Pressure Relief and Flare Systems — A Design Overview

Introduction

Every pressurised facility needs a credible answer to a single question: when something goes wrong, how does the energy get out without taking the plant with it? Pressure relief and flare design is that answer. It is not one system but a layered set of them — a relief valve that opens on overpressure, an emergency depressurisation system that drains a vessel before fire ruptures it, a header that collects every release, a stack that burns it at a safe radiation level, and an instrumented protection layer that prevents the overpressure in the first place.

These pieces are usually engineered by different specialists, sized against different standards, and written up in separate documents — which is exactly why they are so often mismatched. This post is the overview that joins them. It walks the relief and flare architecture end to end, shows where each part hands off to the next, and links to the detailed treatment of each. Think of it as the map; the individual posts are the territory.

The Relief and Depressuring Hierarchy

It helps to see the protective measures as a hierarchy, from "prevent the overpressure" to "survive the consequence":

1. Prevent it — instrumented trips and, where the risk justifies it, a high-integrity pressure protection system (HIPPS) that closes in the source faster than the pressure can build, letting downstream equipment be designed for less than full source pressure.
2. Relieve it — a pressure safety valve (PSV) that lifts at set pressure and protects against overpressure once it has occurred.
3. Depressure it — an emergency depressurisation (blowdown) system that empties a vessel under fire, before the hot wall ruptures.
4. Collect and burn it — the flare header that gathers every release and the flare stack that combusts it at a controlled, safe radiation level.

Each layer has a standard governing it: API 520/521 for relief and depressuring, API 526 for valve hardware, API 537 and 521 for the flare itself, IEC 61511 for the instrumented layers. The art is keeping the load and philosophy consistent across all four — the relief loads feed the header sizing, the depressuring transients often dominate that header, and the instrumented layer changes what relief is even credible.

Relief Valves — The Workhorse Layer

The PSV is the device most engineers picture first. It is a self-actuated, spring-loaded valve that lifts when the system reaches its set pressure and reseats when the pressure falls back. Its job is narrow and absolute: stop the protected equipment exceeding its design pressure for the governing credible scenario.

Two recurring sub-problems have their own dedicated treatment:

• The thermal-relief case — a small, well-bounded overpressure from trapped-liquid thermal expansion. Knowing when a thermal relief PSV is needed and how to size one is a core skill, precisely because the case is small enough that the area calculation rarely governs and mechanical stability does.
• Keeping the valve trustworthy in service — a PSV that passes installation but is never maintained is a liability, not a safety device. Routine PSV maintenance and a justified risk-based inspection interval are what let you claim the valve will actually lift on demand.

A relief valve protects a healthy vessel against overpressure. It does not protect a vessel whose steel is being weakened by fire faster than the valve can bleed it down — that is a different problem.

Emergency Depressurisation — The Fire Case

When a vessel is engulfed in fire, the unwetted wall heats toward flame temperature in minutes and loses strength faster than any relief valve can reduce the pressure behind it. The cure is to actively dump the inventory: an ESD-actuated blowdown valve discharging through a restriction orifice into the flare header, sized to bring the vessel below a safe pressure inside the time it takes the wall to reach the danger zone.

The governing rule — depressure to 50% of design pressure (or 6.9 bar(g)) within 15 minutes — and its surprising side-effect (the auto-refrigeration that the blowdown itself produces, which can drive the vessel's material grade) are worked through in detail in emergency depressurisation and blowdown to API 521. The key architectural point for this overview: the blowdown transient is frequently the single biggest load the flare header ever sees — bigger than any relief valve — so the depressuring philosophy (simultaneous vs. sequential) has to be settled before the header can be sized.

The Flare Network — Collecting Every Release

Every relief and blowdown discharge has to go somewhere. The flare header collects them and routes them through a knock-out drum (to drop out liquids) and a seal drum (to stop flashback) to the flare tip. Sizing the network is a back-pressure problem: the header and tail-pipes must be large enough that, at the governing simultaneous-release case, the built-up back-pressure does not push any contributing relief valve beyond its allowable limit.

