HIPPS Retrofit: Do You Need a Smaller PSV Orifice?

The argument shows up the same way every time: the relief study gets reopened after a high-integrity protective system is added to the steam supply, the required relief rate for the column drops by half, and two people read the result differently. One says the PSV orifice must shrink. The other quotes a corporate relief-systems guideline that says leave the valve alone. Both can be correct, because they are answering different questions — one about sizing basis, one about load accounting. Work the branches in order and the disagreement resolves itself.

Start With the Relief Case Table, Not the Orifice

A PSV orifice is set by one number: the largest required relief rate among all credible overpressure scenarios that remain after credits are applied. A HIPPS on the steam valve removes exactly one thing — the heat-input-driven overpressure case (steam control valve fails open, reboiler duty runaway, whatever your cause-and-effect calls it). It removes nothing else.

Pull the relief scenario summary for that column and list every case with its required rate:

• External fire (pool fire on the column and its skirt/zone)
• Loss of cooling / loss of condensing (overhead condenser, CTW or air-cooler failure)
• Loss of reflux
• Blocked outlet on the vapor line or on the bottoms
• Excess heat input via the reboiler — the case the HIPPS addresses
• Tube rupture, if the reboiler or condenser is a high-pressure exchanger
• Thermal expansion, abnormal feed composition, utility failures

Rank them. The HIPPS is only relevant if the excess-heat-input case is at the top of that list. That is the first check, and most of the disagreements you will hear never got past it.

Check 1: Which Case Sets the Existing Orifice?

Compare the required orifice area for the excess-heat-input case against the required area for the next-largest case.

1. If the heat-input case governed and the next case is much smaller — a smaller orifice is genuinely available. Continue to Check 2.
2. If fire or loss of cooling governed already — the HIPPS changes nothing about the PSV. Keep the existing valve. Do not spend another hour on orifice arithmetic; that is not the fault. The HIPPS still earns its keep on the flare header side (Check 4).
3. If the two cases are within one orifice letter of each other — you get no useful hardware change. Standard orifice designations are coarse steps; a 30% reduction in required area often lands you on the same letter. Confirm against the selected-area table before you write a purchase spec.

This is where the corporate guideline you were quoted usually comes from. Many owner companies write "do not downsize an existing PSV after a HIPPS retrofit" as a default because, in the majority of column retrofits, fire or loss of cooling still governs and the downsize is illusory — while the paperwork, spare-parts churn, and re-rating of inlet and outlet piping are real.

Check 2: Can the HIPPS Actually Take the Credit?

You cannot delete a relief case from the sizing basis unless the protective function is independent of whatever causes the case. Verify before you touch the orifice:

• Independent final element. The HIPPS trip valve must not be the same steam control valve whose failure is the initiating event. Shared final element, no credit.
• Independent initiator. The pressure or temperature transmitter that trips must not be the same measurement the BPCS uses to control the column.
• Verified SIL and target risk reduction. The LOPA that justifies removing the relief case must show the SIF meeting the required integrity level, with the proof-test interval that the calculation assumed actually written into the maintenance plan.
• Bypass and MOS management. If operations can bypass the trip for startup, the relief case comes back while that bypass is in. Document how that state is controlled and time-limited.
• Trip point below MAWP with margin. The SIF must stop heat input and let the column depressure before it reaches the vessel MAWP, accounting for the valve stroke time and the process lag between steam cutoff and pressure turnaround. Fast column, slow steam block valve — the credit evaporates.

If any of these fails, stop. Keep the existing PSV, keep the case in the table, and fix the SIF design first.

Check 3: Rated Capacity vs Required Rate — Why Both Positions Are Right

The concern that an oversized PSV "will still dump the old load when it opens" is physically correct. Once the disc lifts and the valve is flowing at accumulated pressure, mass flow is a function of the effective orifice area, the coefficient of discharge, the relieving pressure, and the fluid properties — not of whatever number you wrote on the sizing sheet. A valve with 2.5x margin passes roughly 2.5x the required rate.

That matters for the piping attached to that one valve. It does not automatically govern the flare header, and that distinction is where the two camps talk past each other.

What you see	Cause	First check
Required rate drops after HIPPS, selected orifice does not change	Fire or loss-of-cooling case already governed the area	Compare required areas case by case, not just the peak rate
Reviewer rejects the relief-case deletion	SIF shares the final element or the transmitter with the BPCS loop	Cause-and-effect matrix and P&ID tag independence
Flare header still overloaded after taking HIPPS credit	Governing global scenario is loss of cooling, not excess heat input	Re-run the global scenario tabulation, not the single-vessel case
New smaller PSV chatters on the existing nozzle	Inlet line pressure loss too high for the smaller valve, or valve now grossly oversized for the remaining case	Inlet pressure drop calculation to API 520 Part II criteria; check valve capacity vs required rate ratio
Downstream tailpipe now marginal after downsizing	Built-up backpressure recalculated at rated capacity of the new valve, not required rate	Outlet hydraulics at the new valve's rated flow

Check 4: What the Flare Header Actually Sees

API 521 guidance for sizing flare headers is to sum the required relief rates of the sources contributing to a given global scenario, not the rated capacities. The reasoning is threefold, and it is worth knowing because it tells you when the rule stops applying:

1. Properly sized PRVs always carry excess capacity, so they cycle open and closed rather than flowing continuously at rated capacity.
2. Different vessels reach set pressure at different times.
3. Relief duration varies — small vessels can be finished before large ones start.

