RECOMMENDED PRACTICE FOR

THE RISK-BASED INSPECTION

(RBI) OF RELIEF VALVES

STANDARD DATA PAGE

REPORT NO. ESR.97.ER.089

SECURITY
CLASSIFICATION:
UNRESTRICTED

ISSUE DATA: OCTOBER 1997

MAIN TITLE: Recommended Practice for the Risk-based Inspection (RBI) of Relief Valves.

CLIENT:

Multi Business

PRINCIPAL RECIPIENT(S):

J Rigden

COMMISSIONED BY:

Production Facilities, MTL, BPX

ISSUING DEPARTMENT/DIVISIONS:
MATERIALS & INSPECTION ENGINEERING
RESEARCH & ENGINEERING CENTRE
BP INTERNATIONAL LIMITED
PREPARED BY:

APPROVED BY:

..................................................
David Ray

Edwin Smith

..................................................
DAVID RAY
Team Leader
MATERIALS & INSPECTION

ABSTRACT:

DISTRIBUTION:

SEE SEPARATE LIST

KEYWORDS:

Copyright BP International Limited 1997

All rights reserved. None of the information contained in this document shall be disclosed outside the recipients own company and
no part of this document may be reproduced or transmitted in any way or stored in any retrieval system without prior written
permission of General Management, Engineering Shared Service, BP International Limited.

RECOMMENDED PRACTICE FOR THE RISK-BASED INSPECTION (RBI)

OF RELIEF VALVES

1. INTRODUCTION
Relief valves in BP have traditionally been inspected and endorsed using the guidelines in the BP
Inspection BPs, 32-3 and 32-4. Although these RPs encourage a risk-based approach to be adopted,
no RBI models have been provided to date. Relief valves are considered to be particularly suitable
equipment items for RBI because their criticality in major installations can be expected to vary from
the profound to the relatively trivial, and the numbers of valves is usually large, many hundreds or
even thousands.
The concept of risk-based inspection (RBI) of relief valves was first considered in detail by BP Relief
Valve Working Group, a multi-business team of relief valve experts and users. The Working Groups
report, ESR.96.ER.059 dated 8th July 1996, included a draft methodology for the endorsement of relief
valves using essentially qualitative RBI principles.
After the publication of this report, numerous Assets in all 3 BP Businesses tested the methodology
and, in general, reported it to be workable and beneficial. The main benefits were seen to be:
a clearer identification of high criticality valves
extended endorsements for significant numbers of low criticality valves
an increased understanding of the design intent of valves by inspectors.
Comments from the Assets about the methodology have been reviewed by members of the original
Working Group, and have been incorporated into this Recommended Practice, where appropriate.

2. SCOPE
This Recommended Practice is applicable to all spring loaded relief valves of conventional and pilotoperated design, capable of having their set-point verified by testing. Other over-and-under pressure
protection devices such as bursting discs, buckling pins, vacuum breakers, pressure-vacuum valves
and anti-surge valves are outside the scope.
In the context of this Recommended Practice no distinction is made between relief valves, safety relief
valves, pressure relief valves and pressure safety valves as defined in API RP 520.
The RP is applicable to all types of process plant installations, whether onshore or offshore, and for all
duties. Both new and used valves are within its scope.
Relief valves protecting installations such as a transmission pipelines and pressurised storage tanks,
which represent major investments protected by relatively few valves, are outside its scope. The risks
associated with these valves are considered to be best assessed on individual basis using a
methodology which models the consequences of failure-to-operate-on-demand in a more rigorous
way.

3. OBJECTIVE
The objective of the RP is to provide a methodology for the relatively fast and qualitative risk
assessment of large relief valve populations in order that inspection and maintenance resources can be
allocated in the most cost effective way. The RP is a risk management tool which has been designed
to provide a higher level of analysis than that required by the existing BP Inspection Code, RP 32-3.

