Author: Phil Henry, P.E., Process Technology Team Leader, Principal Engineer II

Overpressure protection by system design in lieu of pressure relief devices (PRDs) as a method of pressure vessel overpressure protection has been used in industry for a long time, and only relatively recently has it been codified in the ASME Boiler and Pressure Vessel Code, Section VIII, Division 1 (ASME Code) ^[1] as paragraph UG-140. As part of the recent restructuring of the ASME Code, most of the requirements associated with UG-140 are now located in ASME Section XIII, Part 13 ^[2].

Refiners and chemical companies have been utilizing instrumentation as part of their overpressure protection systems when a PRD is deemed unreliable, impractical, or unsafe. A PRD is typically considered unreliable when the relieving fluid causes fouling or plugging. PRDs may also be deemed impractical or unsafe if an excessive number are required or if their hazardous discharges introduce additional risks, such as increased emissions or other environmental concerns.

Experience shows that not all operators are consistently applying the system design philosophy as intended by the ASME Code, and part of the reason may result from the significant confusion about how it should be applied.

Background on Overpressure Protection by System Design

Recognizing that the industry had been applying a system design philosophy without consistent guidance, concerned industry leaders from ASME and API worked together to establish minimum requirements for applying system design in lieu of PRDs. These rules were initially published in 1996 as Code Case 2211 to the ASME Code, “Pressure Vessels with Overpressure Protection by System Design.”

In the 12 years between the initial publication of CC2211 and the incorporation of UG-140 into the ASME Code in 2008, WRC Bulletin 498 ^[3] was published in 2005 to provide practical guidance on how to consistently apply CC2211 across the industry.

In addition to providing guidance to owner-users on how to apply the Code Case, WRC 498 also provided several recommendations for improvements that the ASME Code should consider when eventual incorporation occurred. First, WRC 498 recommended that the ASME Code allow similar allowable overpressures (accumulations) when traditional PRD overpressure protection is supplied. CC2211 was originally written to ensure that overpressure by system design applications limit the pressure rise under all circumstances to the maximum allowable pressure (MAWP).

Second, WRC 498 recommended that the ASME Code consider both the probability and the consequences (i.e., risk) when assessing potential overpressure scenarios. This is where some of the confusion arises – WRC 498 interpreted CC2211 to require that all potential overpressure scenarios, regardless of the overpressure (consequence), be accompanied by a credibility analysis that uses a definition of credibility as any event that occurs more frequently than 1 x 10^-4 events per year (or 1 event per 10,000 years). For example, as written, then, even if the overpressure were to exceed the MAWP by only 20% (very low consequence), high-integrity instrumentation might be required to reduce the event frequency to the tolerable 1 x 10^-4 events per year. A risk-based approach that includes both likelihood and consequences using a company’s risk matrix might not require additional layers of protection for low-consequence overpressure scenarios.

ASME SECTION XIII, PART 13 (UG-140) REQUIREMENTS

In 2008, the final rules on system design were incorporated into the main body of the ASME Code, Section VIII, Division 1 as paragraph UG-140 and later moved to Section XIII, Part 13 in 2023.

System design as outlined in Section XIII, Part 13 can be accommodated in two ways. Inherent safety, as previously detailed in UG-140 (a), exists in applications where the pressure is self-limiting and there is no way to overpressure the vessel. In this case, PRDs are not required. UG-140 (b) detailed the second case where the pressure rise is not self-limiting and instrumentation in lieu of or in combination with PRDs provides overpressure protection.

In all cases, there are some basic requirements owner-users need to include when implementing system design.

1. The decision to provide a vessel with overpressure protection by system design is the responsibility of the user, not the vessel manufacturer or the design contractor.
2. The user shall request that the manufacturer’s Data Report state that overpressure is provided by system design (if no PRD installed).
3. Jurisdictional approval may be required to implement system design philosophy.
4. A multi-disciplined, experienced team (including Operations) shall conduct a process hazard analysis using a standard methodology (e.g., HAZOP, FMECA, What-If, or equivalent) considering the “Causes of Overpressure” as given in API STD 521 ^[4].
5. The results of this study shall be fully documented and signed by the individual in responsible charge of the management and operation of the vessel.

