Chapter 9 — Pressure design, relief and depressurization

Start with what can pressurize the system

Pressure design and protection must cover the same source connections and isolated volumes in each relevant configuration.

The starting point is the pressure sources and the paths between them. Sources include wells, pumps and compressors, controlled vessels, connected high-pressure systems, elevation head, heating of retained fluid and process changes. Operating, blocked-in, startup, shutdown, test and emergency-isolation states can connect or separate these sources differently. A line number identifies information. It does not prove that every volume with that identity remains connected to one protective device.

For each state, establish fluid and phase, pressure-generating equipment, valve lineup, inventories and heat sources, and receiving paths.

A centrifugal pump’s discharge pressure depends on its selected curve, speed or impeller, suction pressure and fluid conditions. A blocked discharge can expose the connected piping to shutoff pressure. Continued blocked operation can add heating or phase-change effects that a cold deadhead calculation does not describe. A positive-displacement source requires a different evaluation. Stopping downstream flow does not establish a benign source limit.

High pressure can also arrive from another system. A failed control element or an exchanger tube failure can connect a lower-pressure boundary to a stronger source. A check valve can affect reverse flow and isolate a pressure-relief route. Any credit for its operation belongs to the adopted scenario and reliability basis. The physical presence of a check valve does not prove that every reverse-flow or trapped-pressure condition is prevented.

Maximum pressure need not occur at the inlet. In a liquid pipeline descending from an elevated source, hydrostatic head can increase downstream pressure while friction decreases it. The governing location can change with flow and density. The complete operating range must be examined, including low or zero flow where relevant. The engineering basis supplies the service and system boundaries. Rotating equipment and Other equipment develop the source behavior.

Keep pressure quantities attached to their conditions

Operating pressure describes a defined operating condition or range. Maximum operating pressure is the greatest pressure under the adopted operating basis. It may differ along the system. An upset case evaluates a specified departure or failure configuration. Design pressure is an input to the containment design at its associated temperature.

A component’s pressure-temperature rating and an equipment maximum allowable working pressure describe permitted capability under their respective bases. Relief set pressure describes an activation setting. The pressure required to pass the full relieving rate can be higher.

These quantities are related but are not interchangeable. A pressure margin chosen to avoid nuisance relief does not increase the component’s allowable pressure. A high flange rating does not prove that calculated pipe wall, gasket, valve trim or connected equipment has the same capability. A test pressure belongs to a temporary boundary and test condition. It does not establish a new operating rating. Materials and classes and Pressure testing and readiness carry those distinctions into selection and proof.

Pressure and temperature must be paired by credible state. The highest operating pressure may occur at a lower temperature than the highest operating temperature. Both combinations matter. One unrelated maximum cannot be assumed to describe every case. Depressurization can produce a cold condition whose material and component suitability differs from normal operation. Metal temperature can differ from bulk fluid temperature, particularly during transient exposure.

The pressure reference must be stated. Gauge pressure is measured relative to the stated surrounding pressure. Absolute pressure is measured from vacuum. Their relationship is $P_{abs}=P_g+P_{atm}$ when the gauge reference is the local atmosphere.

Gas-property and phase calculations need the pressure basis required by their method.

Internal pressure containment and external-pressure stability are separate evaluations. A cooled or drained isolated volume can experience vacuum. A jacket test can pressurize the outside of a core pipe. Wall adequate for one internal-pressure calculation does not establish resistance to collapse. Jacketed assemblies and Nonmetallic collapse behavior explain examples of that distinction.

Straight-pipe wall calculation and limits

The following historical ASME B31.3 (1984) procedure evaluates straight-pipe pressure wall. It does not claim compliance with a current edition. Its factors and limits must not be transferred to a pipeline method or another material system. It evaluates pressure wall for its stated internal-pressure case. Other mechanical and stability evaluations remain necessary.

The method uses the following equations:

In these equations, $P$ is internal design gauge pressure for an atmospheric exterior, and $D_o$ is pipe outside diameter. $t_p$ is pressure design thickness. $S$ is the basic allowable stress at the relevant temperature. $E$ is the product quality factor, and $Y$ is the method’s material/temperature coefficient.

$c$ includes the applicable mechanical and corrosion/erosion allowances. $t_m$ is the required minimum wall before selecting nominal wall. $E$ and $Y$ are dimensionless.

For consistent units:

• Use the same pressure units for $P$ and $S$.
• Use the same length units for $D_o$, $t_p$, $t_m$ and $c$.

The historical method is bounded by $t_p<D_o/6$. Its stated carbon-steel example uses $Y=0.4$ at temperatures of 900°F and below. Other materials and temperatures require their own coefficient basis. That coefficient’s range does not permit every carbon-steel component to be used up to that temperature. Metallurgy, damage, class and component ratings impose separate limits. $E$ is tied to the manufacturing/product and examination basis; it is not a discretionary factor to improve the result.

