When most companies implement the process safety management standard, they routinely or periodically review the relief systems and flare systems design bases to ensure compliance with corporate, industry and/or government standards, hereafter referred to as Recognized And Generally Accepted Good Engineering Practices (RAGAGEP). To mitigate concerns before implementing projects, it is advisable for plant engineers to consider several items when reviewing a concerns list:
- Relief systems review methodology
- Relief systems review priorities
- The process designers familiarity with the process and/or plant when concerns are being reviewed
- The plant engineers understanding of the differences between compliance and best-in-class practices.
An article published in 2000 concluded that up to 40% of the installations evaluated had unidentified concerns.1 Since the publication of this article, many of these concerns have undergone a more detailed review showing that modifications to the facility were not required to address these concerns.
The purpose of this article is to help the plant engineer review the concerns developed by the design engineer. Implementing field modifications without performing such a review is costly and exposes a facility to unjustified risks.
For the purposes of clarity, the following terms used throughout this article are defined as such:
- Plant engineerThe facility or owners engineer who is responsible for reviewing the concerns and determining if facility modifications should be implemented
- Process designerThe individual who is responsible for analyzing the relief device and overpressure protection system and developing the concerns
- ConcernsItems that are listed (prior to being fully reviewed and accepted) as deviations from industry or company standards.
At the end of the relief systems design basis project, the process designer typically identifies many concerns. As most facilities want to comply with RAGAGEP, there is a mandate to resolve these concerns, and their resolution can be costly.
Generally, most facilities seek to comply with regulations for existing facilities and to potentially build new equipment and facilities to a higher standard. This article includes examples of how to review existing systems to determine if concerns justify field modifications.
RELIEF SYSTEMS REVIEW METHODOLOGY
Relief systems design basis reviews are typically performed by contractors that assist in developing project guidelines and then collect the necessary information. After these initial actions, the contractors analyze the systems design basis per the project guidelines and present a list of identified concerns to the plants engineers and management. Prior to spending money to upgrade the relief systems, a plant engineer familiar with the process unit should review the concerns list to ensure that:
- Details of the study are reasonable
- Assumptions of the study are reasonable
- Facility upgrades, not based on minimum compliance, have been thoroughly reviewed.
By reviewing the concerns list with these suggestions, a plant engineer can ensure that costly changes have a basis in sound engineering and that the expense is justified. Note that no hierarchical order is implied in this list.
Typically, when a relief systems design basis project is undertaken, the goal is to produce compliant documentation efficiently and consistently. To do this, process designers must base the analysis on a framework to minimize effort and ensure consistency. This is a practical method for performing a large-scale relief systems analysis; however, for any particular concern, the framework may break down and suggest items that are not actually concerns.
In a recent review project, approximately 40% of the listed concerns were later found to be acceptable based on a detailed review. The following sections help walk a plant engineer through a systematic process and give insight into how to review the listing of concerns.
Reviewing relief system study details
When the concerns are reviewed from the perspective of the process designer, the plant engineer can understand how the framework may have generated potential concerns. Understanding this process can help the plant engineer identify resolvable concerns by reviewing the design basis.
Understanding the process. When completing large-scale relief systems design basis documentation and design processes, the process designer is usually quite familiar with relief systems design but may not be familiar with the particulars of the process or unit. The process designer, therefore, may make unrealistic judgments about process upsets. The following are examples of these items:
- When process flows can be blocked, or if the normal rate is possible under upset conditions
- Use of the normal/design duty from a reboiler for relief rate estimation
- Equipment that is no longer in service is not properly protected.
To ensure the best possible analysis, each study should be reviewed by personnel familiar with the process operation to confirm that unique process characteristics are captured in the relief systems documentation.
