11 replies to this topic

[vanngoc]

Dear all, Do we need to consider the case PSV fails to open on demand? I think PSV is the final layer of protection for process system and the probability of failure is nearly zero (I think)so we do not need consider this case but I read in my client (well-known oil and gas company) existing document, they had considered the case both blocked outlet and PSV failure in the same time (double jeopardy already!!!). Please share your experience. Thank you

[Bobby Strain]

So, what did the client do?

 

Bobby

[fallah]

Dear all, Do we need to consider the case PSV fails to open on demand? I think PSV is the final layer of protection for process system and the probability of failure is nearly zero (I think)so we do not need consider this case but I read in my client (well-known oil and gas company) existing document, they had considered the case both blocked outlet and PSV failure in the same time (double jeopardy already!!!). Please share your experience.

 

vanngoc,

 

If your client had performed a quantitative risk anlysis, it might they considered a much low value for PFD of PSV in mentioned analysis and this can't be a double jeopardy at all...

[Zauberberg]

A non-SIL rated PSV has 0.01 probability to fail on demand. This is the most common figure I have seen being used for PSV.

 

Blocked outlet is an initiating cause, not the consequence. So it is completely legitimate to consider a failure of PSV to react (consequence) upon an initiating event (blocked outlet).

 

LOPA analysis should be used to determine if there is any gap between the intermediate event likelihood (after all layers of protection are accounted for), and the target event frequency (set based on frequency of the initiating event and consequences of unmitigated event).

[vanngoc]

So, what did the client do?

 

Bobby

Dear Sir,

I'm doing detailed engineering now, the existing document that I said above is FEED document. The recommendation is to use mechanical stopper to limit the CV to ensure that pressure will not go higher than design pressure within the closing time of upstream SDV in case of PSV failed.

The question is why we need to consider: blocked outlet and PSV failure in the same time. As per API 521, section 4.4.2.4 " For determining relief loads, it may be assumed that manual or remotely operated valves that are normally open and functioning at the time of inadvertent closure or failure and that are not affected by the primary cause of failure remain in operation at their normal operating positions. A check of possible common mode failures that can affect multiple valves simultaneously (e.g. control systems, electrical equipment, etc.) should be made to assure that the valves are independent and would not be affected by the primary failure", so I think other independent equipment should be in operation.

Please share your point of view

Thank you

 

[vanngoc]

A non-SIL rated PSV has 0.01 probability to fail on demand. This is the most common figure I have seen being used for PSV.

 

Blocked outlet is an initiating cause, not the consequence. So it is completely legitimate to consider a failure of PSV to react (consequence) upon an initiating event (blocked outlet).

 

LOPA analysis should be used to determine if there is any gap between the intermediate event likelihood (after all layers of protection are accounted for), and the target event frequency (set based on frequency of the initiating event and consequences of unmitigated event).

Sir,

Thank you very much for your response.

API 521 give some example of double jeopardy as below...

"Examples of double jeopardy scenarios are ... fire exposure simultaneous with failure of administrative controls to drain and depressure isolated equipment..."

So I think if we consider PSV failure with blocked outlet is double jeopardy! Pressure still built up and can not relief due to PSV failure, so this is a cause, not consequence, right?

Please share your experience.

Regards

[Zauberberg]

Functionality of a PSV is completely separate subject, regardless of the relief scenarios, and it should be approached as such. Installing a PSV and not considering possible failure of the relief valve, is not considered a good practice in risk management.

The fact is that a relief valve can fail. And it can fail to perform only during an overpressure event (it can fail anytime but you will see that it has failed only in the situation when the PSV needs to perform). This cannot be considered as a double jeopardy. An example of double jeopardy would be to have a simultaneous relief from elsewhere in the plant, in parallel with relief from the first PSV. These two events are completely unrelated and that would be a case of double jeopardy.

Secondly, you need to evaluate if a PSV (with given failure rate) is sufficient protection against the incident. That is what LOPA is used for. If for example the probability of PSV failure is 0.01 and the required mitigated event frequency is 0.00001, obviously additional safeguards need to be implemented.

[shan]

There should be 2 levels overpressure protection.  PSH is the primary overpressure protection and PSV is the secondary overpressure protection.  Double jeopardy scenarios refer to 2 independent scenarios (such as fire and blocked outlet) that cause overpressure. Double jeopardy concept does not apply to one overpressure cause (blocked outlet) and one level of overpressure protection (PSV) failure.  You confused 2 apples with 1 apple and 1 orange.

[vanngoc]

There should be 2 levels overpressure protection.  PSH is the primary overpressure protection and PSV is the secondary overpressure protection.  Double jeopardy scenarios refer to 2 independent scenarios (such as fire and blocked outlet) that cause overpressure. Double jeopardy concept does not apply to one overpressure cause (blocked outlet) and one level of overpressure protection (PSV) failure.  You confused 2 apples with 1 apple and 1 orange.

Sir,

The scenario is something like this:

- Due to blocked outlet, the pressure built-up and active PSH, but the closing time of SDV is not fast enough so pressure still raise up and popup PSV. But in this case they considered PSV is failed to open also, that means both two layer of protection is ineffective! Not one of two layers.

- So my question is if we consider blocked outlet and PSV failed to open in the same time is valid and what we can do if PSV, the final layer of protection is failed also.

 

Regards

[fallah]

vanngoc,

 

Would you please upload a simplified sketch of what you are describing....

[Zauberberg]

If closing time of SDV is not sufficiently short to prevent from pressurization, then you cannot account the SDV as a layer of protection in that case.

 

You can decrease the closing time by using exhaust booster on the valve actuator. This will make SDV an additional layer of protection.

As for the second question, you can have a SIL-rated PSV and this will effectively reduce its probability to fail on demand.

[shan]

Then, you have to add the third layer of protection PSE (Rapture Disk).