117 / 648
Safety and environmental standards for fuel storage sites
Final report
115
169 This discussion of time at risk relates to the context of tank filling operations. The context
assumes that the storage facility is operational throughout the year and that periodically during the
year tank filling occurs.
Failure of equipment
170 During the tank filling operation, there is reliance on items of equipment such as a tank level
measurement gauge. Failure of the gauge is one of the potential initiating causes of over filling.
171 For the purpose of this example, failure of the gauge is assumed to be possible at any
time, whether the tank is being filled or not. It is also assumed that the fail-to-danger rate of
the gauge is a constant, whether the tank is being filled or not (and therefore that failures of the
transmitter head or servo-mechanisms may occur with equal likelihood at any time).
Note that
this assumption may not be true for all failure modes and would need consideration on a
case-by-case basis.
172 Figure 26 shows the storage facility as operational throughout the year. It also shows one
period of tank filling. This is to make the diagram easier to follow. However, the line of argument
will still apply to the situation of multiple tank filling periods during the year.
Figure 26
Equipment item failure
173 It is assumed that failure of the level gauge can occur at any time. If it occurs at time A, then
it can clearly affect the control of the filling operation. If it occurs at time B then it can only affect
the filling operation if it is not detected before tank filling starts at time C and the filling operation
proceeds with a faulty gauge.
174 If detection at time C is carried out with a high degree of reliability by some form of checking
operation (eg independent gauging or stock checks) then it can be assumed that only gauge
failures that occur during tank filling can affect the filling operation. The checking activity fulfils a
similar function in this case to a trip system proof-test.
175 If the failure rate of the level gauge is
λ
per year and the total duration of filling during a
calendar year is t hours, then the proportion of time (there being 8760 hours in a year) for which
failures are significant is t/8760. This proportion of time may be used with the failure rate to
calculate the rate at which failures occur during the tank filling operation. This is then
λ
x t/8760 in
units of per year.
Human failure
176 Another potential cause of over filling is some form of human failure. This can be associated
with a failure to control the filling operation or failure to select the correct tank or one of a number
of other possibilities, depending on the details of the operation and what tasks people are involved
in carrying out.
C
January
December
A
B
Plant operational
Tank filling