Emergency Depressurisation and Blowdown — The API 521 15-Minute Rule

Introduction

Pressure relief and emergency depressurisation answer two different questions. A relief valve answers "how do I stop the vessel exceeding its design pressure?" — it lifts at the set point and protects against overpressure. Emergency depressurisation (EDP, or "blowdown") answers a harder one: "the vessel is engulfed in fire, the metal is losing strength faster than the relief valve can bleed off pressure — how do I get the inventory out before the wall ruptures?"

A relief valve keeps a healthy vessel below its design pressure. A blowdown system protects a vessel whose design pressure is becoming meaningless because the steel is heating past the point where it can hold that pressure at all. The two systems coexist on the same vessel and solve different failure modes.

API Standard 521 (Pressure-relieving and Depressuring Systems) is the governing document. Its most-quoted line — depressure to 50% of the vessel design pressure, or to 6.9 bar(g), within 15 minutes — is repeated in every design basis and derived in almost none of them. This post works through where that criterion comes from, how the fire case sets the blowdown load, how the blowdown valve and restriction orifice get sized, and why the cold produced by the blowdown itself often ends up dictating what the vessel is made of.

Why Depressure At All — The Stress-Rupture Argument

Carbon steel does not have a single failure temperature. As it heats, its yield and tensile strength fall along a continuous curve. By around 540 °C a typical pressure-vessel carbon steel retains only about half its room-temperature strength; by 650 °C it is down to roughly a quarter; past 700 °C it is structurally negligible.

Under fire engulfment, an unwetted vessel wall — the part above the liquid level, with only vapour behind it — climbs toward the flame temperature in minutes because there is no boiling liquid to carry the heat away. The wall does not need to reach the pressure that bursts a cold vessel; it only needs to reach the temperature where the operating pressure exceeds the now-degraded rupture strength. For a vessel sitting at design pressure in a fire, that can happen well before the relief valve has made any meaningful dent in the inventory.

This is the failure that blowdown exists to prevent. The logic is a race:

The fire heats the wall and drives down its stress-to-rupture strength.
The blowdown drives down the pressure (and hence the wall stress).

If the pressure falls faster than the strength, the vessel survives the fire long enough for the inventory to be gone and the firefighters to arrive. If it does not, the vessel ruptures — and a pressurised hydrocarbon vessel failing in a fire is the classic BLEVE / vapour-cloud-explosion escalation event that turns a contained fire into a facility loss.

Where the 15-Minute / 50% Rule Comes From

The familiar criterion — reduce pressure to 50% of vessel design pressure (or 6.9 bar(g), whichever is the relevant basis) within 15 minutes of initiation — is a calibrated proxy for the stress-rupture race above.

The reasoning, as captured in the API 521 commentary:

A typical unwetted carbon-steel wall in an open pool fire reaches the temperature region where rupture becomes a concern in roughly 10–15 minutes.
Halving the pressure halves the hoop stress in the wall, moving the operating point well below the stress-to-rupture line at those temperatures for the bulk of vessels.
15 minutes is therefore both achievable with a sensibly sized orifice and fast enough to win the race for the vessels the rule was calibrated against.

The "6.9 bar(g) (100 psi)" alternative limit matters for high-design-pressure vessels: 50% of a 200 bar design pressure is still 100 bar, and a wall holding 100 bar at 600 °C is not safe. For those vessels the absolute 6.9 bar(g) target is the governing one.

Two important caveats that the rule-of-thumb hides:

15 minutes is from initiation, not from the start of the fire. It assumes the fire is detected and the blowdown is triggered promptly. A blowdown that depends on manual initiation has to add the human response time on top.
The rule is a screening criterion, not a guarantee. For thick-walled vessels, vessels with high metal mass, or vessels of unusual geometry, API 521 explicitly points you toward a rigorous transient analysis (vessel-wall heat-up coupled with the depressurisation) rather than blind faith in 15 minutes. The 15-minute rule was calibrated on relatively thin-walled vessels; a heavy forging behaves differently.

