The Frangible Roof Joint and Appendix F Pmax: What Actually Triggers the Rule

What "Frangible" Actually Means in a Tank Roof

A frangible roof-to-shell joint is a weld detail deliberately designed to be the weakest structural connection in the tank. If the vapour space is over-pressurized — a blocked vent, a runaway vaporization event, an ignition in the vapour space — the intent is that the roof-to-shell weld tears and lets the roof lift or separate before the shell itself fails or the bottom-to-shell weld gives way. Losing a roof is a contained, survivable failure. Losing the shell or the bottom joint is a catastrophic release.

This is the philosophy behind API 650's frangible joint provisions: accept a controlled, weaker failure point at the top of the tank so the much more dangerous failure modes lower down never get the chance to govern. It is a passive overpressure protection strategy, not a substitute for a properly sized pressure-relief system — the two work together, not instead of each other.

Where Pmax Actually Comes From

The warning that catches engineers off guard — "design pressure is greater than Pmax" — comes from Annex F, which governs roof design for tanks with a positive internal design pressure. Annex F defines a maximum internal pressure, Pmax, above which the frangible-joint assumption is no longer considered reliable and Annex F's simplified design method no longer applies on its own.

The mechanism is straightforward once stated explicitly: Pmax is calculated from the actual weld detail at the roof-to-shell junction — the compression area at the joint, the anchoring effect of the roof plates and top angle, and the shell's own resistance to being pulled upward before the joint tears. Every one of those inputs is specific to your geometry: shell diameter, top angle size, roof plate thickness, and the exact weld detail specified at the junction. Pmax is not a fixed code number — it is a computed property of the tank you actually drew.

That is why the same nominal internal pressure passes on one project and trips the Annex F warning on another. A tank with a larger diameter, a heavier top angle, or a stiffer roof-to-shell detail has a higher Pmax simply because more of the structure resists tear-out before the joint fails. Change any of those inputs after the fact — heavier top angle for a client-standard requirement, thicker roof plate for a corrosion allowance change — and Pmax moves too. The warning is not telling you your calculation is wrong; it is telling you that, for this specific geometry, the code's assumption that "the roof joint fails before anything else does" has stopped being conservative.

"Pmax exceeded" is not an error to suppress — it is the code telling you the frangible-joint assumption no longer holds for this geometry. When it fires, the roof-to-shell joint can no longer be relied on as the weak point, and Annex F's simplified path is no longer sufficient on its own.

What Happens When Pmax Is Exceeded

When the design internal pressure exceeds Pmax, API 650 does not simply forbid the tank — it removes the shortcut. Annex F's simplified frangible-joint sizing method assumes the joint governs; once that assumption breaks, the roof-to-shell connection, the shell, and the anchorage system all need to be verified by more rigorous means for the actual overpressure case, rather than relying on the joint tearing away as the safety mechanism.

In practice this usually means one or more of the following, decided in coordination with the client and the pressure-relief system designer rather than resolved silently inside the roof calculation:

• Reduce the design internal pressure if the process requirement allows it — often the simplest fix, since many "positive pressure" tanks are only lightly blanketed and the actual operating pressure has margin to spare.
• Redesign the roof-to-shell joint geometry — a lighter top angle or thinner roof plate near the junction increases the margin between operating pressure and Pmax by keeping the joint the deliberately weak point.
• Move outside Annex F's simplified scope entirely and treat the tank as a pressure-rated vessel with an engineered relief system sized for the full credible overpressure case — appropriate when the process genuinely needs sustained higher pressure than a frangible atmospheric tank can accommodate.

The failure mode to avoid is treating the Pmax warning as a nuisance to route around by nudging an input until the flag clears, without revisiting whether the underlying design pressure is actually appropriate for a frangible-roof tank in the first place.

The Scope Mistake: Frangibility Isn't Automatic for Every Roof Type

Separate from the Pmax check, API 650 §5.10.2.6 sets out its own frangibility criteria — geometric limits (roof plate thickness, slope, and the roof-to-shell weld detail) that, if satisfied, let the roof-to-shell joint qualify as frangible without a full Annex F pressure analysis. This is where a second, distinct error shows up in practice: applying §5.10.2.6 blanket-wide across every fixed roof type on a project, when the clause's geometric assumptions were written around self-supported cone roofs specifically.

A rafter-supported cone roof has an entirely different load path at the roof-to-shell junction — the top angle carries rafter reaction forces in addition to the membrane forces the self-supported case assumes, and the joint's actual tear-out behaviour under overpressure is not the same calculation. Assuming §5.10.2.6 frangibility applies automatically to a supported roof, a dome roof, or any geometry outside the clause's actual scope silently removes a safety check rather than satisfying it. The correct approach is to first confirm which roof type is on the tank, then apply §5.10.2.6 only where its assumptions actually hold — and fall back to the full Annex F pressure/Pmax analysis for every other roof type.

This distinction matters because the two checks answer different questions. §5.10.2.6 asks "does this specific joint geometry qualify as frangible by inspection, without further analysis?" Annex F and Pmax ask "given the actual pressure this tank will see, is the frangible-joint assumption still valid at all?" A tank can pass one and still need the other — treating them as interchangeable is how a genuine gap gets missed during design review.

Practical Tips

• Determine the roof type before running any frangibility check. Self-supported cone/dome roofs are the clause's intended scope for §5.10.2.6's simplified geometric criteria; supported (rafter) roofs need the fuller Annex F treatment rather than an automatic pass.
• Treat Pmax as a design output, not a target to satisfy. If a change to top angle size, roof plate thickness, or corrosion allowance is being considered for other reasons, re-check Pmax afterward — it moves with the geometry, and a design that passed before the change may not pass after.
• Coordinate the internal design pressure with the relief system designer early. The frangible roof joint is a backstop, not the primary overpressure protection. A tank whose relief system is undersized for credible upset scenarios should not be relying on Pmax margin to cover the gap.
• Document which check governs and why. A reviewer should be able to see, for each roof, whether §5.10.2.6 geometric frangibility applied directly or whether the full Annex F Pmax analysis was required — and why.
• Don't suppress the warning by iterating inputs blindly. If nudging the top angle or roof plate thickness makes the warning disappear without a documented engineering reason, the design basis has quietly changed and should be re-justified, not just accepted because the flag cleared.

Related reading: Continue with Fixed Cone Roof Design, External Pressure and Vacuum Design, and API 650 14th Edition Changes to keep the full API 650 roof design workflow connected.