1

API 521 7th Edition Ballot Item 7.1 New Work Item – Potential ASME Code Violations

Background

In the API 521 Spring 2018 meeting, Denis Demichael who is on the ASME Safety Valve subcommittee volunteered to review the current API 521 7th Edition draft for possible conflicts with ASME Section VIII Div. 1 code requirements. The following sections in API Standard 521 7th Edition draft containing the term “corrected hydrotest pressure” were included in his review:

1) 4.2.2 Use of Administrative Controls if Corrected Hydrotest Pressure Not Exceeded – see Ballot Item 7.1.1 on page 2

2) 4.4.2.1 Description of a Closed Outlet– see Ballot Item 7.1.2 on page 3 3) 4.4.8.3 Inlet Control Devices and Bypass Valves– see Ballot Item 7.1.3 on page

4 4) 4.4.9.2 Inadvertent Valve Opening – see Ballot Item 7.1.4 on page 5 5) 4.4.9.3.2.2 Severe Check Valve Leakage – see Ballot Item 7.1.5 on page 6 6) 4.4.12 Hydraulic Expansion – see Ballot Item 7.1.6 on pages 7-8 7) 4.4.14 Heat Transfer Equipment Failure – see Ballot Item 7.1.7 on pages 9-10 8) 4.4.14.2 Shell-and-tube Heat Exchangers – see Ballot Item 7.1.8 on page 11 9) 4.4.14.4 Plate-and-frame, Spiral-plate and Welded-block Heat Exchangers – see

Ballot Item 7.1.9 on pages 12-13 10) 4.4.14.5 Sulfur Recovery Unit Thermal Reactor Waste Heat Steam Generators –

see Ballot Item 7.1.10 on pages 14-15

Denis Demichael’s review is given at the end of this ballot on pages 16-28. The proposed responses to Denis Demichael’s review of each section noted above form Ballot Item 7.1.

NOTES:

All 10 of these items are part of Ballot Item 7.1. Relevant sentences/paragraphs are highlighted in yellow. No modifications or changes are proposed for Items 3, 4, and 8 in the

list above. If you vote “Negative” PLEASE identify the specific item(s). An “Affirmative” vote indicates you agree to all proposed responses.

Comments should only address changes being balloted, truly address technical issues if they are technical comments, and propose alternative language.

Committee Draft

2

Ballot 7.1.1

Proposed Modification to API 521 6th Ed Section 4.2.2 “Use of Administrative Controls if Corrected Hydrotest Pressure Not Exceeded”

4.2.2 Use of Administrative Controls if Corrected Hydrotest Pressure Not Exceeded

Certain pressure design codes allow the use of administrative controls to eliminate an overpressure scenario from the basis for pressure relief design if the potential overpressure does not exceed the corrected hydrotest pressure, whereas other pressure design codes do not address this subject. Therefore, applying this for equipment built to pressure design codes that do not address the issue could cause the equipment to be overstressed. In these cases, the user should perform mechanical analyses and/or risk analyses. This philosophy is applied to the following scenarios:

a) closed outlets on vessels (see 4.4.2),

b) inadvertent valve opening (see 4.4.9.2),

c) check valve leakage or failure (see 4.4.9.3),

d) heat transfer equipment failure (see 4.4.14).

The user is cautioned that some systems can have unacceptable risk due to failure of administrative controls and resulting consequences due to loss of containment. In these cases, limiting the overpressure to the normally allowable overpressure can be more appropriate. Note that the entire system, including all of the auxiliary devices (e.g. gasketed joints, instrumentation), should be considered for the overpressure during the failure of administrative controls.

Note that the corrected hydrotest pressure accounts for allowable stress differences of the material of construction between the overpressure scenario temperature (relieving temperature) and either the test temperature or the design temperature (usually higher than the test temperature). Details and examples of the corrected hydrotest pressure are given in C.7.

Committee Draft

3

Ballot 7.1.2

Proposed Modification to API 521 6th Ed Section 4.4.2.1 “Description of a Closed Outlet”

4.4.2 Closed Outlets

4.4.2.1 Description of a Closed Outlet

The inadvertent closure of a valve on the outlet of pressure equipment while the equipment is on stream can expose the equipment to a pressure that exceeds the MAWP. Every valve (i.e. manual, control, or remotely operated) should be considered as being subject to inadvertent operation. If closure of an outlet valve can result in pressure in excess of that allowed by the design code, a PRD is required. If the equipment is designed to the maximum source pressure, then closure of an outlet valve will not result in overpressure, so a PRD is not required for the closed outlet scenario.

In the case of a manual valve, administrative controls can be used to prevent the closed outlet scenario unless the resulting pressure exceeds the maximum allowed by the pressure design code [usually the corrected hydrotest pressure is exceeded (see 3.1.22 and 4.2.2)]. Note that the entire system including all of the auxiliary devices (e.g. gasketed joints, instrumentation) should be considered for the overpressure during the failure of administrative controls.

Committee Draft

4

Ballot 7.1.3

Proposed Modification to API 521 6th Ed Section 4.4.8.3 “Inlet Control Devices and Bypass Valves”

No changes proposed

4.4.8.3 Inlet Control Devices and Bypass Valves

There can be single or multiple inlet lines fitted with control devices. The scenario to consider is that one inlet valve is in a fully opened position regardless of the control valve failure position. Opening of this control valve can be caused by instrument failure or misoperation. If the system has multiple inlets, the position of any control device in those remaining lines shall be assumed to remain in its normal operating position. Therefore, the required relieving rate is the difference between the maximum expected inlet flow and the normal outlet flow, adjusted for relieving conditions and considering unit turndown, assuming that the other valves in the system are still in operating position at normal flow (i.e. normally open, normally closed, or throttling). If one or more of the outlet valves are closed, or more inlet valves are opened by the same failure that caused the first inlet valve to open, the required relieving rate is the difference between the maximum expected inlet flow and the normal flow from the outlet valves that remain open. All flows should be calculated at relieving conditions. An important consideration is the effect of having a manual bypass on the inlet control valve(s) at least partially open. If, during operation, the bypass valve is opened to provide additional flow, then this total flow (control valve wide open and bypass valve normal position) shall be considered in the relieving scenario.

