Hianbotech,
In my opinion, what you have described is a safe design, perhaps a little conservative, but not greatly so.
First I would say that the design pressure of 250 psig is reasonable, because the piping engineers usually call for 300# flanges for hot oil service, regardless of the design pressure, to allow adequate flange tightening against leakage. Your 250 psig will be 300# at the design temperature of the system. You will not save cost by going to a lower pressure.
Next, I understand the reasons for dropping to 80 psig in the expansion drum, arising from the general rule of adding the pump shutoff head to the design suction pressure to define the design discharge pressure. If you had 250 psig as the suction design pressure, then it would be possible in principle to reach (250 + 170) = 420 psig on the discharge, if an ESDV in the discharge or somewhere in the circuit had closed (which could happen in the event of an upset such as a tube rupture) while the pump continued to run. It would probably be transient, but it is possible. You could try to eliminate this scenario by various lines of argument and dynamic modelling, but it is simpler and thus clearer not to go that route.
You could go lower than 80 psig in the expansion tank, so long as the design pressure is above the supply pressure of the blanket gas, but there would be little to gain from that. As it is, the flanges on the vessel would have to be 300# to comply with the pipe spec. Pinhole leaks in the exchangers would pass to the tank and be discharged safely (though difficult to detect).
Now, to come to the tube rupture scenario. A tube rupture should open the relief valve at the exchanger and pass all the gas to flare. The pressure at 250 psig (plus accumulation) would drive the oil out in both directions, pushing it to the expansion tank, and eventually if the gas was still flowing after the entire oil header had been emptied, the gas would break through into the expansion tank where it would have to be relieved. The flow to the expansion tank would have a pressure drop of 170 psi to drive it through the large piping of the hot oil system. It seems likely (but you can check) that the flow that could be sustained with this DP would be higher than the tube rupture could supply, so the pressure in the exchanger would fall. This would close the RV at the exchanger. Thus all the gas through the tube rupture would have to be relieved from the expansion tank.
Note - if you had a bursting disc at the exchanger instead of a RV, the flow woud continue through it at lower pressure and so the flow to the expansion tank would be less.
Note also, that for the above scenario to happenm the tank has to be large enough to receive most of the oil in the system. This is not usually the case, and so the relief valve would be passing oil when it first opens.
Mitigating factors:
This scenario assumes that no instrumented actions have happened to stop the gas flow or to isolate the exchanger. It is good practice to fit a PSHH on the exchanger shell and to fit ESDVs on the hot oil side inlet and outlet, and to provide an ESDV somewhere in the gas system to shut off the feed - these valves actuated by the PSHH. If you have these features, and you check the system integrity level then you could possibly eliminate the expansion tank relief scenario. You could estimate how long it would take to empty the hot oil system as described, and evaluate whether it is credible that no operator action occurs in this time. High high level in the tank would also provide an additional protection.
Making these arguments to convince the client and your colleagues can be difficult, and in the end only offers a small cost saving in the RV at the expansion tank.
Obviously the PSHH should also cause a shutdown of the hot oil pumps, avoiding the discharge high pressure referred to above, with due regard to the required integrity level.
I would add that if you had used a rupture disc instead of a RV, the ESDVs would be also useful to avoid losing all the hot oil into the flare system when the gas pressure falls.
Good luck
Paul