Taking Credit for Emergency Shutdown Devices in Relief System Sizing and Design
Ram K. Goyal, Advisor Risk Management, Bahrain Petroleum Company, The Kingdom of Bahrain

In relief valves sizing, we do not take cognizance of any immediate actions taken by operators or by mitigating devices. However, in the design of overall flare systems to cope with common mode failures such as loss of power or cooling water, many experts these days support taking credit for emergency shutdown systems to reduce investment. While there is no objection , in principle, to such credit taking, its application in practice deserves careful scrutiny.

In the sizing of individual relief valves protecting equipment or process or system, it is a common practice not to take cognizance of any immediate operator action or the action of any mitigating devices. However, when it comes to designing an overall refinery flare system to cope with common mode failures (e.g., loss of power, or cooling water supply failure), an increasing number of experts are supporting taking credit for the action of devices such as unit emergency shutdown (ESD) systems, trips (for example, fired heater fuel supply cut-offs), or auto-starts of pumps whose actions reduce the potential load on the overall refinery flare system. Savings can thus be realised in the sizing of flare headers and other ancillary equipment. While there is no objection, in principle, to taking credit for ESDs in the design of relief systems, its application in practice deserves careful scrutiny. There are still many related issues that have not been adequately addressed by the proponents of the credit-taking approach. This paper highlights these concerns and offers practical advice to those facing relief system design decisions.

In a modern refinery, the practice of atmospheric discharge of gaseous hydrocarbons from Pressure Relief Valve (PRV) tail pipes, irrespective of whether on-plot or off-plot, is neither permissible under environmental guidelines nor desirable from a safety standpoint. The common approach, therefore, is to tie all (or most) pressure relief discharges from a unit into a manifold or unit header, which is then routed to a refinery relief header connected to a suitably sized flare system. Two systems are sometimes preferred - a low-pressure system and a high-pressure system.

The key parameters in the design and sizing of such a relief/ flare header or manifold are the flow rate, the driving pressure and the type of material expected to enter the header from the discharge pipes of various relief valves connected to it. This in turn depends upon assumptions made as to the concurrence of relieving from several sources.

If it is assumed the header is required to handle the numerical sum of the rated capacities of all the relief devices in all the units discharging to it, then its calculated design size will truly be of enormous proportions - and require an equally enormous flare stack to match! Clearly, such an approach is wasteful and unjustifiable, especially where it can be demonstrated that an event culminating in simultaneous relief from all the valves at their respective rated capacities is impossible to occur (except, perhaps, as an extremely elaborate act of sabotage).

A certain degree of realism can be injected into the header design process by assuming that the maximum relief load will be equal to the sum of the actual expected maximum relief flows from those valves which could lift under a given emergency situation. For example, consider utility failure (power, cooling water, instrument air, steam, fuel oil/fuel gas, inert gas, or a combination based upon inter-relationship or common cause) or uni /plant fire. The header size derived will be smaller than that resulting from the total rated relieving-capacity assumption discussed previously. It will, however, be large enough to handle the relief load from all foreseeable emergency situations.

Hence, in sizing a header/flare system, there can really be no serious objection to utilising a conservative time-line analysis approach or a dynamic analysis based on process parameter levels expected under 'upset' conditions to calculate the required relief load, provided individual peak relieving rates get adequately addressed in the analysis.

Further economy in the header and flare system size can be realised by assuming that, in practice, several of the relief valves will not be required to lift in an emergency. Pressure in the vessels or equipment protected by them will not rise above the PRV set pressures due to the action of any "automatic instrumentation" installed that tends to pacify the source of pressure build-up. Automatic instrumentation here does not refer to the normally operating control systems and instruments used to operate the refinery [sometimes referred to as the Basic Process Control systems (BPCS) - see CCPS (1993) automation guidelines]. It refers to non-normal instrumentation such as emergency shutdown devices (ESDs), trips, safety interlock systems, auto-lockouts or auto-starts (all termed "ESD" for the purpose of this paper).

Size reduction sought on the basis of ESDs (i.e., taking credit for ESDs in relief and flare system design) - though it appears to have a 'prima facie' justification - is nonetheless fraught with controversy and a source of genuine concern, especially among operations managements. The key question, therefore, is: should we or should we not take credit for ESDs in the relief/flare system design?

Note that the design of other parts of the relief system - such as PRV sizing, individual discharge piping and the header piping - can be carried out on the basis of the various API recommended practices. Applicable sections of the API RPs are illustrated in Figure 1.

Clearly, the biggest advantage of taking credit for ESDs is minimising the size of the relief system required to handle the PRV discharges from a unit or the entire facility. Reduction in relief load means reduced flare stack diameter and length, reduced header and sub-header sizes, and hence lower investment. In addition to the effect on installation costs, and perhaps of greater significance, is the impact of relief load reduction on the following key parameters associated with the performance and siting of a flare stack:
  • In-plant thermal radiation at grade
  • Radiation received at adjacent equipment
  • Radiation level at refinery fence-line
  • Combined radiation from more than one flare
  • Dispersion of combustion products
  • Dispersion on flame failure
  • Compliance with environmental regulations
  • Health impact on immediate area
  • Health impact on surrounding communities
  • Quantity of product sent to flare.
OBJECTIONS TO CREDIT TAKING
There is no objection in principle, to the concept of taking credit for ESDs or any other shutdown devices/trips in evaluating relief system capacities. It is no different from any other cost versus risk-reduction benefit decisions faced by managements every day. In the highly competitive environment, which currently prevails in the oil business, the potential for savings associated with a smaller flare system cannot be dismissed lightly .

