Upload
doannguyet
View
222
Download
2
Embed Size (px)
Citation preview
1
Emergency Release of Internal Pressures
from Aboveground Storage
TanksBy George L. Morovich
TEMCOR –Houston Office13 Flower Tuft Ct. – The Woodlands, Texas 77380
PH: +1-281-367-7868 [email protected]
CORPORATE HEADQUARTERS
150 West Walnut, Suite 150
Gardena, CA 90248
PH: +1-310-523-2322 www.temcor.com
TEMCOR the oldest and largest provider of Aluminum Dome Roofs
2
Overfill is considered an operator error that can be controlled,but tank design to address overall emergency performance is also critical.
Discussion of emergency release of pressure is related to the overfill protection topic. Based on a 1999 survey the majority of shell joint damage was reported due to overfill.
Internal Floating Roof Tanks (IFRTs) are safer from external event exposure (natural and other).
Approximately 80% of fires occur on External Floating Roof Tanks (EFRTs).
Aluminum Dome Roof Tanks (ADRTs) provide significant advantages over the steel Cone Roof Tanks (CRTs)
A frangible (weak) roof-to-shell joint is desirable for an overfill (or other pressure event).
Emergency pressure release alternatives. The causes, frequency and risks of emergency internal pressure incidents.
3
Methods for providing emergency release of internal pressure from within aboveground storage tanks are desired as a safety precaution to prevent shell uplift.
Shell uplift may cause failure of the bottom to shell joint along with damage to piping, sumps and appurtenances; thereby, resulting in a release of a tank’s contents.
4
There currently are three basic approaches for emergency release of internal
pressure.
1. Emergency venting per API 2000
2. Weak roof to shell seam (Frangible roof)
3. Floating roof with open circulation venting
1) Emergency Venting
Per API 2000 applies only for relief of internal pressures resulting from exposure to an external fire.
5
2) Frangible Roof Joint (weak roof seam)Based on completed research (allowing minimal shell uplift), this approach is not reliable for tanks below 50’ diameter.
Current API research investigated relative strength of roof-to-shell and bottom-to-shell joints along with allowable uplift.
Results of research expected to allow frangible joint down to 30’ diameter (with improved bottom joints and consideration of tank uplift, similar to Appendix E earthquake design for uplift requiting flexibility in piping and attachments).
2) Frangible Roof Joint (weak roof seam)1. Applicable to Cone Roofs only, based on specified
roof slope, top of shell section detail and maximum weld size.
2. Subject to workmanship (such as excessive welds),
3. Subject to changes that weaken the relative strength of the bottom joint (such as bottom settlement and corrosion).
4. Incident results in roof damage (typically requiring removal from service).
5. Not suitable for certain incidents (such as overfill).
6
3) Floating roof tanks with open venting or other means to avoid combustible mixture
Considered exempt from the condition that API 2000 provides protection for.
1) The floating roof minimizes exposed product.
2) Circulation vent area will exceed the area required in API 2000.
3) Circulation vents or other means used to minimize the potential hazard of combustible mixtures from developing within the tank.
7
Domed External FloatingDomed External Floating--Roof TankRoof Tank
Internal FloatingInternal Floating--Roof TankRoof Tank
14
Internal Floating-Roof TankFixed roofFixed roofFloating roofFloating roof
8
Internal Floating Roof Tank --- Internal deflagration reported due to lightening strike during filling
Over Pressure Event
9
Over Pressure Event
Areas of bottom plate lifting.
Area of top shell course damage.
10
TYPES OF EMERGENCY INTERNAL PRESSURE EVENTSOverfillSteam ReleaseGas InjectionProduct ReactionsExternal fire exposureInternal deflagrationEarthquakeOtherOf course other causes of roof / shell failure occur, such as incidents involving excessive wind or exposure to an external deflagration.
