TSE101

Technical Safety Engineering Foundation

3.1.1 Overpressure Protection Basic Rules

Use this area for cover image

(height 6.5cm, width 8cm)

Use this area for sub-brand logo, business or

initiative
(Maximum height 1.5cm)

GSNL-HPTS

Copyright of Shell Projects & Technology RESTRICTED September

Month 2010
2011 1
LEARNING OBJECTIVES

Understand the philosophy regarding protection against over and

under pressure. This includes aspects such as:
Simultaneous occurrence of events (related vs. unrelated)
Role and validity of various safeguarding systems (operator
response, automatic control, IPF, relief valve etc.)
Design basics for proper functioning of safeguarding systems
Understand the selection of control valve failure action
Know how to determine a pressure system.

Copyright of Shell Projects & Technology RESTRICTED September 2011 2

SIMULTANEOUS OCCURRENCE OF EVENTS

We do not take simultaneous (sequential) occurrence of over and

under pressure events into account if it can be demonstrated that:
the events are unrelated
one failure does not lead to another
(Note: above definition also accounts for over and under temperature events)

Example: a fire and the loss of Cooling Water (CW) is normally

unrelated. However, a power failure followed by a CW failure are
normally sequential events.
What remains are only credible scenarios

Copyright of Shell Projects & Technology RESTRICTED September 2011 3

MEASURES AGAINST OVER PRESSURE

Below controls are generally available to prevent over and/or

under pressure beyond concept design parameters (design Pressure
and material selection):
(1) Control of process
(a) Operator response (manual controls by
operation of valves, start- stop buttons, etc) Last line of defence
b) Automatic continuous control by instruments (e.g. from against over-
the Distributed Control System (DCS)) temperature and, by
(2) Instrumented protective functions (IPF) exception, against
Alarm overpressure (e.g.
Switch high integrity back-
Trip flow protection)
Depressuring
(3) Mechanical protection Last line of defence
Sufficient design pressure against overpressure
Relief valves and/or rupture disks
(Inter-)Lock systems
Copyright of Shell Projects & Technology RESTRICTED September 2011 4
MEASURES AGAINST OVER PRESSURE: OPERATOR
RESPONSE

For operator response (control 1a listed on slide 4) to be a valid

control, the following shall be in place:
Sensor (process surveillance)
Operator observation (control room + unit rounds)
Alarms
Logic Solver
(Panel) Operator needs to be able to recognise offset/cause of being outside
operating window/loss of containment/etc.

Copyright of Shell Projects & Technology RESTRICTED September 2011 5

MEASURES AGAINST OVER PRESSURE: OPERATOR
RESPONSE

Actuator (operator response)

Need for sufficient time to take effective action:
Phenomenon develops over time.
Time to respond to situation before LOC typically 30 minutes (no less than 15 min.)
Requirement for clarity on effective action:
Unambiguous corrective action is possible.
Appropriate means of to intervene are available.
Proper instructions.
In case of complicated process upsets > automated action. (Run-away reactions,
integrated equipment (furnaces/compressors), follow-up events (Domino effects).

Copyright of Shell Projects & Technology RESTRICTED September 2011 6

MEASURES AGAINST OVER PRESSURE: AUTOMATIC
CONTINUOUS CONTROL AND IPF

Automatic control (control 1b listed on slide 4)

For instance, liquid level control of a vessel or column to prevent
overfilling (= overpressure)
IPF (control 2 listed on slide 4)
For instance, high pressure or high level alarm/trip.
Shall be independent from other barriers.
SIL classification provides architecture for reliability and availability.

Copyright of Shell Projects & Technology RESTRICTED September 2011 7

MEASURES AGAINST OVER PRESSURE: RELIEF VALVES

In general relief valves (control 3 listed on slide 4) are the last line of
defence against overpressure.
Operator response, automatic continuous control and IPF are normally
not taken into account for relief valve sizing (design flow). Reasons:
Operator intervention could be ineffective,
Automtatic control can be on manual, has a wrong setpoint initiation
or could fail open,
IPF could have a failure on demand.

Copyright of Shell Projects & Technology RESTRICTED September 2011 8

CONTROL VALVE FAILURE ACTION

The failure position of control valves shall allow each system to reach
an inherently safe condition during a total instrument air failure
scenario (e.g. overpressure)
Select spring action to:
Maximise cooling
Minimise heat input
Minimise relief quantity
Keep material where it belongs; do not export problems which may
cause a relief to elsewhere
In case of instrument air failure, the control valves will be assumed to
have taken their spring action.

