Relief Valve Sized for Fire, Not for Cooling-Water Failure
A depropanizer's overhead condenser uses 3,500 gpm of cooling water, and the steam-heated reboiler supplies 40 MMBtu/h. The overhead vapor has a latent heat of about 140 Btu/lb. The column is protected by a relief valve set at 275 psig that was sized, in the original design basis, for the fire case on the reflux drum at 15,000 lb/h. The flare header was sized for that same case. During a PHA revalidation someone asks what happens if the cooling-water supply is lost. There is no low-flow trip on the cooling water, and the reboiler steam valve is air-to-open with a manual station. There is no spare cooling-water pump.
1. Estimate the relief load for a total cooling-water failure and compare it to the installed relief capacity.
Read the worked answer
With the condenser dead, the reboiler keeps boiling until the column reaches the relief set pressure. The vapor rate is set by the reboiler duty at that moment:
W = Q/λ = 40 × 10⁶ Btu/h ÷ 140 Btu/lb = 285,700 lb/h
Installed relief capacity = 15,000 lb/h
Ratio: 285,700 / 15,000 ≈ 19 times undersized.
That number is only the first-order vapor load. Two factors make it worse:
- The reboiler duty does not fall much before the relief opens, because the steam-side condensing temperature is set by the steam header pressure and the column pressure is still climbing toward the set point - the driving ΔT in the reboiler is still large.
- The relief temperature and the volumetric flow at 275 psig are far beyond the fire case, so the flare header, the RV inlet line, and the knockout drum are all potentially undersized. A 19× vapor load is a header and flare capacity problem, not just a valve problem.
Conclusion: the column is not protected against a loss of cooling water. The fire case, though it governs the original design basis, is not the worst credible scenario for this column.
2. Evaluate the possible fixes and recommend one, with the conditions required for it to be valid.
Read the worked answer
Option A - size the RV and flare for 285,700 lb/h. A very large valve, a larger inlet and outlet line, and a larger flare header. This is the most defensible answer but usually the most expensive, and the existing nozzle and header may not accommodate it. Check first whether the header can take it; often it cannot, which turns a valve change into a flare system project.
Option B - take credit for a safety instrumented function in the relief design basis (API 521 allows it with a documented LOPA). Install a low-cooling-water-flow / high-column-pressure trip that closes the reboiler steam valve (change it to fail-closed, or add a trip valve in series), credited as an independent protection layer in a LOPA at the required SIL per IEC 61511. The RV then remains sized for the next-largest credible scenario, which is the fire case. Conditions that must all be met, or the credit is not real:
- Redundant, diverse sensors with proof testing at the credited interval.
- Logic solver and final element rated to the required SIL; the final element is usually the weak link.
- Documented, approved LOPA and updated relief design basis; client and authority acceptance.
- Residual load check: after the trip, the column inventory and the reboiler's thermal inertia still flash vapor. Estimate that surge - it may be on the order of minutes of the 40 MMBtu/h boilup - and confirm the RV and header handle it. This is frequently where Option B fails.
- Management of change, P&ID and cause-and-effect updates, operator training, and a revalidation of the PHA.
Option C - eliminate the demand. Add a low-flow alarm and an automatic trip, and install a spare cooling-water pump or a backup water source. Reducing frequency reduces the risk but does not by itself protect against the consequence scenario, so it supplements but does not replace A or B.
Recommendation: Option B with a rigorous residual-load analysis, plus a spare cooling-water pump if the plant can fund it. If the LOPA cannot support the credit, fall back to Option A and accept the flare header work. Do not leave the column relying on operator response to a low-flow alarm - a 3,500 gpm water loss gives minutes, not hours.
3. What else in the relief system would you check before signing off on the design basis?
Read the worked answer
Mechanical and hydraulic checks on the RV itself
- Inlet line pressure loss under the relief load must be under 3% of set pressure for a conventional valve; recalculate at the higher possible flow.
- Block valves on the RV inlet and outlet must be car-sealed or chain-locked open and listed in the lock list.
- Verify the RV set pressure against the vessel MAWP and the allowable accumulation (10% for a single valve, 21% for multiple/fire per the applicable code), and confirm the fire case is still the governing case after any change.
System checks
- Flare header hydraulic capacity and the back pressure at the RV outlet under the worst simultaneous relief case (a header is sized for one scenario, not for the sum of scenarios).
- Knockout drum liquid handling and the flare tip velocity.
- Whether the column's other relief paths (e.g., a rupture disc or a vent to a scrubber) exist and are independent.
Administrative
- Reissue the relief design basis document with the cooling-water-failure scenario and the LOPA written in, not just the fire case.
- Update the P&IDs and the cause-and-effect matrix for the new trip, and set a proof-test interval with a named owner.
- Record it all through management of change and revalidate the PHA before the unit restarts.