Reconsidering Need For Overpressure Protection Via Instrumentation & Controls In Petroleum Refining

1. Reconsidering Need For Overpressure Protection Via Instrumentation & Controls In Petroleum Refining 2006 ISA Safety Division Symposium Houston TX

2. Layers of Protection

3. Overview • Identify Design Intent of Overpressure Protection • Code and Standards requirements from ASME, API, and ANSI/ISA, as applicable to that specific Design Intent; • Mechanical Design Requirements for Source Vessel • Pressure Protection System Requirements • Different Categories of HIPPS and ‘typical’ requirements

4. Vessel Overpressure Protection Standards

5. HIPPS Design Intent • Intent #1 • Protect against the hazardous effects of overpressure of the source vessel beyond allowable limits per ASME BPV Code under the postulated scenario • Intent #2 • Protect against the potentially hazardous effects of a relief scenario in the event there is no relief disposal system, or a disposal system that is not adequately designed for a postulated contingency. • Intent #3 • Prevent a relief scenario from occurring despite the fact that the relief device and disposal system are adequately designed for the scenario.

6. Overpressure Protection per ASME Boiler and Pressure Vessel Code • Failure of HIPPS Could Results in... • Credible relieving scenario(s) causing overpressure of the source vessel beyond allowable limits per ASME BPV Code, Section VIII, Division 1. Ref UG 125. • HIPPS protects the “Source Vessel” from Overpressure Hazard and mechanical damage

7. Overpressure Scenarios • Loss of utilities, electric, steam, cooling water, instrument air • Runaway chemical reactions • External fire exposure (typically no credit for HIPPS) • Blocked outlet • Instrumentation failures • Loss of Condensing • Tower Reflux Failure • Accumulation of non-condensables • Entrance of highly volatile material • Overfilling • Abnormal heat input • Failure of Automatic Controls • Exchanger tube rupture • Internal Explosion • Hydraulic Expansion • Other equipment failures

8. HIPPS to Prevent Runaway Chemical Reaction

9. Key Issues per ASME BPV Code - Code Case 2211 • Whether the vessel is exclusively in air, water, or steam service; HIPPS not allowed. • User responsibilities in overpressure protection by system design. Vessel fabricators have no responsibility for specifying HIPPS. • User responsibilities for ensuring the Maximum Allowable Working Pressure (MAWP) of a pressure vessel is higher than the highest pressure that can reasonably be achieved by the system, addressing all credible overpressure scenarios. Just as in conventional relief, HIPPS design must be sufficiently robust as to preclude overpressure from all credible scenarios. • Qualitative or quantitative reliability analysis of the proposed HIPPS system. Tie-in to Safety Instrumented Systems requirements under the ANSI/ISA 84.01 standard, performance targets in terms of safety-availability and verification using quantitative reliability analysis. • Proper documentation of the analysis conducted for 3) and 4); and, importantly, possible need for approval by jurisdiction having authority, depending on location.

10. Pressure Relief Design Philosophy • Code Case 2211 HIPPS is NOT just another alternative in Relief System Design • What is a credible relief scenario vs. non-credible? • BPV Code Section VIII does not consider pressure reducing valves and similar mechanical or electrical control instruments as sufficiently positive in action to prevent overpressure. • Code Case 2211 HIPPS should be an option of last resort that enhances overall safety • Not a ‘cost’ decision • Legal, Regulatory, and Administrative Requirements and Perspective from “Jurisdiction Having Authority”

11. HIPPS Design Intent • Intent #1 • Protect against the hazardous effects of overpressure of the source vessel beyond allowable limits per ASME BPV Code under the postulated scenario • Intent #2 • Protect against the potentially hazardous effects of a relief scenario in the event there is no relief disposal system, or a disposal system that is not adequately designed for a postulated contingency. • Intent #3 • Prevent a relief scenario from occurring despite the fact that the relief device and disposal system are adequately designed for the scenario.