System Design Using Inherent Safety – ASME XIII 13.2 [previous UG-140(a)]

Per Part 13.2 of ASME XIII, a pressure vessel can be installed without PRDs if the pressure rise is self-limiting and the vessel cannot be overpressured. A classic example of this is a vessel with a blocked outlet that is downstream of a centrifugal pump, where the deadhead of the pump is less than the MAWP of the vessel. If there are no other overpressure scenarios, this vessel could be installed without a PRD.

Of course, an analysis has to be completed by the multi-disciplined team experienced in the methods used (i.e., HAZOP, FMECA, What-if, etc.), and that analysis shall establish that there are no credible overpressure scenarios that could possibly overpressure the vessel above its MAWP. As part of the documentation, the calculated maximum pressure and coincident temperature for each scenario must be determined and compared against the MAWP of the vessel.

System Design Using Instrumentation – ASME XIII 13.3 [previous UG-140(b)]

A pressure vessel may be protected by instrumentation or by a combination of pressure relief devices and instrumentation if the requirements of ASME XIII, Part 13.3 are met.  Typically, instrumentation would be used to eliminate overpressure scenarios, thereby reducing the size of PRDs OR eliminating PRDs altogether.

In addition to the five basic requirements listed above, UG-140(b) includes the following:

1. In no case shall the system design using instrumentation allow normal operation to exceed the MAWP.
2. The overpressure will be readily apparent so that operators or the protective instrumentation will take corrective action.
3. The vessel is not exclusively in steam, air, or hot water service, unless these services are critical to preventing the release of fluids that may result in safety or environmental concerns, equipment damage, or operational upsets.

The analysis to be completed when system design with instrumentation is used is more involved than what is required in UG-140(a). As before, a multi-disciplined team shall identify and examine all credible overpressure scenarios using API 521 guidance for “Causes of Overpressure.” In this case, the analysis must demonstrate that there are no credible scenarios in which the pressure exceeds 116% of the corrected MAWP.

The corrected MAWP accounts for the differences in allowable stresses at the overpressure scenarios’ relieving temperature when compared to the design temperature and can result in a corrected MAWP that is either lower or higher than the MAWP stamped on the vessel nameplate.                       

In addition to the overpressure analysis discussed above, UG-140(b) requires a credibility assessment and points to the WRC 498 bulletin for guidance on how it should be performed. Accordingly, all independent redundancies must be identified, and a reliability analysis (qualitative or quantitative) must be performed on any safety critical instrumentation used to limit the system pressure.

As discussed above, WRC 498 recommended that the ASME Code consider allowing risk-based methods to be used when performing the credibility assessment. In other words, consider the consequences as well as the probability of the overpressure events when setting the acceptance criteria in the credibility assessment and allowing companies to use their own risk tolerance criteria (risk matrix). For high-consequence events (catastrophic), the probability (or credibility) of the overpressure scenario may require a mitigated frequency of 1 x 10^-5 (1/100,000 years). On the other hand, lower-consequence events (e.g., overpressure below hydro) may require a mitigated frequency of only 1 x 10^-3 (1/1000 years) for the scenario to be deemed acceptable.

This is where some of the confusion originates. Some users only use a probability-based approach in their credibility assessments; others will use a risk-based approach. API’s philosophy as discussed in API 521 clearly allows a user’s risk criteria to be used when applying Section XIII, Part 13.

API Approach Using Risk When Applying Section XIII, Part 13.2

System Design Where PRDs Are Impractical

API’s basic philosophy related to instrumentation, as provided in API STD 521, does not normally recommend taking credit for basic process control systems (BPCS) when sizing PRDs. Control valves that are not part of the overpressure event are often designed to react to a process upset, but when sizing a PRD, API assumes that these basic process control valves are either in manual mode or are in a latent state of failure at the time of the upset. However, paragraph 4.2.6 indicates that there will be situations where a relief device is “impractical” and credit for instrumentation becomes a necessity.

