changes to industry guidance for relief and blowdown
TRANSCRIPT
Changes to industry guidance for relief and blowdown system design and the
impact on existing infrastructure
Sathish Natarajan,
Process Systems Enterprise Inc
Two Allen Center, 1200 Smith Str, Suite 1600, Houston, TX
Paul Frey
Process Systems Enterprise Limited
26/28 Hammersmith Grove, London,W6 7HA
Simon Leyland
Process Systems Enterprise Inc
3 Wing Drive
Suite 103, Cedar Knolls
NJ 07927
Keywords: Incidents, verification, brittle fracture, acoustically induced vibration, flow induced
vibration, Low Temperature, fire survivability, blowdown, relief, flare
Abstract
As the last line of defense for process and equipment integrity, relief, blowdown and flare
systems need to be adequately designed and maintained. Systems need to be periodically re-
assessed so that they operate safely throughout the life of the facility that they help protect. This
talk highlights the importance of ensuring flare and relief systems remain fit for purpose
throughout their lifetime maintaining accountability for plant modifications, changes to
operations, and changes to industry guidance and regulation. Recognizing high profile incidents
involving relief and flare systems from Grangemouth to Westlake and to a number of recent
incidents that have led to loss of containment due to excessive vibrations and brittle fracture of
the flare piping, we show that the root cause of these incidents can be linked to failure to
recognize hazards and perform adequate analysis, which is fundamental to Process Hazards
Analysis programs under OSHA 3133
In recognition of these & other incidents, we describe how relief and blowdown adequacy
assessment has tightened in recent years in regards to significant changes to API 521, and in
particular:
A. the importance of verification of relief and flare systems to ensure they comply with
latest Industry Standards
B. to ensuring the suitability of materials of construction so as to avoid brittle fracture risks
during depressurization
C. the adoption of the more rigorous analytical methodology for assessing vessel
survivability under fire attack for blowdown system design
D. to assessing the likelihood of failure due to acoustic and flow induced vibration in flare
piping
Through a number of case studies we describe a methodology for assessing and analyzing
existing infrastructure for these risks and explain how a detailed model-based analysis can ensure
an inherently safe relief and blowdown system design that is compliant with the latest industry
guidance.
1 Introduction
Processing facilities in offshore assets and chemicals refining, share common technologies for
the safe venting and disposal of hydrocarbons. Depressuring valves and Pressure relief valves
prevent overpressure in various systems such as slug catchers, gas liquid separators, vessels,
distillation columns, compressor systems, packed beds and distribution piping. The undesirable
effects of rapid depressuring of gas systems in upstream facilities, may be the generation of very
low metal embrittlement temperatures. Conversely, in fire events, the depressuring may not be
rapid enough to prevent vessel wall stresses causing rupture and loss of containment of the
vessel.
Relief valves on the other hand, have to operate under a wide range of overpressure scenarios
and may not have been incorrectly sized or not adequate for a case which later turns out to be
governing. Plant modifications are often made which can invalidate existing overpressure
protection systems.
It is important for Contractors as part of design, and Operators maintaining compliance of
existing assets, to take full responsibility for applying the most appropriate analysis techniques.
Whilst little has changed in hardware terms with blowdown valves, relief valves, rupture discs
and flare systems, our understanding has changed of the parameters which cause relieving
events, the calculation of the required capacity and device sizing methods. Recent changes in the
API Standards [3,6] have also meant that new techniques are now recommended to reduce un-
certainty and over- conservatism.
Driving the improvement of Standards, has been a number of well publicized Industry Incidents.
The fire and explosion at Texas City, resulted in a wide ranging review of plant design safety,
operational factors and industry codes of practice. Consequently, API Standard 521 was
reviewed and updated following the 1987 Hydrocracker explosion at Grangemouth, Texas City
and more recently, following the Williams Geismar Olefins Plant fire in 2013.
The impact changes to Standards on existing and ageing facilities is critical. Older facilities
however well maintained from a mechanical perspective, often do not maintain well documented
process design basis, relief and blowdown philosophy documentation and up to date calculations,
especially where assets have changed ownership over their lifetime.
Experience in performing relief system verifications on operational facilities, have shown large
numbers of significant faults due to impact of plant modifications after installation, or changes to
the device itself, or operational changes to the process. Therefore periodically, Process Hazards
Analysis (PHA) and independent third party verifications, are necessary to assess blowdown,
flare and relief systems to ensure the records and sizing is compliant with latest standards.
In the USA, OSHA 3133 provides the framework for process safety management and the
impetus to organizations to comply with the standards. In other regions of the world the National
Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) in
Australia, and the Health and Safety Executive (HSE) in the UK adopt similar schemes.
Formal and mandatory programs of assessment (OSHA) are an important part of maintenance of
safety integrity. The PHA should be conducted on a new facility or after a significant process
modification prior to start up, and then re-validated on a 5 year cycle. The re-validation cycle is
also supported by the general requirement to update and re-issue API Standards every 6 years.
The Operator is also responsible for the analysis and documentation for existing equipment
designed to standards and codes which are no longer in use, to determine that the equipment
design is still appropriate, and operating in a safe manner.
Whilst a PHA must be periodically re-validated, there is no reason why a more proactive
approach to hazard evaluation should not be the basis of process safety management. When
major incidents occur, the root causes are analysed to ensure that an Operators own facility does
not share similar risks.
2 Major Incidents involving overpressure protection systems and case
studies of advanced analysis
2.1 Grangemouth, UK, Fire and Explosion of Hydrocracker, 1987
Figure 1. Schematic of HP/ LP separator
The Hydrocracker Incident at Grangemouth in 1987, was investigated by the UK Health and safety
Executive (HSE) report : The fires and explosion at BP Oil (Grangemouth) Ltd. Through a series of
operational failures on start up of the unit, the last line of defense, the relief devices were
subjected to an overpressure many times higher than their design, and the LP separator failed
catastrophically. The resulting explosion and fire, killed one Operator but could have resulted in
many more fatalities as it occurred during early morning shift handover when the plant was not
operating and few personnel were outside of the control room.
The unit was not on feed, but maintaining recycle flow. The level controller and its trip function
were in-operative and the valves were being controlled manually. The gauging that the operators
relied upon had a 10% zero offset, so read 10% when the level was actually zero.
An extra low low level trip had been disabled as it had caused spurious trips due to ‘vortexing’ of
the liquid at low liquid levels.
When the valves were manually operated to control the level in the HP separator, the liquid
drained away and HP gas entered the LP separator.
Previously an audit in 1975 had confirmed the need to retain the extra low level trip (ELLT) in
operation and that the PSV’s were not sized for the gas breakthrough scenario.
A subsequent Audit in 1980 concluded that the ELLT would be expected to function, and
existing precautions were satisfactory to avoid gas breakthrough, and therefore no additional
relief protection was necessary.
Two years earlier, the relief valves on the LP gas separator had lifted and the board operator had
quickly averted a disaster by closing the flow control valves manually but this ‘near miss’ was
never reported or investigated.
2.2 Changes to the API Standards
The API Standard 521 did not have specific guidance on the potential overpressure
hazard of high pressure gas breakthrough at the time.
In the latest revision, the API now highlights gas breakthrough scenarios, but is still not
providing guidance on overpressure due to displacement of liquids.
In particular verification studies often identify:
Risk of system overpressure due to relief scenario of liquid overfill followed by gas
breakthrough. In this case required relief area is often many times larger than is practical,
and high integrity trip systems must be considered.
This example shows the value of regular safety relief audits/ verifications and the
importance of implementing corrective actions.
3 Brittle Fracture Risks
3.1 Westlake Ethylene Cracker flare Fire, 2002 – brittle fracture of flare header
Figure 2. Simplified schematic of Cold flare vaporizer and Flare Header
This is an example of a loss of hydrocarbon containment, explosion and fire resulting from brittle
fracture of a flare header. Fortunately, no one was injured, however the fire was not extinguished
for a week and the plant was shut down for a month. Corrective actions to replace/ upgrade
systems had to be scheduled in for the 2003 turnaround.
Sequence of events:
Westlake Petro 1 ethylene plant started to produce off spec product, resulting in the
flaring of liquid ethylene into the cold flare drum.
