Vessel overfilling as relief valve scenario

[garfio]

I am analyzing the relief valve protection on a vessel, and would like to have your opinion about considering overpressure by overfilling as a credible scenario.

A terminal has an ASME horizontal vessel that receives propane through a pipeline, and normally there are no operators on site. The operation is controlled from a remote location. The vessel has an electrical operated valve that isolates it from the pipeline.

The propane level is monitored using a level transmitter, preset to close the valve when HHL is reached. A level switch is installed on the vessel also set to close the valve at HHL.

a) If the terminal loses power, the valve won’t be able to close. However, the control center would notice the power lose and stop pumping: Assuming that manually stop pumping will avoid overfilling the vessel, would this still be a credible scenario for overfilling causing overpressure due to a possible operational error?

b) Would the situation change under the following scenarios?
- Permanent personnel in the Terminal, and operational procedure to manually close the valve in case of power loss.
- Providing automatic shutdown of pump if power loss (or communication loss) is detected at the control center.
- Emergency power supply in the Terminal

I will appreciate any opinion on this.

 

[djack77494]

garflo,
I'm not sure I totally appreciate your situation. The first comment that caught my attention was you saying that if you lost power you wouldn't be able to close the valve. I would think that the valve would be set to fail closed on power or air failure.

Your second question caused me to revise my thinking. You can have an army of operators watching the tank's level, but what happens if the sensor fails? You might fill the tank but not be aware of that hazard. This leads me to think that the best approach would be to ensure that the delivery pump was not able to produce excessive pressure even at no flow conditions. You could do this by the cautious selection of a centrifugal pump, perhaps with automated recycle flow and/or high pressure shutoff, and quite possibly a relief valve. You have fewer options with a recip pump, but could mainly still do the same things. Pump shutdown in the event of power or communication loss seems judicious. Emergency power supply should certainly be evaluated. As a last resort, the propane tank will surely have one (or more likely two) relief valves that will ensure the highest level of safety. Redundant instrumentation is also possible, and adds significantly to safe and reliable operation. That's about all you can do.
Doug

 

[JoeWong88]

garfio,
My opinion is...

a) You can not rely on operator intervention for safety related action as you have no way to guarantee operator physical and mental performance. A high integrity and availability protection system is required.

b) Providing automatic shutdown and emergency power supply are part of the primary protection system. Nevertheless, you may need ultimate protection system (i.e. PSV, HIPPS, high SIL system, etc).

 

[CMA010]

In my opinion the overfilling scenario is a credible scenario.

Usually there is not taken any credit for trips and for relief valve sizing automatic control valves are assumed to be in the open position, see API STD 521. Some companies take credit for operator intevention (API STD 521) and calculate if the time to overfill the vessel takes more than 30 minutes.

 

[dcasto]

The simple term is "blocked flow" case. You should design for a humane closing the outlet valve(s).

 

[ggordil]

My opinion is that you have several scenarios that could cause overfilling.

First, you need to determine if a closed outlet will cause your vessel to overfill and how long it will take. My understanding is that if it takes longer than 15 minutes (depends on company) for the vessel to fill from the HLL to overfilling then the pressure in the vessel can reach up to but not above the hydrotest pressure because you can take credit for operator intervention. If your maximum pump discharge pressure is below the hydrotest pressure, then no relief device is needed. If your pump discharge exceeds the MAWP then a relief device is needed.

If the overfilling time is less than 15 minutes, then a relief device is required to limit the accumulation to 10% of the MAWP.

In addition, you can not take credit for favorable response of any instrument for relief calculations.

 

[garfio]

Thanks for all the interesting opinions. Based on all the information provided, my analysis is as follows. Please let me know of any misinterpretation.

API 521 (4.2.4) states that conventional instrumentation should be taken as a substitute" of a relief valve as protection agains single jeopardy overpressure scenario.

So, even if there are on/off valves that would utomatically close when overfilling is detected, I should still consider an overpressure credible scenario.

API 521 (5.4) allows taking credit for operators (at owners discretion), if response can be between 10 to 30 minutes. In 4.2 API 521 even gives an example of double jeopardy when considering operator error with a coincident power failure.

Because operators normally respond based on information provided by instruments (alarms, level gauges), it is clear that is not the intention of (4.2.4), to deny the correct operation of instruments to alert personnel to take action (unless of course, their failure can be considered under a single jeopardy situation).

ASME and API now accept the use of HIPS as an "overpressure protection", meaning that you can avoid installing relief valves if onder certain circunstances, you install a HIPS to take care of a credible overpressure scenario. So, once determined the existence of a credible overpressure scenario, we should either consider relief valves or use HIPS to take care of it.

In my case, I have relief valves for fire protection and am trying to determine if overpressure due to overfilling ("closed valve" situation under API 521) is also a credible credible. Based on the previous notes, I arrived to the following conclusions:

A) If the terminal loses power, and alarm provided by and instrument with adequate power backup for the system, can be considered operating under a single jeopardy situation, so if the terminal has permanent personnel, I could take credit for his corrective action if he has more that 10-30 minutes to react. In this case, the instrumentation system does not need to meet HIPS requirement because "there is not a credible scenario" that I need to address. There should not be a contradiction with (4.2.4) because the instrumentation is not an overpressure protection device. Saying the opposite, would disallow to take credit for the operator in all cases.

B) Under the situation of no permanent personnel in the terminal, if the operator of the transfer pumps (from a remote location) has a means to identify the lose of power in the terminal, and he is able to shutdown in less than 10-30 minutes before the tanks overfill, that would also lead to a not credible overpressure scenario.


Please let me know if this analysis is not correct.


Thanks

 

[crucial]

If your tank design pressure is greater than the shut off pressure of your centrifugal pump then overpressure due to overfilling is not a concern