DOI: 10.3303/CET2290094 Paper Received: 20 December 2021; Revised: 5 March 2022; Accepted: 5 May 2022 Please cite this article as: Wichmann O., Dünger U., Stellmacher V., 2022, Essential Aspects of Pressure Safety – Experiences from Industrial Practice, Chemical Engineering Transactions, 90, 559-564 DOI:10.3303/CET2290094 CHEMICAL ENGINEERING TRANSACTIONS VOL. 90, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Aleš Bernatík, Bruno Fabiano Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-88-4; ISSN 2283-9216 Essential Aspects of Pressure Safety – Experiences from Industrial Practice Oliver Wichmann, Udo Dünger*, Volker Stellmacher Covestro Deutschland AG, 51373 Leverkusen udo.duenger@covestro.com Four simple, real examples from the chemical industry show particularly critical points which, according to experience, can jeopardize the safe functioning of pressure safety devices. Typical pitfalls in pressure relief and vacuum protection devices in package units of process plants, in outsourcing their engineering, in the application of standards for their sizing and in the safe discharge are shown. Systematic life cycle management for these pressure relief and vacuum protection devices in process plants in the chemical industry is then presented. By using it, pressure safety systems can be implemented safely and if they do show weaknesses, these are discovered at an early stage. This makes an important contribution to the safe and reliable operation of chemical plants. 1. Examples from Industrial Practice To produce chemical materials safely and economically, it is necessary to reduce process risks to a tolerable minimum by using state-of-the-art technology and know-how. Possible deviations from the operational state and their corresponding risks are typically identified in a systematic safety review where adequate countermeasures are defined. For risks associated with “pressure too high” and “pressure too low” often mechanical relief devices, such as pressure relief valves, are chosen. This chapter shows examples from industrial practice where safety devices for pressure protection (overpressure and vacuum) did not work as intended or would not have worked due to faulty design. 1.1 Integration of Package Units A heating unit is to be integrated as a package unit into a process plant. If the temperature control of the heating unit malfunctions, the temperature can reach considerably higher values than in normal operation, so that the maximum permissible pressure of the pressure vessels and pipes of the heating unit and associated process equipment can be exceeded by the vapor pressure of the heating medium. The maximum possible temperature must therefore be safeguarded. In the present case, a safety temperature limiter was used for this purpose, which was intended to limit the temperature to the stated and guaranteed maximum temperature of the package unit. An acceptance test and test prior to commissioning were carried out. These tests revealed the following safety related errors: • the installed safety valve to protect against thermal expansion was installed upside-down because of the limited installation space inside the heating unit. According to the manufacturer of the safety valve, upside-down mounting is not permitted, because, among other things, it changes the set pressure. • the sealing material at the seat of the safety valve was not suitable for the permissible temperature range. Sealing material degraded by too high temperature can adhere to the seat of the safety valve, so that the safety valve opens at considerably higher pressures or, in the worst case, does not open at all. • the safety temperature limiter switched off at a temperature that was 50°C above the specified maximum temperature. 559 Figure 1: Heating unit with safety temperature limiter and safety valve 1.2 Outsourcing of Safety Engineering Adequate sizing of mechanical devices against overpressure and vacuum may include sophisticated engineering and calculation tasks which can be very demanding for engineers, even if the design cases are well documented in the process hazard analysis. The skills for proper safety engineering are not taught to a full extent in technical universities, so that a further qualification is indispensable. There are a lot of good reasons to outsource safety engineering to external contractors, but the demand for accuracy, technical know-how and qualification of the executing engineering personnel is just shifted. It also creates a new interface that facilitates further misunderstandings. Despite the delegation of the execution overall responsibility remains with the operator of the plant. The following example shows the demand of expertise and adequate management process: A positive displacement pump is installed to pump a liquid from A to B. In the process hazard analysis it was identified, that in case of a blocked discharge side the allowable working pressure can be exceeded by the pump. As an adequate measure a safety valve was chosen, which relieves the pumped mass flow back to the vessel on the suction side of the pump, see Figure 2. Figure 2: Positive displacement pump with overpressure protection by safety valve The task of sizing this pressure safety valve was handed over to an external engineering contractor. The resulting final design report for this safety valve had nine pages. The first page was about general information and included the signatures of two engineers to follow the 4-eye-principal. On the second page was documented the required volume flow given by the maximum volume flow of the pump and the certified volume flow of the safety valve: • Required volume flow: 36 m³/h • Certified volume flow: 30 m³/h Two engineers of the contractor signed a document for an undersized safety valve! 