The potential for the bypass valve to be inadvertently opened (e.g. during normal operations, control valve maintenance, start-up, shutdown, or special operations) while the control valve is operating (both bypass and control valve wide open) should also be considered unless administrative controls are in place. If the pressure resulting from the opening of the bypass valve can exceed the corrected hydrotest pressure (see 3.1.22 and 4.2.2), reliance on administrative controls as the sole means to prevent overpressure might not be appropriate. The user is cautioned that some systems can have unacceptable risk due to failure of administrative controls and resulting consequences due to loss of containment. In these cases, limiting the overpressure to the normally allowable overpressure can be more appropriate. Note that the entire system, including all of the auxiliary devices (e.g. gasketed joints, instrumentation), should be considered for the overpressure during the failure of administrative controls.

Committee Draft

5

Ballot 7.1.4

Proposed Modification to API 521 6th Ed Section 4.4.9.2 “Inadvertent Valve Opening”

No changes proposed

4.4.9.2 Inadvertent Valve Opening

The inadvertent opening of any valve from a source of higher pressure, such as high-pressure steam or process fluids, should be considered. This action can require pressure-relieving capacity unless administrative controls, as defined in 3.1.2, are in place to prevent inadvertent valve opening. The relief load should be determined using the maximum operating pressure upstream of the valve and the relieving pressure on equipment downstream of the valve. If the pressure source is a pipeline or a production well, the pressure upstream of the valve may reach the maximum shut-in pressure of the source after a shutdown. The user should determine whether inadvertent valve opening combined with maximum shut-in pressure in upstream system is a credible relief case.

The following applies when a manual or actuated valve is inadvertently opened, causing pressure buildup in a vessel. The vessel should have a PRD large enough to pass a rate equal to the flow through the open valve; credit may be taken for the flow capacity of vessel outlets that can reasonably be expected to remain open. The manual or actuated valve should be considered as passing its capacity at a full-open position with the pressure in the vessel at relieving conditions. Volumetric or heat-content equivalents may be used if the manual or actuated valve admits a liquid that flashes or a fluid that causes vaporizing of the vessel contents. It is typical to consider only one inadvertently opened manual or actuated valve at a time, although simultaneous inadvertent opening of multiple valves shall be considered if a common cause is identified (e.g. sequential valve operations). Automatic control failures are discussed separately in 4.4.8.

Committee Draft

6

Ballot 7.1.5

Proposed Modification to API 521 6th Ed Section 4.4.9.3.2.2 “Severe Check Valve Leakage”

4.4.9.3.2.2 Severe Check Valve Leakage

The potential for overpressure caused by reverse flow through one or more check valves in series should be considered where the maximum operating pressure of the high-pressure system is greater than the low-pressure equipment’s corrected hydrotest pressure. The user is cautioned to see 3.1.22 and 4.2.2. Note that the entire upstream system, including vessels, piping and auxiliary devices (e.g. gasketed joints, instrumentation), should be considered for the overpressure scenario.

PROPOSED MODIFICATION:

Replace:

“The potential for overpressure caused by reverse flow through one or more check valves in series should be considered where the maximum operating pressure of the high-pressure system is greater than the low-pressure equipment’s corrected hydrotest pressure.”

With:

“The potential for overpressure caused by reverse flow through one or more check valves in series should be considered a relief system design contingency where the maximum operating pressure of the high-pressure system is greater than the low-pressure equipment’s corrected hydrotest pressure. If the low-pressure side corrected hydrotest pressure cannot be exceeded then administrative controls, maintenance, procedures, etc. can be used to prevent or minimize the potential for an overpressure.”

Committee Draft

7

Ballot 7.1.6

Proposed Modification to API 521 6th Ed Section 4.4.12 “Hydraulic Expansion”

4.4.12 Hydraulic Expansion

4.4.12.1 Causes

Hydraulic expansion is the increase in liquid volume caused by an increase in temperature (see Table 2). It can result from several causes, the most common of which are the following.

a) Piping or vessels are blocked in while they are filled with cold liquid and are subsequently heated by heat tracing, coils, ambient heat gain, or fire.

b) An exchanger is blocked in on the cold side with flow in the hot side.

c) Piping or vessels are blocked in while they are filled with liquid at near-ambient temperatures and are heated by direct solar radiation.

Table 2—Typical Values of Cubic Expansion Coefficient for Hydrocarbon Liquids and Water

Gravity of Liquid °API

Cubic Expansion Coefficient a 1/°C (1/°F)

3 to 34.9 0.00072 (0.0004)

35 to 50.9 0.0009 (0.0005)

51 to 63.9 0.00108 (0.0006)

64 to 78.9 0.00126 (0.0007)

79 to 88.9 0.00144 (0.0008)

89 to 93.9 0.00153 (0.00085)

94 and lighter 0.00162 (0.0009)

water 0.00018 (0.0001)

a At 15.6 °C (60 °F). For other temperatures, Equation (4) can be used to estimate the cubical expansion coefficient.

In certain installations, such as cooling circuits, the processing scheme, equipment arrangements and methods, and operation procedures make the elimination of the hydraulic expansion relieving device feasible, which is normally required on the cooler, fluid side of a shell-and-tube exchanger. Typical of such conditions are multiple-shell units with at least one cold-fluid block valve of the locked-open design on each shell and a single-shell unit in a given service where the shell can reasonably be expected to remain in

Committee Draft

8

service, except on shutdown. In this instance, closing the cold-fluid block valves on the exchanger unit should be controlled by administrative procedures and possibly the addition of signs stipulating the proper venting and draining procedures when shutting down and blocking in. Such cases are acceptable and do not compromise the safety of personnel or equipment, but the designer is cautioned to review each case carefully before deciding that a relieving device based on hydraulic expansion is not warranted because a significant pressure increase can result the corrected hydrotest pressure could be exceeded if the administrative procedures are not followed.

Committee Draft

9

Ballot 7.1.7

Proposed Modification to API 521 6th Ed Section 4.4.14 “Heat Transfer Equipment Failure”

4.4.14 Heat Transfer Equipment Failure

4.4.14.1 Requirements

Heat exchangers and similar vessels may require protection with a relieving device of sufficient capacity to avoid overpressure in case of an internal failure. This statement defines a broad problem but also presents the following specific problems:

a) type and extent of internal failure that can be anticipated,

b) determination of the required relieving rate if overpressure of the low-pressure side of the exchanger and/or connected equipment occurs as a result of the postulated failure,

c) selection of a relieving device that reacts fast enough to prevent the overpressure,

d) selection of the proper location for the device so that it senses the overpressure in time to react to it.

Provision of overpressure protection for the heat exchanger and associated pipework does not remove the need for a process hazard analysis to consider the wider process implications of any interstream leakage.

These guidelines were established without considering a chemical reaction in the event that the high-pressure fluid mixes with the low-pressure fluid. If the heat exchanger contains reactive chemicals, then a careful evaluation shall be performed to ensure that the reactive situation does not result in the pressure exceeding the low-pressure side's corrected hydrotest pressure (see 3.1.22 and 4.2.2).

PROPOSED MODIFICATION:

Replace:

“If the heat exchanger contains reactive chemicals, then a careful evaluation shall be performed to ensure that the reactive situation does not result in the pressure exceeding the low-pressure side's corrected hydrotest pressure (see 3.1.22 and 4.2.2).”

With:

“If the heat exchanger contains reactive chemicals, then a careful evaluation shall be performed to ensure that the reactive situation does not result in the pressure exceeding

Committee Draft

10

the maximum allowable per design code. Administrative controls, maintenance, procedures, etc. can be used to prevent or minimize the potential for an overpressure if the low-pressure side's corrected hydrotest pressure cannot be exceeded (see 3.1.22 and 4.2.2).”

Committee Draft

11

Ballot 7.1.8

Proposed Modification to API 521 6th Ed Section 4.4.14.2 “Shell-and-tube Heat Exchangers”

No changes proposed

4.4.14.2 Shell-and-tube Heat Exchangers

4.4.14.2.1 Pressure Considerations

Complete tube rupture, in which a large quantity of high-pressure fluid flows to the lower-pressure exchanger side, is a remote but possible contingency. Minor leakage can seldom overpressure an exchanger during operation, however such leakage occurring where the low-pressure side is closed in can result in overpressure. Loss of containment of the low-pressure side to atmosphere is unlikely to result from a tube rupture where the pressure in the low-pressure side (including upstream and downstream systems) during the tube rupture does not exceed the corrected hydrotest pressure (see 3.1.22 and 4.2.2). The user may choose a pressure other than the corrected hydrotest pressure, given that a proper detailed mechanical analysis is performed showing that a loss of containment is unlikely. The use of maximum possible system pressure instead of design pressure may be considered as the pressure of the high-pressure side on a case-by-case basis where there is a substantial difference in the design and operating pressures for the high-pressure side of the exchanger.

Pressure relief for tube rupture is not required where the low-pressure exchanger side (including upstream and downstream systems) does not exceed the criteria noted above. The tube rupture scenario can be mitigated by increasing the design pressure of the low-pressure exchanger side (including upstream and downstream systems), and/or assuring that an open flow path can pass the tube rupture flow without exceeding the stipulated pressure, and/or providing pressure relief.

The user may perform a detailed analysis and/or appropriately design the heat exchanger to determine the design basis other than a full-bore tube rupture. However, each exchanger type should be evaluated for a small tube leak. The detailed analysis should consider the following:

Committee Draft

12

Ballot 7.1.9

Proposed Modification to API 521 6th Ed Section 4.4.14.4 “Plate-and-frame, Spiral-plate and Welded-block Heat Exchangers”

NOTE: THIS IS IDENTICAL TO BALLOT 6.1 PROPOSED CHANGE. ONLY THE TEXT HIGHLIGHTED IN YELLOW IS OPEN FOR BALLOT. THE REMAINING TEXT WAS PREVIOUSLY APPROVED IN BALLOT AND IS NOT OPEN FOR BALLOT. COMMENTS ON TEXT THAT IS NOT HIGHLIGHTED IN YELLOW WILL NOT BE CONSIDERED.

4.4.14.4 Plate-and-frame, Spiral-plate and Welded-block Heat Exchangers

For the purpose of overpressure protection, plate-and-frame, spiral-plate, and welded-block heat exchangers are similar enough in construction that each features the same type of leakage failure modes from the high-pressure side to the low-pressure side. In all three types, the most common cause for leaking from side-to-side is to have an opening (e.g., hole or crack) in a plate although However, internal plate failures have occurred. Failure mechanisms typically are related to some form of corrosion such as pitting, cracking, or general corrosion.

Note that the plates in these exchangers are better supported than tubes in tubular exchangers, so vibration damage is not likely. In the case of gasket leaks, Plateplate-and-frame heat exchangers are more likely to leak at the external gaskets rather than internally between the high-pressure and low-pressure side. For spiral-plate heat exchangers, a gasket leak will short circuit the flow bypassing loops in the spiral so would not cause an overpressure. The welded-block heat exchanger does not have gaskets.

To evaluate the likelihood for an internal failure, a materials review should be done for new exchangers and inspection records should be evaluated for in-service exchangers. It may be possible to conclude that failure of the plate is so unlikely that no relief system design for plate failure is warranted. On the other hand, past internal leaks or materials susceptible to corrosion would indicate the need to evaluate an internal failure for relief system design. If there is any doubt regarding the likelihood of failure (LOF), then evaluate this scenario in the relief system design.

Rupture of an internal plate, in which a large quantity of high-pressure fluid flows to the lower-pressure exchanger side, is unlikely. Minor leakage can seldom overpressure an exchanger during operation, however such leakage occurring where the low-pressure side is closed-in can result in overpressure. Loss of containment of the low-pressure side to atmosphere is unlikely to result from an internal plate rupture where the pressure in the low-pressure side (including upstream and downstream systems) during the failure does not exceed the corrected hydrotest pressure (see 3.1.22 and 4.2.2). Pressure relief for an internal plate rupture is not required where the low-pressure exchanger side (including upstream and downstream systems) does not exceed this criterion. An internal failure in a

Committee Draft

13

heat exchanger need not be considered if the low-pressure side corrected hydrotest pressure exceeds the high-pressure side design pressure. The use of maximum possible system pressure instead of design pressure may be considered as the pressure of the high-pressure side on a case-by-case basis where there is a substantial difference between the design and operating pressures for the high-pressure side of the exchanger. Leakage or failure of external gaskets may be a tolerable risk in some services (e.g. cooling water) but not in others (e.g. hydrocarbon, corrosive, toxic services) because of potential impacts of a release.