4. METHODOLOGY
The methodology is based on the analysis of two failure scenarios:
failure to open, fully or partially, on demand
leakage across the seat in service
It requires individual assessments of the probability and consequences of these failure scenarios for
each valve in the population. The outpost of these two assessments are combined in a risk matrix,
which provides recommendations for maximum valve endorsement periods.
A more rigorous analysis would take account of the likely or historical demand rate on each valve.
However, there does not appear to be an easy way to do this at the moment. Differences in site
operations would make it difficult to develop or use a generic database for demand rate, and few sites
keep records of relief valves lifting in service. Nevertheless, some account should be taken of the
increased risks associated with valves which are known or expected to lift in service, and the
guidance notes to the endorsement matrix in Figure 3 attempt to do this.
Note also that failure to reseat at the specified pressure is not considered in this RP and, in most
cases does not represent a hazard, there will be some applications where achieving the correct
blowdown is important. Examples are steam boiler safety valves and relief valves in hazardous duties
which relive to atmosphere. Such valves should be assigned a high consequence of failure rating
(figure 2), and any historical reseating problems should be taken into account when allocating the
probability of failure rating (Figure 1).
Although the methodology is thought to be workable for most sites in the form presented in this RP,
sites may wish to tailor some aspects in order to suit their local requirements and conditions.

4.1 Probability of valves failing to operate on demand or leak in service.

This part of the assessment relies on historical reliability data, in particular the results of pre-pop
testing and visual inspections of the valves and associated piping after previous periods of service.
This part should be fairly easy to complete by inspectors working from inspection and maintenance
records.
Figure 1 shows the methodology, the output of which is a low, medium, or high probability
ranking.
Where historical data on the valve in question is not available, for example in the case of a new
installation or application, it may be possible to utilise data from the BP RV database, maintained by
the Reliability Group in GRE, Sunbury.
For the purpose of this part of the assessment a clear understanding of the term defaulter is
required. The normal recommended definition is that proposed by the Relief Valve Working Group,
i.e. a valve which fails to lift to its required opening at a pressure less than or equal to 110% of the
cold set pressure. Valves which lift light on the pre-pop test should not normally be considered to be
defaulters except where a hazardous situation would arise by their lifting light in service.
4.2 Consequences of valves failing to operate on demand or leak in service.
This part of the assessment attempts to rank the consequences of valve failures, as defined above, in
terms of HSE. The process is shown in Figure 2, the logic of which is described below. Assessment
of the consequences of failure will usually require specialist process engineering input, particularly
with regards to the original design basis for the valve in question, the likely extent of overpressure in
the case of failure to lift on demand, and the flammability and toxicity of the process stream.

It may be necessary to call on other specialist knowledge regarding the condition of the equipment
being protected and the likely effects of overpressure. Appendices A and B provide information on
typical causes and consequences of overpressure of equipment, and may therefore prove useful in
carrying out this part of the assessment.

4.2.1 Notes to Figure 2

1. Pressure-vacuum valves on atmospheric storage tanks and relief valves protecting transmission
pipelines are outside the scope of this RP and should be considered separately. Relief valves on
pressurised storage tanks in non-hazardous duty should also be considered separately.
2. Any loss of containment is likely to have more serious consequences inside a process plant (inside
battery limit) or on an offshore platform.
3. Hazardous fluid service - a fluid service which includes the following services and any other
specified by the site concerned:
(i) Liquids above their auto-ignition temperature (AIT), or 210oC if the AIT is not known.

FIGURE 1: PROBABILITY OF RELIEF VALVES FAILING TO

OPERATE ON DEMAND OR LEAK IN SERVICE

NO

IS THE VALVE IN A CLEAN,

NON-CORROSIVE, NONCYCLIC DUTY?

NEW APPLICATION OR VALVE

RELIEF VALVE?
NO

YES

YES
YES

DID THE VALVE DEFAULT AT

THE LAST INSPECTION?

YES

NO

WERE ALL THE VALVE PARTS

IN THE EXPECTED
CONDITION, GIVEN THE
SERVICE HISTORY OF THE
VALVE?

DID THE VALVE DEFAULT

AT THE LAST INSPECTION?

NO

WAS THE PROBLEM

IDENTIFIED AND
DESIGNED OUT FOR
THE FUTURE?
YES

YES

NO
NO

HAS THERE BEEN ANY

HISTORY OF IN-SERVICE
INTERNAL LEAKAGE OR
FOULING?

LOW

IS THERE SITE OR BP DATA OF VALVES OF

THE SAME DESIGN, DUTY, MANUFACTURE,
MATERIALS AND OF SIMILAR SIZE WHICH
INDICATES SATISFACTORY PERFORMANCE
AND HAS THE VALVE PASSED A PRE-SERVICE
TEST?

NO

YES

NO

START HERE

DID THE VALVE DEFAULT AT ITS PREVIOUS

ONE OR TWO INSPECTIONS?
YES

YES

MEDIUM

HIGH

NO

FIGURE 2: CONSEQUENCES OF FAILURE OF RELIEF VALVES

TO OPERATE ON DEMAND OR PASS (LEAK) IN SERVICE
START HERE
IS THE VALVE IN HAZARDOUS DUTY?
(3)
IS THE VALVE PROTECTING A
TRANSMISSION PIPELINE OR AN
ATMOSPHERIC STORAGE TANK? - OR IS THE
VALVE PROTECTING AGAINST VACUUM?
(1)

IS THE VALVE IN STEAM

GENERATOR/FIRED BOILER
DUTY?

NO
YES

YES
YES
DOES THE VALVE RELIEVE TO ATMOSPHERE? (5)

NO

YES

NO
NO
IS THE VALVE LOCATED WITHIN A PROCESS
AREA OR OFFSHORE?
(2)

IS THERE ANY REASON TO SUSPECT THAT THE

EQUIPMENT MIGHT NOT BEHAVE IN A DUCTILE
MANNER IF SUBJECT TO OVERPRESSURE?
(6)

YES

NO

YES

NO
YES
YES

DOES THE EQUIPMENT BEING PROTECTED INCLUDE

PROPRIETARY EXPANSION DEVICES, BELLOWS, COUPLINGS,
SPECIAL SEALS ETC?
(7)

IS THE VALVE IN HAZARDOUS DUTY?

(3)

SPECIAL ANALYSIS
REQUIRED

NO
YES
NO

IS THE VALVE PROTECTING A PRESSURISED

STORAGE TANK?

NO
YES

NO

NO
YES

NO

ARE THERE ANY SERIOUS

CONSEQUENCES FOR PLANT
ELSEWHERE IN THE SYSTEM?

YES

WOULD SEAT LEAKAGE IN SERVICE

INEVITABLY RESULT IN AN UNACCEPTABLE
OPERATIONAL OR ENVIRONMENTAL
INCIDENT?
(4)

NO

IS THE EQUIPMENT BEING

PROTECTED KNOWN TO BE IN
GOOD CONDITION AND LIKELY
TO REMAIN SO?

COULD THE DEMAND CASE RESULT IN INTERNAL PRESSURES EXCEEDING

THE TEMPERATURE-CORRECTED HYDROSTATIC TEST PRESSURE OF THE
LOWEST RATED PROTECTED EQUIPMENT?
(12)

YES
IS THE EQUIPMENT BEING
PROTECTED OF CONVENTIONAL
FLANGED AND VALVED DESIGN,
AND COULD A MINOR LOSS OF
CONTAINMENT BE TOLERATED?
(13)

R/V DESIGN CASE

PIPING
THERMAL
RELIEF
(8)

EXTERNAL FIRE, SHUT-IN,

HP-LP
UTILITY FAILURE, H/E TUBE
INTERFACE
RUPTURE, EQUIPMENT THERMAL PROTECTION
RELIEF
(10)
(9)

OTHER
(11)

NO
YES
WOULD SEAT LEAKAGE IN SERVICE INEVITABLY RESULT
IN AN UNACCEPTABLE OPERATIONAL OR
ENVIRONMENTAL INCIDENT?
(4)

YES

NO

LOW

MEDIUM

HIGH

(ii)

Flammable liquids flashing on leakage to form a substantial vapour cloud. This shall include LPG, LNG
and NGL condensate and others when specified by site.

(iii)

Fluids liable to cause a hazard by blockage due to hydrate formation or solids deposition.

(iv)

Fluids in which the potential for personnel exposure is judged to be significant and in which a single
exposure to a very small quantity of a toxic fluid, caused by leakage, can produce serious irreversible
harm to persons on breathing or bodily contact, even when prompt restorative measures are taken.
Fluids in this category include substances classified in terms of occupational health risks as Very Toxic,
Toxic and Corrosive Components of process streams which are known to cause serious irreversible harm
include for example hydrogen sulphide (asphyxiant), hydrofluoric acid (corrosive) and sodium hydroxide
(corrosive).
Classification of fluids into this category should take into account both the health hazard of the
individual component of the fluid and the concentration of these components within the process stream
in question.

(v)

Hydrogen service defined as service in contact with hydrogen or gaseous mixtures containing hydrogen
in which the partial pressure or hydrogen is 5 bar (abs), (72.5 psig) or more.

(vi)

Flammable fluids at class 900 flange rating and above.

4.

Seat leakage may or may not be tolerable, dependent on operational and environmental consequences, ability to
isolate and repair, and size of leak. Major leakage should not be considered here.

5.

Valves in hazardous duty which relieve to atmosphere should not suffer seat leakage.

6.

The ductile behaviour of materials when subjected to overpressure cannot necessarily be guaranteed if the
normal operating temperature is below the hydrostatic test temperature. Other embrittling mechanisms may be
operative e.g. creep, hydrogen charging, stress corrosion cracking.

7.

These proprietary devices are likely to be less robust than vessels, piping, etc. designed and constructed to the
usual Codes.

8.

Thermal relief valves for piping (not pipelines) are usually only required to relieve small volumes. In liquid
filled systems much of the effect of overpressure will normally be absorbed by strain in the piping system. In
gas/vapour systems overpressure will also be absorbed by compressibility of the fluids. In both cases pressure
rises are likely to be modest and self-limiting. This is recognised by ANSI B31.3 piping code which allows
overpressures of 33% in the thermal relief case (para. 301.2.2). In practice, at least some relief is also normally
available via leakage past valve seats, valve glands and at flanged joints. See also BP RP 44-1 para. 4.10.1.

9.

This group accounts for most valves in hazardous duty. The allocation of "medium" consequence rating and its
maximum maintenance interval of five years (Figure 3) effectively means that these valves continue to be
treated in line with RP 32-3 and so a more rigorous analysis is not thought to be necessary for the purposes of
this risk ranking exercise.

10.

These valves are clearly associated with the avoidance of catastrophic overpressurisation of an LP system from
HP system breakthrough.

11.

Other design cases might include uncontrolled reactions, mechanical failures (e.g. non-return valves, control
valves, heat removal pumps, fans), hydraulic pressure surges.

12.

The logic here is a generalisation of (a) the "two-thirds" rule which applies to heat exchanger design, as
explained in RP 44-1 (para. 5.2.2.1) and API RP 521, and (b) the requirements for relief provision in the event
on non-return valve failure (API 521 para 2.3.4.)

13

Loss of containment within battery limits or offshore of any volume of LNG or LPG, for example, is usually
considered unacceptable. Individual sites may wish to add other duties e.g. hydrofluoric acid due to its extreme
toxicity.

-4.3 Allocation of Endorsement Periods

The output of the analyses from figures 1 and 2 should be combined using Figure 3, which provides guidance on
maximum endorsement intervals for all the various combinations of probability and consequence of failure (i.e. risks).

Consequence of Failure
Probability
of
Failure

HIGH
MED
LOW

HIGH
24
36
48 (2),(3)

MED
36
48
60

LOW
60 (3)
72
96

Figure 3. Risk Matrix for Relief Valve Endorsements ( months ).

4.3.1. Notes to Figure 3

1.

All "high and medium consequence" endorsements are within the existing guidelines in RP 32-3.

2.

For "high consequence" valves the maximum recommended endorsement is reduced to 48 months form the
60 months in RP 32-3.

3.

Endorsement intervals are biased such that lower consequence events are considered to represent lower risk.

4.