Allowance and tolerance then complete the wall selection. If the product permits fractional negative wall tolerance $u$, the nominal wall must satisfy the following inequality:

Wall allowance accounting explains the mechanical, damage and manufacturing provisions. These provisions cannot be omitted simply because a commercial schedule is readily available.

Apply any governing minimum structural wall, then select an available product and verify its interfaces.

This pressure-wall procedure alone does not establish capacity for external pressure, unusual bending or thrust, branch loads, thermal displacement or fatigue.

Pipeline factors and component ratings follow different routes

Similar pressure formulas do not have interchangeable factors. The historical liquid-pipeline comparison uses $t_p=PD_o/(2S_{pipe})$. That pipeline method’s material and design-factor basis establishes the allowable quantity $S_{pipe}$. Gas-pipeline methods use yield-strength, location/design, joint and temperature factors with their own definitions. The process-piping $S$ and $E$ above cannot simply be inserted into those expressions. Pipeline and offshore interfaces establishes the system/code boundary.

This distinction can change the calculated rating of the same dimensional pipe. A pipeline factor applied to specified minimum yield strength and a process-piping allowable stress at temperature represent different criteria. A favorable numerical result from the wrong route does not establish additional capacity. A historical comparison must retain the applicable product, construction, temperature and location conditions. An application must use the adopted governing edition.

Flanges and valves commonly use pressure-temperature rating tables by standard, material group and class. Those tables provide a separate evaluation from pipe wall.

Use the actual material and temperature row to verify required pressure and component-specific limits.

Gasket, bolting, trim and proprietary connector conditions can impose narrower capability than the body designation suggests. A class designation is not a pressure expressed in psi or MPa.

A class built around a full flange envelope differs from a line with approved wall calculated for narrower actual conditions. Changes therefore have different consequences for the two cases. Raising the operating pressure toward the flange rating can invalidate the latter’s pipe-wall basis. Spare rating is a component characteristic. It is not an unexamined reserve for the whole installation.

Evaluate the cause before selecting the protection

A relieving case identifies the source, protected volume and rate or transient that the protection must handle. Blocked flow, failed control, heat input, fire, tube failure, composition change and loss of fluid removal can govern differently. Cases should preserve how failures affect adjacent equipment and whether common utilities or controls create common-mode loads. An adopted single-event criterion is a scenario-selection rule. It does not erase dependent consequences of that event.

A blocked-in liquid can expand as its temperature rises. The fluid’s limited compressibility and the boundary’s compliance determine the pressure response. A small discharge may relieve thermal expansion. This does not establish capacity for continued inflow from a pump or a high-pressure source. Conversely, a relief device sized for a large inflow still needs a suitable setpoint and flow path for the volume that can become isolated.

A fire case can heat inventory and weaken a boundary. Containment and protection therefore need the relevant material/temperature and inventory basis. Loss of cooling or continued reaction can produce other rate and phase conditions. An exchanger failure can connect a high-pressure side to a lower-pressure side. Equal design pressures can remove a particular pressure-transfer contingency. They do not remove every heat-input, blocked-in or fire case.

The table identifies the questions that distinguish these evaluations. It assigns no design pressures or universal relief rates.

Table 9.1. Pressure causes, demands and protection choices.

Conditions for source sufficiency, relief and instrumented isolation

Designing the boundary for the maximum credible source pressure can remove the need for a particular overpressure device. This requires the full scenario basis to demonstrate that overpressure cannot occur. A selected centrifugal pump with a bounded maximum head may offer this route for a suitable system. The review must include suction pressure, the permitted pump configuration and the other pressure sources. Changing impeller, speed, source connection or valve arrangement can invalidate the argument.

Inherent containment sufficiency and reliance on active protection have different operation and maintenance demands. A pipeline procedure may favor source/design matching where its additional whole-life cost is minor. A process procedure may restrict protection by mechanical design to particular acceptable systems where mechanical relief is infeasible. Those adopted restrictions must remain with the selection. The engineering advantage of fewer protective devices does not grant an exception to a governing requirement.

Mechanical relief releases fluid at a rate sufficient to keep the protected condition within its permitted limit. Spring-loaded, balanced-bellows, pilot-operated and other relief arrangements have different backpressure and operating characteristics. The device, inlet, outlet and receiving system act together.

A rupture disc provides a different one-shot response. After rupture, it requires replacement and can leave the inventory communicating with the discharge system. Where frequent surge is expected, that consequence can make the disc an unsuitable substitute. Its capacity and upstream/downstream arrangement remain part of the design.

