Consider HIPS for Reactive Processes

Such safety-instrumented systems offer advantages over pressure relief valves

1 of 2 < 1 | 2 View on one page


    An uncontrolled reaction can cause overpressure in a vessel and thus lead to significant safety hazards. Industry standards from the American Petroleum Institute and the American Society of Mechanical Engineers provide criteria for the design and protection of vessels from rupture and damage caused by excess pressure.

    Pressure relief valves (PRVs) generally are used to meet API Recommended Practice 521 [1] and ASME Boiler and Pressure Vessel Code, Section VIII [2]. However, safety instrumented systems (SIS) called high integrity protection systems (HIPS) provide an attractive alternative in many cases. This article discusses how to assess, design and implement an HIPS.

    Usual practice
    In conventional design, the primary means of protection against vessel overpressure is a PRV. It is a simple mechanical device that opens when pressure exceeds a set level. The pressure is relieved through the PRV to the atmosphere or to a contained collection system such as a flare, scrubber or thermal oxidizer.

    PRVs boast relatively high integrity, as long as they are properly sized, located, inspected and maintained. Table 1 summarizes reliability data for a single-valve relief system, as published in "Guidelines for Process Equipment Reliability Data" [3]. It shows substantial uncertainty in the failure to open on demand.

    Reactive chemicals and their associated processes present complex scenarios for PRV design. Small deviations in reactant concentration or reaction conditions can put the reaction on a path that the process design, control system and operator procedures cannot adequately manage. Unfortunately, many PRVs are improperly sized for reactive processes, because relief rate calculations often are based on a design and operational envelope that ignores potential reaction paths that are not well understood.


    Numerous incidents, including those at Georgia Pacific (Columbus, Ohio, 1997), Morton International (Paterson, N.J., 1998), Concept Sciences (Hanover Township, Pa., 1999), Chevron Phillips Chemical Co. (Pasadena, Texas, 1999) and BP Amoco (Augusta, Ga., 2001), have proved that there are reactive scenarios under which a PRV is ineffective. They point to a number of general scenarios in which PRVs should not be considered:

  • Reaction generates pressure at an uncontrollable rate (e.g., runaway reaction or decomposition) such that an impractically large vent area is required or, in the worse case, an adequately sized PRV is not possible;
  • Reaction takes place in a localized area (e.g., hot spots), propagating pressure at a rate so fast that containment is lost before PRV is able to act;
  • Reaction occurs in a localized area, raising temperature above thermal decomposition point and causing an internal detonation or fire;
  • Reaction produces, during normal operation, materials that partially or completely block PRVs; and
  • Polymerization reaction continues as material is being relieved through PRV into lateral headers, plugging the relief device or lateral header.

    Thus, the very nature of the reactive process often makes a PRV impractical. For such cases, HIPS should be investigated as a means to supplement the PRV for overpressure protection.

    Hazard analysis
    Successful implementation must be based on a hazard analysis of each potential overpressure scenario. The analysis should follow a structured systematic approach, using a multidisciplinary team. It should document the event propagation from the initiating cause to the final consequence (also referred to as the "overpressure scenario"). The analysis must examine operating and upset conditions that result in overpressure. It must include a thorough review of each step involved in startup and shutdown, in addition to normal operation. For batch and semi-batch processes, scrutinize each step of the operation using typical deviations and batch-oriented deviations, such as skipped steps, steps out of sequence, steps incomplete, steps at wrong time, recipe incorrect, etc.

    The analysis should include a detailed examination of reactive scenarios and brainstorming on potential reaction paths that could lead to high pressure. Examine all reaction paths, including those that may require multiple errors or failures to begin propagating. Once the reaction paths are understood, HIPS can be designed to address each reaction scenario. In many cases, only one or two HIPS are required for mitigation of all potential reaction scenarios.

    Detailing critical conditions
    A safety requirement specification (SRS) describes how and under what conditions the HIPS will mitigate each overpressure scenario; it includes a functional logic description with trip set points and device fail-safe state. Choosing when and under what conditions to trip the unit is probably the most difficult decision to make in the design of the HIPS. For reactive processes, the design is often complicated by the process dynamics and by intricate process variable interactions.

    HIPS design may use single process variables when the reaction path is relatively easy to detect. For example, on high temperature the HIPS will stop the catalyst feed or, on high pressure it will inject reaction kill solution. Single process variables also can prevent the start-up of the reactor under unsafe operational conditions. For example, the catalyst cannot be added until a fixed volume of solvent, which serves as a heat sink, is in the reactor.

1 of 2 < 1 | 2 View on one page
Show Comments
Hide Comments

Join the discussion

We welcome your thoughtful comments.
All comments will display your user name.

Want to participate in the discussion?

Register for free

Log in for complete access.


No one has commented on this page yet.

RSS feed for comments on this page | RSS feed for all comments