Reconsidering Need For

Overpressure Protection Via

Instrumentation & Controls
In Petroleum Refining
Standards
Certification
Education & Training
Publishing
Conferences & Exhibits

2006 ISA Safety Division Symposium

Houston TX

Layers of Protection

Overview
Identify Design Intent of Overpressure Protection
Code and Standards requirements from ASME, API, and
ANSI/ISA, as applicable to that specific Design Intent;
Mechanical Design Requirements for Source Vessel
Pressure Protection System Requirements

Different Categories of HIPPS and typical requirements

Vessel Overpressure Protection Standards

HIPPS Design Intent

Intent #1
Protect against the hazardous effects of overpressure of the
source vessel beyond allowable limits per ASME BPV Code
under the postulated scenario

Intent #2
Protect against the potentially hazardous effects of a relief
scenario in the event there is no relief disposal system, or a
disposal system that is not adequately designed for a postulated
contingency.

Intent #3
Prevent a relief scenario from occurring despite the fact that the
relief device and disposal system are adequately designed for
the scenario.

Overpressure Protection per

ASME Boiler and Pressure Vessel Code
Failure of HIPPS Could Results in...
Credible relieving scenario(s) causing overpressure of the
source vessel beyond allowable limits per ASME BPV Code,
Section VIII, Division 1. Ref UG 125.

HIPPS protects the Source Vessel from Overpressure

Hazard and mechanical damage

Overpressure Scenarios

Loss of utilities, electric, steam, cooling water, instrument air

Runaway chemical reactions
External fire exposure (typically no credit for HIPPS)
Blocked outlet
Instrumentation failures
Loss of Condensing
Tower Reflux Failure
Accumulation of non-condensables
Entrance of highly volatile material
Overfilling
Abnormal heat input
Failure of Automatic Controls
Exchanger tube rupture
Internal Explosion
Hydraulic Expansion
Other equipment failures

HIPPS to Prevent Runaway

Chemical Reaction

Key Issues per

ASME BPV Code - Code Case 2211

Whether the vessel is exclusively in air, water, or steam service; HIPPS not
allowed.
User responsibilities in overpressure protection by system design. Vessel
fabricators have no responsibility for specifying HIPPS.
User responsibilities for ensuring the Maximum Allowable Working
Pressure (MAWP) of a pressure vessel is higher than the highest pressure
that can reasonably be achieved by the system, addressing all credible
overpressure scenarios. Just as in conventional relief, HIPPS design must
be sufficiently robust as to preclude overpressure from all credible
scenarios.
Qualitative or quantitative reliability analysis of the proposed HIPPS
system. Tie-in to Safety Instrumented Systems requirements under the
ANSI/ISA 84.01 standard, performance targets in terms of safetyavailability and verification using quantitative reliability analysis.
Proper documentation of the analysis conducted for 3) and 4); and,
importantly, possible need for approval by jurisdiction having authority,
depending on location.

Pressure Relief Design Philosophy

Code Case 2211 HIPPS is NOT just another alternative
in Relief System Design
What is a credible relief scenario vs. non-credible?
BPV Code Section VIII does not consider pressure reducing
valves and similar mechanical or electrical control instruments as
sufficiently positive in action to prevent overpressure.
Code Case 2211 HIPPS should be an option of last resort that
enhances overall safety
Not a cost decision

Legal, Regulatory, and Administrative Requirements and

Perspective from Jurisdiction Having Authority

HIPPS Design Intent

Intent #1
Protect against the hazardous effects of overpressure of the
source vessel beyond allowable limits per ASME BPV Code
under the postulated scenario

Intent #2
Protect against the potentially hazardous effects of a relief
scenario in the event there is no relief disposal system, or a
disposal system that is not adequately designed for a postulated
contingency.

Intent #3
Prevent a relief scenario from occurring despite the fact that the
relief device and disposal system are adequately designed for
the scenario.

Overpressure Protection per

API Recommended Practice 521
API Recommended Practice 521
Recommends assumptions and credits to be taken for
individual relief sizing and flare system sizing
Section 2.2: Fail-safe devices, automatic start-up equipment, and other
conventional control instrumentation should not replace pressure
relieving devices as protection for individual process equipment.
However, in the design of some components of the blowdown header,
flare, and flare tip, favorable instrument response of some percentage of
the instrumented system can be assumed. The percentage of favorable
instrument response is generally calculated based on the amount of
redundancy, maintenance schedules, and other factors that affect
instrument reliability.

Overpressure Protection per

API Recommended Practice 521
HIPPS failure could result in direct relief to atmosphere
or overload of the relief system beyond allowable limits
per API RP 521
Flare header, knockout drum, or flare stack
The potential consequences include:
Release of a toxic or flammable substance at the discharge of a
relief device (or vent stack)
High thermal radiation and noise near the flare tip
Potential loss of flame stability and blowout
Excessive backpressure in the relief header with the potential for
the actual relief rate to fall below the required rate. Vessel
overpressure above allowable limits.

RP-521 HIPPS To Safeguard

Against Overloading Relief Header

Active Relief Devices on Global Plant Power

Failure

RP 521 HIPPS Analysis

Complicating Factors

Multiple vessels in a large refinery require such systems to prevent

simultaneous relief / overloading.
HIPPS failure causes backpressure levels above tolerable limits
occur somewhere in the flare system. The most-exposed vessel is
not necessarily the source vessel with the HIPPS.
Multiple systems with same SIS logic solver; failure of which could
render multiple overpressure protection systems ineffective
simultaneously.
Multiple final elements on multiple heat sources shutoff using a
single HIPPS. Failure of one final element not as severe as failure
of multiple as would occur in the case of a sensor failure. Both are
credible failures that need to be evaluated separately.
Hazards associated with Spurious Trips
Separation of BPCS and SIS

HIPPS Design Intent

Intent #1
Protect against the hazardous effects of overpressure of the
source vessel beyond allowable limits per ASME BPV Code
under the postulated scenario

Intent #2
Protect against the potentially hazardous effects of a relief
scenario in the event there is no relief disposal system, or a
disposal system that is not adequately designed for a postulated
contingency.

Intent #3
Prevent a relief scenario from occurring despite the fact that the
relief device and disposal system are adequately designed for
the scenario.

Overpressure Protection for

Flare Avoidance
HIPPS Failure would result in higher flare system
loading, at otherwise safe levels
Facility Managements Desire to Avoid Flaring

Flare Avoidance System

Overpressure Protection for

Flare Avoidance
BPCS versus separate HIPPS
ISBL versus OSBL engineering

HIPPS Design Intent

Intent #1
Protect against the hazardous effects of overpressure of the
source vessel beyond allowable limits per ASME BPV Code
under the postulated scenario

Intent #2
Protect against the potentially hazardous effects of a relief
scenario in the event there is no relief disposal system, or a
disposal system that is not adequately designed for a postulated
contingency.

Intent #3
Prevent a relief scenario from occurring despite the fact that the
relief device and disposal system are adequately designed for
the scenario.

Safeguarding Against
Liquid Relief
Reconsidering Credible versus Non-Credible Scenarios
Comprehensive Flare System Reviews
Hazards of concern include:
Atmospheric relief of a flammable or toxic liquid from the flare
stack
Atmospheric relief of flammable or toxic liquid flashing to vapor
during the relief event
Excessive backpressure in relief header due to flashing across a
relief devices and two-phase flow in the header
Ductile to brittle transition due to auto-refrigeration across a
pressure relief device

Flashing Liquid Relief

As Safe or Safer
Code Case 2211 invokes the as safe or safer
requirement
Intent to enhance overall safety
Perspective from Jurisdiction Having Authority

Draft API RP 521 Ed 5 has similar language. Situations

where use of pressure relief devices is impractical
No such requirement applies to Flare Avoidance
Systems

Conclusion
Establishing performance requirements involves the
intersection of expertise in process engineering, plant
operations, relief systems engineering, as well as safety
instrumented systems engineering.
This synergy of skills should not be underestimated
initially.
Short-cuts in the design phase could include either an
over-specified, and excessively costly pressure
protection system; or, more seriously, a system that
provides insufficient protection against overpressure
hazards.