Credibility of scenario or relief rate. For each overpressure scenario that generates a concern, the plant engineer should give particular attention to ensure the credibility of the scenario or required relief rate. Many times, an overpressure scenario or the estimated rate may not be credible. The following are some examples:
- Pumps that can only pump to relief pressure if the upstream system is also upset (however, a simultaneous upset would be considered double jeopardy)
- Systems where overpressure derives from heat input, such that the relief temperature of the process fluid exceeds the relief temperature of the utility fluid
- Control valve failure calculations that are based on the capacity of a control valve instead of on another limitation (e.g., a long section of piping or a pump).
To ensure an accurate analysis, each concern should be reviewed to verify that consideration has been given to the determination of the scenario applicability and that the relief rate estimate is reasonable for the particular process or unit.
Gathering facility data. The relief systems analysis process typically limits the amount of places and time that the process designer can search for process and equipment data. This limitation is usually defined as a project scope item and is used to ensure that the project has boundaries. When reviewing concerns, the plant engineer must ensure that the process designer has not identified concerns that can be readily resolved by further searching for process and/or equipment data. Often, this requires a call to an external supplier or technical body (e.g., the equipment manufacturer or national board).
Other execution issues. The relief systems process typically uses a consistent basis that is often documented and referred to as site or project guidelines. These guidelines are beneficial, as they provide a means for efficient and consistent execution and help ensure that both the process designer and plant engineer are in agreement on the details of the analysis. When these generic and prescriptively conservative guidelines generate concerns, it is imperative that the team generating the documentation reviews the fundamentals of the analysis to confirm that the concern is a legitimate deviation from RAGAGEP and not just a result of the project execution process.
Reviewing relief system study assumptions
The typical execution method of a project tends to enforce consistent assumptions. For most of the project, this ensures that the relief systems design basis is conservative and compliant with RAGAGEP. To ensure that field modifications are for items that must be addressed, these assumptions may need to be challenged when concerns are raised.
Standardization assumptions. Standard and generally conservative assumptions are specified to ensure consistency and efficiency. These assumptions help the relief systems documentation process run efficiently; however, if generic assumptions result in concerns, they should be revisited and updated. The following are some examples of these items:
- Liquid levels for equipment
- Control valve flow coefficients and trim sizes
- Utility pressures (e.g., steam, nitrogen, cooling water)
- Heat exchanger or pump capacities.
To ensure the best possible analysis, the assumptions associated with each concern should be reviewed and, if possible, refined to be specific for that system.
Conservative assumptions. The authors of this article have been carrying out relief systems analysis for multiple decades and believe that conservative assumption is frequently used as a phrase for a simplifying assumption that the process designer invoked. Furthermore, this phrase typically has nothing to do with being conservative. The following are examples of conservative assumptions:
- Normal flowrate was used instead of a reduced estimate
- Column tray or overhead flowrate was used instead of performing a simulation
- Multiple unrelated failures occurred simultaneously.
As previously stated, each conservative assumption should be reviewed and refined so that it is specific for each system.
Other assumptions. The design and analysis of relief systems is an art. Much of the analysis is based on the assumptions that form the overall basis. Mathematical errors are rarely the cause of an incorrect analysis; usually, the cause is a problem with the basis. The basis for each system is stacked on top of a basis for another system. Once the assumptions are flushed out and determined to be correct, the mathematics are easy.
Fractionator example. In the past, the authors reviewed a fractionator (Fig. 1), where the normal feed vapor rate was specified as the relief rate for a power failure relief load (conservatively assumed). When the capacity of the feed furnace was confirmed, the feed furnace could barely vaporize the normal amount at the normal production rate and fractionator pressure. This particular power failure scenario specified the loss of the pumparounds, which resulted in the loss of approximately 80% of the crude preheat train duty.
Fig. 1. Flow diagram of an example fractionator.
With the increase in pressure and cooler-than-normal feed temperature to feed furnace, the maximum vaporization would be around 50% of the normal vapor rate. The argument for keeping the feed preheat was that it was conservative, as the heat input may not be lost. If this turned out to be the case, then pumparounds would have continued, leading to a significantly different outcome. Assumptions need to at least be internally consistent for each scenario. If the pumparound cooling is lost, then so is the feed preheat, and vice versa.