Overfill incidents appear to be the most common and preventable cause of emergency pressure related damage to tanks. Minimum emergency vents or a frangible joint cannot be expected to relieve pressure prior to uplift. Product level control is the best means to avoid this type of incident. Tank design with low profile floating roofs and rim vents can avoid damage.
11
Aluminum dome peripheral venting facilitates overfill with minimal damage or no damage to the dome roof. Any resulting damage to the dome roof can typically repaired without removal of the tank from service. Overfill slots are not desired due to reduced operating capacity.
OVERFILL in a cone roof tank causes damage to frangible roof.
12
Over Pressure Event
Internal deflagration within an aboveground storage tank is the most severe but also a very rare incident.
13
Overfills Overfills -- This is What We Are Talking About This is What We Are Talking About
(start of presentation by P.E. Myers)(start of presentation by P.E. Myers)
Tank OverfillTank OverfillBangkok, ThailandBangkok, Thailand
• 8 Fatalities
• 13 Serious Injuries
• 5 Tanks destroyed or severely damaged
• Numerous facility buildings destroyed or severely damaged.
• Death toll could have reached over 100 if incident had occurred during day.
14
15
Chevron Marketing Corporate Values
Be the preferred provider ofpetroleum terminaling
operations
CustomerSatisfaction
EnvironmentalImpacts
Health&
Safety
Health&
Safety
Public
Workers
Customers /Consumers
Customers /Consumers
RegulatoryRelations
StrategicAlignment
Employee Commitment/
Alignment
CorporatePublic/
CommunityReputation
CorporatePublic/
CommunityReputation
Communityrelations
Corpreputation
Financial
Performance
3
81
Undesirable behaviorInadequate skill,
motivation, procedures,
communication of
expectations, tools, or
equipment
Major Overfill
Minor Overfills
Near Misses
Banta, Tampa, Lexington
Near Miss Investigation
Incident Prevention Observation
Safe Performance Self Assessment
Job Safety Analysis
NMI
1
IPO
SPSA
JSA
Banta 1998
Near misses not done
LPS 2000 Overfill Study
Unknown Near Misses
16
Banta, CA
• Got call on Sunday morning - tank overfill• Spill size over 1000 gallons gasoline• Vapor traveled across highway 5 to prison;
complaints of illness from vapors
-80
-60
-40
-20
0
20
40
60
80
0 20 40 60 80 100 120 140 160
Cro
ssw
ind
Dis
tanc
e (fe
et)
CONCENTRATION CONTOURS: OVERHEAD VIEW
SLAB Cloud
Gasoline Spill: 20 f t. Diameter
casename=OF20F5L
w.s. = 5 mph
F stability
Mon Mar 26 11:15:24 2001CANARY by Quest
Downwind Distance (f eet)
81624 ppm
12868 ppm
12868 ppm
17
GasolineSpill
Diameter(Feet)
Distanceto Upper
Flammability Limit
(Feet)
EstimatedTime toReachUFL
(Seconds)
Distanceto Lower
Flammability Limit
(Feet)
EstimatedTime toReachLFL
(Seconds)5 10 9 50 22
10 25 14 90 3415 35 20 120 4720 40 26 155 6025 50 29 190 7130 65 35 230 85
Flammability Limits and Downwind Distances
We Surveyed the Bay Area Pipeline System Tanks and...
• Alarms and shutdowns not always tested per procedure
• Alarms and shutdowns not accessible for testing
• Alarms and shutdowns set to wrong levels or too close to be effective
18
Banta T-137 Overfill IncidentMOV-51 Station Shutdown
NO HAND RAILS ON TANK 116.
19
TANK 118 JET-A
Old style inspection hatch removed.
Inspected and tested floats assembly.
Voltage readings were good 23.04vdc.
This tank did pass MOVpipeline shut down.
TANK 117 JET-A
This tank didn’t pass the first time I lifted the float assemble. So I tried moving the switch assembly and that seemed to fix the floats.
Retest the floats and it didpass the MOV pipeline shut down.
Voltage reading was 23.04vdc.