12. Overpressure Protection per API Recommended Practice 521 • API Recommended Practice 521 • Recommends assumptions and credits to be taken for individual relief sizing and flare system sizing • Section 2.2: “Fail-safe devices, automatic start-up equipment, and other conventional control instrumentation should not replace pressure relieving devices as protection for individual process equipment. However, in the design of some components of the blowdown header, flare, and flare tip, favorable instrument response of some percentage of the instrumented system can be assumed. The percentage of favorable instrument response is generally calculated based on the amount of redundancy, maintenance schedules, and other factors that affect instrument reliability.”

13. Overpressure Protection per API Recommended Practice 521 • HIPPS failure could result in direct relief to atmosphere or overload of the relief system beyond allowable limits per API RP 521 • Flare header, knockout drum, or flare stack • The potential consequences include: • Release of a toxic or flammable substance at the discharge of a relief device (or vent stack) • High thermal radiation and noise near the flare tip • Potential loss of flame stability and blowout • Excessive backpressure in the relief header with the potential for the actual relief rate to fall below the required rate. Vessel overpressure above allowable limits.

14. RP-521 HIPPS To Safeguard Against Overloading Relief Header

15. Active Relief Devices on Global Plant Power Failure

16. RP 521 HIPPS Analysis“Complicating Factors” • Multiple vessels in a large refinery require such systems to prevent simultaneous relief / overloading. • HIPPS failure causes backpressure levels above tolerable limits occur somewhere in the flare system. The most-exposed vessel is not necessarily the source vessel with the HIPPS. • Multiple systems with same SIS logic solver; failure of which could render multiple overpressure protection systems ineffective simultaneously. • Multiple final elements on multiple heat sources shutoff using a single HIPPS. Failure of one final element not as severe as failure of multiple as would occur in the case of a sensor failure. Both are credible failures that need to be evaluated separately. • Hazards associated with Spurious Trips • Separation of BPCS and SIS

17. HIPPS Design Intent • Intent #1 • Protect against the hazardous effects of overpressure of the source vessel beyond allowable limits per ASME BPV Code under the postulated scenario • Intent #2 • Protect against the potentially hazardous effects of a relief scenario in the event there is no relief disposal system, or a disposal system that is not adequately designed for a postulated contingency. • Intent #3 • Prevent a relief scenario from occurring despite the fact that the relief device and disposal system are adequately designed for the scenario.

18. Overpressure Protection for “Flare Avoidance” • HIPPS Failure would result in higher flare system loading, at otherwise safe levels • Facility Management’s Desire to Avoid Flaring

19. Flare Avoidance System

20. Overpressure Protection for “Flare Avoidance” • BPCS versus separate HIPPS • ISBL versus OSBL engineering

21. HIPPS Design Intent • Intent #1 • Protect against the hazardous effects of overpressure of the source vessel beyond allowable limits per ASME BPV Code under the postulated scenario • Intent #2 • Protect against the potentially hazardous effects of a relief scenario in the event there is no relief disposal system, or a disposal system that is not adequately designed for a postulated contingency. • Intent #3 • Prevent a relief scenario from occurring despite the fact that the relief device and disposal system are adequately designed for the scenario.

22. Safeguarding Against Liquid Relief • Reconsidering Credible versus Non-Credible Scenarios • Comprehensive Flare System Reviews • Hazards of concern include: • Atmospheric relief of a flammable or toxic liquid from the flare stack • Atmospheric relief of flammable or toxic liquid flashing to vapor during the relief event • Excessive backpressure in relief header due to flashing across a relief devices and two-phase flow in the header • Ductile to brittle transition due to auto-refrigeration across a pressure relief device

23. Flashing Liquid Relief

24. “As Safe or Safer” • Code Case 2211 invokes the “as safe or safer requirement” • Intent to enhance overall safety • Perspective from Jurisdiction Having Authority • Draft API RP 521 Ed 5 has similar language. Situations where use of pressure relief devices is impractical • No such requirement applies to “Flare Avoidance Systems”

25. Conclusion • Establishing performance requirements involves the intersection of expertise in process engineering, plant operations, relief systems engineering, as well as safety instrumented systems engineering. • This synergy of skills should not be underestimated initially. • Short-cuts in the design phase could include either an over-specified, and excessively costly pressure protection system; or, more seriously, a system that provides insufficient protection against overpressure hazards.