Receipt of Bulk Liquids

W.V.PETER HUNT

DIRECTOR & PRINCIPAL CONSULTANT,WHAMCORP PTY LTD

www.whamcorp.com.au

BOARD MEMBER & PAST PRESIDENT,AUSTRALASIAN INSTITUTE OFDANGEROUS GOODS CONSULTANTS

www.aidgc.com

2Whamcorp Pty Ltd

Independent systems?

3

4 HOUR POWER OUTAGE TWO BLOCKS AWAY AFFECTS BOTH ISPs

Whamcorp Pty Ltd

Not independent

A 5-million US gallon (19 million litre) aboveground storage tank overflowed into a secondary containment dike during transfer from a ship.The gasoline spray aerosolized, forming a large vapour cloud, which ignited after reaching an ignition source in the wastewater treatment area of the facility.

4Whamcorp Pty Ltd

CAPECO, PUERTO RICO, 2009

5Whamcorp Pty Ltd

TANK GAUGING AT CAPECO

11

Before and after transfer

Used by operator

Used by supervisor

Whamcorp Pty Ltd

“SIDE GAUGE” – dip visible, transmitted to computer

12Whamcorp Pty Ltd

Monitoring volume during transfer

• Before and after transfers, manual dip and strapping (gauging) table for volume.

• Side gauge used by operators, also transmitted to computer

• Computer indicated the values for the liquid depth, the total volume based on the strapping table, and the flow rate into or out of the tank as it graphed values over time and calculated fill rate

• If computer unavailable, start time and table used to estimate fill time

13Whamcorp Pty Ltd

Normal safeguards not installed

14

AOPS

Whamcorp Pty Ltd

CATNAP(CHEAPEST AVAILABLE TECHNOLOGY NARROWLY AVOIDING PROSECUTION)

“The CSB found that CAPECO purchased the least effective level-measurement system and employed an inadequate maintenance program to care for that system.”

• Float and Tape Gauges Prone to Failure

• Poor Float and Tape Gauge Maintenance

• “Practices were contrary to the recommended practices in API Manual of Petroleum Measurement Standards “

15Whamcorp Pty Ltd

Transfer operation

• Shipment of more than 11.5 million US gallons (44 million litres) of unleaded gasoline, expected to take 24 hours.

• No tank available for full load, so pump to 4 small tanks and remainder to top up another

• Operators adjusting flow rates by tank valves and manually calculating fill times based on hourly level check (normal practice due to transmitter problems). Valve to one tank was closed as gauge observed to be stuck

16Whamcorp Pty Ltd

Hourly level check

At the 11 p.m. walk-around, the tank farm operator observed the side gauge on Tank 409 during his hourly check.

The operator called the level into the supervisor who calculated once again that the tank should be full at 1 a.m.

17Whamcorp Pty Ltd

Operator’s midnight check

Before reaching the tank, the operator: • Observed a vapour cloud and a strong smell

of gasoline. • Contacted the dock operator to halt the

flow of gasoline to the tank.• Notified the other operator and supervisor

to meet at the edge of the terminal.

18Whamcorp Pty Ltd

From edge of terminal

Supervisor and operators:

• Observed a white fog approximately 3 feet (about 1 metre) above ground

• But could not hear or see gasoline overflowing from the vents on Tank 409 due to lack of lighting and the topography.

Approaching the fog, they noticed the air cool as the fog condensed on their hands, despite the 26°C temperature.

19Whamcorp Pty Ltd

What to do?

Noting the potential danger, the supervisor:

• sent one operator to the security gate,

• while the supervisor and another operator drove to a high vantage point, attempting to find the source of the leak and developing vapour cloud.

20Whamcorp Pty Ltd

21Whamcorp Pty Ltd

SYSTEMIC FAILURES (1)

• a history of poorly maintaining terminal operations;

• an inherent financial pressure to fill the tanks within the COPECO planning department’s stipulated time, at odds with safety;

• a failure to learn from previous overfill incidents at the facility;

• a lack of preventive maintenance for the malfunctioning float and tape device, automatic tank gauge transmitters;

23Whamcorp Pty Ltd

SYSTEMIC FAILURES (2)

• an unreliable computer for calculating tank fill times;

• a lack of overfill prevention safeguards as an independent alarm;

• a lack of formal procedures for tank-filling operations (operators & managers);

• an insufficient mechanical integrity program for safety critical equipment;

• poor adherence to human factors principles for safety critical equipment.