The minimum design metal temperature of the flare piping was -10F.
The cold flare drum vaporizer and outlet superheater failed to provide sufficient duty and
the flare temperature dropped below -13F which was the minimum temperature recorded
before the temperature instrument failed.
The low temperatures propagating into the carbon steel headers caused brittle fracture of
the header and loss of containment.
A number of root causes were determined by Westlake Group:
Fouling of the vaporizer and superheater had reduced the available duty. It was
determined that heavy oil could remain in the cold flare drum for long periods leading to
increased risk of fouling.
The risks to the flare line safety of mal-operation of the heat exchangers were not
recognized
The brittle fracture required a coincident stress which although not discovered may have
been pipe contraction, or external stress from heavy rain at the time.
The material was impact tested to -10F, subsequently parts of the flare header failed the
charpy v-notch testing for -20F.
Corrective Design Actions:
Inherent safety was improved to reduce the principal risk to the carbon steel piping through low
performance of the heat exchangers, by replacing the header downstream of the vaporizer with
stainless steel. This was continued to the warm flare drum, to prevent effects of reverse flow into
the warm flare piping, and into the main combined header 100 ft downstream of the cold/warm
flare drum tie in point. A new thermocouple was installed at this point and the thermocouple at
the super heater re-ranged for -200F. Stress analysis was conducted for the new flare line and
flare drum. Westlake also replaced the super heater with a 50% larger duty and uprated the
propanol piping. A heavy oil removal system and new level indicators and alarms were installed
on the cold flare drum to manage any liquid accumulation.
3.2 Changes to API Standard for low temperature analysis
The Westlake incident occurred prior to the revision of the API 521 Standard, which now
highlights the importance of accurate assessment of low temperature/ brittle fracture risks.
There are numerous incidents and alerts involving brittle fractures. As Carbon Steel is cooled,
the impact strength reduces rapidly as the material changes from a ductile to brittle zone making
it less resistant to stresses which are present through implied loads, internal pressure or fluid flow
reaction forces.
API 521[3] highlights a number of risks of brittle fracture:
“Materials exposed to temperatures below the specified minimum design temperature may suffer
permanent damage or brittle failure, depending on the mechanical stresses present in areas
subjected to low temperatures.”
“…particularly if there is a possibility of low-boiling point liquids entering the disposal system.
Autorefrigeration will occur as liquid boils at the reduced pressure. If the equilibrium
temperature is sufficiently low, piping and drums fabricated of materials designed for low
temperature may be required to eliminate the risk of brittle fracture” [3] Section 5.2.2.4.
Whilst this is invariably the root cause of the Westlake incident, it is also important to consider
non-equilibrium processes occurring during gas depressuring
Gas depressuring systems are essential for protecting vessels from failure during fire events, and
to minimize the consequences of a loss of containment by removing inventory safely to a flare
system. However the phenomenon of liquids condensing as pressure is reduced and then re-
evaporating in combination with the Joule-Thomson temperature reduction, is often overlooked
by conventional design approaches. This is now recognized in the new edition of the API 521
standard [3].
3.3 Application of Dynamic Simulation
Research into depressuring of vessels by M.A Haque et Al [4] indicated the phenomenon that the
gas cooled the vessel surfaces far less than the surfaces where liquids accumulated and
evaporated. As can be seen from figure 3, where there is liquid, the wall temperature can be as
much as 40°C lower than the gas temperature.
Furthermore, conventional approaches to simulation which do not model the non-equilibrium
processes were shown to be highly inaccurate. In the case of gas depressuring, they were
generally conservative however where liquids were present, highly in-accurate.
Figure 3 Experimental data showing wall temperatures for the depressuring of process
vessels compared with conventional equilibrium simulation approaches.
Figure 4. Comparison between g-FLARE® dynamic simulation and experimental data
For more complex systems of interconnected vessels and piping, typically encountered with
compression systems, gas sweetening and absorption systems, it is important to be able to
represent the actual topography of the plant. This means the equipment orientations, elevations,
and the detail of the piping falls and pockets where liquid may accumulate need to be included
within a simulation model, as well as addressing the complex thermodynamics of the process.
