27 Feb 08 14:56
Thanks for all the interesting opinions. Based on all the information provided, my analysis is as follows. Please let me know of any misinterpretation.
API 521 (4.2.4) states that conventional instrumentation should be taken as a substitute" of a relief valve as protection agains single jeopardy overpressure scenario.
So, even if there are on/off valves that would utomatically close when overfilling is detected, I should still consider an overpressure credible scenario.
API 521 (5.4) allows taking credit for operators (at owners discretion), if response can be between 10 to 30 minutes. In 4.2 API 521 even gives an example of double jeopardy when considering operator error with a coincident power failure.
Because operators normally respond based on information provided by instruments (alarms, level gauges), it is clear that is not the intention of (4.2.4), to deny the correct operation of instruments to alert personnel to take action (unless of course, their failure can be considered under a single jeopardy situation).
ASME and API now accept the use of HIPS as an "overpressure protection", meaning that you can avoid installing relief valves if onder certain circunstances, you install a HIPS to take care of a credible overpressure scenario. So, once determined the existence of a credible overpressure scenario, we should either consider relief valves or use HIPS to take care of it.
In my case, I have relief valves for fire protection and am trying to determine if overpressure due to overfilling ("closed valve" situation under API 521) is also a credible credible. Based on the previous notes, I arrived to the following conclusions:
A) If the terminal loses power, and alarm provided by and instrument with adequate power backup for the system, can be considered operating under a single jeopardy situation, so if the terminal has permanent personnel, I could take credit for his corrective action if he has more that 10-30 minutes to react. In this case, the instrumentation system does not need to meet HIPS requirement because "there is not a credible scenario" that I need to address. There should not be a contradiction with (4.2.4) because the instrumentation is not an overpressure protection device. Saying the opposite, would disallow to take credit for the operator in all cases.
B) Under the situation of no permanent personnel in the terminal, if the operator of the transfer pumps (from a remote location) has a means to identify the lose of power in the terminal, and he is able to shutdown in less than 10-30 minutes before the tanks overfill, that would also lead to a not credible overpressure scenario.
Please let me know if this analysis is not correct.