In contrast to a shell-and-tube heat exchanger, it is more difficult to determine an appropriate leak size for plate-and-frame, spiral-plate and welded-block heat exchangers. One method would be to consider a hole size equivalent to a single tube rupture in a shell-and-tube heat exchanger [e.g. 6.4 mm to 25.4 mm (0.25 in. to 1 in.) in diameter]. Note that the flow would only be across one hole unlike a guillotine tube failure discussed in 4.4.14.2.2 where there are two “holes.”

Committee Draft

14

Ballot 7.1.10

Proposed Modification to API 521 7th Ed Section 4.4.14.5 “Sulfur Recovery Unit Thermal Reactor Waste Heat Steam Generators”

4.4.14.5 Sulfur Recovery Unit Thermal Reactor Waste Heat Steam Generators 4.4.14.5.1 General A special case of heat transfer equipment failure involves a tube failure in a Sulfur Recovery Unit (SRU) Waste Heat Steam Generator (WHSG). Generally, SRU designs are based on the modified Claus process with a thermal reactor that converts hydrogen sulfide to elemental sulfur operating near ambient pressure and at temperatures of about 1700 to 2800°F (925 to 1540°C). The shell side of the WHSG generates steam to cool the thermal reactor effluent gases containing elemental sulfur. WHSG steam-side design pressures range from about 50 to 750 psig (345 to 5170 kPag). The tube side design pressures might range from 15 to 150 psig (105 to 1035 kPag). In contrast to other shell-and-tube heat exchangers, tubes in these WHSG are typically larger (e.g., 2 to 6 inches (50 to 150 mm) in diameter) and fabricated from either schedule piping or boiler tubing. The process side of sulfur recovery units are designed with an open path to the atmosphere that can provide a relief path but some SRU designs contain switching valves that can block or restrict the open relief path to atmosphere. 4.4.14.5.2 Relief Protection Evaluation Procedure PRVs, rupture disks, or other PRDs in a process containing elemental sulfur can be unreliable unless the pressure protection system is properly designed, installed, and maintained to hold the temperature high enough to prevent solidification of elemental sulfur upon cooling. This would result in a restriction or plugging of the PRD and/or the associated inlet and outlet piping. Further, atmospheric relief from a sulfur seal or sulfur pit vent in the vicinity of plant personnel is also a safety concern due to the potential release of molten sulfur along with high concentrations of H2S and SO2 gases. Instead of a PRD, it may be appropriate to provide overpressure protection by system design as the overpressure protection basis for the thermal reactor and other low-pressure side equipment in the SRU. In order to specify appropriate overpressure protection, the type of WHSG internal failures must first be characterized. Sulfur recovery unit WHSG tube failures are not full-bore tube ruptures [1,2] as seen in other shell-and-tube heat exchangers. There have been no reported incidents from the industry to suggest that a full-bore tube rupture has occurred. Instead, other failure mechanisms can occur in multiple tubes (i.e., longitudinal cracks, multiple tube-to-tubesheet joint leaks, or a fish-mouth failure due to dimpled-in tube) whose areas can be conservatively assumed to be equivalent to a full-bore tube rupture area [3]. A review of the industry data demonstrates, while rare, that loss of containment has been reported as a direct result of tube failure due to other failure mechanisms.

Committee Draft

15

As a first step, the user may want to apply steady-state analysis techniques to determine if the process side of the SRU can relieve pass a rate equivalent to the flow rate through double the cross-sectional area of a single tube without exceeding the corrected hydrotest pressure of the thermal reactor and other low-pressure side equipment. The user may choose a pressure other than the corrected hydrotest pressure, if a proper detailed analysis on all affected equipment shows that loss of containment is unlikely. As part of this analysis, the user shall evaluate leaks involving all steam (i.e., tube failure above the WHSG water level), all saturated water (i.e., tube failure below the WHSG water level), and a mixture of both. If the corrected hydrotest pressure is not exceeded, then the considerations given in 4.4.14.5.3 should be evaluated to minimize the potential for the failure mechanisms referenced above. The user shall also consider the potential consequences of process gas releases through paths such as sulfur seal system, sulfur pit vents, combustion air suction piping, or other locations. If steady state modeling shows the corrected hydrotest pressure can be exceeded, then additional considerations are necessary. For example, the designer may decide to utilize a more rigorous dynamic analysis. The user is cautioned against reducing WHSG tube diameter to avoid overpressure due to concerns of high heat flux occurrence at the end of the inlet ferrule [4]. An alternative to dynamic analysis would be to provide overpressure protection by system design as the overpressure protection basis. The considerations given in 4.4.14.5.3 are to be used as part of the detailed analysis by a multidisciplinary team to determine the magnitude of a WHSG tube rupture and the impact of these mitigations to reduce the likelihood and consequences of a WHSG tube rupture.

Committee Draft

16

Denis Demichael’s Review of Potential ASME Conflicts in API 521

My understanding is that the “pressure design code” referenced in the first paragraph of API 521 Section 4.2.2 (shown below) is the ASME BPVC VIII. Division 1. I believe the guidance in the first paragraph is misleading as it is an extrapolation of one of the criteria in Appendix M Paragraph M5.7(b)(2) (Excerpts on the next page) for allowing a stop valve where there is normally process flow to justify vessel pressures in excess of the maximum relief pressures required in UG-125(c).