This allows decisions on equipment metallurgy to be based on specific locations within the plant.
In one recent example a multi-national Oil & Gas operator performed a preliminary blowdown
analysis on a high pressure gas plant that indicated a requirement for 80% of the plant to be
constructed from stainless steel which would have made the economics un-feasible. To minimize
the requirement for stainless steel construction, the operator commissioned a more detailed
analysis study compliant with the latest API guidance to determine the minimum metal
temperatures in the process equipment and piping during system depressurization. The resulting
optimized design decreased the stainless steel construction requirement from 80% of the facility
to just 30%, with total project savings of up to $1.8bn.
Because pressure drops throughout the process control the gas flowrates via different flow paths,
including reverse flows and mixing of streams, certain locations within the same depressurizing
section exhibited different pipe wall temperatures during the depressuring process. For example,
due to the location of the blowdown orifice, some segments could not depressurize until after the
inlet line and separator pressure had reduced. The low gas flow allowed heat gain from ambient
to keep the pipe wall from falling below the limit of -29°C for non-impact tested carbon steel.
However within the separator the starting gas temperature was lower due to evaporating
condensate and non-equilibrium cooling of the gas stream. Due to the significant gas volume and
much higher flowrate the separator outlet pipe wall exceeded the MDMT of -46°C for low
temperature carbon steel (LTCS). This was also a long process line of large diameter which
made changes to this system un-desirable. To minimize changes to materials and cost impact, the
separator was fabricated in LTCS however the Orifice was relocated to another part of the
system so that the separator did not depressurize through the process line.
At the orifice, the extremely high velocity in the downstream piping caused increased heat loss
from the gas due expansion and conversion to kinetic energy, and a very low temperature of -
120°C. In this case it was necessary to change the tailpipes material to stainless steel, and review
how far this cold front extended to the flare header.
The benefit of using a detailed modelling approach was:
Piping low points and areas with liquid accumulation such as the separator, and areas
with high kinetic energy such as the tailpipe were confirmed to be much colder than
expected.
Re-design of the blowdown locations and segment configurations (removal of low points)
assisted with low temperature design
The precise location of the temperatures were discovered to aid material selections.
4 Fire Survivability
4.1 Piper Alpha Offshore Platform fire and explosion, 1988 - Fire Depressurisation
Piper Alpha ranks as the worst offshore human catastrophe with the loss of 167 lives and
insurance claims of approximately US$ 1.4 billion. Whilst the root causes of the initial fire were
due to operator error in starting up a standby pump, fire spread un-checked throughout the
platform. The majority of the deaths occurred within the accommodation module in which
personnel had sought refuge and was overwhelmed by fire and smoke. The Cullen report made
106 separate recommendations to improve offshore safety.
API 14C mandates ESD and depressurization systems as one of the Emergency Support Systems
required. Depressurization systems increase the survivability time of vessels and equipment to
reduce the risk of premature rupture and uncontrolled release of hydrocarbons.
4.2 Changes to API Standards for Fire Depressurization analysis
In 2014, API 521 was significantly changed to include a more advanced analytical methodology
which had been in use by Statoil / Norsk Hydro to provide protection to offshore vessels exposed
to fire. Recently, offshore safety guideline API 14C was re-issued to align with API 521.
API recognized that the previous guidelines were based on empirical fire heat input equations,
suitable for on-shore installations. The basis of these equations were from a series of experiments
on storage tanks exposed to pool fires in a well ventilated and open / un-congested plant layout.
Depressurization guidelines for typical refinery vessels were found not to be applicable for thin
wall vessels and congested equipment layout as found offshore. In offshore facilities there is also
the real risk of impingement of high pressure gas jet fires, which can produce a localized peak
heat flux higher than the surface average heat flux applied in the empirical model. The fire heat
fluxes typically encountered in an open pool fire are between 50 to 150 kW/m2, and this
increases up to 400 kW/m2 [3] for the largest Jet fires.
