Emergency Release of Internal Pressures from · PDF fileInternal Pressures from Aboveground...

1

Emergency Release of Internal Pressures

from Aboveground Storage

TanksBy George L. Morovich

TEMCOR –Houston Office13 Flower Tuft Ct. – The Woodlands, Texas 77380

PH: +1-281-367-7868 [email protected]

CORPORATE HEADQUARTERS

150 West Walnut, Suite 150

Gardena, CA 90248

PH: +1-310-523-2322 www.temcor.com

TEMCOR the oldest and largest provider of Aluminum Dome Roofs

2

Overfill is considered an operator error that can be controlled,but tank design to address overall emergency performance is also critical.

Discussion of emergency release of pressure is related to the overfill protection topic. Based on a 1999 survey the majority of shell joint damage was reported due to overfill.

Internal Floating Roof Tanks (IFRTs) are safer from external event exposure (natural and other).

Approximately 80% of fires occur on External Floating Roof Tanks (EFRTs).

Aluminum Dome Roof Tanks (ADRTs) provide significant advantages over the steel Cone Roof Tanks (CRTs)

A frangible (weak) roof-to-shell joint is desirable for an overfill (or other pressure event).

Emergency pressure release alternatives. The causes, frequency and risks of emergency internal pressure incidents.

3

Methods for providing emergency release of internal pressure from within aboveground storage tanks are desired as a safety precaution to prevent shell uplift.

Shell uplift may cause failure of the bottom to shell joint along with damage to piping, sumps and appurtenances; thereby, resulting in a release of a tank’s contents.

4

There currently are three basic approaches for emergency release of internal

pressure.

1. Emergency venting per API 2000

2. Weak roof to shell seam (Frangible roof)

3. Floating roof with open circulation venting

1) Emergency Venting

Per API 2000 applies only for relief of internal pressures resulting from exposure to an external fire.

5

2) Frangible Roof Joint (weak roof seam)Based on completed research (allowing minimal shell uplift), this approach is not reliable for tanks below 50’ diameter.

Current API research investigated relative strength of roof-to-shell and bottom-to-shell joints along with allowable uplift.

Results of research expected to allow frangible joint down to 30’ diameter (with improved bottom joints and consideration of tank uplift, similar to Appendix E earthquake design for uplift requiting flexibility in piping and attachments).

2) Frangible Roof Joint (weak roof seam)1. Applicable to Cone Roofs only, based on specified

roof slope, top of shell section detail and maximum weld size.

2. Subject to workmanship (such as excessive welds),

3. Subject to changes that weaken the relative strength of the bottom joint (such as bottom settlement and corrosion).

4. Incident results in roof damage (typically requiring removal from service).

5. Not suitable for certain incidents (such as overfill).

6

3) Floating roof tanks with open venting or other means to avoid combustible mixture

Considered exempt from the condition that API 2000 provides protection for.

1) The floating roof minimizes exposed product.

2) Circulation vent area will exceed the area required in API 2000.

3) Circulation vents or other means used to minimize the potential hazard of combustible mixtures from developing within the tank.

7

Domed External FloatingDomed External Floating--Roof TankRoof Tank

Internal FloatingInternal Floating--Roof TankRoof Tank

14

Internal Floating-Roof TankFixed roofFixed roofFloating roofFloating roof

8

Internal Floating Roof Tank --- Internal deflagration reported due to lightening strike during filling

Over Pressure Event

9

Over Pressure Event

Areas of bottom plate lifting.

Area of top shell course damage.

10

TYPES OF EMERGENCY INTERNAL PRESSURE EVENTSOverfillSteam ReleaseGas InjectionProduct ReactionsExternal fire exposureInternal deflagrationEarthquakeOtherOf course other causes of roof / shell failure occur, such as incidents involving excessive wind or exposure to an external deflagration.