20
Banta T-137 Overfill IncidentMagnetrol Cannot Be Field Tested
21
“Eliminate Overfills”
• Trevor Cletz - frequent review of “history” is important to prevent safety problems
• We looked at the past• We looked into our LPS System
Overfill History Early 80sDate EventAugust 1980 Honolulu Pier 30 Tank Overfill and
Fire - 3 FatalitiesMid 1982 Trial Preparation
Overfill Cause SurveyJanuary 1983 Honolulu Lawsuit ConcludedMay 1983 Marketing Overfill Prevention
Program LaunchedNovember 1983 Priorities Developed for 99 terminals
22
Study Basis• Tank overfills are random events as
shown by pattern of 1978-80.• Filling frequency is primary predictor of
overfill potential, among other factorscovered later.
• Visited 10 of 99 terminals (today have40+)
• Study only focused on probability ofoverfill (primarily function of fillfrequency); not on consequence.
• Prediction Factors Developed
Overfills at Marketing Terminals from 1978 to 1984Year Number Number
All Class 11978 11 61979 1 01980 10 51981 10 61982 6 11983 6 Unknown1984 5 UnknownTotal 49 18
No Class I Tanks 548No Fills 10000/yrTotal fills 60000Overfill frequency 3333Class 1 Tanks = 548Pre Program Period 1978-1981For this period there were 8 ovefill/yr = (11+1+20+20)/4
23
Prediction Factors Developed
• Frequency most important• But still differences in
TankFillsfillsActualOver
Terminal Type FactorProduct Receipt Factor MultiplierMarine 1.0Pipeline 1.5Marine and pipeline 2.0Refinery (multiple lines) 2.0
24
Complexity FactorProduct Receipt Factor MultiplierComplex 1.5Normal 1.0 Complex defined as:• Multiple lines between tanks• Tanks at different elevations• Multiple methods of receiving or shipping products• Transfers of products between tanks at the
terminal
Attendance FactorProduct Receipt Factor MultiplierFully Attended-reliable alarms 1.0Fully attended - unreliable alarms 1.5Semi-attended - Partial levelinstrumentation
1.2
Unattended-complete levelinstrumentation
0.5
Completely attended facility has computer moitoring of theflow meters and the tank gages, independent high levelalarms and independent high-high level shutdowns
25
Alarm FactorProduct ReceiptFactor
Multiplier
Reliable alarms 1.0No alarms 1.0Unreliable alarms 2.0Unreliable• Level swithches in tank gages• Sonic level switches• Computer monitoring of tank gages
Average• Magnetrol or mercoid float switches
Reliable• Scully thermister• Enraf infrared• Drexelbrook or Robershall capacitance level
switches
Shutdown FactorProduct ReceiptFactor
Multiplier
No shutdowns 1.0Independentshutdowns
0.5
26
Factor Low High RatioTerminal Type 1 2 2Complexity 1 1.5 1.5Attendance 0.5 1.5 3Alarm 0.5 1 2Shutdown 0.5 1 2Range 36Relative .125 4.5Effectiveness 8 0.2
A
Other Factors
Refinery Terminal
• 5 of 8 highest scoring (greatest risk) adjacent to refineries
• Small tanks, high turnovers• 5 of 18 Class I overfills occurred at 3
refineries
27
Options Action Overfill peryear
Costs$1000s
Case 0 Do noting 8 Overfills/yr 0
Case 1 TrainingProcedures
5 overfills/yr 100
Case 2 Alarms on 6 4 overfills/yr 900
Case 3 Alarms on 18terminals
2.75 overfills/yr 3,100
Case 4 Alrms on 42terminals
1.75 overfills/yr 6,000
Case 5 Alarms on all102 terminals
1.25 overfills/yr 12,000
Overfill Mitigation Costs
0
1
2
3
4
5
6
7
8
9
1 2 3 4 5 6
Case Number
Cos
ts
-2000
0
2000
4000
6000
8000
10000
12000
14000
Costs Per CaseNo of OverfillsCost per Avoided Overfill
28
Wisdom - Acceptable Level of Risk
Prevention
Overfills
Total
Cos
t
No of Overfills “Do nothing”
Optimum
“Total Safey”
Key Problems of Acceptance