Subsequently the API 521 guidance was revised to include the following:
“For pool fire exposure, this generally involves reducing the equipment pressure from initial
conditions to a level equivalent to 50% of the vessel’s design pressure within approximately 15
min. This criterion is based on the vessel wall temperature versus stress to rupture and applies
generally to carbon steel vessels with a wall thickness of approximately 25.4mm or more” and
“The vessel material and thickness influences the depressurization rate. For vessels other than
25.4mm carbon steel the user may choose to apply the 50%/15 min criterion or some other
criterion, or may choose to perform more specific calculations” [3] Section 4.6.6
Prior to the revised guidelines, depressuring design was generally achieved by a dynamic
simulation of the vessel pressure with time, by varying the discharge line orifice sizes to achieve
the 15minute depressuring criterion. There was no associated check of the internal stress and the
ultimate tensile stress of the vessel which varies with the wall temperature. Fundamentally, if a
pressurized vessel wall is heated the material strength reduces to the point where internal stress
(principally pressure) exceeds the tensile strength of the vessel wall and rupture occurs, as
indicated by Figure 5. The API 521 Standard (in Annex A) as well as other guidelines provides
a revised methodology for calculating the fire heat flux based on the stefan-bolzmann equation
and details of the calculation of internal stresses due to pressure within piping and vessels.
Figure 5. Graph illustrating rupture condition when depressurization is not sufficiently rapid.
4.3 Application of Dynamic Simulation
In the following example, a significant on-shore facility consisted of four trains, each train had
four separators (ID=4m, L=20m)
In event of fire on one separator, adjacent separators were blown down simultaneously to
prevent escalation
Analysis of above scenario indicated that:
Steady state simulations showed flare capacity was exceeded
In order not to exceed the flare design capacity, the survivability criterion was violated
for the vessel exposed to fire
In order not to exceed the flare capacity and not violate the fire survivability criterion
Passive Fire Protection (PFP) would have to be used.
Operator decided to investigate option of more accurately determining the extent of flare
capacity utilization to answer the following:
o Is the flare capacity limit actually exceeded?
o How much thickness of PFP, if any, is required?
Results:
A fully representative dynamic model was configured, to include the process vessel, blowdown
lines, orifice plates, and flare system headers including the knock out drum and flare riser. The
simulation solved both the pressure-stress calculation and the wall temperature due to fire heat
input simultaneously using the analytical equation for heat flux [3].
The following results were obtained :
Flare capacity limit was suitable for the maximum load when considered dynamically
(figure 7)
Orifice size optimised to avoid risk of rupture as shown in Figure 6
No requirement for PFP
Figure 6. Case Study: graph indicating separator depressurization meeting stress requirements
Figure 7. Case Study – graph comparing depressuring flow to flare tip flow
4.4 Insala Gas Plant, Algeria 2005, Flare Piping Failure from vibration
This incident [7] involved the failure of a reactor vent line at the flare header. Gas had been
flowing into the header from the first train, and when the second train was started up, noise and
excessive vibration was seen and the tailpipe failed at the junction with the main flare header.
80,000kg of gas released, fortunately no ignition source was encountered, and there was no
consequent explosion or loss of life.
Figure 8. Schematic showing location of 6” tie downstream of PV-111
Recommendations:
The complete flare header was reviewed and >20 pipe modifications were made to limit
excessive velocities.
‘Set on’ welded branch connections were found to be in-adequately re-enforced. These
were addressed by providing a full circumferential reinforcement of the pipe branch and
wall thickness increases for tailpipes entering the flare header.
The main flare header was found not to have been sized for the governing case and was
replaced.
4.8 Changes to API Standard 521 – Vibration failures
Industry has been discussing vibration failure modes based on an increasing awareness of
specific failures and forced shutdowns due to discovery of weld failures and cracks during
routine plant inspections. Data published by the UK Health and Safety Executive for the offshore
industry have shown that in the UK sector of the North Sea piping vibration and fatigue accounts
for over 20% of hydrocarbon releases. Similar figures between 10% and 15% are reported for
onshore plants in Western Europe. [5]
We are also seeing examples of recent designs where no assessment of vibrational risks has been
made.
