LPG Sphere Overfill: HAZOP, LOPA and Independence
A coastal terminal has two 1,000 m3 LPG spheres storing 95% propane and 5% butane at ambient temperature. Normal filling is from road tankers at 60 m3/h, and the current maximum fill is 85% by volume. The level is measured by a servo gauge that feeds the BPCS, which closes the inlet valve at 88%. A high-high level switch trips the same inlet valve at 90%, and the operator has a written response to an alarm at 85%. The relief valves are sized for fire exposure, not liquid overfill. A management-of-change proposal would raise the fill limit to 90% to reduce tanker waits, arguing that the high-high trip remains at 90%. The HAZOP team flags the deviation “more level” and asks for a LOPA. The site tolerable risk for a flash fire from LPG overfill is 1×10−5 per year. Historical overfill initiating frequency is 0.1 per year. The high-high switch shares the same guide-tube housing as the level gauge.
1. Assess whether the proposed 90% fill limit is acceptable. Identify the HAZOP deviations and the independence problem.
Read the worked answer
The 90% fill limit is not acceptable. It sets the normal operating limit equal to the high-high trip setpoint, leaving no operating margin. At 90% fill, the vapour space is only 10%, and hydraulic expansion during fire exposure or a tanker transfer upset can lead to liquid-full conditions. The relief valves are sized for fire vapour generation; they are not a liquid-overfill protection system and may not relieve liquid adequately. The relevant HAZOP deviations are “more level”, “more flow”, “higher temperature”, and “failure of level indication”.
The independence problem is decisive. The high-high switch shares a guide-tube housing with the servo gauge, so a common-cause failure such as a stuck float, fouled guide tube, or mechanical damage can disable both the BPCS indication and the high-high trip. The high-high trip cannot be credited as an independent protection layer at a PFD of 0.1 unless independence is demonstrated. The operator response to the 85% alarm is also weak because it uses the same indication and depends on shift staffing. The 90% proposal should be rejected and the fill limit retained at 85% or lower until independent overfill protection is installed.
2. Perform a LOPA using the stated data. Determine the required risk reduction and whether the existing IPLs are sufficient.
Read the worked answer
Initiating frequency = 0.1 per year. Tolerable frequency = 1×10−5 per year. Required total PFD = 1×10−5 / 0.1 = 1×10−4.
If we credit the BPCS at PFD 0.1 and the operator response at PFD 0.1, the intermediate frequency is 0.1 × 0.1 × 0.1 = 1×10−3 per year. Adding a genuinely independent high-high trip at PFD 0.1 gives 1×10−4 per year, which is still ten times above the tolerable risk. If the high-high trip is properly independent and credited at PFD 1×10−2, the result is 1×10−5 per year, which meets the target. But the existing switch is not independent because of the shared guide tube. Therefore the existing IPLs are insufficient. At least one additional independent layer with PFD ≤1×10−2 is needed, or the fill limit and inventory must be reduced. A SIL 1 independent overfill trip with a separate sensor and separate shutdown valve would be a credible minimum, subject to verification.
3. Recommend a practical risk-reduction package, including management-of-change and Egyptian regulatory considerations.
Read the worked answer
The package should start with rejecting the 90% fill limit and retaining 85%. Install an independent high-high level sensor using a different technology, such as radar or a float switch in a separate chamber, and a separate shutdown valve on the inlet. Add a hardwired overfill alarm and a clear operating procedure that stops transfer on the first high alarm. The relief system should be reviewed against liquid overfill and fire scenarios, and the LPG sphere should have a documented emergency response plan.
The management-of-change should cover the new trip setpoints, cause-and-effect matrix, proof-test intervals, bypass controls, and operator training. The LOPA must be revalidated after installation, and the HAZOP should be repeated for the modified filling operation. In Egypt, the modification should be screened under Law 4/1994 for environmental impact, and the design should follow recognised LPG storage practice such as NFPA 58, together with civil protection and port-authority requirements. The consultant should not accept administrative controls alone as the basis for raising the fill limit.