Process Safety · Lesson 48 · 8 min read

A Protective Discharge Must End at a Safe Destination

Pressure relief and blowdown are protective actions only when the released material completes a safe journey. Opening a relief valve or sending a depressurisation command may protect the vessel, but the hazard is transferred into piping, a knockout drum, flare, recovery vessel or another disposal system. If that path cannot contain, separate, burn or disperse the stream safely, the protection can create a new major release.

The hazard moves downstream

Relief devices protect equipment against excessive pressure, while blowdown systems reduce hazardous inventory after a shutdown or emergency. Both functions can send high rates of vapour, liquid or two-phase flow into a common disposal network. The downstream system must handle credible composition, temperature, pressure, liquid content, backpressure and simultaneous demand.

Failure can occur in several ways. A header may impose excessive backpressure on connected devices. Liquid can exceed the separation or storage capacity of a knockout drum. A drain may be unavailable, level measurement may be misleading, or a flare pilot and ignition system may not be reliable. Low temperature, vibration, radiation, noise and atmospheric dispersion can also create hazards outside the protected vessel.

HSE guidance states that relief discharges should pass to a safe location and that relief design bases must be documented and protected through modification control. Its guidance also identifies knockout drums and similar systems for separating liquids or solids before further treatment, with the worst credible discharge rate and volume considered in design.

Official incident: the disposal system became the release point

The U.S. Chemical Safety Board investigated the 23 March 2005 Texas City refinery explosion. During startup, a distillation tower flooded and became overpressured. Relief valves discharged liquid hydrocarbon into a blowdown drum that was too small to contain it. The drum overfilled, and its atmospheric stack released flammable liquid and vapour that formed a ground-level cloud and ignited. Fifteen people were killed and 180 were injured.

CSB documented earlier releases and fires involving the same blowdown system and found that the atmospheric stack had not been replaced by a safer closed disposal arrangement. The incident involved refinery startup, equipment, organisation and siting conditions that do not define any FPSO. The transferable lesson is that protecting one item is not enough: the complete relief-disposal path must remain safe under the event that demands it.

Hypothetical FPSO example: the vessel is protected but the disposal barrier is not

Hypothetical example—not a documented incident: Before restarting an FPSO processing train, the team reviews a planned depressurisation demand alongside other equipment that can discharge into the same flare header. The relief study assumes the flare knockout drum has its required available capacity, but the current level trend is uncertain and a drain route is unavailable for maintenance.

The team does not proceed because the initiating vessel has a relief valve. They declare the disposal function impaired, confirm the actual liquid inventory, reassess simultaneous loads, restore dependable level indication and the authorised drain path, and verify flare readiness under approved procedures. This example supplies no universal drum level, flare rate, depressurisation time or permission to vent hydrocarbons.

Critical controls

Define credible loads. Connect each relief and blowdown source to its initiating scenarios. Include startup, shutdown, fire exposure, utility failure, control failure and credible simultaneous demands. Account for vapour, liquid and two-phase behaviour rather than assuming dry gas.

Verify the entire hydraulic path. Confirm inlet and outlet restrictions, valve isolation status, header pressure, low points, liquid pockets, thermal effects, supports and the capacity of the receiving equipment. A correctly set relief valve cannot compensate for an unavailable or restricted discharge path.

Protect liquid separation and disposal. Maintain reliable knockout-drum level measurement, alarms, trips where required, drainage and available working volume. Treat an unreliable level, blocked drain or unexpected liquid arrival as a barrier impairment, not a housekeeping issue.

Maintain flare availability. Verify pilot and ignition reliability, purge, flashback protection, structural condition, radiation limits and monitoring. Where material is recovered or treated instead, verify that system against the same credible load and composition.

Control change. Revalidate relief loads after production changes, new tie-ins, revised operating envelopes, isolation changes or simultaneous-depressurisation logic changes. Drawings and relief documentation must reflect the plant actually operated.

Operational and leadership actions

Operators should monitor flare knockout-drum level, flare status, header pressure and unexpected liquid or vibration, using approved response criteria. During startup or abnormal operation, a rising level or unusual flare behaviour needs early escalation; it must not be normalised because the upstream pressure is falling.

Leaders should ask whether the latest relief study covers current inventories and combinations, whether drains and level safeguards are available, whether previous abnormal releases were investigated, and whether known limitations are visible in operating decisions. Provide shutdown and maintenance windows when the disposal path cannot demonstrate its safety function.

Three practical actions

• Trace one demand: follow a relief or blowdown scenario from the protected equipment through every valve, header and receiving system to its final safe destination.
• Check available capacity: verify current knockout-drum level, reliable indication, drain availability and the assumptions used for credible liquid carryover.
• Review combined loads: challenge whether startup, shutdown, fire or utility-failure demands can occur together and whether the disposal system remains within its approved basis.

Official video: Anatomy of a Disaster

The official CSB video reconstructs the Texas City startup, overfill, blowdown-drum overflow and ignition, and explains the wider design and management failures. View the official CSB video page.

Takeaway and team discussion

Key takeaway: a relief or blowdown action is protective only when the complete disposal path safely receives the real discharge.

Discussion question: which relief or blowdown scenario on our installation has the weakest current evidence that its downstream disposal system can safely handle the full credible load?

Continue in the Process Safety hub, and connect this lesson with relief-path isolation, emergency isolation, shutdown-system resilience and startup risk.

Verified primary references

1. UK HSE: Relief systems / vent systems—official technical guidance on safe discharge locations, documented design bases, flare performance and modification control.
2. UK HSE: Secondary containment—official guidance on knockout drums, catchpots and worst-credible discharge rate and volume.
3. UK HSE: Design codes—plant—official guidance that hazardous relief discharge should be routed so it does not create additional hazards or escalation.
4. U.S. CSB: Texas City refinery explosion—official investigation page, final report and recommendations.
5. U.S. CSB final investigation report—official analysis of the overfill, blowdown-drum overflow, atmospheric release and organisational causes.
6. U.S. CSB official video: Anatomy of a Disaster—official incident reconstruction and safety lessons.

Published and sources checked 30 October 2026. Educational discussion only: apply the installation's approved safety case, relief and blowdown design basis, flare operating envelope, performance standards, management-of-change, impairment and operating procedures. No universal flare load, drum level, depressurisation time or permission to vent hydrocarbons is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates