WHEELER

FOSTER

PROCESS PLANTS DIVISION

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE CONTENTS
1.0-1
REVISION
0
DATE
September 1978

CONTENTS

PAGE

1.0

GENERAL

1.0-1

2.0

EVALUATION OF RISKS

2.0-1

3.0

CODES AND RECOMMENDED PRACTICES

3.0-1

3.1
3.2
3.3
3.4
4.0

API Recommended Practices

DIERS Methodology
High Integrity Trip Systems
Dynamic Simulation

SUGGESTIONS FOR DISPOSAL OF RELIEVED GASES

4.1 Atmospheric Discharge
4.2 Flare System

5.0

MISCELLANEOUS SAFETY DESIGN CRITERIA

5.1
5.2
5.3
5.4
5.5

Heaters
Machinery
Tankage
Vapor Filled Systems
Equipment Spacing

3.0-1/2
3.0-2
3.0-3
3.0-3/4
4.0-1
4.0-1/2
4.0-2
5.0-1
5.0-1
5.0-2
5 0-2/3
5.0-4
5.0-4

FOSTER

WHEELER

PROCESS PLANTS DIVISION

1.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
1.0-1
REVISION
0
DATE
September 1978

GENERAL

Every design must be checked to insure that adequate facilities have been
provided to prevent explosions and to keep under control the effects of
accidents such as fires, operating mistakes or operational failures.
The scope of Standard 600 is the provision of rules for designing safety
facilities for process equipment protection. These rules are based on pertinent
codes and recommended practices, backed by design and operating
experience.

FOSTER

WHEELER

PROCESS PLANTS DIVISION

2.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
PAGE
REVISION
DATE

601
2.0-1
0

September 1978

EVALUATION OF RISKS
The process fluid handled is an important factor in risk evaluation. Volatile
materials, with a vapor pressure at ambient temperature greater than atmospheric
pressure, are generally a greater fire and explosion hazard than heavier stocks,
since these "light stocks" will boil at ambient conditions generating dangerous
vapor-air mixtures. The flash point of liquid stocks should also be considered - the
lower the flash point, the more dangerous is the liquid.

WHEELER

FOSTER

PROCESS PLANTS DIVISION

3.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
3.0-1
REVISION
1
DATE
December 1999

CODES AND RECOMMENDED PRACTICES

Each engineering or production company has developed its own rules on specific
problems related to safety of process plants.
Design of safety facilities is regulated by national and local codes which vary from
country to country. These codes generally do not cover all aspects of safety but
dictate specific rules on the most critical areas, such as requirements for safety
valves on pressure vessels.
To develop a satisfactory design of safety facilities it is, therefore, necessary to
integrate the rules given by the National, local, and Client codes with
recommended practices, which are not mandatory but have been broadly
accepted by the industry and proven by experience.
3.1

API Recommended Practices

The most well known collection of recommended practices has been
assembled by the American Petroleum Institute. This collection is the result of
several years work by engineers of the petroleum industry and was originally
intended to supplement the information set forth in Pressure Vessel Section
VIII of ASME Boiler and Pressure Vessel Code. However, the
recommendations given by API are not intended to supersede applicable
laws and regulations.
API Recommended Practices, not being a code, does not inhibit purchasers
and producers from purchasing or producing products made to
specifications other than API and, in addition, API disclaims any
responsibility for loss or damage resulting from the application of their
Recommended Practices.
The API Recommended Practices related to relief systems are condensed in
the two following reports :
- API RP 520 : Sizing, selection, and installation of pressure relieving
devices in refineries
Part I, Sixth Ed, March 1993
Part II, Fourth Ed, December 1994
- API RP 521 : Guide for pressure relieving and depressuring systems,
Fourth Ed, March 1997.

WHEELER

FOSTER

PROCESS PLANTS DIVISION

3.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
3.0-2
REVISION
1
DATE
December 1999

CODES AND RECOMMENDED PRACTICES

3.1

API Recommended Practices

(contd)

The order of priority for the application of codes is the following:

1)
2)
3)
4)

National and local codes

Client code and specifications
API recommended practices
Foster Wheeler practice

If National and Client codes are less stringent and less conservative than API
and FW practice, then the latter shall be used and the Client should be
informed. If the Client rejects the API or FW recommendation, he shall be
requested to confirm in writing.
Note that, on some contracts the client required that NFPA 30 code be
followed in sizing storage tank and vessel relief valves for fire load (refer to
standard 602, 4.1.4-D.6). These requirements are more stringent than API.
3.2. DIERS Methodology
The Design Institute for Emergency Relief Systems (DIERS) was formed in
1979 under the auspices of the American Institute of Chemical Engineers
(AICHE) to develop methods for the design of emergency relief systems to
handle runaway reactions.
Of particular interest is the prediction of when two-phase flow venting would
occur and the applicability of various sizing methods for two-phase vaporliquid flashing flow.
The DIERS research results are available as :
Technical Publications.
SAFIRE Emergency Relief System Design Computer Program : this
program describes functionally the multiphase dynamics for emergency relief
of a batch reactor or storage vessel (based on blowdown and runaway
reaction experimental tests).

FOSTER

WHEELER

PROCESS PLANTS DIVISION

3.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
3.0-3
REVISION
1
DATE
December 1999

CODES AND RECOMMENDED PRACTICES

3.3. High Integrity Trip Systems
High Integrity Trip Systems (HITS) are complex instrumentation systems
which have been recently provided to prevent overpressure. They can be
used in association or not with pressure relief valves.
It consists on multiple detectors and shutdown valves with signal voting
systems. The complexity of the typical instrumentation used requires a
systematic approach in order to assure a reliable trip system (refer to
process standard 603 2.2.4 for design and testing considerations).
However note that for most companies, the method of overpressure control
with the only use of HITS is not acceptable.
A HITS could be used in the following cases :
- when a flaring limitation exists,
- to reduce potential hazards caused by atmospheric relief,
- when the cost and size of any closed system is too high and the
complexity of the proposed installation is well beyond the normal operation
of the system. However, when comparing the two costs, the cost of testing
and maintenance of instrumentation shall be included,
- to avoid or preserve high loss of materials.
An effective use of the HITS proceeds in three phases : in the first phase, it
has to be determined if this system is supported by Owner's standards and
procedures. In the second phase, attention is focused in the hazards analysis
and on the most important sources of losses. In the third phase action is
taken to provide a complete package specification establishing the
appropriate details and data : scope of supply, system design, test facilities,
system reliability and availability, reliability characteristics.
3.4. Dynamic Simulation
It should be first noted that dynamic simulation tools are still under
development. The purpose of this chapter is only to give a very basic
information on this subject.

FOSTER

WHEELER

PROCESS PLANTS DIVISION

3.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
3.0-4
REVISION
1
DATE
December 1999

CODES AND RECOMMENDED PRACTICES

3.4. Dynamic Simulation (contd)
A key area of interest of dynamic simulation for safety is the analysis of flare
header systems during relief scenarios. This more accurate methodology for
design and analysis of such systems can be used either to :
-

reduce size of new headers,

allow additional loads to be added to existing headers (if limiting
conditions were already met).

The recommended approach is to consider first steady state gross relief

rates for all relief loads (traditional approach), and then to use a dynamic
representation of major relief loads. The last step is to achieve a reliability
study exploring the impact of additional protective equipment.
The dynamic representation of a relief load takes for instance into account
liquid hold-up of the system, reduction of reboiler heat input due to T
suppression, delay in overhead condenser flooding .

WHEELER

FOSTER

PROCESS PLANTS DIVISION

4.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
4.0-1
REVISION
1
DATE
December 1999

SUGGESTIONS FOR DISPOSAL OF RELIEVED GASES

Many considerations influence the disposal and handling of relief streams :
a)

Present and anticipated National and local regulations concerning pollution

and noise.

b)

Properties of relieved stream :

- toxicity
- flammability (flash point, explosive limits, auto-ignition temperature)
- potential entrained liquid
- possible chemical reaction of mixed chemicals
- presence of corrosive compounds
- vaporization of liquid or condensation of vapor
- odor
- combustion properties
- smoke
- particulate matter

c)

Prevailing meteorological conditions.

4.1

Atmospheric Discharge
Atmospheric discharge is generally simple and economic, but often not
allowed by National or local codes.
For direct discharge of vapors to the atmosphere, they should be below their
auto-ignition temperature, and should meet one of the following requirements
:
- Vapors of any molecular weight that are non-flammable, non-toxic and
non-condensable.
- Flammable vapors of molecular weight less than 28.9 (MW of air).
- In addition, some customers may accept discharge to atmosphere of
flammable vapors with molecular weight up to 100 when exit velocity in
above 500 fps, based on maximum capacity of the relief valve (see 3.2
of sect. 604).

WHEELER

FOSTER

PROCESS PLANTS DIVISION

4.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
4.0-2
REVISION
1
DATE
December 1999

SUGGESTIONS FOR DISPOSAL OF RELIEVED GASES

4.1

Atmospheric Discharge

(contd)

In all other cases relieved fluids should be disposed to a flare system.

The atmospheric discharge may be done :
a)

Through a short tail pipe directly from the relieving device to

atmosphere,

b)

Through a closed disposal system terminating in a vent stack.

Quenching steam may be piped into atmospheric discharge of safety valves

to minimize the hazard of ignition.
4.2

Flare system
A flare is chosen for disposal of flammable, toxic or corrosive vapors, which
can be converted to less objectionable compounds by combustion.
Potential hazards and problems avoided by a flare system are :
- formation of flammable mixtures at grade level or on elevated structures
- exposure of personnel to toxic vapors or corrosive chemicals
- ignition of relief streams at or near point of emission
- air pollution
- excessive noise level
The availability of plot space may limit the size of a flare and require staging
some discharges to atmosphere if local regulations permit.
Refinery main column overheads are sometimes discharged to atmosphere,
rather than to a closed system, to avoid the need of oversizing headers and
blowdown system (where air quality regulations allow this). This should only
be done at client request.
Often chemical plants are not provided with a flare. Technical reasons for this
may be non-availability of fuel gas for pilots, or the difficulties arising from the
combustion of particular compounds (e.g. chlorinated hydrocarbons generate
HCl, which is highly corrosive ; monomers might, on being heated,
polymerize and clog pilots). These compounds can either be incinerated or
discharged to atmosphere. In any case this should be reviewed with the
client.

WHEELER

FOSTER

PROCESS PLANTS DIVISION

5.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
5.0-1
REVISION
1
DATE
December 1999

MISCELLANEOUS SAFETY DESIGN CRITERIA

In addition to the installation of adequate facilities for process equipment
protection in case of accidents, various design criteria should be followed in order
to minimize the possibility of hazardous situations in the plant and/or to limit the
damage in case of accident.
A few examples of protective devices and safe operating procedures for
miscellaneous types of equipment or hazardous situations are shown below :
5.1

Heaters
- A knockout drum should be provided on the fuel gas supply to each heater
(or group of heaters when located close to each other) to keep
condensate out of the heaters. A slug of fuel gas condensate entering a
gas-fired heater can extinguish the flame and flood the floor of the firebox
and upon reignition cause serious fire damage of the heater and/or
adjacent equipment.
- Adequate facilities should be provided to prevent fuel entering a heater
after a flame-out ; this could cause a serious explosion or fire inside the
heater. To ensure safe operation, it is necessary either to immediately
reignite every burner which has gone out or to shut off the fuel supply. A
system is required to ensure the absence of flammable gas or vapors
from the firebox before an attempt is made to re-ignite the burners after a
flame-out. In the case of heaters with combustion air fans, this can
comprise a Burner Management System (BMS) which only allows pilot
ignition to be attempted after a suitable period of air flow through the
firebox to purge any flammable material.
- Flame-out protection may be provided by continuous gas pilots and by
flame scanners, both being generally preferred for process heaters and
the latter for steam boilers.
- Snuffing steam injection facilities to the firebox and headers should be
provided.

WHEELER

FOSTER

PROCESS PLANTS DIVISION

5.0

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
5.0-2
REVISION
1
DATE
December 1999

MISCELLANEOUS SAFETY DESIGN CRITERIA

5.2

Machinery
To avoid damage to very expensive machinery such as steam and gas
turbines, compressors, gas and diesel engines, etc., automatic trip devices
to prevent overspeed, overtemperature, overpressure or overload are usually
provided, as well as protection against reverse flow. It is understood that
these devices are not a substitute for safety valves, if required.
Serious damage could result in case of liquid carry-over into a running
compressor. To prevent this risk, suction and interstage knockout drums are
provided ; and the suction line from the knock-out drum to the compressor is
generally insulated and steam traced to prevent condensation.