That logic depends on there being a meaningful number of sources. On a sub-header fed by only two or three PRVs, apply judgment: if the source vessels have similar size and similar contents, they can plausibly be open simultaneously, and summing required rates is optimistic. Size that sub-header on the more conservative basis.

So the guideline you were quoted holds up on the header side. Keeping the oversized valve does not increase the flare load you book for the retained scenarios, because you book required rate. What it does change is the tailpipe and knockout-drum hydraulics local to that valve, which are evaluated at the valve's actual capacity.

Check 5: Where the Real Load Reduction Comes From

Flare headers are sized on global scenarios — facility-wide events that put multiple PRVs on the header at once. In practice there are two: fire and loss of cooling. Power failure and loss of cooling are usually the same event, because loss of cooling is normally initiated by the power failure, so treat them as one unless your electrical distribution makes them genuinely independent.

• Fire zones. A fire will not involve the whole plant. Bound zones by trenches, curbs, dike walls, and peak surface elevations — draw them from drainage patterns, not from arbitrary fixed rectangles. API 521 gives guidance on typical zone size. First-pass zones drawn by engineers are almost always much larger than that guidance; revisit the oversized ones and justify shrinking them. Expect to settle between your first sketch and the API default.
• Loss of cooling. More objective than fire. Losing all cooling-water pumps is often the right assumption; with multiple independent distribution systems and separate feeders/MCCs, losing all CTW pumps may not be credible. That call follows the electrical design.
• Model it. Once the zones and scenarios are agreed, simulate each global scenario in a network flow tool such as Flarenet. Sizing sub-headers and main headers is straightforward after that.

The worst-case flare load is almost always loss of cooling. That is also the easiest one to attack: use HIPS (or a SIS, if the owner's risk tolerance allows) to trip the heat source before the vessel reaches MAWP, and strategically switch off one or two of the largest contributors until the total drops to something the existing header can pass. That is what your steam-valve HIPPS is buying — header relief, not necessarily a smaller orifice.

Fit a Smaller PSV to the Existing Nozzle

If Checks 1 through 3 all resolve toward a genuine downsize and the column has no smaller nozzle, mounting a reduced-orifice valve on the existing large nozzle is normal practice. The constraints, in the order they kill schemes:

1. Inlet pressure drop. Recalculate the non-recoverable inlet loss at the new valve's rated capacity against the inlet-line criterion in API 520 Part II. A short, large-bore inlet with a reducer at the valve usually passes easily — that is the whole point of leaving the big nozzle in place. Read the current edition's criterion; do not work from memory.
2. Reducer location and type. Put the reduction as close to the valve inlet flange as the fitting allows, keep it concentric, and keep the full-bore run from the vessel nozzle up to it. Never reduce at the nozzle and run small pipe to the valve.
3. Built-up backpressure. Re-run the outlet hydraulics. A smaller valve on the same tailpipe generally improves backpressure, but check that the discharge piping still drains and that the reduced flow does not put a bellows or pilot-operated valve outside its qualified backpressure range.
4. Chatter margin. A valve with very large capacity margin over the remaining required rate is a chatter candidate regardless of inlet loss. If the remaining governing case is small relative to the smallest available standard orifice, consider a modulating pilot-operated valve or a restricted-lift design rather than forcing a conventional spring valve.
5. Mechanical. Confirm the nozzle reinforcement, flange rating, and the moment the new assembly imposes — a reducer plus valve plus tailpipe changes the load path on the nozzle.

Execute and Verify

1. Reissue the relief scenario table with the excess-heat-input case flagged as HIPPS-credited, cross-referenced to the LOPA node and the SIF tag.
2. Re-size the PSV to API 520 Part I for the new governing case; record the governing case name on the datasheet so the next person does not repeat this argument.
3. Recalculate inlet loss and built-up backpressure at the new rated capacity.
4. Update the flare network model: remove the credited source from the affected global scenarios and re-run the header hydraulics in the network tool.
5. Write the proof-test procedure and interval that the SIL calculation assumed into the maintenance system, and define the bypass/MOS controls.
6. Route the whole package through MOC and PHA/LOPA revalidation before the valve is ordered.

Verification after installation: witness the HIPPS full-loop trip test with the steam valve stroking to closed and record the stroke time; confirm the as-built inlet piping matches the drop calculation; confirm the PSV set pressure and orifice on the installed nameplate against the revised datasheet; confirm the flare model revision matches the as-built source list. If the column has a startup bypass on the trip, verify the alarm and time limit are live in the DCS.

Escalate when the branches conflict. If the SIF integrity calculation will not reach the required SIL with the available final element, or the inlet hydraulics will not meet the API 520 Part II criterion on the existing nozzle, take it to the valve manufacturer's application engineering group and the owner's process safety authority rather than shaving assumptions. A corporate relief-systems guideline overrides a project preference, so get the interpretation of that guideline in writing from the group that owns it before you specify hardware.

FAQ