Overfill protective systems—Complex problem, simple solution

Abstract

Overfills have resulted in significant process safety incidents. Longford (Australia, 1998), Texas City (United States, 2005), and Buncefield (United Kingdom, 2005) can be traced to loss of level control leading to high level and ultimately to loss of containment. A tower at Longford and a fractionating column at Texas City were overfilled, allowing liquid to pass to downstream equipment that was not designed to receive it. The Buncefield incident occurred when a terminal tank was overfilled releasing hydrocarbons through its conservation vents. The causes of overfill are easy to identify; however, the risk analysis is complicated by the combination of manual and automated actions often necessary to control level and to respond to abnormal level events. This article provides a brief summary of the Longford, Texas City, and Buncefield incidents from an overfill perspective, and highlights five common factors that contributed to making these incidents possible. Fortunately, although overfill can be a complex problem, the risk reduction strategy is surprisingly simple. © 2010 American Institute of Chemical Engineers Process Saf Prog, 2010

The Buncefield explosion and fire–lessons learned

“…The safety performance of an organization depends on a complex system of multiple layers of protection including redundant level and control measures [16]. These layers of protection include design, construction, operation, maintenance, prevention systems, and emergency response and mitigation systems.…”

Choosing HIPS over PRD: It is more than risk reduction

“…In non‐reactive scenarios, the challenge is generally a transfer problem due to the lack of a disposal system, capacity constraints of the existing disposal system, or occurrence of significant safety consequences when transfer occurs. The following cases are examples of where the relief itself (e.g., the transfer) poses safety consequences: The PRD relieves liquids or two‐phase flow that reduces the relief rate sufficient to allow the vessel, or other simultaneously relieving vessels, to overpressure 6 The PRD relieves liquids that overwhelm the disposal system, particularly in the cases of toxic gas scrubbing 6 The PRD is routed to a disposal system that is not sized to mitigate the relief scenario 7 The pressure specification for a long pipeline is lowered downstream of pressure sources to reduce installation cost and it is impractical to vent the pipeline to the atmosphere or flare 8 Lower specification manifolds and piping are connected to higher pressure wells (or to higher pressure submersible pumps) and it is impractical to vent the pipeline to the atmosphere or flare 8 The existing pipeline is de‐rated due to corrosion or erosion, so it is no longer an inherently safe design and it is impractical to vent the pipeline to the atmosphere or flare. …”