Process Safety · Lesson 41 · 8 min read

A Process Upset Can Push Equipment Below Its Safe Temperature

Pressure equipment can remain below its pressure limit and still leave its safe operating envelope. A rapid change in composition, pressure or flow can cool metal far below normal operating temperature. If the material has insufficient toughness at that temperature, a flaw and the applied stress can combine to produce sudden brittle fracture with little warning.

Why low temperature changes the pressure-boundary risk

HSE guidance explains that low temperature can reduce the tensile toughness of commonly used materials, including some steels used for pressure vessels. Below a material's transition range, behaviour can shift from ductile to brittle. A brittle crack can then propagate rapidly rather than allowing the visible deformation people may expect before failure. [1]

Temperature alone does not predict failure. HSE's assessment guidance treats fracture toughness, crack-like flaws and stress at the crack tip as connected factors. That is why neither a normal pressure indication nor an external visual check proves that equipment is safe after an abnormal cold transient. The vessel shell, nozzles, welds, attachments, connected piping and relief inlet may have different materials, fabrication histories and stress concentrations.

Cold conditions can occur during normal low-temperature duty, but also during startup, shutdown, depressurisation, blowdown, flashing across a pressure drop, loss of heating, refrigeration upset or unintended entry of a colder or lighter process stream. The limiting case may therefore be a short transient rather than steady production.

Official learning from Beek

HSE's case study of the DSM naphtha cracker explosion at Beek on 7 November 1975 reports that a vapour release from the depropaniser system ignited, killing 14 people and injuring 107. Evidence indicated that low-temperature embrittlement at the depropaniser feed drum was the likely release mechanism, with the initial fracture thought to be in a pipe connecting the drum to its relief valve. [2]

The drum normally operated at 65°C. During a de-ethaniser upset, colder liquid with a high ethane content entered the drum; HSE states that flashing could cool it to about -10°C. Although the drum material was normally suitable to -20°C, the fracture occurred at a weld that ageing may have made vulnerable at temperatures up to 0°C. These figures belong to that investigation only. They are not operating limits for another installation.

The transferable lesson is more important than any one temperature: a foreseeable process deviation moved part of the pressure system toward a condition where its weakest feature could lose adequate toughness. Safe assessment must cover the actual transient and the whole connected pressure boundary, not only the vessel's normal temperature or nominal material grade.

Hypothetical FPSO example: the wall cools during restart

Hypothetical example—not a documented incident: During an FPSO restart, a high-pressure hydrocarbon stream is introduced to a lower-pressure separator. Flashing increases and a metal-temperature trend falls toward the equipment's approved low-temperature limit, while pressure remains within its usual range. The console operator does not use the acceptable pressure reading as proof of mechanical integrity.

The team follows the installation's approved abnormal-operating response, holds the restart within authorised controls and checks the cold-source line-up, temperature measurement and protective functions. Operations, process engineering and integrity specialists then verify that the credible transient, materials, weld details and pressure-temperature combination remain within the assessed envelope before restart resumes.

This example supplies no universal minimum temperature, pressure-temperature curve or recovery action. Those values must come from the actual design records, material data, competent assessment and approved operating procedure.

Critical controls

Define the complete envelope. Identify the minimum credible metal temperature for steady and transient conditions, together with the coincident pressure. Include connected pipework, nozzles, welds, relief paths, bypasses and temporary line-ups. HSE recommends multidisciplinary hazard review of foreseeable deviations and competent assessment where low-temperature suitability is uncertain. [1]

Prevent or detect the cold transient. Use the installation's engineered safeguards for cold-fluid ingress, flashing, refrigeration or depressurisation scenarios. Place temperature measurement where it can represent the vulnerable metal, define alarm and trip responses from the approved assessment, and maintain the full sensing, logic, final-element and utility chain.

Protect integrity over equipment life. Preserve material certificates, weld records, heat-treatment history, repairs and inspection findings. Examination should target credible crack locations and damage mechanisms, not merely general wall thickness. Any rerating, revised safe limit, changed composition, modified blowdown duty or loss of design information belongs in formal management of change and competent pressure-system review.

Leadership actions

Assign clear ownership across operations, process engineering, metallurgy, inspection and control systems. Leaders should require operating procedures to state what the team does when temperature approaches or crosses an assessed boundary, who authorises recovery, and what evidence is needed before repressurisation. Production urgency must not substitute for missing material or transient-analysis evidence.

Use startup and shutdown reviews to challenge assumptions: has composition changed, is pressure reduction faster, is heating available, are sensors correctly located, and does the current relief or blowdown configuration create a colder case than the original study? HSE's plant-design guidance requires materials to be suitable for all reasonably foreseeable operating and test conditions, including temperature. [3]

Three practical actions

• Find the cold transient: choose one restart, blowdown or flashing scenario and verify the minimum metal temperature was assessed with the coincident pressure.
• Trace the whole boundary: confirm vessel, nozzle, weld, connected piping and relief inlet materials are covered—not only the main shell.
• Escalate uncertainty: treat an unexpected temperature trend, changed composition, unavailable heating or missing material record as an integrity question under the approved decision process.

Official technical video

The CSB's Transient Hazards: Explosion at the Husky Superior Refinery is an official investigation video about an explosion during shutdown in which two vessels failed by brittle fracture. Its initiating conditions differ from the low-temperature Beek mechanism; it is included to show why transient operation and brittle-fracture consequences require explicit analysis. The CSB investigation page provides the final report and brittle-fracture appendix. [4]

Takeaway and team discussion

Key takeaway: pressure can remain within limits while temperature moves the material outside its safe envelope.

Discussion question: which vessel or connected line on our installation has the weakest evidence that its assessed minimum temperature covers realistic restart, blowdown or flashing transients?

Continue in the Process Safety hub, and connect this lesson with safe operating limits, controlled startup and management of change.

Verified primary references

1. UK HSE: The assessment of pressure vessels operating at low temperature (HSG93)—material toughness, low-temperature duty and competent assessment.
2. UK HSE case study: Explosion and fire at DSM, Beek, 7 November 1975—process upset, low-temperature embrittlement and loss of containment.
3. UK HSE Technical Measures Document: Design Codes—Plant—material selection for foreseeable pressure and temperature conditions.
4. US CSB: Husky Energy Superior Refinery Explosion and Fire—official report, brittle-fracture appendix and related video.

Published and sources checked 23 October 2026. Educational discussion only: apply the installation's approved operating procedures, pressure-temperature envelope and competent technical assessment. No universal minimum temperature, pressure limit, trip setting or permission to intervene on live equipment is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates