PLANT SAFETY AND ENVIRONMENT

Ensuring site-wide consistency in relief system analyses

Follow these protocols when evaluating common-cause failure scenarios for flares and headers
R. BRENDEL, Jacobs Consultancy, Chicago, Illinois

hen the capacity and capabilities of a sites existing pressure relief system are to be evaluated, engineers often start by gathering current documentation for the relief valves (RVs). Typically, the site staff keep up-to-date documents on required loads and RV orifice areas for individual RVs that discharge into the system under various failure scenarios. The American Petroleum Institute (API) created a guideline for these documents so that the owner can demonstrate that each vessel and system is adequately protected by an RV for all credible overpressure scenarios. Once the information is gathered for each RV that discharges into the flare system, usually the engineers intent is to use the required relief loads shown there to analyze the headers and flare system for various scenarios. Although there are good reasons to approach the flare system review in this sequence, there are also potential pitfalls to avoid that can give a false view of the collection system. The following will discuss several situations in which careful analysis and accounting are required to ensure that the scenario used as a basis for analyzing the overall relief system reflects the plant configuration and that the scenario is self-consistent.

It captures the most likely scenario outcomes under consideration. It meets API-recommended practices and standards. It is reasonably conservative in that all assumptions that can be demonstrated to give estimates of flows into the relief system that are no less than those expected for the actual event under consideration.
Effects of instrumentation responses. When sizing an individual RV for a given service, per API guidelines, the analysis must not consider the normal response of any instrumentation that would tend to reduce the required relief load for that RV. Consider the distillation column shown in Fig. 1. The overhead pressure controller is an example of a beneficial instrumentation response. If a failure occurs and the column pressure starts to rise, the normal controller response would be to open the vent valve, which tends to reduce the required flow of excess gas that must exit the RV. Since this response is beneficial to the RV, the RV sizing analysis would consider that the pressure controller will fail to respond to increasing pressure, and the vent valve position would be considered unchanged from its normal position. Similarly, the individual RV analysis must consider the normal response of any instrumentation that would tend to increase the relief load. The reboiler steam flow controller in Fig. 1 is an example of this type. As the relief event develops and the column pressure increases, the process temperature at the reboiler will likely increase. This reduces the driving force for heat transfer across the reboiler tubes, thus decreasing the rate of steam condensation. The normal action of the steam flow controller would be to open the steam control valve, increasing the steam-side temperature in the reboiler by reducing pressure drop across the valve and increasing steam pressure in the tubes, restoring the driving force and increasing the heat transfer rate back toward its normal value. Thus, the individual column analysis must consider that the steam flow controller will respond normally to restore the reboiler temperature driving force during the event. These rules are required by the API for individual RV analyses to assure that there is sufficient relief protection for each piece of equipment. In the analysis of the entire flare system, however, assumptions that lead to maximum possible individual relief loads do not necessarily lead to maximum possible overall system loads, or to situations that are most demanding of the header system. This is recognized by the API, which, in Standard 521, gives this guidance on a similar, but not identical, situation:
HYDROCARBON PROCESSING DECEMBER 2009

Introduction. System-wide analyses of relief systems are often

based on relief loads determined when sizing individual RVs that discharge into the system because: Much of the technical work required for the system-wide analysis is the same as that done for the individual valves. The overall system basis is usually consistent with the bases used for the individual components. However, there are differences in the analyses necessary for evaluating the relief protection required for a single service as compared to those required for designing or analyzing a relief collection systemthe header system, liquid knock-out vessels, and the flare stack and tip. These differences often make it inadvisable or impossible to use the required relief loads for individual services when determining the governing cases for the collection system. The considerations pointed out here arise more frequently in complex relief systems, e.g., where there are several different flare systems that can interact; or in facilities that have site-wide collection and/ or distribution headers that interact with the relief system. Potential pitfalls are discussed here when evaluating a site-wide relief system from the starting point of data on individual RVs. A proper system-wide analysis will have the following characteristics: It is self-consistent, so no significant stream is doublecounted and no mutually exclusive loads are included.

I 75

PLANT SAFETY AND ENVIRONMENT

To are
PC

To are No. 1
PC

To are No. 1

Cooling water Condenser Distillation column Column feed Feedbottoms exchanger Overhead pump
FC

To vapor recovery Accumulator Vapor product Light liquid product

Accumulator Other units To are No. 1

PC PC

Knock-out drum Accumulator

To are No. 2 To vapor recovery

Steam Heavy liquid product FIG. 1 Reboiler Condensate

Distillation column. FIG. 2 Columns spill gas to a vapor recovery header.

It is important to recognize that systems with pressure-control valves and/or depressuring valves, can maintain the pressure below the opening pressure of a pressure-relief device. In such cases, it is not necessary to include the load from the pressure-relief device in the flare load in addition to that from the pressure-control valves and/or depressuring valves. Note that, in these cases, the resulting disposal-system load from the pressure-control valve or the emergency depressuring valve can be larger than the calculated load for the pressure-relief device.1 Fig. 2 illustrates vapor products from several distillation columns within one unit that are collected and routed on backpressure control to a vapor recovery header, where they join vapors from other units. RVs on the local columns discharge to the nearest flare, named Flare No. 1. The vapor recovery compressor is located far from the unit in consideration. Vapor collection header pressure is limited by a back-pressure controller at the compressor suction, such that, on detected high header pressure, excess gas will spill to Flare No. 2, which is the flare nearest to the compressor. There is no direct connection between the headers for Flare No. 1 and Flare No. 2. When analyzing the required relief loads from the distillation colums for a power failure scenario to size the RVs, API guidelines state that the beneficial controller responses may not be taken into consideration, as previously discussed. Note, however, that, although the normal response of any column pressure controller is beneficial for the column itself, its action is not beneficial for either the knock-out drum in the unit or for the potential load to Flare No. 2. If the power failure scenario takes place as assumed in the RV study for the columns, Flare No. 2 will see a relatively small load since the spill valves into the header are not considered to have responded to increasing pressure in the columns. The calculated load to Flare No. 2 from the suction of the motor-driven compressor, which will stop upon power failure, would be the compressors normal flow since only normal rates of column off-gas flows were considered for the individual streams into the header. There is a potential pitfall in this approach in that the load to Flare No. 2 will actually be much greater than the normal compressor flow if the column back-pressure controllers respond
76

in their intended fashion, by opening to vent excess vapors from the column into the header. The total flow into the header will be much greater than the normal off-gas flows, increasing the flow to Flare No. 2 through the header spill valve as a result of the compressor failure. In analyzing the power failure load to Flare No. 2, if these normal responses of the column pressure controllers are not considered, the estimated spill rate to the No. 2 flare header will be less than the most likely flow, such that the hydraulics may be too optimistic and potential problems in the Flare No. 2 system may be missed. Thus, if the process engineer bases the loads to the flares for power failure by simply cataloging the power failure loads from the RV scenario sheets, and considering the spill rate to Flare No. 2 to be the sum of the vented gases shown in the calculations for the column RVs, the engineer will under-estimate the potential total flow to Flare No. 2. In fact, since the column back-pressure controllers normally operate in automatic mode, they most likely will open in response to the event, increasing gas flow to the header, and result in a higher flow to Flare No. 2 from the header spill. The true picture for Flare No. 2, then, is actually worse than that developed by the engineer depending on only the RV sizing calculations for determining flare loads.
Balances on utility headers and flows between process units. Site-wide header systems such as the vapor

collection header recently discussed, can be difficult to handle in relief system analyses, largely because the flows into and out of the headers during the relief scenario may be markedly different than those during normal operations. Determining the header flows is often an important part of the overall relief system analysis, making it critical that the hard work is done to define the system. Consider the process unit illustrated in Fig. 3, specifically, the interactions with the fuel gas system, which is fitted with an RV that discharges to the flare (fuel gas RV not shown). During a power failure scenario, both the feed pump and the recycle gas compressor will stop since they are motor-driven. As a result, fuel

