Process Safety · Lesson 40 · 8 min read

A Low Level Can Open a High-Pressure Gas Path

A separator liquid outlet is normally a path for liquid. If the level falls far enough, that same open path can pass high-pressure gas into equipment designed for a lower pressure. This gas-blowby scenario can develop quickly, so protection depends on a sound design basis, dependable low-level safeguards and operators who recognise the pressure connection before the downstream system is challenged.

The hazard mechanism: the liquid seal can disappear

A high-pressure separator may discharge liquid through a level-control valve to a lower-pressure vessel. While adequate liquid covers the outlet, the system transfers liquid as intended. If inventory is drained or the level-control path remains open as level collapses, high-pressure gas can follow the same route. The downstream vessel then receives a gas flow and pressure source that may be very different from its normal duty.

The consequence depends on the actual pressure difference, valve and piping capacity, downstream volume, relief arrangement and response of isolation systems. No single outcome should be assumed. The essential question is whether gas blowby is a credible overpressure case and, if it is, which independent controls prevent or safely relieve it. HSE guidance says pressure-relief design should account for process abnormalities and equipment or utility failures, with the design basis documented and kept current. [2]

Official learning from Grangemouth

HSE’s case study of the BP Grangemouth Hydrocracker describes a violent explosion and fire on 22 March 1987, centred on a low-pressure separator during recommissioning after a routine shutdown. The unit had tripped and was held on standby without fresh feed. Operators manually opened and closed the high-pressure separator level-control valve several times. [1]

According to HSE, the liquid level in the low-pressure separator fell, the control valve opened and remaining liquid drained from the high-pressure separator. High-pressure gas then broke through into the low-pressure separator. Its relief system had been designed for the fire case rather than gas breakthrough, and the vessel exploded. The independent low-low level trip that should have closed the control valve had been disconnected during an earlier modification. Operators also distrusted the main level indication, while a backup chart had an offset and was misread. [1]

Those are facts from that specific investigation, not a claim that every separator system has the same design or failure sequence. The transferable lesson is that level indication, low-level shutdown, valve action, isolation and relief capacity must work as one scenario-specific protection strategy.

Do not treat one level reading as the whole barrier

A control-room level value may be correct, biased, frozen or affected by process conditions. A local indication can fail differently, and a low-low trip is only useful if its sensing path, logic, final element and utilities can complete the required action. Agreement between instruments is valuable, but independence and proof of the complete protective function matter more than the number of displays.

Operating teams also need a clear response when level information conflicts. Repeated manual opening of a valve should not become the default way to discover which indication is right. Use approved procedures, escalation routes and operating limits. If the required protection or trustworthy process information cannot be confirmed, place the plant in the condition defined by the installation’s authorised decision process.

Hypothetical FPSO example: pressure rises during restart

Hypothetical example—not a documented incident: During an FPSO restart, the high-pressure separator level trends down while two level indications disagree. The outlet valve remains partly open and the downstream low-pressure separator pressure begins to rise faster than expected. The team does not assume that the downstream relief valve will cover any flow the upstream system can deliver.

The console operator follows the approved abnormal-operating response, alerts the supervisor and stops the restart within the installation’s established controls. Operations and instrument personnel confirm the actual line-up and barrier status without approaching or intervening on pressurised equipment outside approved procedures. The restart remains held while the responsible technical authorities verify the level measurement, independent low-level shutdown, isolation action and relief design basis for gas blowby.

This example supplies no universal trip setting, pressure limit or manual action. Those values and responses belong to the specific facility design and approved procedures. Its purpose is to show that a falling level can create a pressure-transfer hazard rather than only a loss of liquid inventory.

Critical controls and leadership actions

Begin with the pressure-system design basis. Trace every credible connection from higher-pressure inventory into lower-rated equipment, including normal control paths, bypasses, drains and temporary configurations. Confirm whether gas blowby was assessed, what flow was assumed, and whether prevention, isolation and relief measures still match the as-built plant. HSE advises establishing safe operating limits, suitable protective devices and planned, recorded control of modifications. [3]

Verify the whole low-level protective function: sensing, logic, voting where applicable, final element, utilities, alarm and operator response. A healthy transmitter does not prove that the valve will close when demanded. Functional testing should use the installation’s authorised method and acceptance criteria, with impairments controlled and restoration independently confirmed.

Leaders should assign one accountable owner for the complete blowby scenario across process engineering, control and instrumentation, relief-system assurance and operations. Challenge disconnected trips, repeated overrides, nuisance alarms and conflicting readings before they become normal. Management of change should revisit both upstream causes and downstream consequences whenever vessel service, pressure, valve size, control logic, relief routing or operating mode changes.

Three practical actions

• Trace the path: identify one high-pressure-to-low-pressure connection and confirm how loss of liquid level could expose the downstream system.
• Verify the barriers: check that the low-level shutdown, final isolation element and relief basis cover the same credible blowby case and current plant configuration.
• Challenge uncertainty: escalate conflicting level indications, disabled trips, unexplained valve behaviour or an unverified modification through the approved operating and impairment process.

Technical video

No directly relevant official incident or technical video was verified for this lesson. The HSE case study and technical guidance below are the primary learning sources; unrelated third-party media have not been embedded.

Takeaway and team discussion

Key takeaway: when the liquid seal disappears, the liquid outlet can become a high-pressure gas path.

Discussion question: which high-pressure-to-low-pressure connection on our installation has the weakest evidence that low-level protection, isolation and relief design cover gas blowby?

Continue in the Process Safety hub, and connect this lesson with independent level protection, controlled protection impairments and relief-system performance.

Verified primary references

1. UK HSE case study: BP Grangemouth Hydrocracker Explosion—gas breakthrough into a low-pressure separator, 22 March 1987.
2. UK HSE Technical Measures Document: Relief systems and pressure relief—overpressure causes, design basis and change control.
3. UK HSE: Pressure systems—safe operating limits, protective devices, instructions and modifications.

Published and sources checked 22 October 2026. Educational discussion only: apply the installation’s approved operating procedures, pressure-system design basis and competent technical assessment. No universal trip setting, relief capacity, shutdown threshold or permission to work on pressurised equipment is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates