A Health and Safety Executive (HSE) investigation into a gasoline overfill of a carbon adsorption vapor recovery unit (VRU) revealed concerns with the VRU’s design. The overfill prevention system was NOT INDEPENDENT of the basic process control system (BPCS). When the BPCS failed, the overfill prevention system also failed. This resulted in loss of containment, and risked a significant fire and explosion, as well as extensive environmental damage.
VRUs recover hydrocarbon vapor displaced during transfer operations, such as filling road and rail tankers and ships at fuel storage and distribution terminals.
HSE’s investigation identified that the unit’s overfill prevention system was NOT INDEPENDENT of the BPCS, so when the BPCS failed, the overfill prevention system also failed.
There were NO INDEPENDENT REMOTELY OPERATED SHUT-OFF VALVES in the absorbent supply and return lines.
There were no safety functions independent of the BPCS to prevent overfill.
So, the failure of the BPCS held the absorbent inlet and outlet valves in the OPEN position. The head pressure from the absorbent storage tank caused the absorbent to flow through the VRU via the carbon adsorption vessel before being ejected through the air outlet stack. Other safety functions, including over-temperature (hot spot) protection and emergency shutdown (ESD), also relied on the BPCS.
Action required
Duty holders should follow a safe system of work to assess the risk of overfill, check equipment, and, where appropriate, modify VRU control systems and/or implement INDEPENDENT CONTROL MEASURES.
You should consult with the VRU manufacturer and specialist support contractors as required.
Assess risk
Carry out a suitable and sufficient assessment of the risk of overfilling the absorber column and any other risks associated with the VRU.
As part of the assessment process, the VRU control system architecture must be examined to determine which safety functions, if any, are implemented within or are dependent upon the BPCS.
Compare physical examinations against any electrical schematic drawings, cause and effects matrices, Hazard and Operability (HAZOP) studies, Layer of Protection Analyses (LOPAs) or equivalent.
Safety functions include (but are not necessarily limited to):
- overfill prevention
- over-temperature protection
- emergency shutdown (ESD)
- high priority alarms
It may be sufficient to review existing risk assessments if these are available.
Inspect, maintain, and test
Duty holders must physically verify that all identified safety functions and equipment are in place on the VRU.
Ensure that they are suitably inspected, maintained and tested in accordance with relevant good practice.
Modify control measures if required
Following your risk assessment and the identification and verification of safety functions, you may need to modify the VRU control system architecture and/or implement independent control measures to achieve the required risk reduction.
Ensure that you follow a suitable Management of Change (MOC) process.
CLICK HERE for the alert