) Assume that the initial normal liquid inventory in the high-pressure vessel plus
any additional liquid inventory that is swept into it will be transferred to the low-
pressure vessel via the level control valve. Because the liquid flow out of the low-
pressure vessel stops during that utility failure, higher liquid levels may be present
in the low pressure system than were calculated for Case 1.
c) Evaluate the possibility of liquid or two-phase relief due to either overfilling of the
low pressure system or liquid swell as described previously in Case 1. In Case 2,
however, assume the high-pressure level control valve is in its “normal” design
position (instead of wide open).
Case 3 – Both control valve and bypass wide open
1. The situation in which both control valve and bypass are wide open shall be considered
a Remote Contingency.
2. Case 3 shall be evaluated with the same steps and assumptions as Case 1, with the
following differences:
a) Both the control valve and the bypass valve shall be assumed to be wide open.
b) Allowable accumulation is 50 %.
Case 4 – Excess system inventory
1. Each system has a threshold system inventory (inventory in the upstream and
downstream vessels) that, if exceeded, results in liquid entering the downstream
equipment relief device during the vapour breakthrough scenario.
2. Case 4 shall be evaluated by the approach specified for Case 1 with the exception that
abnormal liquid levels coincident with the start of the vapour breakthrough shall be
assessed. This scenario is considered a Remote Contingency.
NOTE: 1. Case 1, a single jeopardy scenario, is based on normal liquid levels plus other simplifying
assumptions.
2. Sizing the downstream vessel to contain the liquid full contents of the upstream vessel may lower
the risks of excess system inventory but does not eliminate the scenario since abnormal liquid
levels in the downstream vessel are also possible.
3. This case shall be mitigated by one of the following two methods:
a) Pressure relief design options as in Case 1 (see 3.7.2.4) with the following
exceptions:
- Allowable accumulation shall be maximum 50 %.
- If rupture disks are used exclusively to mitigate this case (i.e. there are other
relief devices set at the design pressure for other relief contingencies),
consideration may be given to specifying a burst pressure higher than that
specified by the Code. Approval by the Principal is required as well as
explanatory narrative on the PEFS, PSFS, and in the PSSS.
NOTE: Specifying a high burst pressure (up to 1.5 × design pressure) can minimize the likelihood of
nuisance rupture disk reliefs.
b) Risk assessment to determine what other hardware is appropriate to control the
risk, e.g. an IPF. Risk assessment shall examine the likelihood and consequence
of deviating from the assumed condition (e.g., exceeding the threshold inventory).
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 30
3.8 MANUAL VALVE OPERATION
3.8.1
General
3.8.2
An inadvertent valve operation scenario involves determining the consequences of
3.9 individually closing normally open manual valves and individually opening normally closed
3.9.1 manual valves. This includes control valve bypasses.
1. For vapour breakthrough cases that may occur as part of this scenario, refer to (3.7).
2. The consequences of closing normally open manual valves as well as opening normally
closed manual valves SHALL [PS] be evaluated.
NOTE: Most of these cases are already covered if there is a pump or control valve in the system as the
single power failure case and instrument air/controller cases cover the same closed or open
condition.
3. Misoperation of control valve bypasses is covered in (3.8.2).
4. The scenario of inadvertently operating a car-sealed valve is covered in (2.15.3).
Control valve bypasses
1. The typical design premise is that the control valve bypasses are normally closed. The
bypasses are used primarily for control valve maintenance. Therefore, when the
scenario of control valve bypass misoperation is evaluated, the bypass valve should be
assumed to be wide open and the control valve should be assumed to be closed.
Operation of the control valve bypass with the control valve in its normal position is in
this case considered a Remote Contingency.
2. If the unit's operating practice is to routinely use control valve bypasses, the bypass
valves shall be assumed to be wide open when evaluating other relief scenarios on the
downstream system. Having the control valve bypass wide open with the control valve
wide open shall then be evaluated as a design scenario.
NOTE: Assuming the bypass valve to be wide open is not double jeopardy since in this case it is normally
open and it is difficult to quantify to what extent it is open. The wide open bypass valve condition
may affect relief scenarios such as control valve wide open and general instrument air failure. In
addition, fire loads from the upstream equipment may be transferred to the downstream system
through the open control valve bypass.
FIRE
General
The fire scenario involves calculating relief loads caused by external fire exposure.
1. If more than two hours of fire exposure is required for process related equipment (i.e.
not storage tanks) to reach relieving conditions and there is good access for firewater
coverage then, except for processes involving reactive hazards, the fire case need not
be considered as an overpressure contingency. All such situations require review and
approval by the Principal.
2. If a fail open control valve separates two systems and the design pressures differ by
more than 50 %, the impact during the fire scenario on the system with the lower design
pressure shall be evaluated. This is particularly important if both vessels are in the same
fire zone.
3. For the fire case, relief valves do not need to be sized for two-phase flow unless reactive
hazards are involved.
4. During a fire, all input and output streams to and from the fire-affected equipment and all
internal heat sources within the process are assumed to have ceased as a result of fire
detection and operator intervention.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 31
3.9.2 5. If the equipment is located above the 8 m (25 ft) fire zone and there is no other source
3.9.3 of overpressure a relief valve is still required unless it satisfies the fire exclusion criteria
in (3.9.2).
NOTE: Some vessel design codes required a relief device regardless of whether there is a source of
overpressure.
Fire case exclusions
1. Overpressure protection (a relief device) is not required for small-capacity (< 500 L (< 18
ft3)) pressure vessels containing liquid that is not classed “very toxic”, and if the liquid
has an initial boiling point higher than the maximum ambient temperature, and if fire is
the only overpressure scenario.
2. For reboiler condensate vessels (used for reboiler level control) where fire is the only
overpressure scenario, overpressure protection is not required.
3. Overpressure protection is not required for small-capacity (< 500 L (< 18 ft3)) pressure
vessels in vapour service if fire is the only overpressure scenario.
4. For air-cooled heat exchangers where fire is the only overpressure scenario,
overpressure protection is not required.
5. For double-pipe exchangers where fire is the only overpressure scenario, overpressure
protection is not required.
6. Refer to (6) for fire case exclusions for storage tanks.
7. Piping does not require fire case relief devices. However, where possible the design of a
facility should avoid having blocked-in sections of liquid full pipework.
Fire relief requirements for heat exchangers
1. Requirements for fire case pressure relief depend on the system design, the process,
and the exchanger design. Fire exposure of an exchanger blocked in for maintenance is
not normally a design premise. As described in (2.15.2), exchangers shall be promptly
drained and depressured. Consequently, fire exposure only needs to be considered for
exchangers that are in operation before the onset of a fire. Pressure relief credit from
adjacent equipment depends on system hydraulics and manual valve location, and on
whether there is a control valve located in this flow path. As noted in the next section,
some exchanger designs for the fire scenario do not require any fire relief protection,
some require only thermal relief protection, and some require vapour relief protection.
2. For exchangers that do not need any protection against fire exposure, refer to (3.9.2.4)
and (3.9.2.5) for fire case exclusions.
3. Fire case thermal relief applications
Exchangers that have large bolted body flanges (e.g., channel heads) tend to self-relieve
during fire exposure because the heat relaxes the large body flange bolts.
a) Shell-and-tube heat exchangers that are assumed to be self relieving during fire
exposure shall have a means of accommodating liquid thermal expansion during
a fire in which all of the conditions below are effective. This shall be evaluated for
both the shell side and the tube side.