• Cost too high• 2 stages is too many; 1 stage will work
– (define stages)
• Level of protection needed (10-6, 10-10, 10-20?)• My terminal is unique?• Marine terminals not same as pipeline and not same as
refinery terminals
29
Considerations to Start With
• Are Automated safety shutdown system warranted?• Different terminals have different inherent as well as percieved risk
(public) and perhaps should be treated differently• Class 1 vs other classes might need to be considered• We are not starting from ground zero, but building on the original
program
Zero Tolerance
• A goal to strive for (but not possible)• Data and Risk Management Are Critical• Only now is industry beginning to really consider
this; but there is still a problem with sharing statistics and there is a problem with short corporate memories
30
Tank Reference Point
OD pointLSHH > of 5 min or 6 in below OD
LAHH 20 min below LSHHLAH 10 min below LAHH
LSLL 6 in above roof landing or loss of suction
LAL 6 in above LSLL or set by Terminal Mgr
Working Capacity of Tank
Audible & Visual Alarm. Tank inlet valve closes -( II ).Local External Audible & Visual Alarm(NMI).
ITS Visual Alarm. Delivery must Stop!
ITS Audible Alarm. No new truck loadings will be started ITS Audible Alarm. Tank valve closed
How Tank Levels Are SetHow Tank Levels Are Set What Actions OccurWhat Actions Occur
Tank Alarm LevelsTank Alarm Levels
Tank Overfill/Damage - AIM INCIDENT
Time > 5 min. but varies with tankHeight > 6.0 inches
20 minutes @ max fillrate
10 minutes @ max fillrate
Time > 5 min. but varies with tankHeight > 6.0 inches
TITLE
SCALENone
DRAWN BYPEMY
SHEET 1 OF 1
Chevron
DATE7/6/99
Roof Landing Level
LSHH (Level Shutdown High High)Local audible and visual Alarm.Alarm in Houston (Digital alarm in OASyS "HHLO" - a high severity alarm.)This alarm is not adjustable by the controller in Houston.Marketing's independent high high shutdown system (Enraf 873 radar) closes an independent pipelinevalve (SDV52 is a fail-close valve) and operates the local and Houston alarm.Classified as AIM "near miss" .
LAHH (Level Alarm High High )Local audible and visual Alarm.Alarm in Houston (Analog alarm in OASyS "HHAL" - a medium severity alarm.)This alarm is not adjustable by the controller in Houston.ATG (Enraf 854) operates the local and Houston alarm .Classified as AIM "near miss" .
LAH (Level Alarm High) - Normal Max Fill LevelAlarm in Houston (Analog alarm in OASyS "HLAL" - a low severity alarm.)This alarm is not adjustable by the controller in Houston.Houston controller shall close MOV 51 at this level.ATG (Enraf 854) operates the local and Houston alarm.
LSLL (Level Shutdown Low Low)Local Audible Alarm.Alarm in Houston (DIgital alarm in OASyS "LLSD" - a medium severity alarm.)This alarm is not adjustable by the controller in Houston.Truck loading rack valves closed automatically by ITS.ATG (Enraf 854) operates the local and Houston alarm.Classified as a AIM "near miss".
LAL (Level Alarm Low)Local Audible Alarm.Alarm in Houston (Analog alarm in OASyS "LLAL" - a low severity alarm).This alarm is not adjustable by the controller in Houston.ATG (Enraf 854) operates the local and Houston alarm.
TT (Tank Target)Alarm in Houston (Analog alarm in OASyS "TTAL" - a low severity alarm.)This alarm is adjustable by the controller in Houston and is used as a tool to notify them of the tanksmovement to a specific volume or gauge.This alarm is in CPL's alarm system and Marketing is not aware of this alarm; signal.ATG (Enraf 854) operates the Houston alarm.
This is the normalworking capacity of
the tank
Le ve l a l a r m l o wLAL
Le ve l SHUTDOWN l o w l o wLSLL
Le ve l a l a r m HIGH h ig hLAHH
Le ve l SHUTDOWN h i gh h ighLSHH
LEVEL ALARM HIGHo r
n o r ma l Fi l l Le ve l Ma xLAH
Result of SOA
31
The LPS System and Overfills
• New Behavior Based Safety System Implemented
• Phil Wetmore decided to study it for lessons learned; I got to do the grunt work
• Some eye opening findings...
2000 Overfill Case Study
Chevron Products CompanyMarketing Light ProductsPE MyersMonday, June 4, 2001Tampa Florida
32
2000 Overfill Study
• Have LPS System Tool Available• Not available previously• Reviewed 180 near misses and incidents
– 81 near misses and direct relation to AST overfills
• Allows a glimpse into real situation and causes
Trigger
• 8/80-Honolulu Pier 30 Overfill, fire, fatalities
• 5-10/82 Overfill Survey• 1/83 lawsuits completed• 5/83 Original Overfill Prevention Program
33
Duration 2.4 yearsOverfills 3 4%NMIs 78 96%Total 81 100%
LPS Pyramid Ratios
Marine 13 16%Pipeline 35 43%STATIC 14 17%Other 19 23%
81 100%
NMIs by Type of Transfer
34
Independent Human Factor/Equipment Causes
H Causes Only 14 17%E Causes Only 31 38%E&H Causes 36 44%
81 56%
Sunday 12 15%Monday 14 18%Tuesday 7 9%Wednesday 18 23%Thursday 10 13%Friday 8 10%Saturday 11 14%
80 100%
Days of Week Effects
35
IC-1 Following Procedures 48%IC-2 Inadequate Procedures 16%IC-3 Communication 10%IC-4 Other 26%
100%
Independent CausesHuman Factors
Other includes MOC, third party, unable to categorize
IC-1 Alarm System 42%IC-2 Alarm Settings 3%IC-3 ATG 45%IC-4 Other 9%
100%
Equipment Factors
36
IC-1 ES 85%IC-2 EO 15%
100%
Other Factors
37
HP-1 Incorrect Valve Line Up 15%ES Inadequate procedure/tools 13%HP-4 Following Procedures 14%HH-1 Management of change 9%HT Third Party 7%
58%
Top 5 Causes Ranked by Points Across All Causes
Valve Line Up
38
ov erfill frequenciesPre 83 Program 3300Predicted reduction factor 0.15625Predicted Post Program Rat 21120
LPS Rate 18750Marine Rate 25-50000
My Problem - Overfills Shall Stop!