1.3 Using Standards for Sizing the Vacuum Protection of a Flat Bottom Tank In chemical process industry it is often necessary to have storage capacity for the chemical materials. Typical storage units for this purpose are tank farms, which consist of a whole series of different tanks. Quite common for storing liquids are so called flat bottom tanks which, due to their thin wall thickness, have low allowable 560 working pressure and vacuum resistance. To avoid an unintended deviation of the pressure often mechanical relief devices are installed, which can release the gas phase or suck in outer atmosphere (see Figure 3). The correct sizing of this safety equipment is essential for its proper function. The correct calculation of the required volume flow enables the planning engineer to select a device with a sufficient certified volume flow. To support the planning engineer technical standards where created, such as ISO28300. The standards list different overpressure and vacuum sources and how to take them into account for sizing. For the sizing of the vacuum protection device the following scenarios are listed: • Emptying the tank with a pump • Thermal contraction of the liquid and gaseous phase due to temperature change • Condensation • General: False position of valves The technical data of a typical flat bottom tank is listed in Table 1. The tank is equipped with a split-range control system that regulates the tank pressure according to the set target value via pressure measurement, this is done by opening/closing a nitrogen valve and an exhaust valve to an incinerator via a blower, see Figure 3. Table 1: Technical data of the flat bottom tank in Figure 3. Parameter Unit Value Height m 7 Diameter Storage temperature Volume flow of emptying pump Thermal contraction according to ISO28399 design equations Condensation Capacity of Blower Required ventilation flow, without blower capacity Required ventilation flow, blower capacity included m °C m³/h m³/h m³/h m³/h m³/h m³/h 5 40 20 10 0 300 30 330 As failure scenario a faulty pressure measurement is assumed, measuring overpressure where actual vacuum is present. This is resulting in opening the off-gas valve and closing the nitrogen valve. The tank must be equipped with a sufficiently dimensioned safety device against negative pressure so that it does not collapse. When the causes of negative pressure are identified in the process hazard analysis, negative pressure due to emptying pumps, thermal contraction and condensation (which is assumed here to be zero) is typically always considered. As a result, the planning engineer will design the vacuum protection device for a ventilation volume flow of 30 cubic meters per hour. Finally, the planning engineer would select a vacuum protection device in the nomograms of the catalog, which can vent at least 30 cubic meters per hour of air at the latest at the minimum permissible operating pressure. Figure 3: Flat bottom tank with overpressure and vacuum protection 561 Often the off gas-treatment system includes a blower which is responsible for the correct flow direction of the off-gas stream. Typically, the exhaust gas cleaning system is shown on a different flow diagram so that the team performing the process hazard analysis does not see this operating unit together with the tank on a single drawing. In the case of inexperienced teams, this can easily cause the vacuum source “blower” to be overlooked. A vacuum of about 50 millibar or more can occur on the suction side of the blower. A single failure, namely an incorrect pressure measurement within the pressure control, can result in a closed nitrogen- valve and, at the same time, an opened off-gas valve leading to a connection between flat bottom tank and suction side of the blower. Blowers in industry scale can enable a flow rate of 300 cubic meter per hour and higher, depending on the process conditions. If the off-gas valve and off gas line diameter is not limiting the off-gas-volume flow out of the tank (calculated via the Cv-value of the valve and the pressure difference) the full volume flow of the blower must be added when calculating the required volume flow. In this case the total required volume flow without the blower flow is only 30 cubic meter per hour. The correct ventilation volume flow taking into account the volume flow of the blower is 330 cubic meter per hour, which is eleven times higher. Even in case of choosing a slightly oversized valve the probability of installation of an undersized vacuum protection is high. A collapse of the tank when the blower flow is not considered, and the split range control fails as described, is very likely. The case of vacuum by a blower for the flow of exhaust gas to the vent treatment system is often the main contribution to the required breathing flow. It is noteworthy that the relevant standards do not contain any direct reference to the vacuum source "blower". For example, the European standard EN ISO 28300 refers all causes of overpressure or vacuum. Although exhaust gas treatment systems are explicitly listed, only examples of overpressure sources are mentioned in this context. The negative pressure source “Blower” can be best assigned to the cause of “control valve failure” mentioned in this standard. Since this source of negative pressure is quite common in the chemical industry, an engineer should always think of this source of negative pressure. If the overpressure and vacuum safety device is designed purely in accordance with relevant standards, this case can be overlooked which can lead to a collapse of the tank! 1.4 Safe Discharge of Pressure Safety Equipment The first design of the discharge pipe of a safety valve to protect equipment containing hydrogen consisted of a long pipeline with a 180° bend at the outlet pointing downwards, see Figure 4. This was a standard design in the past for all discharge pipes, mainly because it is a good design for preventing rain from entering the discharge line. Figure 4: Initial design of a pressure relief valve for hydrogen with a classic 180° bend When the safety valve was activated, the high impulse forces at the outlet buckled the inadequately fixed blow-off pipe. The hydrogen was forced downward because of the 180° elbow, and the hydrogen cloud reached ground level, where it could have caused considerable personal injury in the event of ignition. This 562 was not (yet) noticed, because no one was around during the release. After dismantling the discharge pipe, the safety valve was temporarily