Instrumented pressure protection detects a condition and closes an isolation path before unacceptable pressure develops. Its integrity depends on sensing, response, final elements, independence and maintained reliability, under the permitted code and regulatory basis. It can be useful where discharge is impractical or would exceed receiving capacity. Ordinary operating pressure control does not automatically provide that protective function.

Instrumentation, measurement and control develops the sensing and control interfaces. The pressure evaluation must establish the required protective demand and response. Operating functional integrity carries verification that the complete required protective function remains effective in the actual operating boundary.

A shared relief device can protect interconnected equipment only under two conditions. Every protected part must have a suitable communicating path, and the device must handle the required combined demand. A control or shutdown valve, filter, check valve or isolation arrangement can interrupt that path. Equal design pressure alone is not sufficient. The review must cover actual configurations in which the device may be unavailable or the volume separated, including maintenance.

Set pressure and full-rate discharge belong to one system

Set pressure, pressure accumulation needed for capacity, reseating behavior, operating control and alarm settings form a coordinated pressure basis. Adequate separation between operating fluctuations and protective activation can reduce nuisance cycling and damage to seals. That separation must also leave full-rate protection within the applicable allowable condition. A percentage margin from one project cannot establish this relationship for every fluid, equipment type or governing standard.

Pressure loss between the protected volume and relief inlet affects the operating condition, as does backpressure in the discharge system. Superimposed backpressure exists in the receiving system before this device discharges. Built-up backpressure arises as discharge flows through it. Device selection and capacity corrections need those conditions, the relieving fluid and phase. Sizing a line only by the relief outlet’s nominal connection does not establish hydraulic performance or mechanical adequacy.

Disposal is part of protection. Flammable or toxic streams can require a closed collection system, liquid separation and flare or another specified destination. A harmless compressed-air discharge and a nitrogen discharge have different personnel hazards. An otherwise safe pressure release can create an asphyxiation or reaction-force exposure. Relief liquids returned to a tank must be compatible with its inventory, capacity and pressure condition. Atmospheric discharge demands its own exposure, noise and dispersion evaluation.

Collection capacity must address the cases that act together. A common utility failure or emergency depressurization can impose several loads at once. Simply selecting the largest individual valve is insufficient. Staging can change peak load and backpressure, but also the time required to depressurize each system.

The evaluation also needs inlet/outlet drainage, condensate or liquid collection, tracing where required, reaction loads, supports and maintenance access. Mechanical analysis and Support selection develop the associated load paths.

Surge and thermal pressure call for their own response

Rapid changes in fluid velocity produce transient pressure changes. Valve closure, pump startup or shutdown and source isolation can therefore govern a condition that a steady-flow calculation misses. The transient must be estimated early enough to influence piping capability, valve actuation and receiving arrangements. Control of the rate of velocity change, sufficient containment margin and suitably located surge-relief or gas-cushioned arrangements address different parts of the event.

A slower closure can reduce surge in an appropriate system. However, closure speed cannot be changed independently of an emergency protective duty. An adopted pipeline procedure specifically separates instrumented protective shutoff from surge-control operation. A surge receiver also has to be available to accept the released fluid when demanded. A nominal tank connection does not establish readiness. Operating procedures should reduce avoidable surge even where protection is installed.

Thermal relief responds to heating of a trapped inventory. Isolation valves, check valves, equipment and temporary boundaries can create pockets that need identification. The release route must reach the retained fluid and lead to a suitable destination. Under the adopted basis, coordinating thermal protection settings with the main protective system can avoid unwanted activation of larger equipment. Avoiding unnecessary block-in and heating remains useful operating practice. A thermal valve is not a reason to ignore the condition.

Depressurization is a transition of an isolated inventory

Relief controls a specified overpressure demand. Emergency depressurization reduces the pressure and inventory of an isolated system for a defined incident duty. These functions can discharge to the same collection system while needing different sizing, initiation and operating assumptions.

The depressurization basis needs the segment that becomes isolated, its contents and pressure-temperature condition, and every communicating volume within it. Check valves can retain pressure on one side after another volume is blown down. The blowdown route must address the intended isolated segment, with the isolation and initiation sequence coordinated. The diagram illustrates two distinct discharge paths. It does not specify a universal arrangement or valve action.

Figure 9.1. Conceptual arrangement of one pressure source and a protected inventory. A relief path serves the connected protected boundary. A separately initiated blowdown path depressurizes the defined isolated inventory. Required capacities, valve actions, timings and receiving-system arrangement are unspecified.

Pressure reduction can cool the fluid and metal and generate vapor from retained liquid. It can produce hydrate concerns, high velocity, erosion, noise and reaction forces. A blowdown valve and downstream piping must serve those changing conditions. A restriction or diffuser can control some effects but changes the achievable rate and pressure distribution. Material suitability must include the minimum relevant temperature. Material selection cannot remain tied solely to the hot operating state.

