SIL study related to an API 2350 category III fuel storage facility (Manned facility).

[billdoor]

Hello, I hope you're all doing fine. Could you please help me in the following matter.
We will be performing a HAZOP study for an attended fuel depot extension (JET fuel, diesel, gasolines).
We have been also asked to perform a SIL study after the HAZOP.
The thing is that the facility does not include any SIS in the tanks inlet as it is a manned facility falling into category III per API 2350. All storage tanks filling operations are fully attended and monitored by operators both on tank surroundings and in the control room.
My question is the following Where is the point developping a SIL study since no automated safety/security shutdown is on place in the tanks inlet to prevent overfillings that could lead to pool fire, VCE or fire-ball.
Also, Is there a previous experience where a SIL study has been performed in API 2350 category III fuel storage facility.
Thank you
Bill

 

[georgeverghese]

Manning of any plant operation, on its own without any SIS, is acceptable only when the risks and / or consequences of loss of containment are minimal. Off the cuff, this strategy you've stated for plant operations without SIS is unacceptable for a fuel depot with significant flammables inventories.

What does Cat III in API2350 say ?

 

[billdoor]

Thank you for your prompts response. In fact I meant Category 1 or 2 Facility as it is a manned facility, tanks would be monitored from a control room, MOV's operated also from control room, LAH alarm in control roomto trigger human operator action (push button); an LSHH independant fromt the LAH bridle/transmitter would trigger another alarm in control room for human/operator action. No Safety Instrumented System (Sensor-Logic Solver-Final Element for Action) is in place.

To answer your question, API 2350 gives:
For Category 1, operating personnel are required on site during the entire transfer operation as a fully-attended
facility. No hand gauging until at least 30 minutes after receipt is complete.
This standard applies to most of the commonly found equipment configurations for terminals taking receipts from
marine or mainline pipelines and for tank-to-tank transfers. However, there are some configurations that are not
covered by this standard although in service within the scope of API 2350. In these cases, the principles of this
standard may be applied. Other tanks in service outside the scope of API 2350 are listed in 1.1.
4.4.5.2 Category 1 Facility
4.4.5.2.1 A Category 1 overfill prevention system may or may not have instrumentation. Even if it does have
instrumentation, it is local to the tank or the facility and does not transmit liquid level or alarm data to the transporter. If
shutdown or diversion is required to prevent an overfill, it should be done manually requiring personnel action by:
a) intervention at the local facility to terminate flow to the tank; or
b) by the transporter after receiving “manual” communications from personnel at the site.
4.4.5.2.2 Category 1 shall be operated as a fully-attended facility for receipts with monitoring continuously during
first hour of receipt, every hour during the receipt, and continuously during the last hour of the receipt, as indicated in
Table 2, since there are no remote monitoring capabilities by the transporter for either alarm or level information.
Safety considerations prohibit hand gauging during product receipt or during the 30 minutes after completion (see API
2003).
4.4.5.2.3 Category 1 shall not be used where, because of the frequency of receipts or the complexity of the facility or
terminal, the operator cannot reasonably be expected to focus fully on termination of one receipt at a time or may be
distracted with other duties or responsibilities.
4.4.5.3 Category 2 Facility
4.4.5.3.1 A Category 2 overfill prevention system shall have an ATG system with level transmittable to a local
control center or a remote control center. It uses the same sensor for level and high-high alarm (LAHH) both of which
can be transmitted. Typically alarms are transmitted to a remote control center. This transmission of alarm data to a
control room is a key difference between Category 1 and Category 2.
4.4.5.3.2 Category 2 systems may be operated as a semi-attended facility for receipts if the level alarms are
monitored by a control center. At a minimum, personnel shall be at the facility with tanks at the start of a receipt and
transfer operation (start denoted by the flow of product) and attend the operation for 30 minutes. In addition,
personnel shall attend the last 30 minutes of the receipt and transfer operation (end denoted by the stop of product
flow.) Personnel may also be required to be at the facility periodically during the receipt.
4.4.5.3.3 If operated as semi-attended, the transporter is required to assist with monitoring the receipts via the highhigh
tank level alarms and shall be in communication with personnel responsible for the receiving tank. The control
centers shall have the ability to terminate (stop or divert) product flow to the facility.
4.4.5.4 Category 3 Facility
4.4.5.4.1 A Category 3 overfill prevention system uses both an ATG and an independent level alarm high-high
sensor (LAHH). The key difference between Category 2 and Category 3 is that the LAHH sensor is independent of
the ATG and alarm data is transmitted to a control center (with discretionary transmission of level data as determined
by facility and shipper agreed protocols).
4.4.5.4.2 A Category 3 site may be unattended if both level data and alarms are monitored by the transporter.
4.4.5.4.3 The independent LAHH sensor (either a point level or continuous level device) may be connected to the
common ATG or SCADA system only if the ATG or SCADA system is electrically supervised and provides diagnostic
alarms to the transporter.

4.4.5.4.4 Tanks in fully automated operation at unattended facilities shall be equipped with an independent LAHH
sensor that shall activate an alarm with the transporter to initiate termination procedures or shall automatically
terminate the flow to the tank. These systems shall also initiate receipt termination procedures in the event of a power
failure in the level measuring system based on an appropriate response time (4.4.2.5).

Best Regards.

 

[georgeverghese]

In my experience, large inventory NGL and crude storage tank farms were operated as Cat III AND monitored at local guages and tank filling stopped manually at CR to prevent triggering the LAH or LSHH.