READ THE CSB REPORT24

Whamcorp Pty Ltd

Instruments–CAPECO 2009

25Whamcorp Pty Ltd

Instruments– Buncefield 2005

26Whamcorp Pty Ltd

Root Causes – CAPECO 2009

27Whamcorp Pty Ltd

Root Causes – Buncefield 2005

28Whamcorp Pty Ltd

Case study 1 – Road tanker

A flammable solvent storage tank was overfilled during unloading of a road tanker. An ultrasonic level transmitter was reading erratically during filling and the vessel was overfilled.

The independent hardwired high level interlock failed to operate.

The overfilled liquid was retained in the bund, fortunately not igniting.

33Whamcorp Pty Ltd

CS1 - Cause

The high level switch had been pulled out for testing and not put back, due to a mix-up and lack of robust permit to work sign-off

34Whamcorp Pty Ltd

Case study 2 - blending

A PLC started the pump, opened the inlet valve and transferred liquid until the required weight (from weigh cell), then stopping the pump.An independent high level switch (LSH) shuts the inlet valve and stops the pump.

After an overfill, weigh cell found faulty but LSH was working OK and had been tested to schedule.

35Whamcorp Pty Ltd

CS2 - Cause

Operators took samples from manhole and left the cover in place but unbolted.

LSH was mounted above level of manhole, so liquid overflowed before reaching LSH

36Whamcorp Pty Ltd

Case study 3 – Storage tank

LSH interlock was based on the DCS control system. Both the level transmitter and LSH set up to close the inlet actuated valve via the software. The level transmitter gave trouble for months. During one fill, erroneous readings of the level transmitter caused the inlet valve to shut. Operators visually checked the tank and found adequate space for the road tanker’s contents. The actuated inlet valve was put in manual mode from the DCS and opened.Filling was completed without any overfill.

37Whamcorp Pty Ltd

Case study 3 – next time!

The actuated valve was not returned to automatic mode. The next time the vessel was filled, the level transmitter again gave trouble and overfilling occurred. The high level switch did alarm at the control room but did not close the valve. The control room operator believing that the valve would close automatically did not initially take action. Approximately 2,000L of flammable solvent spilled but did not ignite.

38Whamcorp Pty Ltd

Case Study 3 - Lessons

• Overfill protection systems to be fully independent of the basic process control systems (BPCS) as required by standards such as IEC61511. Typically this would involve the interlock being hardwired or using an independent safety logic solver to be independent of the BPCS.

• Change control procedures to cover temporary software / control system changes in addition to equipment and process changes.

39Whamcorp Pty Ltd

But we have double walled tanks!

Double containment tanks are becoming increasingly popular both:

• On relatively small scale at industrial premises and commercial premises (such as for back up generators etc.), and

• Much larger double containment “cup” type tanks found in some European oil terminals.

46Whamcorp Pty Ltd

Typical small scale double walled tanks!

47

Typical double-walled tank used for acids and other corrosive liquids. Inner polyethylene tank (shown red) and outer tank.

Whamcorp Pty Ltd

1,000 US Gallon tank (detail)

48

INNER TANKFILLED TO TOP = 1,082 US Gal

(4,096 L)

OUTER TANKFILLED TO TOP = 1,110 US Gal

(4,202 L)

Whamcorp Pty Ltd

What is a double wall tank designed for?

These double containment tanks typically provide 110% containment of the tank volume to contain leaks from the inner tank

They provide only limited protection against overfilling.

i.e. if a tank is already full and further liquid is added there is only limited extra capacity in the annular space between the outer and inner tanks

49Whamcorp Pty Ltd

References

US CSB Final Investigation Report – CAPECO

US CSB video “Filling Blind”

CCPS Process Safety Beacon; Sep 2004, Sep 2006, Sep 2009, Oct 2009, Feb 2016

Loss Prevention Bulletin No 247, Feb 2016

Kletz, Trevor, “What Went Wrong”, 5th ed, Elsevier

Mostia, W.L. “Prevent Tank Farm Overfill Hazards”http://www.putmanmedia.com/assets/ct_sot_levelflow.pdf/

53Whamcorp Pty Ltd

Are there any questions

54Whamcorp Pty Ltd