The Fire Case Sets the Load

The governing blowdown contingency is almost always fire, and the fire heat input is what the depressurisation must out-run. API 521 gives the absorbed-heat correlations for a pool fire engulfing the wetted surface:

With prompt firefighting and adequate drainage:
  Q = 43.2 × F × A^0.82      (Q in kW, A in m²)

Without adequate drainage / firefighting:
  Q = 70.9 × F × A^0.82      (Q in kW, A in m²)

Where:

A = wetted surface area exposed to the fire (m²) — the area in contact with liquid that can absorb heat by boiling. For a gas-filled vessel with little liquid, the wetted area is small and the relief fire case is mild — but the unwetted-wall heat-up is severe, which is exactly why blowdown rather than relief governs gas vessels.
F = environment factor (1.0 for a bare vessel; reduced by fireproof insulation, e.g. 0.3 or lower for a rated coating, down to ~0.075 for water-deluged insulated vessels).

The subtlety: the relief valve is sized on the wetted-area heat input (vapour generated by boiling liquid). The blowdown is concerned with the unwetted wall — the dry vapour space whose steel has nothing to carry the heat away and so heats fastest. A vessel can have a perfectly adequate fire-case relief valve and still need blowdown, because the relief valve protects against overpressure from boiling, not against rupture of the overheated dry wall.

Sizing the Blowdown Valve and Restriction Orifice

The hardware is simple to describe and fiddly to size: an ESD-actuated blowdown valve (BDV) — typically fail-open, so a loss of instrument air or power blows the vessel down — discharging through a fixed restriction orifice (RO) into the flare or vent header.

The RO is the real sizing variable. The BDV is usually a full-bore on/off valve; the orifice sets the rate.

The depressurisation is a transient: as vessel pressure falls, the flow through the orifice falls with it, so the rate is fastest at the start and tails off. The flow is normally critical (choked) for the early, high-pressure part of the blowdown, then transitions to subcritical as the vessel pressure approaches the header back-pressure. The orifice is sized so that the integrated pressure-vs-time curve crosses the target (50% design pressure or 6.9 bar(g)) at or before 15 minutes:

Critical (choked) mass flux through the orifice:
  G = Cd × P₁ × √( k × M / (R × T₁) ) × [ 2/(k+1) ]^((k+1)/(2(k−1)))

Where P₁, T₁ are the upstream (vessel) conditions, k the ratio of specific heats, M the molecular weight, and Cd the discharge coefficient. There is no closed-form answer for "the" orifice size because P₁ and T₁ are themselves changing as the vessel empties and cools — which is why blowdown is almost always sized in a transient simulation rather than by hand.

The two failure modes the RO sizing balances:

Orifice too small → the 15-minute target is missed; the vessel stays pressurised too long in the fire.
Orifice too large → three separate problems: (1) the peak flare load spikes and may exceed the header's capacity, (2) the noise and reaction forces at the orifice become a hazard, and (3) the rapid expansion drives severe auto-refrigeration — the next section.

That peak instantaneous blowdown rate, summed across every vessel that can blow down on a common header during the governing event, is frequently the load that sizes the flare network — blowdown is often a bigger transient than any single relief valve.

The Quiet Driver — Auto-Refrigeration and MDMT

This is the part that surprises people new to blowdown. When a high-pressure gas expands rapidly through the orifice and the vessel inventory flashes and depressurises, the temperature plunges. Two mechanisms stack:

Joule-Thomson cooling of the gas expanding across the orifice and as the vessel pressure falls.
Auto-refrigeration of any liquid inventory as it boils off into the falling pressure, pulling its own latent heat out of the remaining liquid and the vessel wall.

A vessel blowing down from 100+ bar can see fluid temperatures fall to −50 °C, −80 °C, or colder depending on composition. The vessel wall, the downstream piping, and the BDV body all follow the fluid down.

The consequence is a minimum design metal temperature (MDMT) problem. Ordinary carbon steel loses toughness and becomes liable to brittle fracture below roughly −29 °C (the classic Charpy transition region). If the blowdown drives the metal below the material's qualified MDMT, the cure for one brittle-fracture risk (fire rupture) has created another (cold rupture). The mitigations:

Low-temperature carbon steel (LTCS) or stainless for the vessel, BDV, RO, and the cold section of downstream piping.
Slower / staged blowdown to limit the temperature excursion (trades off against the 15-minute target — a genuine tension).
Liquid removal before blowdown where the operating philosophy allows, so there is less inventory to auto-refrigerate.

The reason this is a "quiet" driver is that it does not show up on the relief or fire calculation at all — it only emerges when you run the depressurisation transient and watch the minimum-temperature trace. Skip the transient and you find out at the metallurgical review, or worse, in service. This auto-refrigeration check is one of the standard outputs of a dynamic depressurisation simulation.