If API wants to provide relief device sizing guidance that relies on administrative controls to eliminate certain overpressure scenarios if the source pressure cannot exceed the corrected hydrostatic, then that is within API’s purview for helping users meet the Section VIII overpressure requirements. I don’t believe it conflicts with ASME Section VIII since Section VIII makes it a user’s responsibility to size the relief device and design the relief system and does not provide any specific sizing guidance other than listing in Appendix M fire sizing standards that may be used. However, if the API guidance allows vessel pressures to exceed the limits of UG-125(c) then I believe it does conflict with Section VIII requirements and that needs to be corrected.

If 4.2.2 is to be kept, it needs to be clarified that it’s the user’s responsibility to use management controls to eliminate certain overpressure scenarios for the sizing the relief device and eliminate the inference that ASME has words in the code to support it. Also, check valve leakage is listed in this section but I did not find where administrative procedures are referenced where the text says it’s acceptable for the pressure to go has high as the corrected hydrotest pressure.

I have searched the latest draft API 521 for the term ‘corrected hydrotest pressure” and excerpted the appropriate paragraphs below. I have noted where I believe the text conflicts with Section VIII UG-125(c) requirements with the intent that API address my concerns. I have also included paragraphs where the references to corrected hydrotest pressure with the use of administrative controls provide sizing guidance.

Please note my comments are based on my understanding of Section VIII and API 521. Although I’m a member of the Section VIII Standards Committee I am not representing ASME and these are my personal interpretations of the documents’ text. Several members of our API committee also have company representatives on the Section VIII Standards Committee. Feel free to have the appropriate API Committee members review my concerns with their company’s representatives.

4.2.2 Use of Administrative Controls if Corrected Hydrotest Pressure Not Exceeded

Certain pressure design codes allow the use of administrative controls if the potential overpressure does not exceed the corrected hydrotest pressure, whereas other pressure design codes do not address this subject. Therefore, applying this for equipment built to pressure design codes that do not address the issue could cause the equipment to be overstressed. In these cases, the user should perform mechanical analyses and/or risk analyses. This philosophy is applied to the following scenarios:

a) closed outlets on vessels (see 4.4.2),

b) inadvertent valve opening (see 4.4.9.2),

c) check valve leakage or failure (see 4.4.9.3),

d) heat transfer equipment failure (see 4.4.14).

The user is cautioned that some systems can have unacceptable risk due to failure of administrative controls and resulting consequences due to loss of containment. In these cases, limiting the overpressure to the normally

Committee Draft

17

allowable overpressure can be more appropriate. Note that the entire system, including all of the auxiliary devices (e.g. gasketed joints, instrumentation), should be considered for the overpressure during the failure of administrative controls.

Note that the corrected hydrotest pressure accounts for allowable stress differences of the material of construction between the overpressure scenario temperature (relieving temperature) and either the test temperature or the design temperature (usually higher than the test temperature). Details and examples of the corrected hydrotest pressure are given in C.7.

ASME Section VIII Except (For committee use only)

M-5.7 Stop Valve(s) Provided in the Pressure Relief Path Where There is Normally Process Flow. Stop valve(s), excluding remotely operated valves, may be provided in the relief path where there is normally a process flow, provided the requirements in M-5.7(a) and (b), as a minimum, are complied with. These requirements are based on the potential overpressure scenarios involving accidental closure of a single stop valve within the relief path [see M-5.3(g)]. The accidental closure of these stop valve(s) in the pressure relief system need not be considered in setting the design pressure per UG-21.

(a) The flow resistance of the valve in the full open position does not reduce the relieving capacity below that is required by the rules of this Division.

(b) The closure of the valve will be readily apparent to the operators such that corrective action, in accordance with documented operation procedures, is required, and

(1) if the pressure due to closure of the valve cannot exceed 116% of MAWP, then no administrative controls, mechanical locking elements, valve operation controls, or valve failure controls are required, or

(2) if the pressure due to closure of the valve cannot exceed the following:

(-a) the documented test pressure, multiplied by the ratio of the stress value at the design temperature to the stress value at the test temperature, or

(-b) if the test pressure is calculated per UG-99(c) in addition to the ratio in M-5.7(b)(2)(-a), the test pressure shall also be multiplied by the ratio of the nominal thickness minus the corrosion allowance to the nominal thickness then, as a minimum, administrative controls and mechanical locking elements are required, or

(3) if the pressure due to closure of the valve could exceed the pressure M-5.7(b)(2), then the user shall either

(-a) eliminate the stop valve, or

(-b) apply administrative controls, mechanical locking elements, valve failure controls, and valve operation controls, or

(-c) provide a pressure relief device to protect the equipment that could be overpressured due to closure of the stop valve

Committee Draft

18

Definition

corrected hydrotest pressure Hydrostatic test pressure multiplied by the ratio of stress value at upset temperature to the stress value at test temperature.

NOTE 1 See 4.2.2 and C.7.

NOTE 2 In this definition, the hydrostatic test pressure is that specified by the pressure design code, whether or not the equipment has actually been hydrostatically tested

4.4.2 Closed Outlets

4.4.2.1 Description of a Closed Outlet

The inadvertent closure of a valve on the outlet of pressure equipment while the equipment is on stream can expose the equipment to a pressure that exceeds the MAWP. Every valve (i.e. manual, control, or remotely operated) should be considered as being subject to inadvertent operation. If closure of an outlet valve can result in pressure in excess of that allowed by the design code, a PRD is required. If the equipment is designed to the maximum source pressure, then closure of an outlet valve will not result in overpressure, so a PRD is not required for the closed outlet scenario.

In the case of a manual valve, administrative controls can be used to prevent the closed outlet scenario unless the resulting pressure exceeds the maximum allowed by the pressure design code [usually the corrected hydrotest pressure is exceeded (see 3.1.22 and 4.2.2)]. Note that the entire system including all of the auxiliary devices (e.g. gasketed joints, instrumentation) should be considered for the overpressure during the failure of administrative controls.

In general, the elimination of block valves and the omission of block valves in between vessels in a series can reduce the number of PRDs.

The two highlighted references to maximum pressure “allowed by the design code” are confusing since they use the same terminology but seem to address two different values. In addition, for the second one I cannot find any words in Section VIII to support the statement. In the first highlighted sentence the “pressure in excess of that allowed by the design code” was changed from maximum allowable working pressure in the 5th Edition. It appears to address the maximum relief pressures allowed in UG-125(c) for sizing the relief device. The second highlighted sentence parenthetically says the maximum allowed pressure allowed by the design code is usually the corrected hydrostatic test pressure. So which one of the “maximum allowed pressures” is it and where does ASME say that maximum allowed pressure is the corrected hydrostatic test pressure?