Overfill incidents appear to be the most common and preventable cause of emergency pressure related damage to tanks. Minimum emergency vents or a frangible joint cannot be expected to relieve pressure prior to uplift. Product level control is the best means to avoid this type of incident. Tank design with low profile floating roofs and rim vents can avoid damage.

11

Aluminum dome peripheral venting facilitates overfill with minimal damage or no damage to the dome roof. Any resulting damage to the dome roof can typically repaired without removal of the tank from service. Overfill slots are not desired due to reduced operating capacity.

OVERFILL in a cone roof tank causes damage to frangible roof.

12

Over Pressure Event

Internal deflagration within an aboveground storage tank is the most severe but also a very rare incident.

13

Overfills Overfills -- This is What We Are Talking About This is What We Are Talking About

(start of presentation by P.E. Myers)(start of presentation by P.E. Myers)

Tank OverfillTank OverfillBangkok, ThailandBangkok, Thailand

• 8 Fatalities

• 13 Serious Injuries

• 5 Tanks destroyed or severely damaged

• Numerous facility buildings destroyed or severely damaged.

• Death toll could have reached over 100 if incident had occurred during day.

15

Chevron Marketing Corporate Values

Be the preferred provider ofpetroleum terminaling

operations

CustomerSatisfaction

EnvironmentalImpacts

Health&

Safety

Health&

Safety

Public

Workers

Customers /Consumers

Customers /Consumers

RegulatoryRelations

StrategicAlignment

Employee Commitment/

Alignment

CorporatePublic/

CommunityReputation

CorporatePublic/

CommunityReputation

Communityrelations

Corpreputation

Financial

Performance

3

81

Undesirable behaviorInadequate skill,

motivation, procedures,

communication of

expectations, tools, or

equipment

Major Overfill

Minor Overfills

Near Misses

Banta, Tampa, Lexington

Near Miss Investigation

Incident Prevention Observation

Safe Performance Self Assessment

Job Safety Analysis

NMI

1

IPO

SPSA

JSA

Banta 1998

Near misses not done

LPS 2000 Overfill Study

Unknown Near Misses

16

Banta, CA

• Got call on Sunday morning - tank overfill• Spill size over 1000 gallons gasoline• Vapor traveled across highway 5 to prison;

complaints of illness from vapors

-80

-60

-40

-20

0

20

40

60

80

0 20 40 60 80 100 120 140 160

Cro

ssw

ind

Dis

tanc

e (fe

et)

CONCENTRATION CONTOURS: OVERHEAD VIEW

SLAB Cloud

Gasoline Spill: 20 f t. Diameter

casename=OF20F5L

w.s. = 5 mph

F stability

Mon Mar 26 11:15:24 2001CANARY by Quest

Downwind Distance (f eet)

81624 ppm

12868 ppm

12868 ppm

17

GasolineSpill

Diameter(Feet)

Distanceto Upper

Flammability Limit

(Feet)

EstimatedTime toReachUFL

(Seconds)

Distanceto Lower

Flammability Limit

(Feet)

EstimatedTime toReachLFL

(Seconds)5 10 9 50 22

10 25 14 90 3415 35 20 120 4720 40 26 155 6025 50 29 190 7130 65 35 230 85

Flammability Limits and Downwind Distances

We Surveyed the Bay Area Pipeline System Tanks and...

• Alarms and shutdowns not always tested per procedure

• Alarms and shutdowns not accessible for testing

• Alarms and shutdowns set to wrong levels or too close to be effective

18

Banta T-137 Overfill IncidentMOV-51 Station Shutdown

NO HAND RAILS ON TANK 116.

19

TANK 118 JET-A

Old style inspection hatch removed.

Inspected and tested floats assembly.

Voltage readings were good 23.04vdc.

This tank did pass MOVpipeline shut down.

TANK 117 JET-A

This tank didn’t pass the first time I lifted the float assemble. So I tried moving the switch assembly and that seemed to fix the floats.

Retest the floats and it didpass the MOV pipeline shut down.

