133 / 648
Safety and environmental standards for fuel storage sites
Final report
131
Architectures of overfill protection systems
New tank automatic overfill protection system
10 Automatic overfill protection systems for a new tank should meet the requirements of
BS EN 61511 and paragraphs 5 to 9.
11 The following architecture shows an independent automatic system, which will operate to shut off
product delivery to the tank without any human action.
Figure 33
High-high level trip
12 Figure 33 shows a new tank fitted with a high-high trip sensor (independent from any other
tank instrumentation) connected to a logic solver and a fail closed valve. This arrangement should
meet the requirements for SIL 1 and may meet the requirements for SIL 2. PFD calculations and
conformity to hardware fault tolerance require checking. (See Annexes 1–3.)
Existing tank installations
13 Where there is an existing overfill protection system to a standard other than BS EN 61511, a
gap analysis should be conducted to determine the extent of compliance with BS EN 61511.
14 For SIL 2 or higher safety requirements the installation should fully comply with BS EN 61511.
15 For SIL 1 safety requirements, improvements to existing systems may still be necessary
to meet ALARP even in cases where it is not reasonably practicable to upgrade or replace
existing systems to fully meet the requirements of BS EN 61511. The following issues should be
addressed when considering what improvements are required:
The degree of independence of sensors used for the high-high alarm/shut-off.
■
■
The suitability of the logic solver.
■
■
Degree of independence from BPCS.
■
■
Demonstration and evidence of prior use.
■
■
Suitability of final elements.
■
■
16 It should be noted that a prescriptive description of the steps needed to meet BS EN 61511
so far as is reasonably practicable cannot be provided in this guidance. The degree of compliance
should be discussed and agreed between the dutyholder and the CA on a case-by-case basis.
However some further more detailed points for consideration are given below, and in Annex 4.
17 Figure 34 illustrates the use of a motor operated valve/electrically operated valve (MOV/EOV)
as the final element within an overfill protection system.
‘Final
element’
fail closed
Fuel feed from:
-
rail
-
ship
-
process
Actuator
Logic
solver
‘Sensor’
high-high trip
L
New tank