The governing case is rarely the sum of every device opening at once; it is the worst credible coincident scenario — typically a plant-wide power failure or a global blowdown. Flare network sizing to API 521 covers how that scenario is built and how the header is hydraulically sized against it.

The Flare Stack — Radiation and Siting

Once the header capacity is fixed, the stack has to burn the gas without exposing people or equipment to excessive thermal radiation. The stack height and the radius of the exclusion zone are set by the radiation a person or a piece of equipment can tolerate — commonly 4.73 kW/m² at the boundary for a few seconds of escape, lower for continuous exposure. The flare-tip Mach number, the gas heating value, and wind all feed the calculation. Flare radiation and stack siting to API 521 works through the radiation model and how it drives stack height and layout — often a binding constraint on a weight- and space-limited offshore deck.

The Instrumented Layer — Preventing the Relief Case

The cleanest way to handle a relief load is to make it incredible in the first place. Where an instrumented function can be shown to be reliable enough, it can either reduce the demand on the relief system or, with a HIPPS, allow downstream equipment to be rated below full upstream pressure — trading a large mechanical relief system for a high-integrity instrumented one.

That trade is governed by functional safety under IEC 61511 and the integrity target comes from a SIL determination using LOPA. The relief engineer and the safety engineer must agree the split: every claim that an instrumented layer prevents a relief case must be backed by a SIL that the functional-safety lifecycle can actually deliver and maintain. HIPPS is the most demanding example — typically SIL 3 — and it only makes sense when the saving in flare and relief hardware outweighs the lifecycle cost of the instrumented function.

Worked Example — Why the Header Is Sized by Blowdown, Not Relief

Scenario (illustrative): an offshore gas-processing module with three vessels on a common flare header.

If the header were sized only on the relief loads, the governing simultaneous case might be ~30–40 t/h (not every relief valve opens in the same scenario). But on a confirmed-fire ESD, all three vessels blow down. Sum the opening blowdown transients and the instantaneous header load is 138 t/h — three to four times the relief case. Size the header on the relief loads and the first real blowdown over-pressures it, pushing back-pressure onto the relief valves that are also trying to lift.

The fix is the philosophy, not the pipe. Stagger the blowdowns — a sequential cascade that fires the vessels in timed steps rather than together — and the peak instantaneous load drops to roughly the largest single contributor plus the tail of the others, perhaps ~85–90 t/h. That is a much cheaper header, achieved by changing the ESD logic, not the steelwork. This is the central lesson of relief-and-flare design: the systems are coupled, and the cheapest design comes from getting the philosophy right early, not from oversizing one component in isolation.

Common Pitfalls

• Sizing the flare header on relief loads alone. Blowdown transients usually dominate. Fix the depressuring philosophy (simultaneous vs. sequential) before sizing the header.
• Treating relief and blowdown as interchangeable. They protect against different failures — overpressure of a healthy vessel vs. fire rupture of an overheated one. Many vessels need both.
• Claiming instrumented credit the SIL can't support. Reducing a relief load because "the trip will catch it" only holds if the function meets the required SIL and is maintained for life. Reconcile the relief basis with the LOPA.
• Ignoring auto-refrigeration. The cold a blowdown produces can drive the vessel and tail-pipe material grade. It never shows up on the relief or fire calc — only on the depressuring transient.
• Forgetting maintenance in the reliability claim. A relief valve only counts as a protection layer if a maintenance and inspection programme keeps it proven to lift.
• Letting radiation siting be an afterthought. On a tight deck, the flare exclusion zone can be a binding layout constraint. Bring stack siting into the layout early, not after the structure is fixed.

Conclusion

Pressure relief and flare design is one coupled system wearing five hats: prevent, relieve, depressure, collect, and burn. The instrumented layer changes what relief is credible; the blowdown transient usually sizes the header; the header back-pressure constrains every relief valve; and the radiation footprint can drive the layout. Engineer them in isolation and the mismatches surface late and expensively. Engineer them as a whole — with the philosophy fixed early — and each layer does its job without forcing the next one to be oversized.

Use the linked deep-dives for the detail on each part. If you are putting a relief and flare philosophy together for a new facility or want a second pair of eyes on an existing one, get in touch — relief and flare assurance is core to our process safety work.