I DECEMBER 2009 HYDROCARBON PROCESSING

PLANT SAFETY AND ENVIRONMENT

gas flow to the furnace will be halted on loss of flow through the In situations such as these, it may be that both controller process tubes as a protective measure for the furnace. response cases need to be considered in the flare system analyIf steam header pressure is maintained during the event, heat sis since determining which controller status is a worst-case sceflow to the column reboiler will continue for at least some time nario may not be straightforward. Experience shows that as long after the event starts. The loss of reflux to the column will lead to as RV discharge tailpipes were designed for the full valve capacity increasing pressure in the column, and the flow of gas into the fuel as required by the API, it is generally more difficult to dispose of header will increase if the column pressure controller responds. the same material through an RV set at a lower pressure than it is to The fuel gas system is now out of balance. Flow out of the relieve through one set at a higher pressure. This is due to the allowsystem has been decreased by the shutdown of the reactor furnace, able back-pressure being lower for the lower set pressureless presand flow into the system has increased by the actions of the back sure driving force is available to push the material out the RV and pressure controller opening in response to increasing pressure in through the header system to the flare. In this case, if the fuel gas the column. In this example, the required flow to flare from the RV is set lower than that for the column, it will probably be a worse fuel gas system RV will be the sum of these two changes, not simply scenario for the relief system overall if the column controller acts the increased inflow through the column pressure control valve. as normally expected. That is, the excess gas from the column will Note that the true power failure load to the flare will not be the be easier to dispose of to the flare if it exits in the column RV. Most sum of the individual required loads for this scenario from the collikely, however, much of it will be let down to the fuel-gas system umn RV and the fuel system RV. The reaand eventually routed to the flare through son is that the same gas has been counted Determining the header the fuel gas RV set at a lower pressure. twicethe assumptions are mutually This is the typical situation in units exclusive in the column RV analysis and flows is often an important where gas is let down to a lower pressure that done for the fuelgas system. The col- part of the overall relief system on back-pressure control. Gas is umn pressure controller did not respond often let down to the system with the in the column analysis but it did respond system analysis, making it lowest set pressure, where it will be the normally in the fuel system analysis. If the critical that the hard work is most difficult to route to the flare. This is total flare load for the scenario is deteramong the reasons to perform a thorough mined by summing the required loads for done to define the system. balance on utility headers for the scenario power failure from these two RV calculain question, taking care to avoid doubletions, the result will be that for a physically impossible situation: counting any sources that may appear in summaries of required the controller cannot both respond and fail to respond. flows from individual RVs. In this example, double-counting some material is also possible The situation is similar when considering flows between process due to the interaction within the unit between the separator RV units. This can arise for a site that has multiple hydroprocessing and the column. The relief calculation for the power failure scenario units operating at widely varying pressures. Optimizing the hydrofrom the separator will likely consider condensation loss in the prodgen utilization site-wide may lead to a scheme in which off-gas uct coolers, with the required relief load estimated to be the vapor from a high-pressure unit acts as makeup gas for a lower-pressure amount not condensed that normally would be. For the column RV, unit. Here again, the same gas may appear in the required loads the analysis may consider that the liquid level in the separator had for several RVs in the different process units based on mutuallybeen lost due to the combined effects of loss of liquid feed to the unit exclusive assumptions about the actions of the controllers manipuand at least partial loss of condensation. If the separator level conlating the flow among the units. Overall flare system evaluation troller fails to respond to the decreasing liquid level, a vapor blowmust involve determining which of several mutually exclusive through scenario will develop such that high-pressure gas can flow instrument actions is more severe for the system. from the reactor section into the low-pressure column; this excess gas Finally, there is another level of complication possible when will be included in the required flow from the column RV. headers spill on back-pressure control not directly to the relief If the vapor blow-through situation arose, hydraulic analysis may show that the separaTo are To are Relief valve tors RV will not be required to lift as the excess PC gasand possibly moreis being vented into Recycle gas the column. Thus, the required relief loads from Cooling compressor Condenser the power failure scenario as listed on the RV water Separator M data sheets for the separator and the column Cooling Fuel Air cooler water cannot both occur as they depend on mutually gas LC exclusive events. For the separator RV to open, Trim cooler the level controller must respond as it normally Accumulator Furnace would upon loss of incoming liquid. But, for M the full required load to develop in the column, that same level controller must fail to respond FC Feed/ efuent to the liquid level loss in the separator, resultSteam Fuel LC Charge exchanger Reactor gas ing in vapor blow-through to the column. The pump T Condensate level controller cannot both respond and fail to respond, so at least a portion of the calculated FIG. 3 Reactor and separation example. required relief loads from the two individual RVs is actually the same material counted twice.
HYDROCARBON PROCESSING DECEMBER 2009

I 77

PLANT SAFETY AND ENVIRONMENT

system, but down to other lower-pressure headers, which in turn may spill to the flare. The chances for counting the same material multiple times will increase since the level of complexity can get quite large in such a site.
Discharge of non required RVs.