Staged and Sequential Blowdown

On a facility with many vessels tied to one header, blowing them all down at once produces a flare-load spike that can dwarf the steady relief case and force an oversized — and expensive — flare system. Two common refinements:

Sequential blowdown: vessels blow down in a timed cascade rather than simultaneously, flattening the peak header load. The logic lives in the ESD system.
Staged orifices / two-stage blowdown: a larger initial rate while the pressure (and the fire-rupture risk) is highest, throttling to a lower rate as the pressure — and the auto-refrigeration risk — increases. This directly manages the tension between the 15-minute target and the MDMT limit.

The decision of what blows down to where is an EDP philosophy question settled early in design, usually at FEED, because it sizes the flare header and fixes the ESD cause-and-effect logic. Changing it late is expensive.

Worked Example — Gas Separator Blowdown

Scenario: an offshore HP gas separator. Design pressure 120 bar(g), operating 95 bar(g), gas volume ~12 m³, mostly C1–C3 (M ≈ 22, k ≈ 1.27). Flare header back-pressure ~3 bar(g). Bare-vessel fire case, F = 1.0.

Target: 50% of design pressure = 60 bar(g), or 6.9 bar(g) — for this high-pressure vessel the absolute 6.9 bar(g) limit is the governing target. Reach it within 15 minutes.

First-cut orifice: the flow stays choked from 95 bar(g) down to the point where the vessel pressure is below about 2× the header absolute pressure (~7 bar abs), i.e. for almost the entire blowdown. A choked-flow transient through a candidate orifice is integrated to find the pressure-vs-time curve. For this inventory a restriction orifice of roughly 12–14 mm bore brings the vessel from 95 bar(g) to 6.9 bar(g) in about 11–12 minutes — comfortably inside the 15-minute target with margin for the firefighting-detection delay.

The catch — minimum temperature: running the same transient for temperature, the gas leaving the separator dips to roughly −55 °C near the end of the blowdown as the pressure collapses and J-T cooling peaks. That is well below the −29 °C limit for ordinary carbon steel. The result: the separator's lower shell, the BDV, the RO, and the first spool of the blowdown tail-pipe are specified in LTCS qualified to −60 °C MDMT, and the BDV is selected with a low-temperature trim. None of that fell out of the fire or relief calculation — only the transient revealed it.

The header check: the peak instantaneous blowdown rate at t = 0 (95 bar(g), choked) is the spike that gets added to the simultaneous-blowdown case for the flare header sizing. On its own this single vessel's opening transient is several times its steady relief rate.

Common Pitfalls

Treating blowdown as a relief-valve substitute. They protect against different failures — overpressure vs. fire-rupture of the overheated wall. A vessel often needs both.
Quoting "15 minutes" without checking it. The rule is a screening proxy calibrated on thin-walled vessels. Thick-walled or high-mass vessels need a rigorous wall-heat-up-coupled transient.
Forgetting the firefighting-detection delay. 15 minutes runs from initiation. A manually initiated blowdown adds operator response time on top.
Sizing the orifice for time only and ignoring temperature. The fast orifice that hits the 15-minute target can drive the metal below its MDMT. Always run the minimum-temperature trace.
Summing blowdown loads as if simultaneous when they are not — or vice versa. The flare header sizing depends entirely on the blowdown philosophy (sequential vs. simultaneous). Get the philosophy fixed before sizing the header.
Using a fail-closed BDV. The blowdown valve should fail open on loss of motive power, so that the protective action survives the very utility failures a fire tends to cause.
Ignoring liquid carry-over to the flare. Rapid blowdown of a vessel with liquid can carry slugs into the flare header — a separate two-phase and knock-out-drum consideration.

Conclusion

Emergency depressurisation is the system that admits the vessel's design pressure has stopped being a safe number. Under fire, the steel weakens faster than a relief valve can help; blowdown wins the stress-rupture race by collapsing the pressure — to 50% of design or 6.9 bar(g) — inside the 15 minutes it typically takes the wall to reach the danger zone.

The fire case sets the load, the restriction orifice sets the rate, and the auto-refrigeration produced by the blowdown itself quietly sets the material grade. The 15-minute rule is the easy part to quote and the easy part to get wrong: it is a screening criterion that assumes prompt initiation and thin walls, and it says nothing about the cold it leaves behind. A blowdown designed well reconciles all three — fast enough to beat the fire, gentle enough to keep the metal above its MDMT, and coordinated enough not to overwhelm the flare. Done on a rule of thumb alone, it can solve the fire-rupture problem by creating a brittle-fracture one.