Distinguishing minimum compliance from best practices
The final items that need to be reviewed by the plant engineer are any deviations from RAGAGEP (and not just deviations from best practices). Often, when completing relief system projects, the team responsible for the design will, with the best of intentions, work into guidelines some requirements that go beyond RAGAGEP.
While extra requirements may be justified based on the increased safety at nominal incremental costs in new construction, these requirements can be quite expensive for existing facilities. These additional requirements must be reviewed and possibly excluded from items that need to be retrofitted. Regulatory requirements may require additional documentation to ensure that not making modifications presents an acceptable risk.2
Gray areas for modification. Often, items may not be absolutely correct, but they also may not rise to a level requiring field modification. An example is when current corporate standards exceed the standards to which a unit was built. This situation is particularly relevant when a facility is acquired, thus creating a situation where a facility was constructed to one set of corporate standards but is now operating with a new corporate standard in effect.
In these cases, a process designer should investigate any deviations and document why these deviations are acceptable. For cases where past designs do not meet the current RAGAGEP standards, but the deviations are deemed to be minor, management at some facilities may choose to have more regulatory risks than safety risks.
Consideration of risk to make changes. Fixing issues with equipment design, especially when the facility is running or even in turnaround, must be carried out with great care. In the past three or four years of literature searches, the authors have yet to find a single case of a slightly undersized relief device resulting in an injury or loss of containment. There are, however, countless records of injuries sustained from refinery modifications that can be found via Internet search.
To illustrate this point, in a 2009 Chemical Safety Board (CSB) video requesting that the city of Houston, Texas adopt the American Society of Mechanical Engineers (ASME) Pressure Vessel Code, the CSB was unable to find instances resulting in loss of containment for pressure vessels for undersized relief devices.3 The video cites three examples of vessel failures from undersized relief devices. The first example is a low-pressure tank with an undersized relief device, and the other two examples have plugged or isolated vent lines.4, 5, 6
For a plant engineer responsible for increasing overall facility safety, it may be possible to defer modifications for the resolution of minor deviations until other equipment changes are required. This would be at the discretion of the facility, it would require a reasonable level of risk, and it could open up the facility to regulatory action.
FLARE SYSTEMS REVIEW METHODOLOGY
The preceding section reviewed the typical methodology that a process designer would use to generate a relief systems design basis. This section is designed to help the plant engineer understand how the individual relief systems loads are developed and used to create an overall set of global scenarios, which is then used to verify that the flare system and associated equipment are adequately designed. Several key topics will be further explored:
- Global load considerations
- Reasonable and consistent assumptions
- Advanced flare techniques.
By reviewing the flare systems design concern list from these three angles, a plant engineer can ensure that the basis for costly changes is justified.
Global load considerations
When a relief systems design project is undertaken, the individual relief device loads are typically gathered first. Once these loads are known, they are entered into a hydraulic analysis tool, and then the flare system is analyzed. However, as with the individual load determinations, there are areas that a plant engineer should review.
Credibility of the scenario. In global scenarios, the process designer typically will review power failures (both a total loss of power and partial power failures), utility failures and large-scale liquid pool fires. All of these scenarios affect multiple systems of equipment and should be considered. The process designer for each individual scenario looks at the underlying scenario to ensure that it is credible. For example:
- Is a large-scale liquid pool fire possible, and to what extent?
- Is a total utility failure possible, or does the utility feed all the listed equipment systems?
- Does one utility failure lead to another utility failure (e.g., loss of steam resulting in the loss of the turbine-driven instrument air compressor)?
As previously stated, conservative assumptions for scenarios that are not controlling or that do not have concerns may be acceptable. A plant engineer should review the scenario basis for any global scenarios with concerns. Additionally, the conservative assumptions associated with the sizing of the relief device may not be consistent or even possible, given the specific global scenario being evaluated.
