Guidelines for Initiating events and Independent protection Layers in layer

of Protection analysis. Center for Chemical Process Safety.

2 0 1 5 the American Institute of Chemical Engineers, Inc. Published 2015 by John Wiley & Sons, Inc.

APPENDIX E. PRESSURE VESSELS

AND PIPING OVERPRESSURE
CONSIDERATIONS
Estimating the severity of overpressure is a common activity in risk analysis; and
yet it seems to pose considerable problems for many risk analysts and is therefore
deserving of special emphasis.

DEFINING OVERPRESSURE
As the pressure within a system rises, the probability of a leak or a rupture
increases, although the specific failure point is dependent on system design and
maintenance. There are, however, some issues to consider when assigning the
consequence category to an overpressure event. Vessels and piping design can
provide protection against overpressure when appropriate design stress
calculations and construction codes are used.
For example, the ASME Boiler and Pressure Vessel Code (BPVC) Section
VIII (2013) uses the concept of Maximum Allowable Working Pressure (MAWP).
This pressure is determined based on the design temperature, allowable stress for
each material in the system, and the installed thickness minus the corrosion
allowance. The code dictates the inclusion of a safety factor in the calculation of
the maximum pressure that the vessel can continuously withstand. Some pressure
vessel codes use a design margin of 3^4 times the material strength required at the
design pressure (ASME 1999, ASME 2013). The vessel is also typically
hydrotested at a pressure of 1.3-1.5 times the MAWP. Other boiler and pressure
vessel codes will use similar concepts but may have different design margins.
The 2013 ASME code allows the relief valves protecting the vessel to have a
margin above the MAWP, to account for the characteristics of the relief valve as it
opens and to allow operational flexibility. Thus, using the 2013 ASME code as an
example, a single relief valve is required to be capable of limiting the maximum
pressure to no more than 110% of MAWP. Multiple relief valves are required to be
capable of limiting the maximum pressure to no more than 116% of MAWP. For a
single or multiple relief valves in a fire scenario, the size is required to be large
enough to limit the maximum pressure to no more than 121% of MAWP. Also, the
codes require that the vessel be pressure tested at greater than the MAWP.
A sudden pressure rise, such as one due to a runaway reaction or internal
deflagration, can cause a large hazardous material release and/or other severe
consequences due to overpressure rupture of a vessel. Conversely, while it is
certainly true that gradually increasing internal pressure increases the probability
of a leak from flanges, packing, seals, and instrument connections, it is also true

328
E. CONSIDERATIONS FOR OVERPRESSURE OF PRESSURE VESSELS AND PIPING 329

that normally these relatively small leaks may also help to prevent catastrophic
rupture of the system by providing venting of excessive pressure. Such a release
will typically have local, rather than widespread, effects. Consequences that result
from the release, such as local fire, small vapor cloud, or liquid pool will also tend
to be localized and have limited effects. However, release of highly toxic materials
can still lead to localized fatalities, even for small leaks. The combination of
design criteria and implementation of properly designed relief systems has proven
effective such that overpressure ruptures of a vessel and piping systems are rare.
Some companies may define their policy such that any increase in pressure
above the allowable overpressure is a violation of code and could choose to
assume catastrophic failure when it is exceeded. This is a conservative approach,
and it results in scenarios in which only small increases in pressure beyond the
MAWP will be treated as equivalent to scenarios where there is a significantly
higher potential for a rupture.