The two principal vibrational risks for piping systems are high frequency Acoustically Induced
Vibration (AIV), and a lower frequency Flow Induced Vibration (FIV). The former is caused by
high flow and pressure drops across control and relief valves and is now recognized in API521
(2014). FIV is principally caused by flow turbulence or vortex shedding effects downstream of
branches which causes flow pulsation.
Both of these are excitation modes which when coupled with the piping natural frequency create
amplified oscillatory response and potential failure of insufficiently supported piping due to the
concentration of stresses at branches or fabricated sections, as shown on the example figure 8
above.
The recommended approach [3,5] is a screening of the Sound Power Level, and application of
the Carucci/ Mueller Guidelines. This research established a correlation between an SPL
>155dB(A), pipe diameter and wall thickness for a number of failures associated with AIV.
The API guidelines do not include any reference to the other principal mode of pipe vibration,
however, the Energy Institute Guidelines [5] detail the approach to be taken for both AIV and
FIV analysis.
The Likelihood of Failure (LOF) is a screening approach using Qualitative or Quantitative
Analysis. The latter method for calculating LOF for Flow Induced Vibration requires a
knowledge of the stiffness of the piping section based the support span, the kinetic energy and
composition of the fluid. An LOF below 0.29 is acceptable, with no further action required. LOF
above 0.5 for a main header requires remedial investigation of the pipe supporting and flexibility,
and special focus on branch connections where there is greatest failure risk.
Often in complex systems, dynamic simulation can be used to model the response to transient
flow conditions. For example a choke valve and production piping manifold design, was
modeled to check the vibrational risk during start up. The flowrate from the well affected the 2-
phase flow regime in the piping, and ultimately the LOF.
The mitigation approach followed was to control the start up flowrate and ramp rate until the
pipe manifold downstream of the choke was under stable flow conditions and piping design was
improved to provide stiffer pipe supporting.
In other cases, the piping backpressure develops as the flow establishes, and the worst case for
vibration may exist at the beginning of a ramp flow change. These scenarios are readily tested
using a dynamic model, which allows the exact fluid properties to be used in the calculation of
AIV or FIV screening during transient flow conditions.
5 Conclusion
Prior to the issue of the revised API Standard 521, and Standard 520 Parts 1&2, these Standards
were written around the downstream sector, but were applied also for certain areas of upstream
design. Changes to industry practices in upstream sectors affecting depressuring design and
better understanding of how dynamic simulation analysis tools can be applied has brought
pressure on the need to revise the guidelines.
The key changes to API Standard 521 which affect the maintenance of both ageing as well as the
design of new plants are:
Relief valve sizing and importance of maintaining adequate records through periodic
verification
Low temperature depressurization risks and avoidance of brittle fracture through detailed
analysis
Vessel Depressurisation to achieve adequate Fire Survivability may not be rapid enough
for thin walled vessels - requiring a faster blowdown rate, and a detailed dynamic
analysis.
Screening of vibration risks in flare headers due to high flow or pressure drops is now
recommended using the Energy Institute guidelines with particular focus on small bore
connections.
6 References
[1] UK Health and safety Executive (HSE) report : The fires and explosion at BP Oil
(Grangemouth) Ltd. Available at web link
www.hse.gov.uk/comah/sragtech/casebpgrang87b.htm Accessed 09/2017
[2] “Flare line failure case, what have we learned” Presentation prepared by Westlake Group
for 16th Annual Ethylene Producers’ Conference, New Orleans, LA, April 2004
[3] Pressure-relieving and Depressuring Systems, API Standard 521, Sixth Edition, July 2014
[4] M.A Haque et al., Blowdown of pressure vessels, Trans IChemE Part B Process Safety
Environmental Protection, 70 (BI) 1 and 10, 1992
[5] Guidelines for the avoidance of vibration induced fatigue failure in process pipework, 2nd
Edition, Energy Institute, London, January 2008 [6] Sizing Selection and Installation of Pressure-Relieving Devices, API Standard 520 Part 1,
Ninth Edition July 2014, Part 2 Sixth Edition March 2015 [7] “Acoustic Fatigue –Turbulence Induced Fatigue Failure of Relief System Piping”, E.
Zamejc given at spring 2006 API Refining Meeting, May 3, 2005