put into operation without a discharge pipe. When the safety valve was activated again in this condition without a discharge pipe, the hydrogen ignited and set fire to the cable tray of the plant, which was located directly above the safety valve. Again, fortunately no one was injured but the financial damage caused by the resulting downtime of the plant was considerable. This incident shows how important it is to evaluate the “safe discharge” of pressure safety valves carefully. An overview of the possible hazards to be taken into account in the release of substances is shown in Figure 5. If necessary, the "size of the endangered areas" is determined using dispersion calculations. Figure 5: Keywords to assess hazards during pressure relief to atmosphere In the case of hydrogen a safe discharge can be achieved by using a flare. If this is not feasible the effects of thermal radiation and pressure in the event of ignition have to be considered. Additionally for light gases such as hydrogen, the discharge pipe must be routed upwards with a so-called lambda outlet or comparable outlets (DVGW, 2015). It should also be noted that the best solution is if the equipment used has sufficient mechanical integrity so that the maximum permissible pressure cannot be exceeded at all. This was the situation in the case described above. The pressure was adequately safeguarded by the hydrogen supplier. Therefore, the additional safety valve in the downstream system could have been removed. This “unnecessary” safety measure is also an example for interfaces challenges. 2. Systematic Safety Device Life Cycle Management The four examples presented show that errors can occur in the design of pressure relief devices. A systematic life cycle management (LCM) for pressure relief devices ensures that these errors can be identified early and thus makes a decisive contribution to preventing accidents. The necessary components of the LCM are shown in Figure 6 and are described below. Figure 6: Pressurized system and pressure safety device life cycle 563 2.1 Identify all Relevant Pressure Scenarios The first principal of a pressure safety concept is a systematic approach to identify all relevant pressure scenarios and define appropriate safety measures in case the allowable pressure range of the equipment could be exceeded. The basic specification of safety measures is typically done in the process hazard analysis. If possible, mechanical integrity is chosen as the preferred measure. The adequate reliability of safety devices is determined by carefully determining the associated risk. For mechanical relief devices such as bursting disks, safety valves or tank vents (seal pots or mechanical valves) the “design cases” are identified and the safe disposal is defined. 2.2 Engineering Excellence and Quality The second principal for safe overpressure and vacuum protection systems is their correct design including sizing, installation and initial testing prior to commissioning. In order to realize this with the necessary quality, continuous efforts are necessary. Professional Education and regular training of engineering personnel, easily accessible knowledge documents, standards and verified calculation tools contribute to achieving excellence in engineering. A detailed definition of requirements and a quality check for internal and external engineering services are also required. In addition, good quality pressure relief devices are indispensable to achieve the required reliability. 2.3 Regular Testing and Maintenance In order to maintain high reliability for a long time, regular functional tests and careful maintenance are required. The maintenance intervals must be sufficiently short; in practice, the concept of risk-based inspections has proven itself. As a result, resources are used efficiently and critical points are examined particularly frequently and thoroughly according to their risk. 2.4 Corrective Measures Regular revalidations of the safety assessments are carried out in order to detect incomplete or incorrect pressure protection measures. In this case, it is also checked whether safety-related updates or retrofits are necessary due to changes in the state of the art. When any change is made to the process, this is done using a systematic management of change approach, so that the devices for pressure protection are adapted to new conditions such as increased throughput. Such a change can also be the decommissioning of a pressure relief device, which is replaced by another safety measure (for example, a PCT measure). Another important opportunity to improve the reliability of pressure protection is to learn from near-miss events and, if necessary, incidents. According to George Bernard Shaw “success does not consist in never making mistakes but in never making the same one a second time”. 3. Conclusions Four examples from the industrial practice of pressure safety devices have shown possible faults on such safety devices. The presented systematic life cycle management for pressure relief devices enables early detection and elimination of such faults. A high quality life cycle management of pressure relief devices is indispensable for reliable pressure relief devices and can make a decisive contribution to safe and reliable chemical plants. Acknowledgments Many thanks to Heather Thomas and Johannes Laudenberg for their valuable support. References DVGW, 2021, Technical note - Instruction sheet, DVGW G 442 (M), July 2015, Potentially explosive Atmosphere at Exhaust Openings of Venting Lines at Gas Plants or Systems. European committee for standardization, 2008, Petroleum, petrochemical and natural gas industries — Venting of atmospheric and low-pressure storage tanks, ISO 28300:2008 EPSC, 2021, Hydrogen Vents, EPSC Learning Sheet April 2021, European Process Safety Centre, , accessed 01.12.2021 564 https://epsc.be/epsc_media/Learning+Sheets/2021/21_03+EPSC+Learning+Sheet+_+Hydrogen+Vents-p-2838.pdf https://epsc.be/epsc_media/Learning+Sheets/2021/21_03+EPSC+Learning+Sheet+_+Hydrogen+Vents-p-2838.pdf lp-2022-abstract-026.pdf Essential Aspects of Pressure Safety – Experiences from Industrial Practice