FACTORS THAT LIMIT PRESSURE RISE

Initiating events and the failure of IPLs may result in scenarios that lead to an
energy imbalance in a system, with a corresponding pressure rise. However, this
does not necessarily mean that the pressure rise will be uncontrolled or unlimited.
The characteristics of the equipment, and the vapor-liquid equilibrium of the
material in the process, often act to limit the maximum pressure that is reached in
the system. Consideration should be given to these issues to support the realistic
estimate of consequence severity assigned to a scenario.
Examples of factors that can affect the maximum pressure rise in equipment
are listed below. Note that the factors below only apply to properly maintained and
inspected equipment that have not degraded below the thickness/integrity required
for the design intent.
Upstream pressure - If the upstream pressure is limited, then the
maximum pressure that the system can experience is also limited. For
example, if the IE is a failure of a pressure control system, and the supply
pressure could be no more than 300 psig through inherent means, then the
maximum pressure that the system could reach would be 300 psig. If the
MAWP for the system was 230 psig, then the overpressure would be
approximately 30%. This would be above any code pressure limit (such
as MAWP), but below a typical hydrotest pressure of 130-150% of the
MAWP. Using the most conservative approach, this could be treated as a
rupture. However, a reasonable approach could also be to state the
consequences as "exceeding of code pressure limit and possibility of leak
from flange or instrument connection." (Some organizations might not
even consider this a LOPA scenario, since the expected overpressure is
still below the test pressure.)
330 INITIATING EVENTS AND INDEPENDENT PROTECTION LAYERS IN LOPA

Centrifugal pump maximum discharge pressure - This is a particular case

of limited upstream pressure. For example, suppose that a new impeller
has been installed for a pump and the shutoff head is now 130 psig, as
compared to the original 100 psig. The system connected to the pump had
a MAWP of 100 psig. If the pump is deadheaded due to a valve closing
downstream of the vessel being fed by the pump, then the pressure would
rise to 30% above MAWP. The probable consequence would not be a
rupture, but instead would most likely be a leak from a flange or a seal or
an instrument connection. This approach is not meant to suggest ignoring
code requirements; however, a range of consequences "begin" when
exceeding the code requirements, and the potential consequences will
gradually escalate as the pressure continues to rise.
For a positive displacement pump, the analyst would need to be
careful to use the true maximum discharge pressure. Positive
displacement pumps will generate discharge pressures limited only by the
capacity of the system to contain the pressure or tolerance in the pump
itself. Also, analysts should be aware that a centrifugal pump can generate
pressure greater than its maximum discharge pressure if it is isolated. The
energy input from the spinning impeller can become a source of heat,
causing thermal expansion of the liquid. The additional heat can also
initiate a thermal decomposition or other uncontrolled reaction in some
systems.
Compressor - A similar situation to the centrifugal pump can arise for
centrifugal compressors.
Temperature pinch for distillation column bottoms reboiler - When a
distillation column experiences a pressure rise, the boiling point of the
column bottoms also rises due to the vapor-liquid equilibrium of the
system. As the boiling point rises, such as from a change in composition
or increased pressure, it narrows the temperature differential between the
heating media (usually steam) and the column bottoms in the reboiler.
This causes the rate of energy input into the column to decrease. If the
pressure continues to rise, the boiling point of the column bottoms will
eventually reach the temperature of the heating media for the reboiler.
Unless there is additional energy input to the column from another source,
the pressure at which the heating media temperature for the reboiler and
the column bottoms temperature are equal represents the maximum
pressure that can be reached, assuming a nonreactive system.
As an example, suppose that, for a given column, the MAWP is 300
psig. In the event of loss of temperature control, the steam to the reboiler
could potentially heat the column bottoms to the boiling point, resulting
in 375 psig pressure in the column. In this case, the maximum pressure
that could be achieved if the relief valves did not open, and assuming no
other energy input, would be approximately 125% of the MAWP. This
may be a code violation but is not likely to result in a rupture of the
E. CONSIDERATIONS FOR OVERPRESSURE OF PRESSURE VESSELS AND PIPING 331

system, unless the integrity of the system is already severely

compromised, such as by corrosion or embrittlement. A leak from a
flange, seal, or instrument connection would be more likely; although, no
vessel rupture would likely occur.