Voltage reading was 23.04vdc.

20

Banta T-137 Overfill IncidentMagnetrol Cannot Be Field Tested

21

“Eliminate Overfills”

• Trevor Cletz - frequent review of “history” is important to prevent safety problems

• We looked at the past• We looked into our LPS System

Overfill History Early 80sDate EventAugust 1980 Honolulu Pier 30 Tank Overfill and

Fire - 3 FatalitiesMid 1982 Trial Preparation

Overfill Cause SurveyJanuary 1983 Honolulu Lawsuit ConcludedMay 1983 Marketing Overfill Prevention

Program LaunchedNovember 1983 Priorities Developed for 99 terminals

22

Study Basis• Tank overfills are random events as

shown by pattern of 1978-80.• Filling frequency is primary predictor of

overfill potential, among other factorscovered later.

• Visited 10 of 99 terminals (today have40+)

• Study only focused on probability ofoverfill (primarily function of fillfrequency); not on consequence.

• Prediction Factors Developed

Overfills at Marketing Terminals from 1978 to 1984Year Number Number

All Class 11978 11 61979 1 01980 10 51981 10 61982 6 11983 6 Unknown1984 5 UnknownTotal 49 18

No Class I Tanks 548No Fills 10000/yrTotal fills 60000Overfill frequency 3333Class 1 Tanks = 548Pre Program Period 1978-1981For this period there were 8 ovefill/yr = (11+1+20+20)/4

23

Prediction Factors Developed

• Frequency most important• But still differences in

TankFillsfillsActualOver

Terminal Type FactorProduct Receipt Factor MultiplierMarine 1.0Pipeline 1.5Marine and pipeline 2.0Refinery (multiple lines) 2.0

24

Complexity FactorProduct Receipt Factor MultiplierComplex 1.5Normal 1.0 Complex defined as:• Multiple lines between tanks• Tanks at different elevations• Multiple methods of receiving or shipping products• Transfers of products between tanks at the

terminal

Attendance FactorProduct Receipt Factor MultiplierFully Attended-reliable alarms 1.0Fully attended - unreliable alarms 1.5Semi-attended - Partial levelinstrumentation

1.2

Unattended-complete levelinstrumentation

0.5

Completely attended facility has computer moitoring of theflow meters and the tank gages, independent high levelalarms and independent high-high level shutdowns

25

Alarm FactorProduct ReceiptFactor

Multiplier

Reliable alarms 1.0No alarms 1.0Unreliable alarms 2.0Unreliable• Level swithches in tank gages• Sonic level switches• Computer monitoring of tank gages

Average• Magnetrol or mercoid float switches

Reliable• Scully thermister• Enraf infrared• Drexelbrook or Robershall capacitance level

switches

Shutdown FactorProduct ReceiptFactor

Multiplier

No shutdowns 1.0Independentshutdowns

0.5

26

Factor Low High RatioTerminal Type 1 2 2Complexity 1 1.5 1.5Attendance 0.5 1.5 3Alarm 0.5 1 2Shutdown 0.5 1 2Range 36Relative .125 4.5Effectiveness 8 0.2

A

Other Factors

Refinery Terminal

• 5 of 8 highest scoring (greatest risk) adjacent to refineries

• Small tanks, high turnovers• 5 of 18 Class I overfills occurred at 3

refineries

27

Options Action Overfill peryear

Costs$1000s

Case 0 Do noting 8 Overfills/yr 0

Case 1 TrainingProcedures

5 overfills/yr 100

Case 2 Alarms on 6 4 overfills/yr 900

Case 3 Alarms on 18terminals

2.75 overfills/yr 3,100

Case 4 Alrms on 42terminals


Case 5 Alarms on all102 terminals


Overfill Mitigation Costs

0

1

2

3

4

5

6

7

8

9

1 2 3 4 5 6

Case Number

Cos

ts

-2000

0

2000

4000

6000

8000

10000

12000

14000

Costs Per CaseNo of OverfillsCost per Avoided Overfill

28

Wisdom - Acceptable Level of Risk

Prevention

Overfills

Total

Cos

t

No of Overfills “Do nothing”

