Protect Tanks from Overpressure and Vacuum

This article is based on a presentation at the 2019 AIChE Spring Meeting and 15th Global Congress on Process Safety, New Orleans, LA.

Low pressure does not mean low risk. If low-pressure tanks are compromised, they can release large volumes of material to the environment. Develop a safeguarding strategy for each tank at your site.

Low-pressure storage tanks abound in the chemical process industries (CPI) and are necessary to maintain a stable global supply of liquid raw materials, intermediates, and final products. These tanks enable storage of large quantities of material at low pressure, often in remote locations away from occupied buildings and public population centers. It is, however, irresponsible to assume that low pressure implies low risk.

While these storage tanks operate at low pressure, their large volumes pose greater risk than pressure vessels of smaller volumes. The maximum inventory of material that could be released in the event of loss of primary containment could produce dire consequences. In addition, relief of hazardous material to the atmosphere is a common component of their design, because the backpressure that could develop in a closed relief header often makes pressure relief via a closed system impractical. Inherently safer design with respect to equipment pressure and vacuum ratings is also generally not feasible for storage tanks, as it would require a pressure vessel, which would increase the cost of fabrication. A final risk is the sense of complacency that can develop around low-pressure tanks, particularly if they are sited in relatively remote locations.

Table 1 provides examples of process safety incidents involving low-pressure tanks in the U.S. over the past 20 years. Many of the incidents involved ignition of flammable material inside tanks caused by hot work in areas adjacent to those tanks — which emphasizes the risk of venting a low-pressure tank to atmosphere.

Effective design of low-pressure tanks requires consideration of the tank venting requirements for all credible causes of overpressure and vacuum and the implementation of appropriate safeguards for these scenarios. It is possible, and sometimes likely, that a low-pressure tank may require different types of safeguards for each individual credible overpressure or vacuum scenario. When designing these pressure- and vacuum-relief systems, it is important to understand the strengths and weaknesses of each safeguard, and to deploy these safeguards strategically to capitalize on their strengths and mitigate their weaknesses.

Tank overpressure and vacuum scenarios

API Standard 2000 defines the venting requirements for atmospheric and low-pressure storage tanks for both overpressure and vacuum. The standard covers causes of overpressure and vacuum, including additional scenarios to be considered for refrigerated tanks (Table 2) (2). Note that the causes of vacuum are often the inverse of analogous causes of overpressure.

Overpressure scenarios fall into five general categories:

• liquid inflow caused by normal liquid flow to a tank or by unexpected diversion of liquid to a tank (e.g., liquid heat-transfer fluid ingress from a leak), which can displace the tank vapor space (i.e., outbreathing) or overfill the tank
• vapor inflow caused by the malfunction of a control valve or of a regulator on a tank blanketing system to the open position, breakthrough of pressurized motive gas used for liquid transfer, or mechanical failure of an internal steam heating coil or steam jacket
• change in heat transfer caused by high ambient temperatures or increased solar radiation, changes to process conditions upstream (e.g., hotter feed), an external fire, malfunction of a heating coil or jacket temperature control system, or loss of cooling or refrigeration system functionality
• loss of venting capacity caused by continuous tank-venting system malfunction to the closed position or plugging, or an intermittent tank-venting system that fails to open on demand
• mixing of incompatible materials caused by human error that generates exothermic reactions, deflagrations, or detonations.

Likewise, vacuum scenarios fall into four categories:

• liquid outflow caused by normal liquid effluent flow or unexpected diversion of liquid flow out of a tank (e.g., inadvertent opening of a normally closed drain valve) that pulls a vacuum on the tank vapor space (i.e., inbreathing)
• loss of vapor inflow caused by the malfunction of a control valve to the closed position or of a regulator on a tank blanketing system
• change in heat transfer caused by low ambient temperatures or decreased solar radiation, changes to process conditions upstream (e.g., colder feed), malfunction of a heating coil or jacket temperature control system, an increase in cooling or refrigeration system duty, or the introduction of cooling media directly into the tank in the event of a mechanical failure of a cooling coil or jacket
• mixing of incompatible materials caused by human error that generates endothermic reactions.

While API 2000 presents a fairly comprehensive list of causes of overpressure and vacuum, no code or standard can adequately address all conceivable processes. Therefore, it is incumbent upon those designing tank pressure- and vacuum-relief systems to seek and apply the knowledge and experience of engineering and operations personnel familiar with the process.

For example, one scenario not explicitly covered in API 2000 is vacuum due to a broken tank nozzle, possibly caused by vehicle impact (although this cause would likely fall under the liquid outflow category). The capacity for gravity-induced flow through a broken nozzle at the bottom of a tank could exceed the capacity of the pump used to move liquid out of the tank. The tank vacuum protection systems may be designed only for the pump-out rate, not the flow by gravity due to a broken nozzle, and this could cause a vacuum that exceeds the tank’s vacuum rating to develop (3). Personnel knowledgeable of the site should determine the likelihood of such a scenario by considering the location of the tank relative to vehicle traffic and other potential causes of nozzle damage.

Tank pressure- and vacuum-relief systems

Once the credible causes of overpressure and vacuum have been established for a tank, next consider the best strategy to safeguard against each of the scenarios identified. Various safeguards are available to do this and may be incorporated into the design of the tank or the surrounding process, included in the basic process control system (BPCS), or added as dedicated pressure- and/or vacuum-relief devices. Each of these types of safeguards has its own strengths and weaknesses (Table 3).

A tank overflow mitigation system can be installed on a tank with overflow vents to direct liquid flow via a closed gutter to secondary containment. This arrangement prevents the occurrence of cascading liquid (i.e., waterfall effect), which can increase the size of potential vapor clouds. A waterfall effect, such as occurred at an incident in Bayamón, Puerto Rico, on Oct. 23, 2009, can generate aerosols that can be ignited by an external ignition source or by static discharge from falling liquid. The waterfall effect can pose significant flash fire and vapor cloud explosion (VCE) hazards.

▲Figure 1. Low-pressure tanks and their associated processes should be designed to prevent overpressure or vacuum when practical. Beyond the design, the basic process control system (BPCS) can ensure stable operation. Alarms and human intervention may be appropriate if the BPCS is unable to maintain safe operation, which can be further backed up by safety instrumented systems, pressure-relief systems, secondary containment, plant emergency response, and community emergency response.

In addition to the strengths and weaknesses of the safeguards listed in Table 3, it is important to consider the hierarchy of controls (Figure 1). Protection of a tank against overpressure and vacuum by system design is the most desirable solution when possible.

System design. Safeguards should be considered for each level of the control hierarchy. Beginning with system design, changing the pressure or vacuum rating of a tank to achieve inherently safer design is often impractical; inherently safer design with respect to pressure rating may require a pressure vessel rather than a tank. Open atmospheric vents, flame and detonation arrestor vents, and liquid overflow lines may be considered as part of the system design, and their mechanical integrity must be ensured by an appropriate inspection, testing, and preventive maintenance (ITPM) program. Even with these safeguards in place and functioning, do not overlook the consequences of relief of hazardous tank contents to the atmosphere.

BPCS. Next, consider safeguards associated with the BPCS. Blanketing a tank with inert gas via the BPCS and/or mechanical pressure regulators can be an effective means of relieving pressure and breaking vacuum caused by liquid movement into or out of the tank. Such blanketing systems can eliminate the need to vent hazardous tank vapors to the atmosphere or pull air into the tank and potentially create a flammable internal atmosphere. However, blanketing systems may be a cause of overpressure and must be included in the ITPM program to ensure their continued functionality.

Alarms and human intervention. Safeguards related to alarms and human intervention might include a level alarm to prevent overfilling, which requires a sufficient response time from the initial alarm activation. Pressure alarms, however, generally do not allow sufficient response time before the tank pressure or vacuum rating is exceeded.

Safety instrumented systems. A safety instrumented system (SIS) may prevent overpressure or vacuum, but these systems require a high-integrity safety interlock independent of the BPCS, which necessitates significant investments in design, installation, maintenance, and testing. Consult engineering and operations personnel knowledgeable about the process associated with the tank and a SIS subject matter expert to verify the proposed system’s effectiveness for the application.

Pressure-relief systems. Tank pressure-relief systems, such as atmospheric pressure/vacuum conservation vents and emergency vent hatches, can be employed as safeguards. However, if the tank contains hazardous material, these types of safeguards should only be considered as a last line of defense against the malfunction of other safeguards in the hierarchy.

Secondary containment and emergency response. Secondary containment and emergency response, either on-site or in the surrounding community, are only intended to reduce the impact of a hazard created by the loss of primary containment. These types of controls should not be considered preventive safeguards.

Dispersion consequence modeling

Once the credible overpressure and vacuum scenarios are identified and a safeguarding strategy is developed, the next step is to evaluate the consequences of atmospheric dispersion of hazardous material releases from the tank’s relief devices.

Hazard assessment software can be used to conduct consequence modeling. To better understand this process, consider a hypothetical hexane storage tank at the Wilfred E. Baker Test facility in La Vernia, TX, with these specifications:

• length: 16 ft
• diameter: 4 ft
• orientation: horizontal
• head type: flat
• elevation above grade: 1 ft
• design pressure: 10 in. H₂O(g)

Three overpressure scenarios were identified for the tank:

(a) liquid overfilling by a transfer pump with capacity of 100 gpm

(b) nitrogen blanket control valve malfunction to the open position based on a 50-psig nitrogen supply via a generic 1-in. globe valve

(c) external fire based on a liquid level of 75% of the tank diameter.

Each overpressure scenario has an associated safeguard:

(a) a 2-in. overflow line to grade for the overfilling scenario

(b) a 3-in. gooseneck vent (which would require a flame arrestor) for the nitrogen control valve malfunction

(c) an 8-in. emergency vent hatch for the external fire.

(Note that pressure and vacuum due to liquid movement into and out of the tank would also be vented via the 3-in. gooseneck vent, but those cases were not evaluated quantitatively for this example.)

Each dispersion scenario in Table 4 was modeled under two different weather conditions, F2.3 and D7.2. The letter in the name of the weather condition (i.e., F or D) represents the Pasquill atmospheric stability, where A represents the most unstable conditions and G extremely stable conditions; the number (i.e., 2.3 or 7.2) is the wind speed in meters per second. These weather conditions were chosen based on statistical meteorological data for the San Antonio International Airport (SAT) near the facility. The F2.3 weather conditions generated more significant consequences, so the discussion and figures present the results for those conditions.

The software used to generate these images uses a free-field dispersion model that was developed based on one-dimensional turbulence theory (4). This model does not account for specific obstructions such as buildings; therefore, flammable clouds are reported up to 50% of the lower flammability limit (LFL). This generates a conservative illustration of areas where obstructions could create localized flammable mixtures in air.

(a) Overfill scenario. Figure 2 shows the flammable vapor cloud contours for the relief of hexane via a 2-in. overflow line terminating 1 ft above grade. In this scenario, a flammable vapor cloud could extend up to hundreds of feet downwind of the release point and could affect an occupied building, but the cloud would remain within a 1.5-ft elevation above grade. Based on this model, it may be appropriate to add a preventive measure to the system, such as an interlock to shut down the transfer pump if the level in the tank is high, and/or add a means to mitigate the hazard, such as a properly sized secondary containment dike with appropriate hazardous area classification. The model shows the steady-state dispersion and does not account for exhausting the supply of hexane, which may be relevant depending on the quantity of hexane available upstream of the transfer pump (which was not defined for the purpose of this example).

▲Figure 2. These plots illustrate the dispersion of a flammable vapor cloud generated by the overfilling of a hexane tank and relieved through a 2-in. overflow line terminating 1 ft above grade.

▲Figure 4. This plot displays the height and distance of a flammable vapor cloud generated by a release through an 8-in. emergency vent hatch on top of the tank in the event of an external fire.

(c) External fire scenario. Figure 4 shows the flammable vapor cloud for the relief of hexane via an 8-in. emergency vent hatch on top of the tank in the event of an external fire. The flammable cloud of vaporized hexane rises rapidly within the first 5 ft of horizontal distance from the release point; it then remains at least 20 ft above grade before dissipating and the concentration falls below the flammable range. This relief would not pose a hazard beyond the potential escalation of the fire due to the hexane vapor cloud. While this is not desired, it would still be preferable to a full rupture of the tank due to overpressure.

Had these three examples been part of an actual chemical plant pressure-relief dispersion study, plant personnel would have the option to pursue further risk analysis using more comprehensive methods, such as a site-wide facility siting study and/or a quantitative risk assessment (QRA).

Final thoughts

When evaluating the potential risks associated with overpressure and vacuum of low-pressure storage tanks, potential causes should be evaluated in accordance with API 2000. However, also consider scenarios not explicitly covered in this standard. Consult with engineering and operations personnel knowledgeable about tank locations relative to other equipment and activities, as well as of the process systems associated with the tanks. Evaluate the strengths and weaknesses of potential safeguards and determine where each safeguard fits into the hierarchy of controls. Even if appropriate safeguards are in place, consider the potential consequences should these safeguards fail in an emergency, and implement any additional preventive safeguards and/or consequence mitigation measures if additional risks are identified. In these cases, plant personnel could also pursue more-comprehensive site-wide risk evaluations such as facility siting and QRA studies.