Endorsements must reflect the previous inspection intervals upon which the probability of failure was
assessed. For "high and medium consequence" valves it is recommended that increases in endorsements
should be made progressively towards the maximum, subject to a developing history of satisfactory
inspections and tests. The maximum recommended increase for these valves is 12 months at any one time.

5.

Account should be taken of the increased risks associated with valves which are known to be likely to lift in
service, based on previous history or based on a prediction of plant operation. All such valves should be
identified and consideration should be given to limiting their endorsement intervals to less than the
maximum.

5. REFERENCES
API RP 520

Sizing, Selection and Installation of Pressure-Relieving Devices

in Refineries

API RP 521

Guide for Pressure-Relieving and Depressuring Systems

ANSI-ASME B31.3

Chemical Plant and Petroleum Refinery Piping

BP RP 44-1

Overpressure Protection Systems

ESR.96.ER.059

BP Relief Valve Work Group Report

IChemE

"Relief Systems Handbook"

APPENDIX A

COMMON CAUSES OF OVERPRESSURE

The most common causes of overpressure which are catered for by the design of plant relief systems are as follows:

A.1. External Fire

External fire is often the most frequent design case for relief valves in major installations. Fires can potentially
generate extremely high pressures, especially in closed liquid systems and, as the temperature of the metal is
increased, its strength will be reduced such that the equipment might fail by overpressure without any demand
being made on the pressure relief system.
A.2 Ambient Effects
Solar radiation can create overpressure in unprotected liquid filled systems by liquid expansion. Equipment types
most commonly at risk are above-ground pipelines and pressure vessels. Changes in atmospheric conditions (e.g. rain
storms) and solar radiation can also affect the internal pressure of large low pressure storage tanks and hence the rate
of vapour venting. This can lead to either an under-or overpressure condition.
A.3 Closed Outlet
Inadvertant valve closure on the outlet of equipment or opening a valve on the inlet can cause overpressure by
subjecting the equipment to the maximum upstream pressure. In the case of a pump this is the shut-off pressure,
typically 20% above normal operating pressure for centrifugal pumps, but theoretically infinite for reciprocating
pumps. In the case of compressors the overpressure from centrifugal machines may be limited to around 15% by the
recycle setting. In the case of reciprocating compressors the degree of overpressure is again theoretically infinite.
Inadvertant valve closure on both inlet and outlet may also cause overpressure if energy can still be absorbed into the
equipment contents through, for example, internal heating coils, or externally from heat tracing or direct heating in
the case of furnace coils.
A.4. Instrument Failures
The failure of an automatic control loop can cause overpressure by closing the outlet valve or opening the inlet control
valve from a high pressure source, resulting in a similar situation to that described above.
Loss of level control in a vessel may permit high pressure gas or vapour to flow into a downstream vessel designed for
a lower pressure. This is known as gas breakthrough and can, dependent on the plant design, result in major
overpressurisation.
A.5. Valve Failures
Mechanical failures of valves can produce the consequences described in A.3 and A.4. Additionally, the failure of a
non-return valve can permitflow in the reverse direction and create overpressure upstream of the valve.
A.6 Other Equipment Failures
Failures of rotating machinery can create overpressure in a number of ways, e.g.
failure of a pump extracting hot liquid from a distillation column in a pumparound system
failure of an air cooler fan
failure of a cooling water pump

Failures of heat exchanger tubes and floating head gaskets in shell-and-tube designs will result in direct
communication between the tow sides which are likely to have different operating and design pressures.

A.7 Utility Failures

Utility failures can result in overpressurisation in a number of ways, e.g.

electric power failure causing loss of the same machinery described in A.6
cooling water failure causing loss of cooling for condensers etc
instrument air failure causing, for example, control valve failure
computer failure causing loss of automatic valve control
steam failure causing loss of turbine-driven machinery
fuel supply failure causing loss of engine-driven machinery

A.8 Other Effects

A variety of process-related effects can result in overpressure, e.g.

uncontrolled chemical reactions or internal explosions

contamination of a hot heavy material with a lower boiling point component
hydraulic pressure surge caused by a sudden stop or start of a long liquid column
internal fouling causing blockage in relief valves, lines and vents.