Credibility of the rates. Global overpressure scenarios are often a compilation of relief rates specified as closely related individual relief device scenarios. While these scenarios may have been conservatively estimated and may have generated no concerns, summing multiple systems with conservative rates may result in problems.
In a presentation to the 6th Global Congress on Process Safety, Dustin Smith reported on a refinery-wide review that resulted in a 40% reduction in the design relief rate by reviewing the specified relief loads and eliminating overly conservative assumptions.7 A plant engineer should ensure that the process designer does not simply create a global scenario on the basis of multiple conservative calculations; the designer must also review the system to ensure that rates are reasonable and defensible (and not excessive due to assumptions).
Reasonable and consistent assumptions
As with the individual relief systems analysis, the scenario assumptions and those used to generate the relief rates make a tremendous impact on the adequacy of the flare system and associated equipment.
Buried assumptions. When sizing individual relief devices, RAGAGEP require that the process designer assumes that the worst case occurs and that all related failures, pump lineups and control valve responses are either neutral or detrimental. For global scenarios, the process designer must assume that the global failure occurs, but the requirement for neutral or detrimental effects is more muted. The following are some examples of buried assumptions typically used:
- Heat exchanger duty based on service overall heat transfer coefficient and area (UA) instead of the clean and new UA
- Level control valves hold level in process vessels
- Airfin coolers retain some fractional cooling capacity
- Operations personnel do not simultaneously open depressuring valves with utility failures unless directed to in operational procedures.
The plant engineer and process designer should work with personnel that operate the units, and they should review scenario basis and loads for any global scenarios with concerns.
Consistent assumptions. In the definition of global overpressure scenarios and associated rates, the need to ensure consistency is paramount. Many times, the process engineer will assume for one equipment system that a pump was in operation and has failed, while, in the next equipment system, the failure pump was spared and the alternative pump was in operation. For these analyses, consistency across the facility is required, as the goal is to analyze the flare system (vs. the individual relief devices). Some assumptions can result in system-wide inconsistencies:
- When a pump is spared and used for multiple equipment systems, the scenario should specify which pump has failed for all systems
- The effects of the failures must be considered for systems with heat integration
- Utility failures that result in cascading losses must be examined consistently.
The plant engineer should review the controlling global scenarios to ensure that the assumptions used are internally consistent.
Advanced flare analysis techniques
API Standard 521 allows for the consideration of positive action of instrumentation, operations or other favorable items, as long as the failure of these items is considered.8 Prior to making costly flare system modifications, the plant engineer should review more complex flare system analysis tools to ensure that modifications are justified.
Flare load probability analysis. In a presentation to the 6th Global Congress on Process Safety, Dustin Smith reported on a method to estimate the flare loading probability.7 This method determines the likelihood of loads to the flare system, and it can be used to target instrumented responses and piping modifications. This method demonstrates that analysis of the effects of safeguards and the probability of failure on demand (PFD) of these safeguards can be used to develop the system loading as a function of probability/frequency. Using this information and given an acceptable time frame (e.g., 1 in 100,000 years), the expected flare load is lower than the worst-case scenario.
The authors recently reviewed a refinery where the likelihood of a worst-case load, if a total power failure occurred, was approximately 1 in 100 million years. The design load for 1 in 100,000 years was a fraction of the total load, and it was more consistent with the complexity of the plant, along with the DCS programming and the safety instrumented functions and interlocks recently installed.
Flare quantitative risk assessment. Flare quantitative risk assessment is a way to review each scenario and the perturbations of these scenarios to determine the likelihood of vessel overpressure as a function of frequency.9 This varies from the flare loading probability in that the statistical analysis and hydraulic analysis are coupled; whereas, in the flare loading probability, the flare loading statistical analysis is separate from the hydraulic analysis. In both cases, the plant engineer must ensure that the scenario initiating event frequencies and the PFD of safeguards are reasonable and defensible.