OPTIONS FOR TREATMENT OF OVERPRESSURE

There is no definitive approach throughout the process industries for treatment of
overpressure within the context of risk assessment. Rather, individual companies
have developed their own approaches. To help companies determine which
approach would be most suitable, various options are presented below, along with
the associated advantages and disadvantages:
Option 1: Assume any pressure rise that exceeds code criteria will result in a
rupture with major direct and indirect consequences in terms of human fatalities
and injuries, capital and operating losses, and environmental impact. This
approach:
a. Is the most conservative and will result in many overpressure scenarios
having the most severe consequences. Therefore, all such overpressure
scenarios will need to be mitigated by applying the same risk-reduction
factors. This approach will not allow for any distinction in IPLs between
scenarios with the potential for very large pressure rises and those in
which the pressure rise will be limited but still above the code limit.
b. Is strict in its view of following the code of construction and essentially
means that a failure to achieve full code compliance is the consequence of
concern.
c. Is easy to apply and enforce.
d. Reinforces the importance of adhering to design codes.
This option should be followed if there is no supporting data to demonstrate the
integrity of the vessel.
Option 2: Assume that there is a hierarchy of consequences, based upon the
overpressure that occurs. This approach:
a. Explicitly considers that, while a pressure rise above code allowance is
undesirable, the consequence and likelihood of specific failure (i.e., leak
versus rupture) depends upon the percent overpressure. See Table E-l for
a conceptual indication of the types of consequences that might be
considered appropriate at different levels of overpressure.
b. Can allow consideration of a leak of a toxic material to be a consequential
event, and yet distinguish that a small leak of a flammable material may
be much less consequential.
332 INITIATING EVENTS AND INDEPENDENT PROTECTION LAYERS IN LOPA

c. Is more c o m p l e x to apply and to enforce than Option 1.

d. Has the potential to lower the emphasis of maintaining operating

parameters b e l o w prescriptive safety limits.

e. Places a greater dependence on the I T P M program to detect and correct

defects that would reduce the safety margin of the vessel.

T h e potential consequences of various levels of overpressure should be

defined b y an individual organization, based on their design criteria, applicable
codes, and the organization's risk protocol. A n example hierarchy of possible
consequences as a function of vessel overpressure is given in Table E - l .

Table E-1. C o n c e p t u a l c o n s e q u e n c e vs. pressure vessel o v e r p r e s s u r e

(This example pertains to design of carbon steel vessels per ASME Boiler and Pressure
Vessel Code (BPVC) Section VIII, Division 1 (2013); for other design codes and for other
materials and grades, the consequence versus % accumulation may be more severe. Also,
catastrophic failures at lower overpressures would be expected if the vessel is beyond its
corrosion allowance, has experienced over temperature or overpressure excursions in the
past, is operated below its ductile/brittle transition temperature, or exhibits pitting or cracking.)

Accumulation
Significance Potential Consequence
(% over MAWP)

Allowable accumulation for

process upset cases (non-fire) No expected consequence at
10%
protected by a single relief this accumulation level
device

Allowable accumulation for

No expected consequence at
16% process upset cases protected
this accumulation level
by multiple relief devices

Allowable accumulation for

external fire relief cases, No expected consequence at
21%
regardless of the number of this accumulation level
relief devices

Standard hydrostatic test Increasing likelihood of leaks

>21%
pressure in associated flanges, piping,
to 30% equipment, etc.

Catastrophic failure becomes

increasingly likely. Since this
Minimum yield and ultimate level of overpressure goes
strength varies with material beyond code allowance, an
>30%
and grade analysis and supporting
documentation by the
organization will be necessary
to evaluate the severity of the
E. CONSIDERATIONS FOR OVERPRESSURE OF PRESSURE VESSELS AND PIPING 333

consequence of
overpressure.

The approach presented in Table E-l is in general accordance (with the

exception noted) with recommended changes of Code Case 2211-1 of the ASME
Code presented in Welding Research Council Bulletin 498, Guidance on the
Application of Code Case 2211 - Overpressure by Systems Design (Sims 2005).
Also see UG-140 of Section VIII Division 1 of the ASME Boiler and Pressure
Code (2013) for a better understanding of how this code case was incorporated
into the pressure vessel code. Table E-l only presents a conceptual example.
Specific values for overpressure will need to be determined by individual
organizations and account for materials of construction and design codes.

REFERENCES
ASME (American Society of Mechanical Engineers). 1999. ASME Boiler and
Pressure Vessel Code Section VIII - Rules for Construction of Pressure
Vessels, Division 1. New York: ASME.
ASME. 2013. ASME Boiler and Pressure Vessel Code Section VIII - Rules for
Construction of Pressure Vessels, Division 1. New York: ASME.
Sims, R., and W. Yeich. 2005. Guidance on the Application of Code Case 2211 -
Overpressure Protection by Systems Design. Bulletin 498. New York:
Welding Research Council.