Pset: 100 psig

To are

PC

Vapor Pset: Note that there are many RVs associated product 100 psig Accumulator with the column in Fig. 4, and they all have Light liquid the same set pressure: 100 psig in this examproduct ple. The RVs associated with the exchangOverhead Column feed pump ers were installed due to the presence of the FeedTo are To are To are block valves around the exchangers which Pset: bottoms Pset: allows one to be taken out of service for 100 psig exchanger Pset: 100 psig cleaning or repair while the column con100 psig tinues to operate. Often, the only credible FC Heavy liquid product Steam overpressure scenarios for such exchangers are the external fire and blocked-in with Reboilers Condensate heat cases. Since none of these exchanger RVs can be guaranteed to be on line during a relief event, the individual relief analysis FIG. 4 Distillation column showing instrumentation and relief valves. for the column will consider only the RV on the column overhead to be in service, and thus it must have sufficient orifice area available to protect the entire column system from overpressure. consistent, the engineer should take the following steps: In this case, the process engineers documentation survey for all Go through the relief system unit by unit or section by secRVs associated with this column will likely show that there is only tion and develop a consistent material balance for the scenario a single flow required to flare for the power failure scenario: vapor under consideration, keeping in mind that the flows may not sum from the column overhead RV. to zero as the plant will not be in a steady state. During an actual column overpressure event, any exchanger Do a full accounting for feed, product and internal streams in the reboiler, bottoms or feed service will reach a given pressure to avoid double-counting any material. before the column overhead. Due to the systems hydraulics, the Include flows to and from header systems that are consistent pressure is a little higher at the bottom of the column than it is at with assumptions made within the process unitsfurnaces may the top. Thus, the RVs protecting the equipment at the column be key in many cases. bottoms will open before the RV on the column overhead line. As Consider how normal instrumentation responses may move a result, the relief disposal system (a flare header, in this example) some material from a high-pressure area to a low-pressure area will likely see significant amounts of hot and flashing liquid with from which will generally be more difficult to direct into the properties quite different from the column overhead vapor. Thus, relief header. when the goal is analysis of the relief discharge system, the pos Consider any mutually exclusive scenarios where the worst sibility must be considered that the exchanger RVs will lift and case is not readily identifiable, or where the cases tax different discharge into the system for many scenarios, even though theyre sections of the relief system differently. not required to lift according to the individual RV analysis guideOnly after completing the steps above can the engineer be lines. A relief system study that relies solely on the individual RV assured that he or she has a full and complete picture of the analyses will miss this potentially important detail. required flows into the relief system for the scenario in question. The system hydraulics and other constraints can then be analyzed Overview. The engineer must recognize the differences in with confidence that the results will be representative of how the approach required for sizing an individual RV vs. analyzing the actual plant will respond to the event. HP relief system as a whole. In the examples considered, it was shown LITERATURE CITED that although all individual RVs are properly sized, the interaction 1 Pressure relieving and depressuring systems, ANSI/API Standard 521, Fifth of multiple RVs and control valves discharging to different relief Edition, January 2007. headers can lead to an expected load to the flare that is actually larger than the sum of individual required RV loads for the scenario in consideration. On the other hand, eliminating doublecounting of required relief rates for various RVs may show that the total flow to the relief system is actually less than the sum of all the required flows from the individual RVs. In conclusion, the process engineers work is not done once Rob Brendel is a senior consultant in the Oil, Chemicals and he or she has collected the required loads for a given scenario, as Energy practice of Jacobs Consultancy. He has 20 years of expeshown on the individual RV documentation. To ensure that the rience in the refining and petrochemicals industry working for engineer has analyzed the entire system for how the scenario will Jacobs, UOP and Mobil Technology Company. Mr. Brendels areas of expertise include safety and relief systems, and energy efficiency. most likely evolve, and to ensure that the overall analysis is self78

Distillation column To are

Condenser

Cooling water

To fuel

I DECEMBER 2009 HYDROCARBON PROCESSING