Optimum

“Total Safey”

Key Problems of Acceptance

• Cost too high• 2 stages is too many; 1 stage will work

– (define stages)

• Level of protection needed (10-6, 10-10, 10-20?)• My terminal is unique?• Marine terminals not same as pipeline and not same as

refinery terminals

29

Considerations to Start With

• Are Automated safety shutdown system warranted?• Different terminals have different inherent as well as percieved risk

(public) and perhaps should be treated differently• Class 1 vs other classes might need to be considered• We are not starting from ground zero, but building on the original

program

Zero Tolerance

• A goal to strive for (but not possible)• Data and Risk Management Are Critical• Only now is industry beginning to really consider

this; but there is still a problem with sharing statistics and there is a problem with short corporate memories

30

Tank Reference Point

OD pointLSHH > of 5 min or 6 in below OD

LAHH 20 min below LSHHLAH 10 min below LAHH

LSLL 6 in above roof landing or loss of suction

LAL 6 in above LSLL or set by Terminal Mgr

Working Capacity of Tank

Audible & Visual Alarm. Tank inlet valve closes -( II ).Local External Audible & Visual Alarm(NMI).

ITS Visual Alarm. Delivery must Stop!

ITS Audible Alarm. No new truck loadings will be started ITS Audible Alarm. Tank valve closed

How Tank Levels Are SetHow Tank Levels Are Set What Actions OccurWhat Actions Occur

Tank Alarm LevelsTank Alarm Levels

Tank Overfill/Damage - AIM INCIDENT

Time > 5 min. but varies with tankHeight > 6.0 inches

20 minutes @ max fillrate

10 minutes @ max fillrate

Time > 5 min. but varies with tankHeight > 6.0 inches

TITLE

SCALENone

DRAWN BYPEMY

SHEET 1 OF 1

Chevron

DATE7/6/99

Roof Landing Level

LSHH (Level Shutdown High High)Local audible and visual Alarm.Alarm in Houston (Digital alarm in OASyS "HHLO" - a high severity alarm.)This alarm is not adjustable by the controller in Houston.Marketing's independent high high shutdown system (Enraf 873 radar) closes an independent pipelinevalve (SDV52 is a fail-close valve) and operates the local and Houston alarm.Classified as AIM "near miss" .

LAHH (Level Alarm High High )Local audible and visual Alarm.Alarm in Houston (Analog alarm in OASyS "HHAL" - a medium severity alarm.)This alarm is not adjustable by the controller in Houston.ATG (Enraf 854) operates the local and Houston alarm .Classified as AIM "near miss" .

LAH (Level Alarm High) - Normal Max Fill LevelAlarm in Houston (Analog alarm in OASyS "HLAL" - a low severity alarm.)This alarm is not adjustable by the controller in Houston.Houston controller shall close MOV 51 at this level.ATG (Enraf 854) operates the local and Houston alarm.

LSLL (Level Shutdown Low Low)Local Audible Alarm.Alarm in Houston (DIgital alarm in OASyS "LLSD" - a medium severity alarm.)This alarm is not adjustable by the controller in Houston.Truck loading rack valves closed automatically by ITS.ATG (Enraf 854) operates the local and Houston alarm.Classified as a AIM "near miss".

LAL (Level Alarm Low)Local Audible Alarm.Alarm in Houston (Analog alarm in OASyS "LLAL" - a low severity alarm).This alarm is not adjustable by the controller in Houston.ATG (Enraf 854) operates the local and Houston alarm.

TT (Tank Target)Alarm in Houston (Analog alarm in OASyS "TTAL" - a low severity alarm.)This alarm is adjustable by the controller in Houston and is used as a tool to notify them of the tanksmovement to a specific volume or gauge.This alarm is in CPL's alarm system and Marketing is not aware of this alarm; signal.ATG (Enraf 854) operates the Houston alarm.

This is the normalworking capacity of

the tank

Le ve l a l a r m l o wLAL

Le ve l SHUTDOWN l o w l o wLSLL

Le ve l a l a r m HIGH h ig hLAHH

Le ve l SHUTDOWN h i gh h ighLSHH

LEVEL ALARM HIGHo r

n o r ma l Fi l l Le ve l Ma xLAH

Result of SOA

31

The LPS System and Overfills

• New Behavior Based Safety System Implemented

• Phil Wetmore decided to study it for lessons learned; I got to do the grunt work

• Some eye opening findings...

2000 Overfill Case Study

Chevron Products CompanyMarketing Light ProductsPE MyersMonday, June 4, 2001Tampa Florida

32

2000 Overfill Study

• Have LPS System Tool Available• Not available previously• Reviewed 180 near misses and incidents

– 81 near misses and direct relation to AST overfills

• Allows a glimpse into real situation and causes

Trigger

• 8/80-Honolulu Pier 30 Overfill, fire, fatalities

• 5-10/82 Overfill Survey• 1/83 lawsuits completed• 5/83 Original Overfill Prevention Program

33

Duration 2.4 yearsOverfills 3 4%NMIs 78 96%Total 81 100%

LPS Pyramid Ratios

Marine 13 16%Pipeline 35 43%STATIC 14 17%Other 19 23%

81 100%

NMIs by Type of Transfer

34

Independent Human Factor/Equipment Causes

H Causes Only 14 17%E Causes Only 31 38%E&H Causes 36 44%

81 56%

Sunday 12 15%Monday 14 18%Tuesday 7 9%Wednesday 18 23%Thursday 10 13%Friday 8 10%Saturday 11 14%

80 100%

Days of Week Effects

35

IC-1 Following Procedures 48%IC-2 Inadequate Procedures 16%IC-3 Communication 10%IC-4 Other 26%

100%

Independent CausesHuman Factors

Other includes MOC, third party, unable to categorize

IC-1 Alarm System 42%IC-2 Alarm Settings 3%IC-3 ATG 45%IC-4 Other 9%

100%

Equipment Factors

36

IC-1 ES 85%IC-2 EO 15%

100%

Other Factors

37

HP-1 Incorrect Valve Line Up 15%ES Inadequate procedure/tools 13%HP-4 Following Procedures 14%HH-1 Management of change 9%HT Third Party 7%

58%

Top 5 Causes Ranked by Points Across All Causes

Valve Line Up

38

ov erfill frequenciesPre 83 Program 3300Predicted reduction factor 0.15625Predicted Post Program Rat 21120

LPS Rate 18750Marine Rate 25-50000

My Problem - Overfills Shall Stop!

• What is the acceptable level of risk?• 1:100,000 or 1:1,000,000 or

1:1,000,000,000?• Management accepted 1:Million

39

“No Incidents=10-6”

• Trevor Cletz– Normal systems 10-2 or 3

– Considerable effort to get 10-4

– Significant effort 10-6

• Having 1 overfill in a 10 year period covering at least 1000000 receipts 10-6 -a significant effort

• To meet mgmt directive = automated safety shutdown system and a change in behavior

• We turned to CRTC

Independent Protection Layers

Alarms, Operators

Passive Safety SystemFinal and IndependentProtection

Operations, Training,Procedures

Emergency Response

Incident

ProcessPhysical Limits

Event

Primary Layer of Protection

ANSI/ISA S84.01AICHE “Guidelines for Safe Autoation of Chemical ProcessesAPI 14C Offshore Platform Shutdown Systems

40

Category 1UninstrumentedOperator control

Category 2Instrumented, alarmedOperator and process controlledNo Independent Shutdown System

