Relief System Adequacy After an Unreviewed Debottlenecking
A 35-year-old toluene storage and transfer facility is covered by OSHA PSM (29 CFR 1910.119). The two 1,200 m³ tanks have conservation vents and a common relief header. The relief valves were sized in 1990 using API 520 5th edition and a 250 m³/h maximum fill rate. A debottlenecking project last year raised the maximum fill rate to 295 m³/h, an 18% increase, and changed the incoming stream to include a light hydrocarbon heel. No management-of-change review was performed; production argued the change was within the existing design margin. A recent revalidation using two-phase relief sizing under current API 520/521 methods shows the existing relief capacity is inadequate for the new fill rate and fluid. The relief valves were last bench-tested in 2019 and are on a five-year interval. The site's RAGAGEP standard says "API 520 current edition." The compliance audit also found that the 2019 relief-valve test records for one tank are missing.
1. Identify the PSM elements violated and assess whether "grandfathering" protects the existing relief design.
Read the worked answer
The violations center on process safety information and management of change. Under 1910.119(d)(3)(i)(B), the employer must document that equipment complies with recognized and generally accepted good engineering practices. The site's own RAGAGEP standard adopts the current API 520, and the revalidation shows the relief capacity does not meet it for the new fill rate and two-phase flow. Under (d)(3)(ii), relief system design and design basis must be documented; the 1990 basis no longer matches current operation. Under (l), a change in fill rate and feed composition required MOC, including hazard review, before implementation. The missing test records also implicate mechanical integrity under (j).
Grandfathering does not protect the design here. Even if older equipment is not automatically required to meet every new standard, the 18% fill-rate increase and the light hydrocarbon heel are changes that trigger MOC and require the design basis to be updated. The claim of "existing design margin" is not a substitute for relief sizing: two-phase relief behavior changes with fluid properties and fill rate, and a fill-rate margin is not the same as relief capacity margin. The site standard also commits to the current edition, so the organization cannot rely on the 1990 edition as its own RAGAGEP.
2. What interim risk controls would you require while the relief system is corrected?
Read the worked answer
Interim controls should reduce the demand on the relief system and provide independent protection. Immediate actions: reduce the maximum fill rate to the 1990 basis of 250 m³/h or lower until re-rating is complete; stop or limit the light hydrocarbon heel that changes the relief fluid properties; and verify that high-level alarms and shutdowns are functional and independent. If the tanks can be isolated or the feed routed elsewhere, that should be considered.
The interim case should be documented as a temporary MOC with a defined expiry date. A risk assessment should evaluate credible overpressure scenarios: overfill, blocked outlet, external fire, and thermal expansion. If the existing relief capacity is inadequate for any credible scenario, additional protection such as a temporary flare, rupture disk, or independent high-integrity overfill trip may be needed. Operating procedures should include reduced filling limits and verification of vapor space. Emergency response should be briefed on the potential for a relief header overload.
The interim controls should not be treated as a permanent solution. They should be tracked with an owner and completion date, and the tanks should not return to the higher fill rate until the relief system has been re-rated, installed, and tested.
3. Define the corrective action set and the documentation needed to close the audit findings.
Read the worked answer
Corrective actions should follow the hierarchy of controls. Engineering: re-size or replace the relief valves and evaluate the common header for the new two-phase duty; consider a rupture disk, independent high-level trip, or flare upgrade. Administrative: implement MOC for all future rate and feed changes; update operating procedures and training; establish relief-valve test intervals based on service and RAGAGEP. Mechanical integrity: bench-test both relief valves, restore missing records, and add overdue-test tracking.
Process safety information must be updated: relief design basis, maximum fill rate, fluid properties, and RAGAGEP edition. The PHA should be revalidated for the new operation, and the MOC should be completed retroactively with a documented hazard review. A compliance audit follow-up should verify that the site's RAGAGEP standard is applied consistently and that changes in feed composition are screened for MOC.
Closure documentation should include the revised relief calculations, test certificates, updated P&IDs and design basis, MOC records, training records, and a statement of residual risk. The audit finding should remain open until the engineering correction is installed and tested, not merely until the paperwork is complete.