102 / 648
Safety and environmental standards for fuel storage sites
Final report
101
Mitigation layers
100 Mitigation layers are protection layers representing intentional design or operational measures
which become effective once primary containment has been lost. They must be relevant to the
hazardous scenario under consideration and must prevent the consequence from developing. The
same mitigation layer may be effective against some consequences but ineffective against others.
For example, bunding will not prevent the development of a vapour cloud from a storage tank
overflow, but may be effective in preventing certain kinds of environmental consequence. Possible
mitigation measures which may have an impact on the overflow of a gasoline storage tank include:
overflow detection (including gas detection, liquid hydrocarbon detection and direct
■
■
observation);
fire protection (to the extent which this may reduce escalation or environmental
■
■
consequences from a tank overflow, although this was not the case at Buncefield);
bunding or dyking;
■
■
emergency warning systems and evacuation.
■
■
101 For all these, it needs to be recognised that these mitigate the consequence but do not
prevent a release and incident. If their effect is included in a LOPA study, it is important to make
sure that they are:
independent of other protection layers, especially where positive action is to be taken;
■
■
properly designed to prevent the undesired consequence;
■
■
effective in preventing the undesired consequence; and
■
■
tested periodically to assure continued effectiveness.
■
■
102 When included in a LOPA study, the function of the mitigation layers need to be described in
terms of how they meet a demand and their reliability.
Overflow detection
103 Overflow detection may take several forms. It may be automatic, using suitably located gas/
liquid detectors to operate valves or pumps, or it may be manual, relying on operator response to
various forms of detection (including alarms raised by suitable instrumentation, visual indications
such as direct observation or via CCTV, or smell). The details of overflow detection measures will
be site-specific, and a number of factors need to be taken into consideration.
104 Where reliance is placed on operators to detect (as opposed to respond to) the overflow, the
following factors should be considered:
site manning levels;
■
■
procedures detailing required checks and appropriate actions;
■
■
other duties performed by the operator.
■
■
105 Detection may be adversely affected where the personnel present on site have a number of
tasks to do which limit their opportunities for regular and scheduled checks of the storage area.
Any checks that are occasional and ad hoc should not be credited in the LOPA. Conversely, when
operators have sufficient time formally set aside to check the storage tanks at pre-determined
intervals during filling operations, detection becomes more likely. If regular site checks are cited as
a mitigation measure these should be set out in a formal procedure and be subject to verification.
106 Where hydrocarbon gas or liquid detection equipment is used the following factors should be
considered:
the type of detection, which should be determined on a case-by-case basis and be specific
■
■
to the tank under consideration; and
the location of the detector(s), and the kind of releases which can and cannot be detected; and
■
■
whether the detector is connected to an alarm or provides an input for an automated
■
■
shutdown, or both.