SAFEtY

TA N K S T O R A G E June 2011

Guus Greve, general manager for supply and distribution at Shell

Netherlands, believes that when it comes to safety the bulk liquid storage
sector needs to cooperate and actively share knowledge and information

Safety is
not a competition
M

any would question

whether a company
like Shell benefits
from being better at safety
than the competition. But
when an incident occurs in
the industry it affects the
whole sector. The tragic
BP incident (resulting in
a drilling moratorium for
all) is a case in point.
Safety first as a principle
is echoed well into terminal
operations, so during
tank filling operations
utmost care is needed to
prevent product overfill.
As a result of experience,
four key operating levels

have been established, as

further described here.
For all product transfer
operations there must be
sufficient time for action to
be taken once an alarm is
activated. The key to creating
effective protection barriers
is their independence from
each other and the availability
of three to four backup
options. Below are some
examples of current barriers:
Safeguard alarms/level
alarms, monitor operations
and operating windows.
Operating windows are
limits that have been clearly
defined, as operating

limits for a tank, these are

divided as described in
detail to fill levels, including
response times required in
the case that product in the
tank arrives at these limits
Site procedures and
receipt plans (training
and procedures)
Site maintenance and
inspection plans: A receipt
plan is in place to ensure
that all the relevant barriers
are well understood and
that the responsible
person is aware of the
plan of action and when
in doubt has a procedure
for reference, taking

into account external

factors that it is natural
for stress during alarms to
cloud judgment. Terminal
management shall ensure
that this information is
available to all operators, is
clearly marked and indicated
on tanks to be visible to
operators performing tank
gauging and sampling
Gauging systems and
their verification
High level alarms: Safeguard
alarms are set according to
operating windows. They
are also in place to allow
for operational limitations
of any floating roof and

Tank operating levels

Top kerb anglero

other top strake fitting
or opening

Fixed
Roof
Tank
Dip Plate

38

Overfill Level
High High Level

Response Time
Typ 15 minutes

High Level

Operator
Response Time

Normal Fill Level

Response Time

Low Level

Typically 5 to
10minutes
response time

Ext. Floating
g
Roof
Tank
Dip Plate

SAFEtY

June 2011 TA N K S T O R A G E
product expansion. The
testing of alarm audibility
is a required check
Study cases including bow
tie analysis of barriers
and the issues that impact
their effectiveness.
Monitoring of operations is
done by two types of devices
that track the level of the
product according to the
operating window: Typical
displace/float type device
or a vibrating fork type.
Below are the operating
limits set points (Ref: API
2350, Overfill Protection
for Petroleum Storage
Tanks, sect 1.3):
Overfill level tank
maximum capacity
The product level at which
any additional product
will overfill and spill from
the tank or at which
level contact or damage
will occur between the
floating roof and the tank
structure or appurtenances.
There must be 150mm
clearance for IFC/IFR

and external floating roof

to prevent damage
High-high level The
high-high level is the
product level at which the
second overfill warning
alarm is set. The highhigh level is established by
determining the amount of
time required to take the
appropriate action necessary
to completely shut down or
divert product flow before
the level of product in the
tank reaches overfill level.
While the actual level
is determined based on
factors such as fill rates
and time necessary for
response actions to occur
after activation, the typical
default level is 15 minutes
below the overfill level. A
high-high level alarm is
fitted to this level, set at
200mm (8in) below overfill
and must be an independent
device. All tanks are
required to have this device
High level The high
level is the product level

at which the first overfill

warning alarm is set. The
high level is established by
determining the amount of
time required to take the
appropriate action necessary
to completely shut down
or divert product flow
before the level of product
in the tank reaches the
high-high level. While the
actual level is determined
based on factors such as fill
rates and time necessary
for response actions to
occur after activation,
the typical default level
is 5 to 10 minutes below
the high-high level,
75mm(3in) below HH level
Normal fill level - The
normal fill level is the
highest product level the
tank can be filled during
normal operations. Filling
the tank to this level is the
volume that operations,
supply, etc. plan to use
the tank. Set at 75mm
(3in) below H level
Low level The low level

is the lowest product level

the tank is can be emptied
during normal operation.
Emptying the tank to this
level is the volume that
operations, supply, etc.
plan to use the tank. The
low level is set such that
all roof legs do not touch
the floor, any internal
floating cover vacuum
breaks remain closed,
the gauging of the tank
is not compromised (i.e.
the IFC has not entered
the critical zone), pumps
can draw product from the
tank without precautions
(pump does not cavitate)
and the tank can be filled
at the maximum flow rate.
The volume between the
low level and the normal fill
level is the tanks working
capacity, and this is an
effective way to set operating
limits and respective
barriers, as illustrated in
the drawing on the previous
page, the responding reaction
time is 5-10mins. n

39