(i) The exchanger is within a fire zone.
(ii) The exchanger is liquid full (95 % or more liquid full)
(iii) Downstream control valve is fail-close and is in the same fire zone as the
exchanger.
(iv) Thermal relief cannot flow upstream due to any of the following reasons:
– the upstream equipment's design pressure is greater than the
exchanger's design pressure;
– the flow path contains either a fail-close valve (in the same fire zone) or
a check valve (typically with pumps).
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 32
(v) The exchanger is not in cooling water service or any other service in which
circulation would likely continue in the event of a fire.
(vi) The exchanger is not in a process that requires vapour relief (see 3.9.3.4)
b) Acceptable means of accommodating liquid thermal expansion due to fire is
described in (3.10.6).
4. Fire case vapour relief applications
a) Exchangers in LNG service require fire case vapour relief protection.
b) Exchangers that have a reactive hazard potential may require fire case vapour
relief protection. Consult the Principal for guidance.
c) The shell side of a fixed-tubesheet exchanger shall comply with the fire case
overpressure protection requirements specified for pressure vessels.
Consequently, fire case pressure relief may be required for fixed-tubesheet
exchangers if they have a capacity greater than 500 L (18 ft3).
NOTE: The shell side of a fixed-tubesheet exchanger does not have large body gaskets to provide self-
relief during fire exposure.
d) Exchangers with special high pressure closure designs on the tube side and/or
the shell side shall comply with the fire case overpressure protection
requirements specified in (3.9). These are:
(i) For the tube side TEMA Front End Stationary Head Type D
(ii) For the shell side TEMA Front End Stationary Head Type N with a Rear
End Head Type of L, M, or N
NOTE: Such closures might not self relieve during fire exposure.
e) If the exchanger uses fused plates (i.e., no gaskets between the plates), it shall
be assumed that it does not self-relieve. When sizing for fire relief in this case,
conservatively use the heat flux from the exchanger's entire external surface area
on each stream in the exchanger.
f) If fire vapour relief is required, the vapour relief path shall be evaluated to confirm
that the equipment does not exceed 21 % accumulation during fire exposure. Any
control valve within the relief path should be assumed to be in the closed position.
3.9.4 Fire heat input calculations
1. If there are adequate fire fighting efforts and drainage to avoid accumulation of
flammable liquids underneath the protected equipment, relief load for fire case shall be
based on heat input calculated in accordance with the following equation:
0.82
Q = 43.2 FA
where
Q = Total heat input in kW
F = credit for fire-resistant insulation
2
A = Wetted surface in m
or
Q = 21000 * F * A0.82
Where: Q = heat input in Btu/h
F = credit for fire-resistant insulation
A = internal wetted area in ft2
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 33
2. If adequate drainage and fire fighting capabilities are not available, the relief load shall
be based on the heat input calculated in accordance with the following equation:
SI units:
0.82
Q= 71 FA
USC units:
Q = 34500 * F * A0.82
3. The Environmental Factor, F, for bare vessels and vessels with conventional insulation
is 1.0, therefore no reduction in relief load is allowed.
4. The Environmental Factor, F, for vessels with a heating or cooling jacket is 0.6.
5. Fire-resistant insulation may be applied to reduce heat input due to a fire. There are two
types of fire-resistant systems: thermal insulation and intumescent coatings. If fire-
resistant insulation is provided, then the Environmental Factor, F, as defined in ISO
23251, may be used. Alternatively, the factors in the following table may be used:
Fire-resistant Insulation Thickness Environmental Factor, F
mm (in)
25 (1) 0.3
37 (1.5) 0.2
50 (2) 0.15
75 (3) 0.10
≥ 100 (4) 0.075
The designer should use actual insulation conductivity data, for which insulation
specialists shall be consulted.
For intumescent fire-resistant coatings, the Environmental Factor shall be evaluated on
a case-by-case basis, taking into account that the intumescent coating provides
protection only for a limited time.
An insulation system is considered fire-resistant if the insulation is fire resistant and it is
sheathed and banded with stainless steel.
Normally it is not economic to provide insulation to reduce the size of relief loads from
process equipment under fire exposure. However, reduction of fire heat input can be
accomplished by using a fire-resistant insulation system. Note: use of insulation may
introduce the potential for corrosion under insulation.
6. The Environmental Factor for mounded storage (excluding the part exposed to fire) shall
be 0.03.
7. The Environmental Factor for underground storage shall be zero.
3.9.5 Internal wetted area
1. The internal wetted area shall be calculated as follows:
a) For calculating wetted area, a fire height of 8 m (25 ft), as specified in ISO 23251,
shall be used for process equipment other than spheres or spheroids, and 9.1 m
(30 ft), as specified in ISO 28300, for storage tanks. For the wetted area of
spheres and spheroids, ISO 23251 requires the use of the diameter or 8 m (25 ft),
whichever is greater. The height shall be measured from grade or from any solid
deck/floor that could have a pool fire.
NOTE: 8 m has been used in many sites as equivalent to 25 ft. Sites may continue to use whichever
height they have historically used.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 34
3.9.6 b) For process equipment, the wetted area shall be based on the normal liquid level
and not on the high level alarm point. For vertical vessels supported on skirts with
a maximum of one skirt opening, the area of the bottom head shall not be
considered as part of the wetted area.
c) For storage vessels/tanks, the maximum operating liquid level shall be assumed
when calculating the wetted area. See ISO 23251 and ISO 28300 for specific
guidance on the wetted area of spheres.
d) For columns, the wetted area shall be based on the normal liquid level, plus
75 mm (3 in) per column tray, and plus 3 cm for each 24 cm (1.5 in for each ft) of
internal packing to account for drainage of liquid holdup. If an evaluation of the
particular column shows that it has lower amounts of liquid hold-up, then values of
less than 75 mm (3 in) may be used with approval by the Principal.
e) For processes that have reactive hazards, the Principal shall be consulted
regarding the assumptions to be made about exchanger's wetted areas.
f) The wetted area of piping affected by the fire case shall be included in the total
wetted area of the equipment.
2. For new design, only the wetted areas within a 300 m2 (3200 ft2) plot area shall be
considered when a system's relief loads are calculated or when flare loads for multiple
systems are evaluated. Unless physical barriers (such as walls) are present the fire
zone shape shall be assumed to be circular. Curbing is not considered a physical barrier
and does not affect the shape of the fire zone.
For process buildings or offshore facilities, the concept of fire areas is replaced by one
of fire compartments segregated by fire walls or floors. The area of these compartments
usually determines the size of the fire.
3. Since the fire relief load is based on the wetted area of the equipment and the liquid
properties in the equipment, then it is often not appropriate to simply add up the wetted
areas of multiple pieces of equipment that are in the same fire zone. That is, the fire
relief loads may need to be calculated for each individual piece of equipment and the
resultant loads combined.
If shell-and-tube heat exchangers are within the fire circle of other vessels and there is
an open fire relief path to that equipment, then the fire relief load from the exchanger
should be included in the fire relief of the vessel, partly because the exchangers are
often rated higher than the attached equipment.
Applying the fire heat input to the process
Any heat of reaction triggered by fire exposure is additive. Typically this is a complex
problem since this heat input is not steady state. The Principal will provide guidance on a
case-by-case basis.
1. Properties of the vaporizing liquid shall be based on the relieving pressure and
temperature, and not on the normal operating conditions.
2. Consider different compositions that may exist during the unit start-up or shutdown.
NOTE: For example, flushing oil may be in the equipment during these conditions.
3. If a vessel contains two separate liquid phases, all the fire heat input shall be applied to
one phase and then to the other phase. The case that results in the highest orifice area
shall be used.
4. For single component fluids, the fire relief loads shall be calculated by dividing the total
heat input by the latent heat of vapourization.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 35
3.9.7 5. If a vessel contains a mixture of fluids, the relieving fluid properties shall be calculated
by assuming that 5 % by weight of the original mixture has already flashed. This shall be
done as follows:
a) Evaluate all the following properties at the maximum allowable accumulated
pressure.
b) Flash off the lightest 5 %.
c) Use the remaining 95 % to determine the average properties.
d) Determine the latent heat of vaporization of the remaining 95 % by:
- Finding the bubble point specific enthalpy of the liquid in J/kg (Btu/lb).
- Finding the dew point enthalpy of the vapour in J/kg (Btu/lb).
- Subtracting the liquid enthalpy from the vapour enthalpy to find the latent heat
of vapourization in J/kg (Btu/lb).
e) Find the average molecular weight, compressibility, and temperatures associated
with the vapour at Maximum Allowable Accumulated Pressure and use these
properties for the PRV vapour sizing.
NOTE: The latent heat, temperature, and molecular weight of the liquid that is initially vaporized will be
lower than the average values. A rigorous (dynamic) analysis of one mixture has illustrated that
the simplified approach of using average values is conservative.
6. For a column's fire relief, the PRV shall be sized assuming two compositions as follows:
a) First composition based on the tray below the top tray.
NOTE: For modelling purposes, this is the third theoretical stage composition or reflux composition if the
third theoretical stage data is not readily available.
b) Second composition based on the column bottom.
c) The column's PRV shall be sized for both compositions and the larger size of the
two shall be used. Do not apply the 5 % by weight rule since the removal of light
materials is already taken into account by using the composition in the tray below
the top tray.
Fire relief loads near process critical point
When the process is near its critical point, the latent heat of vapourization approaches zero.
Because of simplifications made to the API fire relief equations, the use of low latent heat
values may result in inaccurately large fire loads.
1. If the latent heat of vapourization is less than 115 kJ/kg (50 Btu/lb), use the calculated
latent heat of vaporization, or use the iterative fluid expansion technique specified
below.
2. The iterative fluid expansion technique shall be as follows:
a) Calculate system volume. This is the equipment volume that is available to
absorb the expansion. The system volume includes everything within the
pressure system boundaries, and not just the equipment in the fire zone.
b) Calculate the fire heat input. Because there is no difference between liquid and
vapour above the critical point, use the full vessel area as the wetted area. It is
acceptable to ignore the wetted area that is more than 8 m (25 ft) above the
grade/pool fire source.
c) Run the process simulation starting at the normal temperature and pressure.
Then find the temperature required for the system to reach relieving pressure.
Determine the time required to reach this point.
d) Rerun the process simulation at small intervals of increasing temperature.
- The increased temperature causes the density of the supercritical fluid to
decrease (specific volume increases).
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 36
3.9.8 - Since the system volume is fixed, the change in specific volume multiplied by
the total volume is the amount that shall be removed over the time interval
corresponding to the inputted temperature change.
- For each simulation interval, capture the physical properties for the purposes
of PRV sizing.
- Put all of this information in a spreadsheet to plot the mass flow rate and
required orifice area required as a function of time.
e) Run the simulation at relieving pressure and relieving temperature plus a
temperature increment. Capture the average density and heat content of the
material, and its compressibility.
- Given the change in heat content from the previous simulation and the fire
heat input, calculate the time corresponding to the temperature increment.
- Given the change in density over this time period, calculate the mass that shall
be removed from the system. Given the physical properties, calculate the relief
area required (use the API vapour relief sizing equation). Do this again for
another temperature increment.
f) When the required orifice area is plotted against time, the orifice area usually
peaks out. Use the peak required area. Smaller time increments may be
necessary near the peak point. If it does not peak, pick the largest area within a
two hour fire exposure time.
Internally insulated vessels
Internally insulated vessels include vessels that have internal refractory lining (used to keep
the hot process temperature from heating up the vessel shell) and vessels that have
internal concrete/gunite lining (intended to minimize internal corrosion).
1. Internally-insulated vessels exposed to an external fire can fail due to vessel shell
overtemperature. Mitigation measures to prevent this shall be assessed on a case-by-
case basis.
Internal insulation/lining on vessels might not be indicated on pre-existing PEFSs, but
shall be shown on any PEFS and PSFS created or revised by the project.
2. Fire relief loads for vessels that are partially or totally internally insulated shall be
calculated ignoring any insulation effects of the internal lining.
3.10 THERMAL RELIEF/THERMAL EXPANSION RELIEF
3.10.1
General
Equipment and piping that can be blocked in and can be exposed to increased
temperatures shall be protected against overpressure. This DEP differentiates between
applications that result in vapour relief and those that result in liquid or two-phase (liquid
could flash across PRV) relief since installation requirements differ. If the increased
temperatures cause the liquid's vapour pressure to exceed the equipment's design
pressure, then the relief will be vapour, otherwise the relief will be liquid or two-phase.
1. Thermal relief
Thermal relief is the blocked-in vapour relief scenario caused by heat gain from the
environment or process. For example, a blocked-in LNG pipe would have a vapour
relief due to heat input from the environment. The thermal relief valve should be located
at the highest point in the system in order to relieve the vapour. See specific equipment
relief requirements described in (3.10.2 through 3.10.5).
Thermal relief valves on piping where the heat input is from the environment do not
need to be sized. The relief rate due to environmental heat input is expected to be no
larger than the rated flow of a nominally sized relief valve. Thermal relief valves on
traced or jacketed piping, vessels, exchangers, and pumps do need to be sized.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 37
3.10.2 2. Thermal expansion relief
3.10.3
Thermal expansion relief (also known as liquid expansion relief or hydrostatic relief) is
3.10.4 defined a liquid or two-phase (if there is flashing) relief scenario caused by heat gain
from the environment or from the process. For example, a blocked-in liquid-full pipe
heated up by the sun or a blocked-in heat exchanger (cooling water side heated by the
process) may have hydrostatic relief requirements. The Thermal Expansion Relief Valve
(TERV) does not need to be located at the highest point in the system, instead it should
be located close to the process. See specific equipment relief requirements described
below.
a) If the heat gain is from the environment, TERVs do not need to be sized. The
relief rate due to heat input is expected to be no larger than the rated flow of a
nominally sized relief valve.
b) If the heat gain is from the process, TERVs shall be sized using the design duty of
the equipment or the heat gain from chemical reactions.
Vessels
Vessels that are liquid full shall be evaluated for thermal expansion/thermal relief.
Heat exchangers
1. If isolation of the cold side of heat exchangers in liquid service with continued heat input
from the process or utility heat medium (hot side) results in a vapour pressure greater
than design, then overpressure protection SHALL [PS] be provided. Note: this is a
process pressure relief scenario, not a "thermal relief" one.
2. Heat exchangers SHALL [PS] have a thermal relief valve if the vapour pressure of the
shell or tube side fluid at ambient temperature exceeds the respective design pressure.