Category 3Has IPL-2 automated shutdown system

Category 4Has Enraf standard ATG and IPL-2Radar automated safety shutodwn system

IPL2Enraf StandardRadar ShutdownSystemCurrent Standard

Four Fundamental Categories of Tank ATG/Overfill Systemsin the System Population

ATG

ATG

SERVO RADAR

ALARM

ALARM

LSHH

IPL2Maybe anyindependentshutdownsytsem

IPL-1 Systems use operations, procedures, training and all normal activities to prevent an overfill

IPL-2 Systems use an instrumented, independent automated safety shutdown system which isnot dependent on operator intervention

44

Pipeline Company providing receipts thatare too large; possible meter

calibration problem on their part, no overfill automatic shutdown systems,multi tank receipts

Control Number 5327

45

Control Number 6704

Locked valve prevented it frombeing opened;operator did not realize importance

Control Number 7403

One of several tanks had units in gallons except T-44 (bbls);suggests needs for standardization

46

Control Number 6700

Failure of radio duringcritical moment of fuel transfer

Control Number 8122

Multi product flying switch proceduresnot covered by Modes document;

47

Control Number 13299

This involved gravitating between2 tanks and valve line up


Failure to follow proceduresleads to incorrect valve line up

48


Operator was distracted and shortof help, did not get back to attending receiptintended 15 minutes but took 24 minutes.


Relief line valve failed causing transmix tank to fill, but failure of flow switch didnot notify operators, pipeline saw tank levelrise and shutdown pipeline

49


Jumper line was installed that operatornot familiar with; changes made by Asphalts


Simply left valve open

50


Filling into 2 tanks, but insufficent timeto make switch, first tank nearly overfilled.


MS-445's not being filled our correctly;operators did not see value and did notknow how to complete

51


Varec freezes in position


Could not open frozen lock or valve

52


Check valve fails when 2 tanks opento receipt, due to gravitation


Varec did not have tape connected

53


Frozen open check valve causes wrongtank to be open and fluid to fill it


Operator failed to close valveafter previous receipt

54


Pipeline Co says could not contactoperator on cell phone; started receiptanyway; excess volume in tanks


Tanks not identified as they were painted,manager did not check alignment boardposting, valve alignment was wrong

55


Operator in restroom when alarm sounds,failure to use MOC causes incorrect alarm settings

We Have Done Our PartWhat About Industry?

• All of the good practices needed are in API 2350

• The first of 2 problems is the language of the document which may not be adaptable by jurisdictions having authority

• The second problem is the scope which is limited to Class I liquids

57

Roof leg on high position

Roof leg on low position

Foam dam

Secondary seal

Rafters or roof structure

The highest roofappurtenance whichinterferes with the roofstructure sets the overflowor damage level

6 in margin

6 inches abovewhere floating roof

leg would touchbottom

OD

LSH

LAH

LAL

Nor

mal

Wor

king

Cap

acity

Lower of Overflow/DamageLevel Shutdown HighCauses automated valveto close off against receipt.Not often used but shouldalways be considered.

Level alarm highMandates operator to startshutdown of receiptmanually. In common use.Also, many operators usemore than one alarm.

Tank Action Levels

Level alarm lowSometimes used toprevent landing floatingroof which may be an airpermit violation

Industry and Overfills

• API 2350 has the information• Problem involves 2 key factors

– scope inadequate (transfer type, class of liquid)– rp vs standard

• Revise, Revalidate or Remove• Scope change is now the issue-I will work

on this

58

We’re Making Progress

[email protected]

• 1 Overfill in 3300, or 5000 or even 10000 is too high (because there are lots of tank fillings - millions annually)

• We want to get to 1 in a million: Can’t do with principles of S84.01

• Share the lessons learned

Emergency Release of Internal Pressures from · PDF fileInternal Pressures from Aboveground...

Documents

Transcript of Emergency Release of Internal Pressures from · PDF fileInternal Pressures from Aboveground...