APPENDIX B
EFFECTS OF OVERPRESSURE ON EQUIPMENT
B.1.

General

Apart from the specific considerations mentioned below the effects of overpressure on equipment will depend on:
(a)
(b)
(c)
(d)
(e)
(f)
(g)

the amount of overpressure

the temperature at which it occurs
the frequency of application of overpressure (i.e. fatigue effect)
the general condition of the equipment (corrosion, remanent creep/fatigue life etc.)
the degree to which structural materials and welds are free from defects
the original assumptions made in design (degree of conservatism etc.)
the rate of pressure build-up

For these reasons it is clear that, except in the case of new plant, any risk based overpressure protection policy must
take into account the actual equipment and its condition rather than the equipment shown on
P & IDs and piping
isometrics. Future deterioration should also be taken into account.
It is also important to realise that equipment which has been subjected to significant overpressure is no longer in the
same condition as it was previously (e.g. material properties may be different) and that any decision to continue
operation must take this into account.
Equipment which is intended to operate at elevated temperature is usually hydrostatically tested at a pressure which is
increased to take account of the higher strength of the material at the (ambient) test temperature. It is important to
realise that the capacity of such equipment to withstand overpressure at design temperature is not indicated by the
cold hydrostatic test pressure.
B.2.

Pipework

Most of the pipework under consideration will have been designed to ASME B31.3. This does not involve calculation
of actual stresses so the margin available in any particular arrangement is difficult to determine.
In practice, where standard type flanged joints are used, the most likely failure mode is leakage at the flanges. When
dealing with flammable (and sometimes toxic) fluids, this is obviously a significant failure. Structurally, the most
vulnerable components are expansion bellows followed by mitred elbows and standard elbows which have a high
bending moment applied (resulting in ovality of cross section). Items such as filters, which are frequently provided
with large diameter, flat covers, are also vulnerable. (It should be noted that flat sections generally are not easy to
analyse so that the effects of a specific amount of overpressure are difficult to predict)
Where high operating temperatures exist, ultimate failure would often be due to creep, and significant increases in
pressure in such circumstances would reduce the time to failure by accelerating the rate of accumulation of
microstructural damage.
Most piping systems will have been hydrostatically tested to a pressure of 1.5 x design pressure, factored to take
account of elevated temperature. This gives some confidence that joints will not leak excessively at pressures up to
1.5 x design, and that any local areas of plastic deformation will have shaken down so that there will be no gross
deformation. In this case, occasional excursions to pressure <1.5 x design are unlikely to have a detrimental effect.
However, if the design is such that shakedown has not been achieved in the hydrotest, repeated applications of
overpressure may cause ratcheting, leading to ultimate collapse. Such circumstances are likely to be rare but, as
explained above, it would be difficult to identify likely danger zones.
There are two other possible test pressures which may have been applied: pneumatic testing at 1.1 x design pressure
and, where piping is tested along with a connected vessel, 0.77 x 1.5 x design pressure (min). It should be possible to
determine from records which systems fall into these categories.
The response of a piping system to overpressure will also depend to some extent on flexibility e.g. a pipe bend which
has to withstand a large bending moment will have less capacity available to absorb overpressure.

B.3.

Flanged Joints

In an uncorroded piping system flanged joints are usually the weak link and will tend to fail first. Structural failure
will usually be preceded by leakage (as a result of distortion and loss of gasket compression force) which, despite
tending to reduce pressure, may be unacceptable. However, more sudden failures (e.g. due to gasket blowout or
excessive bolt strain) are also possible and badly made joints are likely to suffer most. Such failures are not very likely
with relatively minor pressure increases.
The type of flange has a bearing on the pressure at which leakage or failure might occur. Generally, slip-on welded
flanges can be expected to fail before weld neck flanges and also will be more liable to problems if fatigue or pressure
fluctuations are involved. Compact flange connectors (Grayloc etc.) will often continue to seal up to the pressure at
which gross structural failure occurs.
B.4.

Valves

All valves should have been hydrostatically tested in the fully assembled condition to 1.5 x cold rated pressure (i.e. as
with pipework, testing is temperature related) and, in most cases, leakage through stem seals and body flanges is the
most likely failure mode.
There may be exceptions to this, however. High pressure valves having pressure seal body joints will simply continue
to seal better as the pressure rises and valves with self energising body joint or stem seals (O rings, lip seals etc.) will
often also be capable of retaining pressures much higher than 1.5 x design. In such cases, gross deformation and/or
seal failure at high pressure are the likely failure modes. Low pressure systems often include oval bodied gate valves
and these will generally suffer from gross deformation at lower pressures than cylindrical/spherical counterparts.
However, since they are always provided with simple, flanged body/bonnet joints, leakage through these should be the
primary failure mode.
It should be remembered that, unlike most pipe joints, the flanged bonnets of valves are not restrained so that, if gross
leakage does not lead to a pressure reduction, they are likely to become missiles in gas/vapour systems.
B.5.

Pumps and Compressors

The casings of pumps are hydrostatically tested to 1.5 x design pressure and the same considerations apply to leakage
through flanged joints as for valves above. Although casings often depart considerably from the cylindrical/spherical
ideal and sometimes contain significant stress raisers, many will have been subjected to extensive stress analysis to
demonstrate acceptability. In most cases they are designed to achieve a high degree of rigidity and stability and this
will usually result in an ability to withstand relatively high pressure loads.
In the case of many centrifugal machines, automatic bypass/re-circulation arrangements will limit the overpressure to
a modest amount.
Seals are normally designed for suction conditions however, and are not normally tested other than for function under
operating conditions. Oil seals will normally only have a 10% margin over design pressure. Seal failure is therefore
by far the most likely failure mode resulting from overpressure and the quantity of fluid discharged as a result can
represent a serious fire or other hazard.
Rotating machines generally are sensitive to loads applied through the connecting flanges so if these are significantly
increased by overpressure conditions loss of function could result.
B.6.

Pressure Vessels (including heat exchanger shells)

A vessel subject to overpressure will eventually reach a condition where it will either fail to fulfil its service function
(e.g. through leakage or excessive deformation) or it is structurally unsafe (i.e. the ultimate limit of the design has
been reached). Design Codes do not normally consider the former and so cannot guarantee protection against failures
of this type.
Within design codes there are different categories of construction (e.g. involving different levels of NDE) and
different methods of design and analysis (involving more or less knowledge of the true pressure bearing capability of
the vessel). In attempting to assess the effects of overpressure it is important to have the maximum possible
information about the true condition of the vessel.

(a)

Serviceability limit/functional failure

Vessels with flanged joints are likely to exhibit leakage before gross deformation occurs but the comments made above
regarding self energising seals apply here as well. Similarly, most vessel closures will be unrestrained in the event of
catastrophic failure.
Large flanges are the most vulnerable but operating temperature and gasket design are also important factors.
Depending on the design code used vessels will have been hydrostatically tested at between 1.25 x and 1.5 x design
pressure. In most cases the test pressure will have been factored to take account of temperature so having passed the
hydrostatic test does not guarantee freedom from leakage when similar pressures are applied at elevated temperatures.
Deformations may affect related equipment (e.g. by transmitting unacceptable loads to machinery) or internal
components without running the risk of structural failure of the vessel.
(b)

Ultimate limit/structural failure

The potential failure modes and the operating conditions under which each may occur are shown in Figure B1. As a
general rule, the codes apply a minimum safety factor of 1.5 when designing against these, the limit state being
defined by the lowest failure load. If there are any shape imperfections, the safety factor will be greatly reduced. This
is particularly significant for spherical heads and for cylinders of vessels under the axial compressive stress. This is
because they experience a different type of collapse known as snap-through buckling.
Tensile failure takes the form of a component yielding due to tension or bending or both, and is the most likely failure
mode for a sound vessel operating at moderate temperatures. An unperforated cylinder would be subject to uniform
tension across its thickness but a dished head may fail at a plastic hinge created under the combined action of tension
and bending. The presence of stress concentrations (e.g. at cone-cylinder junctions, nozzles and attachments) will
cause individual regions of failure requiring elastic, plastic or elastic-plastic analysis for evaluation and would be of
great significance in the case of fatigue loading (e.g. repeated applications of overpressure).
Creep is a significant failure mode at elevated temperature. Code design rules are mainly based on applying a factor
of safety to the rupture stress of the material at the design temperature and required lifetime for the vessel. This then
equates to the permissible design stress. The relation between stress and time to rupture is logarithmic and, very
approximately, a 100% increase in stress leads to a 50% reduction in the time to rupture.
In the case of brittle fracture, failure is determined by the three main factors: the applied stress (including residual
stress at welds), the size and orientation of defects and the fracture toughness of the material at the design
temperature. Note that the latter is related to the material thickness (ductile/brittle transition temperatures for ferritic
materials usually increase with increasing thickness). The significance of an increase in stress due to overpressure
will depend on the material, temperature, quality of the fabrication (i.e. presence of significant defects) and whether
the vessel was stress relieved.
Collapse requires the presence of external pressure or an internal vacuum. The items most likely to suffer from the
effects of overpressure are internals such as baffles and pipes/tubes under external pressure. Interstiffener collapse of
cylinders may need to be checked and also overall collapse of stiffeners.
Most vessels will conform to fairly standard configurations whose behaviour when subjected to high loadings is
reasonably well understood and can be analysed. Where vessels may have undergone uprating to new operating
conditions it is important to confirm that the factors of safety mentioned above have not been reduced.
Possible failure modes for heat exchangers include leakage through the bolted closure and bending of the tubesheet.
Heat exchanger tubes may burst or buckle when overpressurised resulting in LP system overpressure, undesirable fluid
mixing and expensive repairs. The most serious case would be instantaneous tube rupture and recent studies have
shown that transient overpressure of the LP side is dependent on both the speed of opening of the relief device and the
volume of pipework between it and the heat exchanger shell. In addition to overpressure of the shell, slugging flow
may occur in the connected pipework leading to excessive loading of pipe supports. The likelihood of tube failure will
vary with design, material and condition.
B.7

Column Reactors

Generally, similar comments apply as for pressure vessels. However, due to the influence of internal components such
as trays, catalyst beds etc. failure modes involving pressure differences within the vessel itself may need to be
considered and this is one area where collapse becomes a possible failure mode.
Reactors are potentially at risk from overpressure failure where the internal reactions are exothermic, either during
normal operation or during transient conditions such as catalyst regeneration. Local hot spots on the reactor wall can
lead to local bulging of failure by ductile overload at the elevated temperature.
B.8

Tanks

Fixed roof tanks will usually have very little margin for pressure increase and deformation will occur very quickly.
Depending on construction, slight overpressure will tend to cause tanks to deform by lifting off the base at the annular
ring, shell slightly bowing out and possible rippling (buckling?) or distortion near the roof top rim area. Tanks are
normally designed to fail as a result of overpressure by rupture of the roof edge to top rim seal weld ("frangible joint")
so that pressure relief is achieved without loss of contents. However, it is not always possible to guarantee this failure
mode due, for example, to the effects of in-service corrosion having weakened the annular ring joint. In this case, loss
of contents would be total and possibly catastrophic.
Some tanks may have some redundancy of overpressure protection by virtue of dip-hatch covers, overflow vents and
emergency vents. In this case the risk of overpressure could be greatly decreased. On the other hand, tanks
containing products which tend to cause deposits may well have a dependency on cleaning routines for effective
overpressure protection.
Fixed roof tanks are also at risk from failure by underpressure, which usually results in inwards collapse of the roof
and/or the shell. The nature of the failure will be largely determined by the tank height-diameter ratio, and the
relative stiffness of the roof and the shell.

FIGURE B1

VESSEL FAILURE MODES

200

Pressure
Bar Gauge

BRITTLE
FRACTURE
(FERRITIC)

TENSILE
FAILURE

CREEP

Temp oC

-250

1250oC

C O L L A P S E
-40

Corrosion
Erosion
Fatigue

Stress Corrosion Cracking

Tensile Failure

apply throughout

applies selectively
applies at all positive pressures