The thermal relief valve shall be sized for vapour relief and located at the high point in
the system.
3. Except as noted below, the cold side of all heat exchangers in liquid service require
TERVs if the cold side of the exchanger can be blocked in and the vapour pressure is
less than the design pressure. If there is a control valve, or a manually operated valve
that is routinely used to adjust flow, on the outlet of the cold side of the exchanger, then
full closure of this valve shall also be considered.
4. At sites that have established procedures, training and competencies to permit the use
of administrative controls to manage the operation of exchanger maintenance isolation
valves, a TERV to protect the cold side of the exchanger may not be required unless
the cold side of the exchanger is operating above its auto-ignition temperature or if the
exchanger contains LPG or “very toxic” substances.
Piping
1. Piping SHALL [PS] have a thermal relief valve if the vapour pressure of the fluid at
ambient temperature exceeds the piping design pressure. Wherever possible, the
thermal relief valve shall be located at a high point in the system. No specific vapour
relief calculations are normally required for piping, irrespective of the volume.
2. Piping that can be blocked in and contains more than 500 L (18 ft3) of LPG or “very
toxic” liquids require a TERV. For processes that have a low threshold on material
releases (e.g. environmental reporting of ethylene oxide releases), more stringent
criteria than what is shown above may be appropriate. Consult the Principal for
guidance.
3. Other process lines shall have a means for thermal expansion relief if all of the following
conditions are met.
a) Line is completely full of liquid (i.e., more than 95 % full).
b) It is probable that the line will be blocked-in at both ends.
NOTE: 1. Is the piping or equipment continuously in operation and thus unlikely to be isolated without
being depressurised and drained? Most process equipment and piping is in this category.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 38
3.10.5 2. A check valve is considered an isolation valve in one flow direction when evaluating relief
3.10.6 paths only.
3. The closure of valves that are used only for maintenance isolation (i.e., not a normally
operated valve) is usually not considered a condition that requires thermal relief because it is
expected that procedures to prevent hydrostatic overpressure will be followed.
c) It is not practical to drain the line or to provide a thermal expansion relief path.
d) Line is above ground and will likely heat up due to solar radiation, heat tracing,
etc.
Pumps
1. A TERV located on the suction side shall be provided for centrifugal pumps in butane or
lighter service.
2. For canned LNG pumps, the pump SHALL [PS] have a thermal relief valve. The thermal
relief valve shall be sized for vapour relief and located at the high point in the system
(the highest point on the pump case/discharge piping).
Thermal relief and thermal expansion relief mitigation
1. Economics as well as reliability should be considered when choosing mitigation options.
Thermal relief and thermal expansion relief shall be mitigated by one of the following
options.
a) Install a TERV.
In accordance with ASME B31.3, TERVs that protect only piping and piping
components may be set at 120 % of the piping system design pressure. Depending
on the design concept of a project (particularly in relation to its required
expandability, operability and maintainability) the Principal may specify a lower
allowable set point, e.g. 110 %.
b) Drill a small (e.g., 3 mm (1/8 in)) hole in the check valve.
c) Prevent full closure of the control valve by:
(i) Providing a physical minimum stop.
(ii) Drilling a small hole in the valve.
(iii)Providing a small bypass with a restriction orifice.
d) Use normally-open check valve bypass (car-sealing such valves open is not
required). This option is not recommended for LNG thermal relief applications.
NOTE: Leakage through a seated check valve is assumed not to be adequate for the fire-induced thermal
expansion case.
2. The means of accommodating thermal relief and thermal expansion as described above
should be shown on the PEFS.
3.11 REACTIVE HAZARDS
The Principal SHALL [PS] be involved in either calculating or reviewing third party
calculations for reactive hazard relief loads (runaway reactions).
3.12 VACUUM
The vacuum scenario involves evaluating the consequences of any potential vacuum
conditions that exceed the external design pressure of the equipment.
Vacuum caused by steam-out procedure failures is not a design premise. When assessing
the potential for vacuum conditions during pump out, take the maximum normal liquid level
as the starting condition. Any vacuum caused by changes in temperature shall be
considered.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 39
4. REMOTE CONTINGENCY SCENARIOS
4.1
4.1.1 GENERAL
4.1.2
4.2 Although the set pressures of relief devices used exclusively to mitigate Remote
4.2.1 Contingencies (i.e. there are other relief devices set at the design pressure for other relief
contingencies) may be higher than those specified by the Code, this practice shall not be
4.2.2 adopted unless approved by the Principal, in which case it shall be explained in the
narrative on the PEFS and PSFS, and in the PSSS.
The potential accumulation and consequences of Remote Contingencies shall be
evaluated and documented in the Safeguarding Memorandum.
HEAT EXCHANGER TUBE RUPTURE
General
The heat exchanger tube rupture scenario involves evaluating the consequences of a tube
rupture of a shell-and-tube heat exchanger. This scenario also includes heating and cooling
coils that could rupture.
1. Shell-and-tube heat exchanger system (exchanger and attached equipment) SHALL
[PS] have overpressure protection if exchanger tube rupture is considered viable and
the hydraulic limits of the system's relief path allow the system pressure to exceed
150 % of the design pressure.
2. Tube rupture shall be considered a viable overpressure scenario only if the exchanger
high side design pressure is greater than 150 % of the design pressure of the low side
system. The viability of a tube rupture shall be considered for downstream systems as
well. Where the system design pressures meet the 2/3rds rule, the tube rupture case is
no longer an overpressure scenario for the heat exchanger, but the upstream and
downstream systems still need to be considered both for overpressure and for other
consequences (e.g. contamination).
3. For new designs where the low pressure side of the exchanger can be isolated by block
valves, the low pressure side design pressure shall be based on 2/3rds of the high side
design pressure including the piping and the block valves. If this is costly, then relief
devices located within the block valves shall be specified.
4. If the low pressure side can be isolated while the high pressure side continues to
operate, the potential overpressure could be of long duration. In this case the design
pressure of the low pressure side and the piping including the block valves should be
made equal to the design pressure of the high pressure side.
5. The internal rupture of double pipe exchangers shall not be considered viable provided
the double pipe exchangers are constructed from piping components.
NOTE: Hairpin exchangers with tube bundles are not considered double pipe exchangers.
6. Internal failure of plate and frame exchangers shall be evaluated by assuming a 1.5 mm
(1/16 in) wide crack along the length of the high pressure header or the low pressure
header
7. Relief loads due to internal failure of printed circuit heat exchangers shall be calculated
assuming failure of one flow channel and that the flow will be restricted by the cross
sectional area of the largest single flow channel (semi-circular groove). Similar to shell
and tube exchangers, this flow shall be multiplied by 2 to account for flow into/out of
both ends.
8. Internal failure of spiral exchangers shall be evaluated on a case-by-case basis.
9. For waste heat boiler tube ruptures in a Sulphur Recovery Unit, the Principal shall be
consulted for guidance.
Relief loads
1. Relief flows from a ruptured tube shall be calculated as follows:
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 40
a) Calculate relief loads assuming steady state conditions unless otherwise
specified.
b) Assume the upstream pressure is the normal operating pressure, and the
downstream pressure is at 50 % accumulation.
c) Select the appropriate flow assumption:
- If the high-pressure side fluid is liquid, calculate the flow into the low-pressure
side by assuming that the flow is through a square edge orifice with a diameter
equal to the exchanger tube's inside diameter, based on specified average
tube wall thickness.
- If the high-pressure side fluid is gas or vapour and if the pressure ratio
between the high-pressure side's normal operating pressure and 50 %
accumulation on the low-pressure side is less than the critical pressure ratio
for sonic flow (i.e. subsonic flow), calculate the flow into the low-pressure side
by assuming that the flow is through a square edge orifice with a diameter
equal to the exchanger tube's inside diameter based on the specified average
tube wall thickness.
- If the high-pressure side fluid is gas or vapour, and the pressure ratio between
the high-pressure side's normal operating pressure and 50 % accumulation on
the low-pressure side is greater than the critical pressure ratio for sonic flow
(i.e. critical flow), calculate the flow into the low-pressure side by assuming
that the flow is through a nozzle with a diameter equal to the exchanger tube's
inside diameter based on specified average tube wall thickness. For PRV
sizing, use the equation for vapour in API RP 520 Part I, with a typical
discharge coefficient of 0.975.
d) Assume that no product flashing occurs in the throat of the square edge orifice.
e) The design premise is typically a single full-bore tube rupture, so multiply the flow
by 2.0 to account for flow from both ends of the ruptured tube. If the shell and
tube heat exchanger is in the reactor train of a hydrocracker unit, then the design
premise shall be two simultaneous full-bore ruptures, so multiply the flow by 4.0.
Consult the Principal's hydrocracking specialist to determine whether or not this
premise shall be applied to a specific heat exchanger.
f) This multiplication factor of 2.0 (or 4.0) might be overly conservative since the
flow through the exchanger tube will be less than the flow through the tube sheet.
Depending on specific geometry and process conditions this multiplier could
actually be as low as 1.3. Consult the Principal for guidance if performing a more
precise analysis would be cost effective.
g) Consider any significant vaporization of products in the low-pressure side caused
by high-pressure, high-temperature tube rupture.
The Principal will provide direction if there is a viable tube rupture case involving
water or light hydrocarbons entering hot liquid systems.
2. There is a special case of the tube rupture scenario for exchangers with boiling liquids
on the high-pressure side (where the high-pressure side is the side being heated up and
is two phase; such as a reboiler).
a) Assume that the physical properties of the fluid that flows through both ends of
the tube leak are those of a homogeneous mixture of the high-pressure side inlet
and outlet streams.
b) Unless the tubesheet is unusually thick, assume that flashing does not choke the
flow into the low-pressure side.
c) Mix the tube rupture flow with the normal low-pressure side flow and determine
the amount flashed.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 41
4.2.3 d) Relief requirement (typically two phase) is the volumetric rate, in excess of the
4.2.4 normal low-pressure side volumetric rate.
e) If this approach shows that there is insufficient relief capacity in the system, it may
be cost effective to perform a rigorous two phase hydraulic analysis to evaluate
the normal flow path relief capacity. Otherwise, size the relief device for the
volumetric flow.
3. If all of the following conditions exist, transient (pressure surge) relief loads SHALL [PS]
be evaluated:
a) High-pressure side is on the tube side.
b) Shell side is primarily liquid phase.
c) Ratio between the high-pressure side's operating pressure and the low-pressure
side design pressure is greater than 3 to 1.
4. If required, transient relief loads SHALL [PS] be mitigated by one of the following two
options:
a) Assume the relief load is the flow of liquid at the tube rupture's volumetric flow
rate and locate the relief device close to the exchanger outlet. Specify a rupture
disk (instead of a relief valve) if the high side design pressure is greater than
7000 kPa (ga) [1000 psig].
b) Perform a surge analysis.
Impact on downstream equipment
1. The effect of tube rupture on downstream systems (i.e. through a control valve)
SHALL [PS] be considered.
2. The tube rupture flow to the downstream systems shall be the smallest of the following:
a) Flow and amount of flash assuming the differential pressure across the
exchanger tubesheet is based on 50 % accumulation in the downstream system.
NOTE: For example, if the high-pressure side of the exchanger is at 2700 kPa (390 psi) and the
low-pressure side of the exchanger had a 50 % accumulation of 2000 kPa (290 psi) and the
downstream system had a 50 % accumulation of 700 kPa (100 psi) then the tube rupture flow rate
to the downstream system could conservatively be based on the differential between 2700 kPa
and 700 kPa (390 psi and 100 psi).
b) Control valve capacity assuming the pressures upstream and downstream of the
control valve are both the Remote Contingency accumulation pressures of 50 %.
c) Flow and amount of flash based on a rigorous analysis of the specific system.
3. The impact (not just the mass flow) of the tube rupture flow into the downstream system
shall be evaluated.
Consider how the system might respond adversely to the tube rupture flow. For example
a tube rupture might introduce non-condensables into a column that would blanket the
condensers and also cause loss of overhead cooling.
Pressure relief considerations
1. For the tube rupture scenario, the pressure relief devices for ASME Section VIII
equipment shall be sized assuming a 50 % accumulation provided that no single item in
the system exceeds 50 % accumulation.
2. Pressure relief devices used to protect the shell side of an exchanger SHALL [PS] be
placed downstream of the inlet nozzle. This is required if the exchanger contains one or
more impingement plates that could blow off and block the exchanger inlet during a tube
rupture and thereby block the relieving path.
3. Although a full bore tube rupture is a remote but possible contingency, tube failures of
smaller magnitude are common. ASME Section VIII specifically requires the failure of a
heat transfer surface to be evaluated and requires that the relief device open before the
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 42
4.3 limiting MAWP is exceeded. The set pressure of relief devices protecting ASME Section
4.3.1 VIII heat exchangers shall be such that at least one device opens before the limiting
MAWP is exceeded.
4.3.2
4.4 INEFFECTIVE OPERATOR INTERVENTION
4.5
4.6 If, in the evaluation of an overpressure scenario, credit for operator intervention is being
4.6.1 considered (see 2.14), then the consequences of ineffective operator intervention SHALL
[PS] be assessed. The allowable accumulation for ineffective operator intervention is that
4.6.2 of a Remote Contingency when credit for operator intervention is considered in a design
4.6.3 scenario.
All consequences associated with ineffective operator intervention SHALL [PS] be
evaluated – not just overpressure. Examples include potential release of liquids to the
environment or equipment damage.
BOTH CONTROL VALVE AND BYPASS WIDE OPEN
This shall be evaluated as a Remote Contingency unless this is a design scenario in
accordance with (3.8.2).
VAPOUR BREAKTHROUGH
Four cases to evaluate for vapour breakthrough are described in (3.7). Case 3 and Case 4
are Remote Contingencies.
IMPROPER VALVE SEQUENCING
Pressure relief valves
Improper valve sequencing when lining up or isolating PRVs can result in overpressure of
the PRV body and possible damage to internal parts such as bellows or loss of containment
on the low pressure side of the PRV. This overpressure potential is normally mitigated via
mechanical/key interlocks on the PRV isolation valves. Sites that have established HSE
Management Systems which permit the use of administrative controls to manage PRV
valve sequencing may continue to use this approach; for those sites the potential
consequence of improper valve sequencing on the PRV block valves shall be described in
the Safeguarding Memorandum.
NOTE: The pressure rating of the discharge side of the PRV is often less than that of the inlet side.
Pumps and centrifugal compressors
For new pumps, the pressure rating of the suction side and discharge side of the pump
shall be the same. Exceptions to this require approval by the Principal
Positive displacement compressors
If the compressor inlet block valve is closed while the discharge valve is opened, equipment
located between the inlet block valve and the compressor discharge could be
overpressured due to backflow (leakage) through the compressor. This applies to all
stages. This scenario shall be mitigated by designing the equipment to limit the
accumulation to 50 % or by providing a PRV on the low-pressure side.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 43
4.7 BLOCKED OUTLET DUE TO CHECK VALVE FAILURE
4.7.1
A blocked outlet due to internal failure of a Class 1 check valve is not a design or Remote
4.7.2 Contingency scenario. If the check valve is in the fire relief path for upstream vessels, the
check valve shall either be fire proof insulated or have a design that is not susceptible to
binding closed during fire exposure.
A blocked outlet due to internal failure of other check valves shall be considered a Remote
Contingency with an allowable accumulation of 50 %.
If there is at least one block valve upstream or downstream of the check valve, check valve
failure should normally not result in any additional analysis since the closure of the block
valve should already have been evaluated.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 44
5. SPECIFIC PROCESS EQUIPMENT GUIDANCE
5.1
5.1.1 FRACTIONATING COLUMN RELIEF
5.1.2 General
Fractionator column relief loads are often major contributors to the overall flare load.
Consequently, the amount of effort to eliminate or reduce these relief loads should be
commensurate with the impact that this load would otherwise have on the relief/flare
system design .
Dynamic modeling of a fractionator column may show that the calculated peak relief load is
50% (or less) than the calculated load using the steady state calculation methods described
in this DEP. Proper dynamic modeling, however, can be labor intensive. So, its use
should be limited to the fractionators that individually or collectively have a large impact on
the flare system design. The project/study shall define and rationalize the method used
for each of the column reliefs. This shall be reviewed and approved by the principal.
Dynamic modeling of fractionator column reliefs is complex. The principal shall ensure
dynamic modeling of processes is performed by a subject matter expert. Dynamic
modelling shall use only business approved process simulators.
NOTE: The option of using dynamic modelling is available for most refining/olefin processes. The simulation tool,
UniSim, is typically applied. Dynamic simulation has not been as widely available for most chemical plant
applications because of the private custom data libraries which are used in the simulation tool that is often
used for chemical plant process designs. Only recent versions of the simulator have been extended to
allow dynamic simulation capabilities.
For new fractionator systems, the economics of specifying sufficiently high design
pressures to eliminate/minimize power failure/cooling water failure relief loads shall be
evaluated. Dynamic modeling to calculate the peak pressure can be a useful design tool.
If instrument settings/tuning becomes critical in the dynamic analysis these values shall be
documented in the Safeguarding Memorandum.
Loss of overhead cooling – Steady state – General
1. The required relief load is the vapour rate going to (not coming from) the top tray. This
load may be higher than the vapour rate coming from the top tray if there is any reflux
sub-cooling. Validate this by comparing this relief load to that where reflux stops (i.e.,
the stripper model). To determine the required relief area for loss of overhead cooling,
calculate the size assuming that reflux continues and assuming reflux stops (the stripper
model). Select the higher of the two relief areas.
The requirements in this subsection assume the use of a steady state process
simulator. Steady state simulation may not be successful if the simulation cannot be
converged under relieving conditions. This could happen if the process goes into the
critical region. It may also be difficult to simulate fractionating columns with multiple
products and cooling streams (e.g., refinery unit main fractionators) since these are
difficult to model under normal operating conditions. Steady state simulation assumes
continued feed because the simulator will not converge with zero feed.
If the column is modelled with a condenser, the condenser is theoretical stage 1 and the
top tray is theoretical stage 2. If the column is modelled without a condenser (i.e. the
condenser is external to the column), the top tray is theoretical stage 1.
NOTE: 1. Loss of overhead cooling causes a pressure build-up due to lack of overhead condensation.
Reflux continues until the accumulator liquid level is lost.
2. Some companies prefer to use a non-reflux stripper model to predict the relief load for loss of
overhead cooling. A stripper model neglects or ignores the trays/stages above the feed tray. For
loss of overhead cooling this model, however, may not be conservative. After overhead cooling is
lost, there is a transient period during which the column can pressure up and relieve while reflux
continues (until the accumulator runs dry). This means that liquid continues to flow down the
column trays and separation continues. The initial material relieved during this period has a lower
molecular weight than predicted by the stripper model. Consequently, the use of the non-reflux
stripper model may understate the relief area required.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 45
2. There are special cases where, for various reasons, the full column model simulations
converge under normal conditions but cannot or will not converge at relieving conditions.
In these cases it is acceptable to approximate the relief loads by using a stripper model
but with a correction factor calculated as follows: First calculate the relief area required
for the full column model under normal conditions (i.e. not at relieving pressure) using
the vapour to the top tray. Then model the column as a stripper under normal operating
conditions and calculate the required relief area using the vapour from the feed tray.
Determine the ratio between the relief areas for the two relief loads: ratio = full model
results / stripper model results. If the full model/stripper model ratio is greater than 1.0,
then run the stripper model for relieving conditions and multiply the relief case stripper
model results by the ratio determined above. If the full model/stripper model ratio is less
than 1.0, use the stripper model results without adjustment downwards.
3. See (3.2.6) for guidance on air cooler performance with loss of fans.
5.1.3 Loss of overhead cooling simulation procedure
The procedure for steady state simulation of a fractionating column for loss of overhead
cooling shall be as follows:
1. Calibrate the process model of the column using normal operating conditions.
2. If the column has a feed-bottoms exchanger, model it by interchanging heat between
the two streams using a specified transfer coefficient and exchanger area (i.e. set “UA”
or “U” and “A” in the simple exchanger model, do not set Q or one of the outlet
temperatures).
3. Eliminate design specifications and convergence control from the model as follows.
a) Set all column heat inputs, feed and product flows at their design case values.
b) Set the reflux rate or ratio at the design case value.
c) Set the reflux temperature at the design case value.
d) Set the side draw flows (if any) at the design case value(s).
e) For partial condensers, maintain constant accumulator vent rate. Set the vent rate
at the design case value.
f) Do not specify or vary parameters to obtain any tray temperatures, flows or
compositions in the distillation model. This means turning off all design
specifications, external/internal controllers, or other composition constraints
around the column.
g) Allow condenser duty and overhead product rate to vary during convergence.
4. Run the column at the normal pressure.
5. Ensure that the same results are obtained as with the original model, within the
calculated accuracy or convergence tolerance.
6. Rerun the simulation with the overhead pressure equal to the relieving pressure (PRV
set pressure plus allowable overpressure).
CAUTION: It may be necessary to increase the column overhead pressure up to the relieving pressure in
multiple small steps, always using the last converged solution as the initial guess for the next
higher pressure run. Even with this technique, sometimes the model will fail to converge. Usually
this happens when a tray dries up and liquid flow down the column is lost. If this situation cannot
be remedied (see (b) below), a fallback option is to consider the stripper model alternative
discussed above.
a) Again, initially assume normal reboiler and overhead duties.
b) Allow compositions to vary and if necessary adjust the tops product rate until the
model converges.
7. Confirm that instrumentation response assumptions are consistent with (2.10.1).
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 46
There SHALL [PS] not be any relief load reduction due to a favourable control
instrumentation response.
Always assume control loops that would decrease relief requirements are on manual
during the relieving conditions. For example, a reboiler steam supply valve that is on
column pressure control will tend to close under relieving conditions. This SHALL [PS]
not be assumed to happen.
Conversely, control loops that would increase relief requirements SHALL [PS] be
assumed to be in “automatic”. For example, if a reboiler heat medium is on flow control
then assume that the control instrumentation attempts to maintain this flow.
8. If the column has a temperature control loop for the reboiler, check the temperature at
the control tray point and proceed as follows:
If under relieving conditions the temperature is higher than the reboiler temperature
control point, such that the control instrumentation reaction tends to close the reboiler
control valve, assume that the valve is on manual control. Continue to assume a
constant reboiler heat input.
Conversely, if under relieving conditions the temperature is less than the reboiler
temperature control point, assume that the reboiler supply valve opens and the reboiler
duty is higher than normal. Revise the column model by adding back in the control
temperature specification and allowing the reboiler duty to vary.
This unusual control system response may be possible for columns in which there is a
sharp temperature (or composition) break across a few trays. During relieving conditions
this break point could shift past the tray that has the temperature control sensor, which
would result in the reboiler valve opening in an attempt to maintain target temperatures.
The resulting relief loads calculated by these methods are conservative and do not take
any load reduction credits that may be attributable to reboiler temperature pinches.
Temperature pinches and their effect on relief loads are discussed below.
9. The above calculated relief loads are premised on a constant or increased reboiler duty,
which depends upon the control tray temperature response. Under relieving conditions,
however, the process temperatures may increase at the bottom of the column to the
point where the reboiler duty decreases. This is called a temperature pinch.
NOTE: For example, if the reboiler is in steam service, the increase in process pressure to relieving
conditions might at first glance seem to reduce the reboiler's LMTD (log mean temperature
difference), which reduces the reboiler duty and steam demand. If, however, the reboiler is on flow
control, the steam valve will tend to open in an attempt to maintain the same flow, thereby raising
steam chest pressure and condensing temperature which would counter the higher process
temperatures associated with relieving conditions. Whether there is a net reduction of reboiler heat
input due to a temperature pinch is a case-specific and somewhat complex analysis that requires
careful consideration.
Evaluate reboiler temperature pinches as follows:
a) Determine the reboiler temperature pinch by looking at the decreased LMTD due
to the increased process side temperatures associated with the column operation
at elevated (relieving) pressure. As specified above and in (5.1.3.7), assess the
control system response.
b) If a fired furnace is used as a reboiler there is no temperature pinch credit
available as the effective supply temperature of the furnace (the flame) is quite
high.
c) If the reboiler heat source is hot oil, calculate the reboiler duty under relieving
conditions assuming the reboiler's normal hot oil inlet temperature and flow.
d) For all other reboiler types, calculate the reboiler duty by the following iterative
sequence.
(i) First, run the column model at relieving conditions with no assumed reboiler
pinch (follow the steps above). Obtain the required duty and process side
conditions from this model.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 47
5.1.4 (ii) Second, create a separate process model of the reboiler using a simple
5.1.4.1 heat exchanger. Specify all four stream flows and temperatures. For the
process side use the flow and temperatures from the column model above.
5.1.4.2 For the utility side, start with the normal flow and temperatures from the
reboiler data sheet. Also specify the combined UA or individual U and A,
but use the clean U and actual A indicated on the reboiler data sheet.
Calculate the transferred duty and compare with the relieving model.
- If the exchanger model duty is larger than the column relief model duty,
re-run the column relief calculation with the larger duty, then update the
exchanger model and rerun it, etc., until both models agree.
- If the exchanger model duty is smaller than the column relief model
duty, there may be a temperature pinch. As specified above and in
5.1.3.7, assess the control system response. To avoid more iterative
calculation, simply assume the steam side conditions are the same as
the steam supply conditions and rerun the exchanger model, then the
column model with the new duty, etc., until the pair of models converge.
Alternatively, a more exact hydraulic calculation can be performed by
setting the steam condensing pressure at supply conditions minus the
pressure drop across the fully open control valve for the steam flow that
was previously calculated. This hydraulic calculation will also be
updated each iteration as the duty and hence the steam flow changes.
After obtaining the pinched exchanger duty, rerun the column relief
model with the new duty, update the exchanger model with the new
process conditions and rerun it, etc., until both models are in agreement.
e) Do not use reboiler duties in the model that are less than 50 % of design, since
duties less than this might result in column dumping. Consult the Principal if a
calculated reboiler duty less than 50 % is to be used.
f) The Principal shall review all reboiler temperature pinches.
Loss of overhead cooling – Manual heat balance
General
The simulation method should be used for calculating relief loads on fractionating columns,
but if process simulation is not practicable, the manual heat balance method may be used if
approved by the Principal.
Calculation procedure
The manual heat balance calculation of a fractionating column for loss of overhead cooling
shall be as follows:
1. Calculate the reboiler duty under relieving conditions with the same procedure as in
steady state simulation and the following additional requirements.
a) If the column is on temperature control and the column calculations show a sharp
temperature/composition break near the control tray point, then (1) assume
maximum possible reboiler heat duty in the analysis, or (2) consult the Principal
for guidance.
NOTE: The maximum possible reboiler duty is the maximum duty assuming a clean bundle (clean U,
actual A), a wide open reboiler control valve, and the actual log mean temperature difference
(LMTD) under relieving conditions.
b) If the normal bottoms composition under relieving conditions results in
temperatures high enough to reduce reboiler duty to no less than 50 % of design,
then use this calculated reboiler heat duty in the heat balance calculation.
c) If the normal bottoms composition under relieving conditions results in
temperatures high enough to reduce reboiler duty to less than 50 %, then the
assumption that bottoms composition remains constant during relief may not be
conservative. In this case, calculate the reboiler LMTD using the bubble point
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 48
5.1.5 temperature of the feed. If this approach results in a duty of less than 50 % of
5.1.6 design, then calculate the reboiler LMTD using the bubble point temperature of
the reflux.
d) Given the LMTD calculated above, calculate the reboiler duty and use this value
in the heat balance calculation.
2. Perform a heat balance.
a) Sum up all enthalpies (entering and leaving) associated with process streams.
b) Add in the estimated reboiler duty, and use zero heat duty for the condenser.
c) Calculate the heat imbalance (the excess heat) and divide that by the average
latent heat of vaporization for the entire liquid on the 2nd from the top tray (use
properties at relieving pressure). The relief rate is the vapourization rate from this
tray (this is the vapour going to the top tray). If the relieving conditions approach
the critical point, consult the Principal for guidance.
3. If a more refined heat balance approach is appropriate, consult the Principal for
approval.
4. For columns with stripping steam, assume the steam and hydrocarbon exit at a common
temperature.
Fractionating column – Loss of reflux or overhead product
For loss of reflux or overhead product, no relief is required until the accumulator fills and the
condenser floods. The result is the same as loss of overhead cooling.
Fractionating column – Loss of feed
1. The following two scenarios for loss of feed to fractionating columns shall be evaluated:
a) First scenario – Only the feed to the column is lost and no other malfunction
affects the column.