5.3

Tankage
Serious fires can occur in case of a high flowrate of hydrocarbon vapors
vented to the atmosphere from storage tanks. To prevent this, it is necessary
to limit the temperature of any stream entering an atmospheric storage tank
to a value such that the true vapor pressure of the stream does not exceed 13
psia (for a sea level storage tank).
In addition, to prevent explosions due to sudden generation of steam inside
the tank, storage temperatures in the range between 200F and 250F
should be avoided.
Basic information is given hereafter for some events which may happen for
tankage in situations related to fire or operating contingencies, with
potentially catastrophic consequences (particularly for boil-over).
Boil-over (from NFPA 30) :
An event in the burning of certain oils in an open top tank when, after a long
period of quiescent burning, there is a sudden increase in fire intensity
associated with expulsion of burning oil from the tank. Boil-over occurs when
the residues from surface burning become more dense than the unburned oil
and sink below the surface to form a hot layer, which progresses downward
much faster than the regression of the liquid surface.

FOSTER

WHEELER

PROCESS PLANTS DIVISION

SAFETY
DESIGN PHILOSOPHY

PROCESS STD
601
PAGE
5.0-3
REVISION
1
DATE
December 1999

5.0 MISCELLANEOUS SAFETY DESIGN CRITERIA

Boil-over (from NFPA 30) : (contd)
When this hot layer, called a "heat wave", reaches water or water-in-oil
emulsion in the bottom of the tank, the water is first superheated and
subsequently boils almost explosively, overflowing the tank. Oils subject to
boil-over consist of components having a wide range of boiling points,
including both light ends and viscous residues.
These characteristics are present in most crude oils and can be produced in
synthetic mixtures.
Slop-over (from NFPA 30) :
A minor frothing that occurs when water is sprayed onto the hot surface of a
burning oil.
Froth-over (from NFPA 30) :
Not associated with a fire but resulting when water is present or enters a tank
containing hot viscous oil. Upon mixing, the sudden conversion of water to
steam causes a portion of the tank contents to overflow.
Roll-over :
Due to stratification in an atmospheric storage tank. Roll-over is a
spontaneous and sudden migration of a substantial mass of liquid from the
bottom of the tank to the surface.
The effects of roll-over can typically be :
release of large quantities of vapor which can overpressure the tank,
wall-base or wall-roof failure related to the movement of the tanks
contents.
Temperature stratification leading to rollover might occur in refrigerated
atmospheric storage tanks (LPG, ammonia).
Also stratification may occur in tanks containing viscous product and filled
batchwise.

SAFETY
DESIGN PHILOSOPHY

WHEELER

FOSTER

PROCESS PLANTS DIVISION

5.0

PROCESS STD
601
PAGE
5.0-4
REVISION
1
DATE
December 1999

MISCELLANEOUS SAFETY DESIGN CRITERIA

5.4

Vapor Filled Systems

Vessels containing only gases (no liquid level) are subject to stress rupture
during a fire, even though pressure does not exceed maximum allowable
working pressure plus accumulation. It is therefore advisable to
provide an emergency vapor depressuring system capable of quickly
reducing the pressure inside the vessel to a level where stress rupture of the
material due to high temperature is not of immediate concern (Refer to API
RP 521, 3.19).

5.5

Equipment Spacing
In the design of the layout of new plants, sufficient spacing between
equipment should be provided to ensure that adequate separation exists for :
1.

Safety

(isolation to contain a fire or to minimize the involvement of

adjacent facilities ; access for fire fighting)

2.

Access for operation and maintenance.

National or local codes specify minimum distances between the various

components of a refinery. In addition Major Refiners have their own
specifications or recommended minimum distances between various types
of equipment. When necessary, the latter recommended spacings may be
reduced after evaluation of the risk involved and a decision by Owner to
accept it. In case reduced spacing is accepted, additional safety and fire
protection facilities may be required to compensate for the greater risk.