Flare load dynamic simulations. Offering and requesting dynamic flare system designs are becoming increasingly common. Like the other advanced flare analysis techniques, this one increases the complexity of the analysis, thus requiring the facility to increase its understanding of the effects of assumptions on the final answer.10 The basic premise of dynamic simulation is that, by combining the effects of the staged timing of releases and the dynamic pressurization of the flare system, the peak loads and back pressures on system components are reduced. In this method, the plant engineer must ensure that the fundamental assumptions affecting the timing of each system or release are reasonable and defensible, thereby ensuring that the system is properly modeled.
Other techniques. Other methods to analyze flare systems are proprietary to operating companies. All of these methods are designed to account for the probability that either operator intervention or instrumentation will operate, or fail to operate, as desired.
Any method of flare header analysis that is not a worst-case analysis must, therefore, establish some reasonable means of accounting for the positive action of instrumentation or operator intervention to mitigate the worst-case load. The delicate balance between realism and conservativism in flare header design is paramount in creating a safely designed flare header at a reasonable cost.11
When reviewing concerns generated from the relief system or flare design and documentation process, the plant engineer must ensure that each concern is valid and that any resolution requiring physical changes is a justified investment of a facilitys capital. To properly perform this task, it is recommended that a plant engineer understand how a process designer performs the study and review the concerns prior to making physical changes to the facility.
When properly reviewed, upgrades to the flare and relief system from a relief systems analysis can improve the safety of an operating facility. HP
1 Berwanger, P. C., R. A. Kreder and W. S. Lee, Analysis Identifies Deficiencies in Existing Pressure Relief Systems, Process Safety Progress, Vol. 19, 2000.
2 Smith, D. and J. White, Ensuring safe operations when fulfilling action item requirements, Hydrocarbon Processing, March 15, 2010.
3 Without Safeguards, Pressure Vessels Can Be Deadly, US Chemical Safety Board, Video, 2009.
4 Poje, G. V., A. K. Taylor and I. Rosenthal, Catastrophic Vessel Overpressurization, US Chemical Safety and Hazard Investigation Board, Report No. 1998-002-I-LA, 2000.
5 D. D. Williamson & Co. Inc., Catastrophic Vessel Failure, US Chemical Safety and Hazard Investigation Board, Report No. 2003-11-I-KY, 2004.
6 The Goodyear Tire and Rubber Company, US Chemical Safety and Hazard Investigation Board, Report No. 2008-06-I-TX, 2011.
7 Smith, D., System Limited Flare Design: A Flare Load Mitigation Technique (with a QRA Case Study), 6th Global Conference on Process Safety, 2010.
8 ANSI/API Standard 521, Pressure-Relieving and Depressuring Systems, American Petroleum Institute, 2008.
9 Kreder, R. A. and P. C. Berwanger, Quantitative AnalysisA Realistic Approach to Relief Header and Flare System Analysis, 2005.
10 Chen, F. F. K., R. A. Jentz and D. G. Williams, Flare System Design: A Case for Dynamic Simulation, Offshore Technology Conference, Houston, May 1992.
11 Burgess, J., Flare Header Debottlenecking, Design Institute for Emergency Relief Systems, Spring Meeting, 2006.
||Dustin Smith, PE, is the co-founder and principal consultant of Smith & Burgess LLC, a process safety consulting firm based in Houston, Texas. As a consultant, Mr. Smith has extensive experience with helping refineries and petrochemical facilities maintain compliance with the PSM standard. He has more than a decade of experience in relief systems design and PSM compliance. His experience includes both domestic and international projects. Mr. Smith is a chemical engineering graduate of Texas A&M University and a licensed professional engineer in Texas. |
||John Burgess, PE, is the co-founder and principal consultant of Smith & Burgess LLC, a process safety consulting firm based in Houston, Texas. Mr. Burgess is a consultant who specializes in helping refineries and petrochemical plants meet the PSM standard. His experience includes more than 10 years in relief systems and PSM compliance, for both domestic and international projects. Mr. Burgess has BS and MS degrees in chemical engineering from both Texas Tech University and the University of Missouri, and he is a licensed professional engineer in Texas.|