The 2005 Buncefield incident was a result of gasoline overfill from a tank (#912) at Buncefield oil storage and transfer depot. A contributing cause for this incident was failure of servo level gauge to indicate high level in the tank – on the day of the incident the gauge indicated static level when the level was rising.
It is therefore not a surprise that recommendations from Buncefield incident investigation and the ensuing expert reports/papers have emphasized the need for having a Safety Instrumented System (SIS) for tank overfill protection to assure reliability. Higher integrity level tank overfill protection system is expected to work every-time its called for.
Does this mean you should replace level indicators in your tanks with radar detectors? Should you have redundant level indicators in tanks?
Replacing existing tank level detection system is capital intensive and does not necessarily reduces risks. Let me explain.
The degree of automation in tank farms varies depending on specific risks and frequency of loading/unloading. It is a standard practice to use a analog instrumentation for measuring tank levels within normal operation and a level switch to take protective action. The arguement is to use a more expensive and reliable radar level detection technology or redundant instrumentation. However, instrumentation is only part of the solution.
If a level switch is well maintained, it will provide reliable response when called upon. The key for me is maintenance and proof testing of the instrumentation involved and not necessarily new instrumentation.
In fact the Proven-In-Use section of IEC 61511 allows use to select sensor if you can prove reliable operation in the field and I see existing level instrumentation for tank has been proven in use.
What is missing is the proof test requirements on the existing level sensor to demonstrate operation.
3 Responses
Hi Sanjeev,
you are right in saying that proof testing on exisiting level sensor is important. The only challenge there is that its labor intensive and when tanks carry highly toxic or flammable material, the task becomes even more daunting. e.g. what do you proof test against? mass transfer calculations (have element or errors)? physical dipping (which is hazardous)?
Also it might be prone to human errors.
I think a risk based approach still makes sense as you suggested. For tanks in the ‘red’ zone, do all you can to increase the safety level and keep a close log of instrument validation etc. Automation using more accurate and sophisticated system might be warranted for high risk storage systems.
Having worked in logistics operations and planning, the challenge often is how far you’d like to operate from the ‘limits’ vis-a-vis making full use of the asset.
Good analysis. Whatever be the level of automation, if we do not maintain and carryout regular tests/calibration, nothing can ensure a safe work environment.
In a previous role, I was involved in tank overfill prevention applications. In both cases, the client wanted to change to using a SIL rated tuning fork, but wanted a way to manually test the switch. We designed a chamber to allow the liquid to be filled into it, at a much faster rate than it flowed out of the bottom, so the level rose and tripped the switch, verifying its operation. One was a manual system, where they had a side spout to fill from a jerry can, the other was more sophisticated and pumped from the tank into the chamber. System could be used to verify whatever type of level switch is used, or even a GWR. Happy to put people in touch with the manufacturer if there is interest.