Copyright of Shell Projects & Technology RESTRICTED September 2011 9

CONTROL VALVE FAILURE ACTION

Different nomenclature for valve failure action:

FO Failure Open FC Failure Close

AFO Air Failure Open AFC Air Failure Close
ATC Air to Close ATO Air to Open
STO Spring to Open STC Spring to Close

Lock-up device (usually mechanical). Allows valve not to completely

open or close:

Copyright of Shell Projects & Technology RESTRICTED September 2011 10

 PRESSURE SYSTEMS

A pressure system is an individual equipment item or groups of equipment

including their associated piping that, within its boundaries, remains open
under all conditions. This means:
NO Valves (block valves, control valves).
See next slide for some acceptance criteria

NO Blockage in piping/equipment, e.g.

fouling, freezing/solidification, debris, salts, damaged internals and elicit objects

Copyright of Shell Projects & Technology RESTRICTED September 2011 11

PRESSURE SYSTEMS
Role of valves in a pressure system
In general, relief valves cannot be taken to be open (or closed) to
prevent a relief.
However deviations are allowed. This depends on the region. This
should be approved by the principle.
Outside North-America (Shell interpretation)
Single valve with or without lock (i.e.: locked open LO valve or interlock
system) is normally not accepted as an open system if closure of that valve can
create an immediate overpressure case > 110% of the DP.

North America (ASME 8 Rev. Appendix M)

Single valve is normally accepted as an open system if closure of that valve
cannot create an immediate overpressure case > 116% of DP (MAWP).
Single valve with lock (i.e..: LO) could be accepted as an open system if
closure of that valve cannot create an immediate overpressure case > corrected
hydrotest pressure (yet >116% of DP) (MAWP)

Copyright of Shell Projects & Technology RESTRICTED September 2011 12

PRESSURE SYSTEMS
A pressure system has virtually the same operating pressure throughout.
A pressure system can be considered to be exposed from one or more
pressure sources of which one governs the pressure.
A pressure system can be designed for this governing pressure (by
design pressure) or can be protected at one point against the governing
overpressure by a pressure relief device. Hereby taken into account:
Hydraulics to be evaluated to assure that no equipment exceeds its design pressure (see
note 1).
Low flow interconnecting piping to be checked for potential restriction for relief flow.
Consider actual elevations that may result in different design pressures due to liquid
head (see note 2).
Note 1: If all equipment items in a system have equal design pressures with the PRV located on the last piece of equipment, then due to the
pressure drop, the set pressure of the PRV shall be below the design pressure to ensure that the upstream equipment is not
overpressured before the PRV opens.

Note 2: When the system is liquid-full, the design pressure of the accumulator vessel downstream of a cooler of a distillation column (vessel
located at significant lower elevation with respect to the location of the relief valve near top of distillation column) shall be increased
for extra liquid head.

Copyright of Shell Projects & Technology RESTRICTED September 2011 13

PRESSURE SYSTEMS

Note: Pressure system II is based on P1 pump shutoff. Pressure system III is indicative is case of a potential
run away of R1 (higher pressure than P1 shut off pressure).
Copyright of Shell Projects & Technology RESTRICTED September 2011 14
EXAMPLE 1 (OPEN PRESSURE SYSTEM)

Relief valve is OK to be used to protect

the entire system
It is accepted that a check valve will
open in the flow direction
Note that pressure drop over the
non return valve should be taken
into account (3% rule).

Relief valve cannot be used to

protect the entire system
Due to the non return valve there is
no open connection from the
downstream vessel to the relief valve.

Copyright of Shell Projects & Technology RESTRICTED September 2011 15

EXAMPLE 2

DP column = (OP x 1.05) x 1.10

Relief scenarios to consider blocked outlet
DP column = (1) + (2) + (3) (4)
Relief scenarios do not have to consider blocked outlet
for flow ex pump

(1)

(4)

(2) (3)

Copyright of Shell Projects & Technology RESTRICTED September 2011 16

EXAMPLE 3: SEPARATOR SYSTEM (VAPOR)

Is the single relief valve

good enough for protection
of both LP separators
against failure of either
control valve?

Copyright of Shell Projects & Technology RESTRICTED September 2011 17

EXAMPLE 3: SEPARATOR SYSTEM (VAPOR)

Is a relief valve on cold LP separator good enough for protection of

both LP separators against failure of either control valve?
No guarantee that NNF line is open and free of blockage (less
attention paid, or at least not the amount that is paid to dead ends
like to the RV)
No guarantee that that the NNF line is large enough to enable
suitable path to RV (see rules in slide pack 3.1-4 associated with this
lesson)

So, typically not allowed

Copyright of Shell Projects & Technology RESTRICTED September 2011 18

 EXAMPLE 4: DESIGN PRESSURE PROFILE

Hydrotreater and hydrocracker systems

may have a flat (new systems) or
a sloping pressure profile
(typically for existing systems)

Flat design pressure

profile as used in new
designs. More robust, less
need for various
protections (RVs and
IPF's).

Sloping design pressure profile as used in existing designs. Potential blocked outlet may
raise the pressure to the maximum pressure from the feed pump and/or hydrogen
compressor. Additional safeguards are required (RV- not desirable due to high temperature
and high flow, or IPF such as 1oo3 PZA HH stopping the pressure generating equipment
and stopping heat input).

Copyright of Shell Projects & Technology RESTRICTED September 2011 19

SUMMARY

Overdesign pressure events are only based on credible scenarios

Operator response can be a valid barrier to prevent overpressure.
Automatic control is not.
Sufficient design pressure or a relief valve is the last line of defence
against overpressure
Control valve failure action should be selected with care to prevent an
unsafe (e.g. overpressure) situation
A pressure system shall remain open under all conditions (no valves
and no blockage allowed)

Copyright of Shell Projects & Technology RESTRICTED September 2011 20