This section seems to cover two concepts. 1) sizing the relief device and 2) guidance for when closing the outlet valve should be included in the design basis for sizing the relief device. The first section should clarify if the user determines the vessel can be exposed to a pressure that can exceed the limits in UG-125(c) then it should be included in the design basis for sizing the relief device not whether a relief device is required. Determining whether a relief device is required is a different topic and comes only after all the potential scenarios are evaluated. Section VIII is clear it’s the user’s responsibility or their designated agent to design the relief systems so that the pressure in UG-125(c) are not exceeded.

If the second paragraph wants to provide the user guidance that the administrative controls can be used to eliminate the closed outlet scenario, then it needs to clarify under what conditions it may be done. If API wants to establish a pressure limit as the corrected hydrotest pressure so be it. However, I don’t know any specific references in Section VIII that says it’s OK to eliminate the cause of overpressure if the corrected hydro test pressure is not exceeded. If there are other design codes that permit it, I would be interested in knowing which ones. Section VIII does not tell users how to size relief devices. Consequently, if user relies

Committee Draft

19

on management procedures and that outlet valve is operated within those procedures and the pressures in UG-125(c) are not exceed, then the code requirements are met. If the administrative controls fail and the valve is inadvertently shut and the relief valve has insufficient capacity so that the pressure in the vessel exceeds the limits in UG-125(c) then the code requirement is not met.

Committee Draft

20

4.4.8.3 Inlet Control Devices and Bypass Valves

There can be single or multiple inlet lines fitted with control devices. The scenario to consider is that one inlet valve is in a fully opened position regardless of the control valve failure position. Opening of this control valve can be caused by instrument failure or misoperation. If the system has multiple inlets, the position of any control device in those remaining lines shall be assumed to remain in its normal operating position. Therefore, the required relieving rate is the difference between the maximum expected inlet flow and the normal outlet flow, adjusted for relieving conditions and considering unit turndown, assuming that the other valves in the system are still in operating position at normal flow (i.e. normally open, normally closed, or throttling). If one or more of the outlet valves are closed, or more inlet valves are opened by the same failure that caused the first inlet valve to open, the required relieving rate is the difference between the maximum expected inlet flow and the normal flow from the outlet valves that remain open. All flows should be calculated at relieving conditions. An important consideration is the effect of having a manual bypass on the inlet control valve(s) at least partially open. If, during operation, the bypass valve is opened to provide additional flow, then this total flow (control valve wide open and bypass valve normal position) shall be considered in the relieving scenario.

The potential for the bypass valve to be inadvertently opened (e.g. during normal operations, control valve maintenance, start-up, shutdown, or special operations) while the control valve is operating (both bypass and control valve wide open) should also be considered unless administrative controls are in place. If the pressure resulting from the opening of the bypass valve can exceed the corrected hydrotest pressure (see 3.1.22 and 4.2.2), reliance on administrative controls as the sole means to prevent overpressure might not be appropriate. The user is cautioned that some systems can have unacceptable risk due to failure of administrative controls and resulting consequences due to loss of containment. In these cases, limiting the overpressure to the normally allowable overpressure can be more appropriate. Note that the entire system, including all of the auxiliary devices (e.g. gasketed joints, instrumentation), should be considered for the overpressure during the failure of administrative controls.

In the yellow highlighted text, it seems that API is giving sizing guidance that if the corrected hydrotest pressure cannot be exceeded then administrative controls can be used to eliminate the inadvertent opening of the bypass valve as a sizing basis for the relief system. Again, Section VIII does not tell users how to size relief devices.

Committee Draft

21

Inadvertent Valve Opening

The inadvertent opening of any valve from a source of higher pressure, such as high-pressure steam or process fluids, should be considered. This action can require pressure-relieving capacity unless administrative controls, as defined in 3.1.2, are in place to prevent inadvertent valve opening. The relief load should be determined using the maximum operating pressure upstream of the valve and the relieving pressure on equipment downstream of the valve. If the pressure source is a pipeline or a production well, the pressure upstream of the valve may reach the maximum shut-in pressure of the source after a shutdown. The user should determine whether inadvertent valve opening combined with maximum shut-in pressure in upstream system is a credible relief case.

The following applies when a manual or actuated valve is inadvertently opened, causing pressure buildup in a vessel. The vessel should have a PRD large enough to pass a rate equal to the flow through the open valve; credit may be taken for the flow capacity of vessel outlets that can reasonably be expected to remain open. The manual or actuated valve should be considered as passing its capacity at a full-open position with the pressure in the vessel at relieving conditions. Volumetric or heat-content equivalents may be used if the manual or actuated valve admits a liquid that flashes or a fluid that causes vaporizing of the vessel contents. It is typical to consider only one inadvertently opened manual or actuated valve at a time, although simultaneous inadvertent opening of multiple valves shall be considered if a common cause is identified (e.g. sequential valve operations). Automatic control failures are discussed separately in 4.4.8.

In the yellow highlighted text, it seems that API is giving sizing guidance that “pressure-relieving capacity” is needed unless administrative controls are used to prevent inadvertent valve opening and the corrected hydrotest pressure cannot be exceed.

Committee Draft

22

4.4.9.3.2.2 Severe Check Valve Leakage

The potential for overpressure caused by reverse flow through one or more check valves in series should be considered where the maximum operating pressure of the high-pressure system is greater than the low-pressure equipment’s corrected hydrotest pressure. The user is cautioned to see 3.1.22 and 4.2.2. Note that the entire upstream system, including vessels, piping and auxiliary devices (e.g. gasketed joints, instrumentation), should be considered for the overpressure scenario.

There is no sizing guidance here just a clear statement that the corrected hydrotest pressure is the basis for determining whether overpressure protection is needed which is contrary to the limits in UG-125(c) if a vessel is part of the system. This needs to be fixed.