This first scenario could be the controlling case (i.e. may be higher than loss of
overhead cooling) when the feed stream is a source of column cooling (i.e., it is a
subcooled liquid absorbing heat and not providing any vapourization upon entry
into the column).
If the feed stream is a source of heat, then this first scenario will not be the
controlling case for PRV sizing. However, for flare studies and in other cases that
are focused on total power failure loads from a process unit, this lower more
realistic load should be used rather than the larger load calculated from the total
loss of overhead cooling.
b) Second scenario – Feed to the column is lost while the column is upset.
The second scenario can occur if the feed does not have enough pressure to get
into the column during relieving conditions or if the feed is lost by the same
mechanism that caused the column upset (e.g., power failure).
2. The relief load from loss of feed shall be calculated by the steady state or manual heat
balance calculation as described with the following additional requirements:
a) For steady state simulation, determine the relief loads using the normal feed rates
as specified in 5.1.3. Then reduce column feed to 1 kg/h (2.2 lb/h) or whatever
minimum flow the column simulator will converge with. This may need to be done
in small feed reduction steps to avoid convergence problems.
b) For the manual heat balance simulation specified in (5.1.4), use zero feed.
3. When feed is lost, the column bottoms can lose liquid feed from above and vapour
generation can stop. This can result in the column dumping all its liquids to the sump.
This potential is automatically accounted for in the steady state simulation. It is also
accounted for in the manual heat balance simulation via the reboiler temperature pinch
analysis.
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 49
5.1.7 Reboiler supply control failure
5.1.7.1
Heat exchangers
5.1.7.2
5.1.8 1. When evaluating a control failure of the supply valve for reboilers (i.e., supply valve
goes wide open), the clean duty shall be assumed for the reboiler. Credit for the
overhead condenser can normally be taken up to the minimum turndown design case.
That is, if the unit is designed for a turndown of XX % of design flow, then assume that
the reflux and product rates are running at the XX % design rate when the reboiler
steam valve goes wide open.
NOTE: If the specific control scheme has no provision for turndown of the overhead cooling load, for
example a system designed with no outlet temperature control on an air cooler, then it is acceptable
to assume 100 % of the design condenser cooling rate.
2. If this scenario governs (i.e., it is worse than the loss of overhead cooling), the following
factors shall be considered:
a. Actual duty under relieving conditions (reboiler temperature pinch)
b. Rigorous heat exchanger modelling
NOTE: These factors may actually limit the relief.
Fired heaters
For fired heaters the maximum amount of duty that can be transferred to the process when
the fuel gas valves go wide open shall be evaluated on a case-by-case basis.
NOTE: The maximum heat duty depends on air flow capability, available draught, rated duty to max duty ratio,
excess air at the start of the scenario and many other factors.
Fractionating columns – Location and routing of pressure relief device(s)
1. The preferred location of fractionating column relief valves is on top of the vessel. An
alternative location is on the overhead line, upstream of the condensers.
PRVs located on accumulators or downstream of condensers might need to pass a
volumetric flow of liquid during loss of reflux. This could affect the sizing of the PRV
and/or it could create a problem of liquid slugs in the flare lateral. In addition, if system
pressure relief is provided exclusively by relief valves located on the accumulator or
downstream of the condenser(s) and there are equipment block valves between the
column and the relief valves, then there is the possibility of a blocked overhead. This
shall be assessed carefully even if there are parallel cooling circuits. Locating the PRV
upstream of the condenser can avoid this issue.
5.2 FURNACES AND FIRED PROCESS HEATERS
5.2.1
Design the system so that a pressure relief valve is not required.
5.2.2
In view of the high temperatures involved in fired heaters, overpressure protection and the
5.2.3 route for relieving the high temperature products are often not practical or possible. In
5.2.4 addition, regardless of whether a PRV is installed, prevention of tube rupture requires
instrumentation safeguards.
If a pressure relief valve is required, it shall be located upstream of furnace trips or flow
measuring devices.
NOTE: Locating the PRV downstream of the heater would permit continued flow through the heater but the
normal high temperatures at this location may result in fouling/coking the PRV, thus jeopardizing its
function.
Where a design against overpressure is impractical, instrumented protective functions may
be considered.
NOTE: Common applications are in ethylene, hydrocracking and hydrotreating units. Use of high pressure
trips, low flow trips, and high temperature trips may be required.
For a fired heater tube rupture, process lines on the outlet of furnaces that operate above
3500 kPa (ga) [500 psig] shall contain a single Class 1 check valve. Some processes with
ECCN EAR99 DEP 80.45.10.11-Gen.
February 2011
Page 50
two-phase flow out of the furnace have a range of flow regimes or other process conditions
so that it is very difficult to assure the reliability of even a Class 1 check valve.
NOTE: Common applications are with hydroprocessing units. The use of a check valve here would prevent
de-inventorying the reactor in the event of a furnace tube rupture. Without backflow prevention, more
process (fuel) could be dumped into the furnace which could cause escalation. This is an equipment
damage issue, not an over-pressure issue.
In order to avoid slug flow, the check valve should be installed close to reactor to minimize
liquid accumulation down stream of the check valves if there is a furnace trip.
Check valve to be non-slam design.
5.3 HEAT EXCHANGER – DIFFERENTIAL PRESSURE DESIGN
5.4 The design of the heat exchanger tube sheet, tubes, and other internals should be
5.4.1 designed for the following two conditions a) the shell side is at design pressure and the
5.4.2 tube side is atmospheric and b) the tube side is at design pressure and the shell side is
atmospheric. Where this is not done (i.e., where a differential design pressure for these
5.4.3 components is used), then the potential for having normal operating pressures on one side
of the exchanger and no (or reduced) pressure on the other side shall be evaluated.
ROTATING EQUIPMENT
Centrifugal pumps
Safeguards to prevent upstream equipment overpressure and centrifugal pump reverse
overspeed shall be provided. See (2.10) for details.
Centrifugal and axial compressors
1. Safeguards to prevent upstream equipment overpressure and compressor reverse
overspeed shall be provided.
2. Safeguards to protect centrifugal and axial compressors against backflow are the same
as for centrifugal pumps with the following additional requirements:
a) Distances between the compressor discharge and the check valve should be
minimized. The acceptable minimum distance shall be supported by hydraulic
analysis.
b) The surge control flow path shall be upstream of the check valves.
c) The Principal may restrict the type of acceptable check valves.
Positive displacement pumps
1. External PRVs shall be used on positive displacement pumps, except where noted
below.
2. For small additive positive displacement pumps (low risk applications), use of internal
PRVs is acceptable in lieu of an external PRV. A strategy for testing these devices and
maintaining them shall be defined.
3. Safeguards to prevent upstream equipment overpressure due to backflow through
positive displacement pumps shall be evaluated on a case-by-case basis.
If check valves are required for reciprocating pumps, proper check valve selection and
orientation is critical to assure reliable valve operation. Experience has shown that
improper check valve selection and/or valve orientation has caused severe valve
damage. Consequently, the need for check valves in these applications should be
carefully reviewed.
NOTE: Check valves may be required for operability reasons. In reciprocating pump applications without
recycle lines, external check valves (in the piping) are typically not required. They are installed in some
applications, including parallel pump operation, where discharge depressuring is required for start up.
The words you are searching are inside this book. To get more targeted content, please make full-text search by clicking here.
DEP_80.45.10.11_FEB-11
Discover the best professional documents and content resources in AnyFlip Document Base.
Search