Nonetheless, before lending unequivocal support to the concept, a few concerns need to be aired and resolved. From the standpoint of operations and engineering managements these are considered to be extremely significant - in fact so much so as to disfavor the practice of ESD credit taking. Past incidents on record involving flare systems further add to a plant owner's anxiety in what is perceived as 'cutting corners' in the system design. One example is the Grangemouth (U.K.) Refinery incident. Although not related to flare line sizing, it was, nonetheless, a major incident involving a flare system.

API RP-521 states that the discharge piping system should be designed so that the built-up back pressure caused by the flow through the valve under consideration does not reduce the capacity of any pressure relief valve that may be relieving simultaneously. This statement is extremely clear and specific in terms of its content and guiding intent. It can be argued that ESD credit-taking violates the requirement quoted above in that if a smaller header size is selected it may permit the build-up of back pressure to such a level as to reduce the capacity of another PRV connected to the system if the ESDs fail to act in the assumed manner.

The hydrocarbon processing and the chemical industries are sometimes portrayed in the media as being those causing many major incidents resulting in loss of life and property. Setting aside the validity of such claims, there is no denying that most reputable companies have been acutely aware of their responsibilities in terms of safety of the communities and the environmental issues since well before the onset of recent legislation on clean air and process safety management.

In the post-OSHA period, the punitive element, invariably associated with the law, has forced a major modification in the outlook of many operations managers. The first question management wants answered is: "Does this decision conform to existing international standards, codes of practice, or guidelines or best-known/approved practices?" Or, conversely: "Will we be in violation of, or interpreted to be in violation of any international code?" In the past, the fact that the API has been silent on the subject of ESD credit taking would have been just one factor in the overall decision-making process. Nowadays, this silence will get noticed with added alarm.

Lack of a recognised standard leaves engineers and managers, who permit the design and installation of a relief system taking credit for ESDs, vulnerable to the possibility of unfavorable comment from official investigations of any loss or injury incidents involving relief system sizing. This concern should not be considered a mere speculation. Past experience of management on incidents elsewhere, in which established industry practices were set aside in favor of calculated low-risk options, forces us to a closer scrutiny of this issue.

COMPROMISING A KEY SAFETY FEATURE:
Even if the law permits taking credit for ESDs, a carte blanche approval can not be granted for this practice. Each application must be thoroughly analysed on the basis of its particular situation.

It can be argued that the ESD credit-taking practice compromises the safety margins. An "undersized" flare header receiving load from several units makes it possible for an equipment over-pressure event (which might lead to an explosion or fire) to occur simultaneously in more than one or all the units connected to the single flare system following a common mode initiating event such as power failure or cooling water failure.

Correct actuation of an ESD does not necessarily mean the relief load gets reduced to zero at the same instant. Residual heat in the fluid contained in a tower will often be sufficient to maintain flow through the relief valve for some time. Also, the time taken to discharge the vapor inventory from the PRV opening pressure down to the reseat pressure is not negligible.

If you feel extremely confident that the ESD will work and will not permit an overpressure situation to arise, then don't install a PRV.

If you feel a PRV needs to be installed, then don't undersize it because you feel the probability of it lifting is low due to ESD action. Provide a full -size PRV. See Kletz (1984).

If you decide to connect the tail-pipe to the flare header, then don't undersize the flare header because you feel the probability of PRV lifting is low. Provide an adequately-sized flare header.

CONCLUSIONS AND PATH FORWARD
While there is no objection to the concept of taking credit for ESDs in the relief and flare header sizing and design, each application needs to be individually scrutinised to ensure plant safety is not compromised. Special attention needs to be given to potential impact on other units sharing the relief header.

The current API recommended practices (RP-520 and RP-521) appear to be silent on this issue. There are no other internationally recognized standards, codes of practice or guidelines which specifically permit taking credit for ESDs in relief system design.

There is a need to initiate a dialog with the API and/or hold further discussions under the aegis of some other recognised body, such as the NPRA (National Petroleum Refiners Association), for guidelines to be established and placed on record.

Confirmation should be sought from OSHA that taking credit for ESDs in relief system design does not constitute any violation of the intent of OSHA 1910.119 Paragraph (d)(3)(H)(ii) which states that the employer shall document that equipment complies with recognised and generally accepted good engineering practices; the statement being applicable to relief system design and design basis per Paragraph (d)(3)(D) of the OSHA regulation.

In addition to giving approval to the concept, any future internationally recognised standards or codes must incorporate detailed guidelines on the types of ESDs for which credit-taking would be permissible. These should include reliability targets for high-integrity ESDs or a directive to conduct detailed reliability analyses of such systems.

From an operating company management standpoint, ESD credit-taking is not advisable before this practice is clearly recognised and/or approved in an international standard or code. Lack of such a standard leaves engineers and managers, who permit the design and installation of relief systems taking credit for ESDs, vulnerable to the possibility of adverse comment from official investigations of any loss or injury incidents involving relief system sizing. In a court of law, it would place them in a weak defensive situation.

Even if ESD credit-taking becomes an “approved” practice, operating company management are advised to exercise caution. An extremely risk-aversed interunit spacing in a well laid-out refinery is a valuable asset. It presents a natural barrier to the insurer’s EML calculations. Do not erode this barrier by opting for “savings” in the relief header and flare system costs.

Designers and suppliers of ESD systems need to prove that the on-stream availability and reliability of their systems, so readily demonstrable on paper or in FATs, can be reproduced on-site, and are practically immune to environmental factors arising from geographical location or the work ethos of the client company.

In a market place of ever-shrinking refining margins, the incessant pursuit of cost effectiveness in all decision-making is not merely a desirable activity, but the key to survival. However, cost effectiveness must never be misconstrued to mean indiscriminate cost-cutting.