In a previous post I addressed the issue of not designing a relief valve for liquid overfill in relation with the requirements for instrumental protection. Taking this subject a little bit further, there is also a relation between liquid overfill and design pressure.

Not taking this relationship into account during early design stages may lead to surprises at later stages as safety reviews may require corrective action to safeguard the design. What could have been an easy solution (selecting a slightly higher design pressure) will then no longer be an option as it would usually mean massive re-work and schedule impact.

Example system

Let’s take a look at the column system in the figure below:
Liquid Overfill Example System

It’s drawn somewhat to scale and depicts a generic case for an overfill scenario. Feed pump P-100 charges the feed into fractionator C-100 and we assume it can overpressure this column beyond the setting of relief valve RV-100. This relief valve is also protecting reboiler E-100, condenser EA-100 and overhead accumulator V-100 against overpressure.

We will further assume that the whole column system has been designed for 3.5 barg. No additional design credit for liquid full operation is assumed. However, each equipment item should be mechanically designed for water-full conditions during individual hydro testing.

Liquid Overfill due to Overhead Rundown Failure

Consider that control valve CV-103 fails shut for some reason. This will cause the level in the drum to rise. Eventually it will cause flooding of condenser EA-100 so relief will occur. Although vessel V-100 will have been designed for the set pressure of RV-100, it will now see this pressure increased by the liquid column up to the top of condenser EA-100. Typically this will mean an additional 0.4 bar or so. Assuming a low pressure column with 3.5 barg design pressure this would mean an excess of 10%. Not shocking but this will bring the accumulated relief pressure to 120% of design which is at least not per code.

Liquid Overfill due to Bottoms Rundown Failure

Let’s look at another possibility where control valve CV-101 on the bottoms rundown fails. This will cause column C-100 to fill up. When the liquid reaches the overhead line, the whole overhead system will fill as well. Note that per API 521 we cannot assume that any of the control valves will act to compensate for the additional inflow of liquid in that system. End of the story is that the condenser is flooded while the reboiler may still be functional.

So in case the feed pump P-100 is only capable of filling the column at normal overhead pressure, we may still be able to move into a relief scenario. If it can exceed the design pressure of the column we surely can.

The problem now is that in this case vessel V-100 will see its design pressure exceeded by maybe 20 meters of liquid column. This is equivalent to some 1.5 bar or about 60% overpressure in case of a 3.5 barg system. Conclusion: the vessel may very likely fail. Furthermore: even if the relief valve was designed for the liquid overfill contingency, we may still need to install a high integrity instrumental protection against this scenario!

For the bottoms pump discharge system a similar remark can be made, be it that the percentage overpressure is probably much lower here as the design pressure will be higher. Note that the column itself will probably be safe due to the water-full hydro testing requirement.

Considerations for Liquid Overfill and Design Pressure

Of course the above will depend on the actual time for overfilling and the possible actions the operator can take to stop the overfilling from getting too far. The problem with this is the fact that design pressures are assigned in an early stage of the design process where such details may not be defined yet.

In the example system, stopping the feed pump or closing its control valve would seem like a simple solution (and it probably is). However, imagine a different feed source under high pressure with a large liquid holdup. Combine this with a scenario where excessive feed rate causes overfill rather than rundown failure. This could make it much more difficult to stop the column from overfilling.

There are a number of considerations to make in order to decide whether or not an allowance for liquid overfill should be made:

  1. Client requirements: Exxon procedures for example require that liquid overfill is incorporated in the equipment design conditions. The Shell DEP currently does not explicitly state this (however, it used to in the past).
  2. The maximum percentage of overpressure possible: if the example system were designed for 15 barg, the overpressure would be 10% leading to a possible gasket failure or similar risk. This would typically require a moderate SIL level only.
  3. The effects of loss of containment: how dangerous is the process medium for instance. Failure of a water stripper may cause injuries or death to an operator, but it will not cause fire, explosion, soil contamination, etc.
  4. The likely SIL level (increase) in case liquid overfill contingency is not applied for design pressure.
  5. Applying notes on PFD’s/EFD’s: consideration should be given to document mandatory design requirements on the process (engineering) flow diagrams, enabling adequate operator responses within the required time frame (if possible).

So in case client requirements do not already enforce to include the static pressure from liquid overfill into the equipment design conditions, you should first make a cost-benefit analysis to see if not designing for it is worth the risk. If it does not make any difference in pipe classes for instance (also downstream of course) the cost impact will be minimal. In such cases incorporating an allowance for liquid full static heat is a nobrainer.

In case conservatism is not possible or desired, high level instrumental protection may be considered as an alternative.  As a last step you can mitigate the risk by applying design instructions. This last option should be used with care as it should be possible to adhere to the instructions. If the design cannot comply, design conditions throughout the system will need to be changed or instrumental protection will need to become more complex to compensate. However, it is one of the simplest methods to avoid additional design contingencies while avoiding problems later.

Leave a Reply

Time limit is exhausted. Please reload the CAPTCHA.