“Fail-safe devices, automatic start-up equipment, and other conventional instrumentation should not be a substitute for properly sized PRDs as protection against single jeopardy overpressure scenarios. There can be circumstances, however, where the use of PRDs is impractical and reliance on instrumented safeguards is needed. Where this is the case, if permitted by local regulations, a PRD might not be required.”

The author believes that a key part of the API philosophy is that replacing traditional PRDs with other means of overpressure protection, including instrumentation, is to be done in rare situations. PRDs should only be eliminated when their use is “impractical.” Some examples from API that may pass the “impractical” hurdle include:

• High level on column to prevent overfilling
• High-temperature or plugging services (PRD not suitable)
• Trips on high-pressure turbines
• Explosion prevention to avoid large vents
• Prevent overpressure due to mixing errors (possible explosive conditions)
• Reduction in number and/or size of relief vents
• Eliminate releases to atmosphere
• Chemical reactor runaways

Use of Risk Criteria When Analyzing Credible Scenarios

It is clear that API philosophy allows a user’s risk tolerance criteria to be used when performing the credibility assessment required by API 521, Section XIII, Part 13.2. Annex E provides additional guidance to the user on applying Section XIII, Part 13.3 and emphasizes the use of instrumentation to reduce the probability of an overpressure contingency. It further points to the IEC61511^[5] standard and its supplement, ISA TR84-02^[6], for calculation procedures that meet the Section XIII, Part 13.3 requirement to conduct a reliability or availability analysis for safety instrumented systems (SIS).

Annex E, “High-Integrity Protection Systems (HIPS),” provides general steps in using SIS to protect against a hazard as follows:

1. Perform a Process Hazards Analysis (PHA) to identify hazards. To meet the intent of Section XIII, Part 13.3, this analysis should be conducted by a multi-disciplined team, including Operations.
2. Although IEC 61511 does not specify the type of analysis to use, Annex E suggests that a Layers of Protection Analysis (LOPA) is usually performed as a quantitative analysis to further evaluate high-risk scenarios identified in the PHA.
3. Apply non-SIS protection layers first to eliminate identified hazards or reduce the associated risk.
4. Determine if additional independent layers of protection, such as an SIS, are needed to achieve the tolerable risk.
5. Define the target safety integrity level (SIL) or availability value required for the SIS.  With appropriate level of redundancy, the SIS (or HIPS) can be designed to achieve a level of availability equal to or greater than a mechanical relief device.  

Note that, when using risk-based methods such as LOPA, the user may determine that an SIS with a high SIL is not always needed. For example, one redundant transmitter may be all that is needed to achieve the tolerable risk reduction. Annex E indicates that “In the large majority of cases for HIPS, the result of the hazard analysis is either a SIL-2 system (requiring a minimum of 99 % availability) or a SIL-3 system (requiring a minimum of 99.9 % availability).”

At this point, a word of caution is warranted. There will be many low-consequence (i.e., low-risk) overpressure scenarios that can be designated as meeting the user’s risk tolerance criteria by taking credit for basic safeguards, such as administrative procedures or basic control valves (BPCS). In some cases, the overpressure scenario can be shown to meet the user’s risk criteria without any safeguards at all. Users should not be using Section XIII, Part 13.3 to eliminate PRDs in situations where use of a PRD is the practical solution. Both WRC 498 and API 521 indicate that using Section XIII, Part 13.3 to eliminate PRDs should only be done in rare applications where the use of a PRD is impractical.

Inspection and Testing Requirements for SIS

The user is responsible for developing and implementing the necessary documented procedures and methods to ensure adequate reliability of the identified safety critical elements. Per Annex E of API 521:

“It is critical that the instrumentation associated with HIPS be tested at regular intervals. The availability analysis assumes a test interval for each piece of equipment. In order for the actual HIPS reliability to align with that predicted by the availability calculations, it is necessary that the actual testing frequency (during operation) corresponds to the assumed in the availability calculations performed during the design.”

Annex E also cautions that the user needs to consider the impact of the required proof testing on the facility receiving the SIS, and whether the facility has the skills and resources to maintain the equipment. The risk reduction credited to the SIS is achieved when the system is operated and maintained as per the safety requirement specification.  If the operation and maintenance requirements cannot be met, an alternative SIS design should be considered. 

CONCLUSION

Going forward, the use of certified PRDs will continue to be the standard means of overpressure protection. In rare cases where a PRD is impractical, the use of instrumented system design in lieu of PRDs will be necessary. Each installation where system design philosophy has been applied should be audited to ensure the requirements of Section XIII, Part 13 are met. Some of the questions that the user should be asking include:

1. Has permission from the jurisdiction to use system design been obtained?
2. Does the installation using a system design approach pass the “impractical” hurdle? Instrumentation should not be used in lieu of a PRD when the installation of a traditional PRD is reasonable.
3. Where inherent safety has been established, has a disciplined team been involved in analyzing potential overpressure scenarios in accordance with API 521, and has it been established that there are no credible overpressure scenarios that could possibly overpressure a vessel above its corrected MAWP?
4. Where instrumentation is used as a replacement for PRDs or in combination with PRDs, has a multi-disciplined team been involved in analyzing potential overpressure scenarios in accordance with API 521, and has it been established that there are no credible overpressure scenarios that could possibly overpressure the vessel above it corrected MAWP by more than 116%?
5. Additionally, has a credibility assessment been completed by qualified individuals to demonstrate that the probability (or credibility) of any overpressure event meets the corporation’s risk criteria?
6. Where SIS has been used as part of the system design to eliminate or reduce the size of PRDs, has a reliability (or availability) analysis been completed as per IEC 61511?
7. Have the results of the system design studies been documented and signed by the individual in charge of the management and operation of the vessel?
8. For safety critical equipment, have test intervals and test protocols been established so that the required reliability (or required SIL) as determined from the reliability analysis is maintained?

System design using an instrumented approach will likely be more expensive than standard PRD protection, so typically these solutions will only be applied when the PRD installation is impractical or unreliable. The initial cost of the SIS as well as the testing and inspection requirements to maintain reliability can be expensive, making routine usage of a system design approach infrequent. 

Although PRDs will continue to be the overpressure protection of choice, the use of instrumentation in lieu of or in combination with PRDs will increase as users become more comfortable with the process.  The application of the system design philosophy as codified in ASME Section XIII, Part 13 and as supplemented by API 521 Annex E will ultimately reduce risk and improve safety and profitability as risk and instrumentation become an integral part of relief system design.

REFERENCES

[1] ASME Boiler & Pressure Vessel Code: Section VIII, Rules for the Construction of Pressure Vessels, American Society of Mechanical Engineers, Two Park Avenue, New York, New York 10016-5990.

[2] ASME Boiler & Pressure Vessel Code: Section XIII, Rules for Overpressure Protection, American Society of Mechanical Engineers, Two Park Avenue, New York, New York 10016-5990.

[3] J. R. Sims and W. G. Yeich, Welding Research Council, Bulletin 498, Guidance on the Application of Code Case 2211 – Overpressure Protection by Systems Design, January 2005.

[4] API Standard 521, Pressure-Relieving and Depressuring Systems, American Petroleum Institute, 7th ed., 2020.

[5] IEC 61511-1:2016, Functional safety – Safety instrumented systems for the process industry sector – Part 1: Framework, definitions, system, hardware and application programming requirements.

[6] ISA-TR84.00.04-2011, Part 1 Guideline for the Implementation of ANSI/ISA-84.00.01-2004 (IEC 61511).

Please submit the form below with any questions for the author: