Overfill of flammable or toxic liquid is one of the scenarios most likely to escalate into a major accident (see the Buncefield and Caribbean Petroleum lessons in this library).
Layers
- Tank gauging with alarms (the basic control layer): level measurement, high alarm, operator stops the transfer.
- Independent high-high level alarm with operator response: separate sensor and alarm path.
- Automatic overfill prevention: a SIF with an independent level sensor that closes the receipt valve and, where possible, stops the transfer pump.
- Mitigation: bund, detection, foam.
Setting the trip level
Work back from the overfill level: the level at maximum transfer rate that leaves enough time for the SIF response (sensor, logic, valve closure, pump run-down, pipeline drain-down), plus margin. Recheck when transfer rates change.
Design points
- The SIF sensor must be independent of the gauging system (different sensor, preferably different technology).
- Receipt valves are often motor-operated: energise-to-trip designs need a secure power supply and monitoring.
- Closing a valve against a running pipeline transfer can cause pressure surge upstream; coordinate with the supplier.
- Proof tests should exercise the real sensor and confirm the valve closes in the required time.
In First Out AI
The tank example (SIF-105) with its LOPA scenario, HAZOP node, drawing and the tank farm C&E example.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.