• What is the acceptable level of risk?• 1:100,000 or 1:1,000,000 or
1:1,000,000,000?• Management accepted 1:Million
39
“No Incidents=10-6”
• Trevor Cletz– Normal systems 10-2 or 3
– Considerable effort to get 10-4
– Significant effort 10-6
• Having 1 overfill in a 10 year period covering at least 1000000 receipts 10-6 -a significant effort
• To meet mgmt directive = automated safety shutdown system and a change in behavior
• We turned to CRTC
Independent Protection Layers
Alarms, Operators
Passive Safety SystemFinal and IndependentProtection
Operations, Training,Procedures
Emergency Response
Incident
ProcessPhysical Limits
Event
Primary Layer of Protection
ANSI/ISA S84.01AICHE “Guidelines for Safe Autoation of Chemical ProcessesAPI 14C Offshore Platform Shutdown Systems
40
Category 1UninstrumentedOperator control
Category 2Instrumented, alarmedOperator and process controlledNo Independent Shutdown System
Category 3Has IPL-2 automated shutdown system
Category 4Has Enraf standard ATG and IPL-2Radar automated safety shutodwn system
IPL2Enraf StandardRadar ShutdownSystemCurrent Standard
Four Fundamental Categories of Tank ATG/Overfill Systemsin the System Population
ATG
ATG
SERVO RADAR
ALARM
ALARM
LSHH
IPL2Maybe anyindependentshutdownsytsem
IPL-1 Systems use operations, procedures, training and all normal activities to prevent an overfill
IPL-2 Systems use an instrumented, independent automated safety shutdown system which isnot dependent on operator intervention
41
42
43
44
Pipeline Company providing receipts thatare too large; possible meter
calibration problem on their part, no overfill automatic shutdown systems,multi tank receipts
Control Number 5327
45
Control Number 6704
Locked valve prevented it frombeing opened;operator did not realize importance
Control Number 7403
One of several tanks had units in gallons except T-44 (bbls);suggests needs for standardization
46
Control Number 6700
Failure of radio duringcritical moment of fuel transfer
Control Number 8122
Multi product flying switch proceduresnot covered by Modes document;
47
Control Number 13299
This involved gravitating between2 tanks and valve line up
Control Number 13329
Failure to follow proceduresleads to incorrect valve line up
48
Control Number 14779
Operator was distracted and shortof help, did not get back to attending receiptintended 15 minutes but took 24 minutes.
Control Number 15216
Relief line valve failed causing transmix tank to fill, but failure of flow switch didnot notify operators, pipeline saw tank levelrise and shutdown pipeline
49
Control Number 15661
Jumper line was installed that operatornot familiar with; changes made by Asphalts
Control Number 15732
Simply left valve open
50
Control Number 16303
Filling into 2 tanks, but insufficent timeto make switch, first tank nearly overfilled.
Control Number 16417
MS-445's not being filled our correctly;operators did not see value and did notknow how to complete
51
Control Number 27099
Varec freezes in position
Control Number 29899
Could not open frozen lock or valve
52
Control Number 35026
Check valve fails when 2 tanks opento receipt, due to gravitation
Control Number 36986
Varec did not have tape connected
53
Control Number 36715
Frozen open check valve causes wrongtank to be open and fluid to fill it
Control Number 51039
Operator failed to close valveafter previous receipt
54
Control Number 79243
Pipeline Co says could not contactoperator on cell phone; started receiptanyway; excess volume in tanks
Control Number 83411
Tanks not identified as they were painted,manager did not check alignment boardposting, valve alignment was wrong
55
Control Number 94082
Operator in restroom when alarm sounds,failure to use MOC causes incorrect alarm settings
We Have Done Our PartWhat About Industry?
• All of the good practices needed are in API 2350
• The first of 2 problems is the language of the document which may not be adaptable by jurisdictions having authority
• The second problem is the scope which is limited to Class I liquids
56
57
Roof leg on high position
Roof leg on low position
Foam dam
Secondary seal
Rafters or roof structure
The highest roofappurtenance whichinterferes with the roofstructure sets the overflowor damage level
6 in margin
6 inches abovewhere floating roof
leg would touchbottom
OD
LSH
LAH
LAL
Nor
mal
Wor
king
Cap
acity
Lower of Overflow/DamageLevel Shutdown HighCauses automated valveto close off against receipt.Not often used but shouldalways be considered.
Level alarm highMandates operator to startshutdown of receiptmanually. In common use.Also, many operators usemore than one alarm.
Tank Action Levels
Level alarm lowSometimes used toprevent landing floatingroof which may be an airpermit violation
Industry and Overfills
• API 2350 has the information• Problem involves 2 key factors
– scope inadequate (transfer type, class of liquid)– rp vs standard
• Revise, Revalidate or Remove• Scope change is now the issue-I will work
on this
58
We’re Making Progress
• 1 Overfill in 3300, or 5000 or even 10000 is too high (because there are lots of tank fillings - millions annually)
• We want to get to 1 in a million: Can’t do with principles of S84.01
• Share the lessons learned