The required depressurization time and final pressure belong to the project incident and equipment basis. A particular philosophy can specify a target such as 100 psig or half design pressure, whichever is lower, within 15 minutes. That is a conditional project criterion, not a universal survivability result. The actual transient, material temperatures, equipment limits and flare duty must be evaluated against the chosen requirement.

A compressor or other sensitive equipment may impose a maximum rate of pressure reduction. If the incident target and equipment limit conflict, substantiated equipment mitigation or a smaller isolated segment needs investigation before a slower result is accepted. Moving or adding isolation close to the sensitive equipment can reduce the volume subject to its rate restriction. This changes system architecture, operation and maintenance. It therefore requires more than adjusting a blowdown orifice.

Facility blowdown can create backpressure that prevents safe discharge of low-pressure systems or causes backflow. Staged blowdown and segregated receiving arrangements can address that interaction. They have their own timing and capacity consequences. High- and low-pressure collection should reflect the evaluated loads, rather than merely the names of the connected systems.

Blowing down vapor does not necessarily remove liquid. A philosophy may leave liquid contained while handling vapor evolved from it and the fire case. Another duty may require separate liquid deinventory. The basis must state which is intended. “Depressurized” does not prove that a system is empty, chemically clean or ready to open. Operation and Intervention develop those subsequent conditions.

Shutdown commands and actual inventory state

Equipment shutdown, isolation and blowdown are distinct demanded actions. Their physical result depends on valve closure and communicating paths; shutdown can leave pressurized inventory.

One adopted project philosophy illustrates the distinction. Its operator emergency-shutdown command demands isolation and shutdown but does not automatically initiate blowdown. The operator has a separate means to request blowdown of the affected areas. Confirmed fire or gas initiates emergency shutdown and automatic blowdown under that philosophy. These event/action relationships belong to a selected basis. They are not competing universal definitions of emergency shutdown.

The same basis distinguishes process shutdown from total-plant shutdown. Process shutdown retains utilities and electrical generation while stopping the process. Neither that command nor the total-plant command automatically initiates blowdown.

In this adopted basis, total-plant shutdown normally demands stopping process systems, utilities and power generation, subject to specified essential-equipment exceptions. Essential emergency equipment can also remain energized under its specified exceptions. Examples include firewater or water-mist pumps, standby generation and instrument air. The word “total” cannot substitute for the actual list of required and retained functions. The defined incident state must establish which consumers, energy sources and supplies must stop or remain available.

Coordinate these actions with the segment actually isolated, retained pockets, the blowdown route, receiving-system capacity and surviving utilities. Confirm the required pressure endpoint and any required liquid removal before relying on the resulting state. These event/action relationships do not prescribe another plant’s sequence, valve fail position or reset permission. Sensing and protective action develops the protective logic; functional integrity covers verification in the actual boundary.

Atmospheric tanks need pressure and vacuum paths

A low-pressure tank can be damaged by filling, withdrawal or heat when its breathing path is inadequate. Inflow displaces vapor. Outflow requires replacement gas or a vacuum-protection path. A blanketing and vapor-recovery system therefore interacts with the maximum filling and withdrawal duties. A permanently open vent used for one nonhazardous service differs from the closed arrangement of a hazardous inventory.

Pressure relief, vacuum breaking and emergency venting have different initiating conditions. A normal breathing path does not automatically establish fire vent capacity. A relief-only device does not establish vacuum protection. The receiving destination, overflow possibility, blanketing supply and maintenance isolation must be considered with the tank type. Storage develops the containment and equipment account. This chapter preserves the pressure-protection interface.

Keep the protective basis alive through test, operation and change

The protection record needs the cases, source capabilities, communicating boundaries, device settings/capacity basis and receiving-system assumptions. Testing a relief device confirms selected device properties. It does not establish that the installed inlet/outlet path is unobstructed or that every intended volume remains connected. Inspection, proof testing and replacement need the actual component identity and service history. Statutory or adopted intervals remain applicable requirements.

Maintenance isolation can remove a relief route. Temporary test blinds or closed valves can create a new pocket. Before introducing pressure, establish what protects the resulting configuration. Reinstatement must restore intended communication and remove temporary restrictions under the readiness procedure. The pressure chain runs from defined conditions through this chapter’s containment/protection decisions to verified test and restoration.

Change can reopen the original protection choice. A larger impeller, higher source pressure, new upstream connection, altered control response, replaced valve, hotter cleaning method or larger isolated volume changes the cases or capacity. Before relying on the old setting, reevaluate the affected boundary and neighboring receiving system. The useful record explains why the protection works in its defined states. A future change can then identify what has ceased to be true.