Committee Draft

23

4.4.12 Hydraulic Expansion

4.4.12.1 Causes

Hydraulic expansion is the increase in liquid volume caused by an increase in temperature (see Table 2). It can result from several causes, the most common of which are the following.

a) Piping or vessels are blocked in while they are filled with cold liquid and are subsequently heated by heat tracing, coils, ambient heat gain, or fire.

b) An exchanger is blocked in on the cold side with flow in the hot side.

c) Piping or vessels are blocked in while they are filled with liquid at near-ambient temperatures and are heated by direct solar radiation.

Table 2—Typical Values of Cubic Expansion Coefficient for Hydrocarbon Liquids and Water

Gravity of Liquid °API

Cubic Expansion Coefficient a 1/°C (1/°F)

3 to 34.9 0.00072 (0.0004)

35 to 50.9 0.0009 (0.0005)

51 to 63.9 0.00108 (0.0006)

64 to 78.9 0.00126 (0.0007)

79 to 88.9 0.00144 (0.0008)

89 to 93.9 0.00153 (0.00085)

94 and lighter 0.00162 (0.0009)

water 0.00018 (0.0001)

a At 15.6 °C (60 °F). For other temperatures, Equation (4) can be used to estimate the cubical expansion coefficient.

In certain installations, such as cooling circuits, the processing scheme, equipment arrangements and methods, and operation procedures make the elimination of the hydraulic expansion relieving device feasible, which is normally required on the cooler, fluid side of a shell-and-tube exchanger. Typical of such conditions are multiple-shell units with at least one cold-fluid block valve of the locked-open design on each shell and a single-shell unit in a given service where the shell can reasonably be expected to remain in service, except on shutdown. In this instance, closing the cold-fluid block valves on the exchanger unit should be controlled by administrative procedures and possibly the addition of signs stipulating the proper venting and draining procedures when shutting down and blocking in. Such cases are acceptable and do not compromise the safety of personnel or equipment, but the designer is cautioned to review each case carefully before deciding that a relieving device based on hydraulic expansion is not warranted because the corrected hydrotest pressure could be exceeded if the administrative procedures are not followed.

The 6th edition added the reference to the hydrotest pressure and administrative procedures. Although one could consider this sizing guidance, this is different from the previous scenarios where the upstream pressure is known and the failure to follow the administrative controls results in a pressure that is expected to be below the corrected hydrotest pressure. For this scenario, failure to follow the administrative procedure will result in a pressure that in all likely hood will far exceed the corrected hydrotest pressure so why focus

Committee Draft

24

on just the hydrotest pressure. Shouldn’t the user be cautioned that a significant pressure increase can result if administrative procedures are not followed?

4.4.14 Heat Transfer Equipment Failure

4.4.14.1 Requirements

Heat exchangers and similar vessels may require protection with a relieving device of sufficient capacity to avoid overpressure in case of an internal failure. This statement defines a broad problem but also presents the following specific problems:

a) type and extent of internal failure that can be anticipated,

b) determination of the required relieving rate if overpressure of the low-pressure side of the exchanger and/or connected equipment occurs as a result of the postulated failure,

c) selection of a relieving device that reacts fast enough to prevent the overpressure,

d) selection of the proper location for the device so that it senses the overpressure in time to react to it.

Provision of overpressure protection for the heat exchanger and associated pipework does not remove the need for a process hazard analysis to consider the wider process implications of any interstream leakage.

These guidelines were established without considering a chemical reaction in the event that the high-pressure fluid mixes with the low-pressure fluid. If the heat exchanger contains reactive chemicals, then a careful evaluation shall be performed to ensure that the reactive situation does not result in the pressure exceeding the low-pressure side's corrected hydrotest pressure (see 3.1.22 and 4.2.2).

There is no sizing guidance here just a statement that I need to be sure the corrected hydrotest pressure is not exceeded which is contrary to the limits in UG-125(c). This needs to be fixed.

Committee Draft

25

4.4.14.2 Shell-and-tube Heat Exchangers

4.4.14.2.1 Pressure Considerations

Complete tube rupture, in which a large quantity of high-pressure fluid flows to the lower-pressure exchanger side, is a remote but possible contingency. Minor leakage can seldom overpressure an exchanger during operation, however such leakage occurring where the low-pressure side is closed in can result in overpressure. Loss of containment of the low-pressure side to atmosphere is unlikely to result from a tube rupture where the pressure in the low-pressure side (including upstream and downstream systems) during the tube rupture does not exceed the corrected hydrotest pressure (see 3.1.22 and 4.2.2). The user may choose a pressure other than the corrected hydrotest pressure, given that a proper detailed mechanical analysis is performed showing that a loss of containment is unlikely. The use of maximum possible system pressure instead of design pressure may be considered as the pressure of the high-pressure side on a case-by-case basis where there is a substantial difference in the design and operating pressures for the high-pressure side of the exchanger.

Pressure relief for tube rupture is not required where the low-pressure exchanger side (including upstream and downstream systems) does not exceed the criteria noted above. The tube rupture scenario can be mitigated by increasing the design pressure of the low-pressure exchanger side (including upstream and downstream systems), and/or assuring that an open flow path can pass the tube rupture flow without exceeding the stipulated pressure, and/or providing pressure relief.

The user may perform a detailed analysis and/or appropriately design the heat exchanger to determine the design basis other than a full-bore tube rupture. However, each exchanger type should be evaluated for a small tube leak. The detailed analysis should consider the following:

The guidance in the first highlighted text uses the corrected hydrotest pressure as criteria for determining whether a complete tube rupture should be considered. The second highlighted text says each heat exchanger should be evaluated for a small tube leak. The two highlights are providing sizing guidance.

Committee Draft

26

4.4.14.4 Plate-and-frame, Spiral-plate and Welded-block Heat Exchangers

For the purpose of overpressure protection, plate-and-frame, spiral-plate, and welded-block heat exchangers are similar enough in construction that each features the same type of leakage failure modes from the high-pressure side to the low-pressure side. In all three types, the most common cause for leaking from side-to-side is to have an opening (e.g., hole or crack) in a plate although internal plate failures have occurred. Failure mechanisms typically are related to some form of corrosion such as pitting, cracking, or general corrosion.

Note that the plates in these exchangers are better supported than tubes in tubular exchangers, so vibration damage is not likely. In the case of gasket leaks, plate-and-frame heat exchangers are more likely to leak at the external gaskets rather than internally between the high-pressure and low-pressure side. For spiral-plate heat exchangers, a gasket leak will short circuit the flow bypassing loops in the spiral so would not cause an overpressure. The welded-block heat exchanger does not have gaskets.

To evaluate the likelihood for an internal failure, a materials review should be done for new exchangers and inspection records should be evaluated for in-service exchangers. It may be possible to conclude that failure of the plate is so unlikely that no relief system design for plate failure is warranted. On the other hand, past internal leaks or materials susceptible to corrosion would indicate the need to evaluate an internal failure for relief system design. If there is any doubt regarding the likelihood of failure (LOF), then evaluate this scenario in the relief system design.

An internal failure in a heat exchanger need not be considered if the low-pressure side corrected hydrotest pressure exceeds the high-pressure side design pressure. The use of maximum possible system pressure instead of design pressure may be considered as the pressure of the high-pressure side on a case-by-case basis where there is a substantial difference between the design and operating pressures for the high-pressure side of the exchanger. Leakage or failure of external gaskets may be a tolerable risk in some services (e.g. cooling water) but not in others (e.g. hydrocarbon, corrosive, toxic services) because of potential impacts of a release.

There is no sizing guidance here nor a reference to administrative controls just a statement that an internal failure need not be considered if the low-pressure side corrected hydrotest pressure exceeds the high-pressure side design pressure. This is contrary with Section VIII UG-133(d) that states “Heat exchanges and similar vessels shall be protected with a pressure relief device of sufficient capacity to avoid overpressure in case of an internal failure” and UG-125(c). This needs to be fixed perhaps similar to how shell and tube heat exchangers are addressed.

Committee Draft

27

4.4.14.5 Sulfur Recovery Unit Thermal Reactor Waste Heat Steam Generators 4.4.14.5.1 General A special case of heat transfer equipment failure involves a tube failure in a Sulfur Recovery Unit (SRU) Waste Heat Steam Generator (WHSG). Generally, SRU designs are based on the modified Claus process with a thermal reactor that converts hydrogen sulfide to elemental sulfur operating near ambient pressure and at temperatures of about 1700 to 2800°F (925 to 1540°C). The shell side of the WHSG generates steam to cool the thermal reactor effluent gases containing elemental sulfur. WHSG steam-side design pressures range from about 50 to 750 psig (345 to 5170 kPag). The tube side design pressures might range from 15 to 150 psig (105 to 1035 kPag). In contrast to other shell-and-tube heat exchangers, tubes in these WHSG are typically larger (e.g., 2 to 6 inches (50 to 150 mm) in diameter) and fabricated from either schedule piping or boiler tubing. The process side of sulfur recovery units are designed with an open path to the atmosphere that can provide a relief path but some SRU designs contain switching valves that can block or restrict the open relief path to atmosphere. 4.4.14.5.2 Relief Protection Evaluation Procedure PRVs, rupture disks, or other PRDs in a process containing elemental sulfur can be unreliable unless the pressure protection system is properly designed, installed, and maintained to hold the temperature high enough to prevent solidification of elemental sulfur upon cooling. This would result in a restriction or plugging of the PRD and/or the associated inlet and outlet piping. Further, atmospheric relief from a sulfur seal or sulfur pit vent in the vicinity of plant personnel is also a safety concern due to the potential release of molten sulfur along with high concentrations of H2S and SO2 gases. Instead of a PRD, it may be appropriate to provide overpressure protection by system design as the overpressure protection basis for the thermal reactor and other low-pressure side equipment in the SRU. In order to specify appropriate overpressure protection, the type of WHSG internal failures must first be characterized. Sulfur recovery unit WHSG tube failures are not full-bore tube ruptures [1,2] as seen in other shell-and-tube heat exchangers. There have been no reported incidents from the industry to suggest that a full-bore tube rupture has occurred. Instead, other failure mechanisms can occur in multiple tubes (i.e., longitudinal cracks, multiple tube-to-tubesheet joint leaks, or a fish-mouth failure due to dimpled-in tube) whose areas can be conservatively assumed to be equivalent to a full-bore tube rupture area [3]. A review of the industry data demonstrates, while rare, that loss of containment has been reported as a direct result of tube failure due to other failure mechanisms. As a first step, the user may want to apply steady-state analysis techniques to determine if the process side of the SRU can relieve a rate equivalent to the flow rate through double the cross-sectional area of a single tube without exceeding the corrected hydrotest pressure of the thermal reactor and other low-pressure side equipment. The user may choose a pressure other than the corrected hydrotest pressure, if a proper detailed analysis on all affected equipment shows that loss of containment is unlikely. As part of this analysis, the user shall evaluate leaks involving all steam (i.e., tube failure above the WHSG water level), all saturated water (i.e., tube failure below the WHSG water level), and a mixture of both. If the corrected hydrotest pressure is not exceeded, then the considerations given in 4.4.14.5.3 should be evaluated to minimize the potential for the failure mechanisms referenced above. The user shall also consider the potential consequences of process gas releases through paths such as sulfur seal system, sulfur pit vents, combustion air suction piping, or other locations. If steady state modeling shows the corrected hydrotest pressure can be exceeded, then additional considerations are necessary. For example, the designer may decide to utilize a more rigorous dynamic analysis. The user is cautioned against reducing WHSG tube diameter to avoid overpressure due to concerns of high heat flux occurrence at the end of the inlet ferrule [4]. An alternative to dynamic analysis would be to provide overpressure protection by system design as the overpressure protection basis. The considerations given in 4.4.14.5.3 are to be used as part of the detailed analysis by a multidisciplinary team

Committee Draft

28

to determine the magnitude of a WHSG tube rupture and the impact of these mitigations to reduce the likelihood and consequences of a WHSG tube rupture.

I’m not familiar with this equipment but if it’s built to Section VIII using the corrected hydrotest pressure for sizing the relief device is contrary to UG-125(c).

Committee Draft