As pleckner points out, tube rupture is normally a remote scenario because of the reasons BenThayer points out. Therefore, suggest checking the test pressure of shell side to see if it is equal or greater than the tubeside design pressure. If so, then you have a low probability of catastrophic failure of the exchanger shell in the event tube ruptures. But in the end, remote scenario must be considered in the process design.