SPC/PERMISSIONING/30
1 As a consequence of a number of incidents including Buncefield, the COMAH CA developed a new Containment Policy for the bulk storage of hazardous liquids. This was publicly consulted upon and issued by the CA in February 2008.
2 The Buncefield MIIB required the CA to review with operators of Buncefield Type sites their response to the BSTG and MIIB recommendations and expected site-specific timed action plans. The BSTG Final Report set out required actions and a timetable for implementation with deadlines up to July 2008. The CA must now verify the progress of sites against these BSTG recommendations and where necessary take appropriate action to ensure sites complete them.
3 This SPC sets out a programme of site visits to follow up the COMAH CA Containment Policy and to check sites’ progress against the Buncefield Standards Task Group (BSTG) recommendations. Paras 14–20 outline the main actions required of Regulatory Inspectors.
4 The Policy provides a broad framework within which the CA intends to drive forward improvements in the storage of bulk hazardous liquids and sets out the key principles relating to the bulk storage of flammable liquids, focussing initially on petrol (gasoline), similar petroleum products or other fuels. Supporting detailed guidance for other hazardous liquids will be developed in prioritised phases – currently this is by utilising the regulator/industry networks established following the Buncefield incident and the Policy incorporates the recommendations of the BSTG where appropriate.
5 Industry undertook to comply with the BSTG recommendations within the timescales set out in the BSTG final report. Where the Policy goes beyond these recommendations it states that a period of 10–20 years could be expected for all measures to be implemented. However, far speedier implementation is expected for higher risk sites and whenever an operator replaces tanks and associated equipment they should implement the measures then.
6 Under the Policy, HSE is primarily concerned with primary containment particularly overfill prevention measures. However there are substantial concerns about other aspects of primary containment; for example, failure of the tank base has been an issue in two recent incidents. We would expect primary containment as a whole to be covered by HSE as part of the CA’s COMAH intervention plans although in cases of specific environmental concern they may be taken forward more urgently in partnership with EA and SEPA.
7 The BSTG recommendations constitute improved standards that underpin the Policy. They represent good practice in the industry and can be interpreted as ‘necessary measures’ under COMAH Regulation 4. Initially, the BSTG issued eight recommendations in October 2006. These had to be complied with by the end of November 2007. Further recommendations were issued in July 2007 in the BSTG Final Report. Full compliance with all BSTG recommendations was set for July 2008. Future work on the recommendations in the MIIB Design and Operations Report [887kb]
and in support of the Containment Policy is currently being taken forward by the successor to the BSTG, the Process Safety Leadership Group (PSLG).
8 Compliance with the Policy will be verified as part of the CA’s intervention programmes with instructions and guidance to inspectors developed jointly by the CA to ensure consistency of approach. Compliance with the BSTG recommendations will equate to compliance with the policy at this stage. Secondary and tertiary containment measures will be prioritised by EA and SEPA on the basis of environmental risk. Improving primary containment will not remove the requirement for secondary containment.
9 For safety related issues sites have been prioritised by HSE using measures of the off site population situated within the revised 400m CDs, as set out in the Consultation Document, CD 211. A map of high, medium, low and very low priority sites has been circulated to CI operational team leaders and the rationale for the prioritisation categories used are set out in Annex 3. This information should be used to determine operational priorities for follow up work. There are currently approximately 50 such ‘buncefield type’ sites.
10 For secondary and tertiary containment issues, priorities have been based on site environmental sensitivity data. EA and SEPA have separate site lists (they have approximately 80 such sites) for their regulatory inspectors based on this data and these will be shared with HSE to enable joint intervention planning integrating both safety and environmental elements.
11 It is important that HSE and EA/SEPA inspectors discuss their intervention plans locally to understand their respective roles and agree a proportionate CA plan for verifying and gaining compliance with the Containment Policy (BSTG recommendations). To support this local working CI4F will arrange a CA review meeting to be held in autumn 2008 to discuss emerging issues arising out of this work.
12 In February 2008, the CA published a report on sites’ progress against the BSTG initial recommendations. This was based on industry self-reporting combined with sample verification of the 6 safety recommendations by HSE at 17 high priority sites. No enforcement action was deemed appropriate at that stage with respect to these recommendations. Reported progress against the secondary and tertiary recommendations was verified by EA and SEPA, and this resulted in five improvement notices being issued for non-compliance.
13 Sites have recently provided an update to PSLG of their progress against the further recommendations contained in the BSTG Final Report. The site specific responses have been made available to relevant CA Inspectors to assist with planning their follow up verification visits and can be found on the Buncefield Inspectors website. It is important to verify that sites have done what they claim, that it meets the BSTG recommendations and where there are gaps in compliance these are addressed in a proportionate and consistent manner. HSE inspectors will be expected to use the HSC EPS and apply the EMM to determine appropriate levels of enforcement. Please see additional guidance in Annex 5.
14 High Priority Sites - During the remainder of 2008/09 and the first six months of 2009/10 a visit should be made to high priority sites to check progress with the further recommendations contained in the BSTG Final Report if not already completed.
15 Medium Priority Sites - During 2008/09 and the first six months of 2009/10 a visit should be made to medium priority sites to check progress against both the BSTG initial recommendations and the further recommendations contained in the BSTG Final Report;
16 Low and Very Low Priority Sites - Verification of compliance with the initial and further recommendations outlined in the BSTG final report should be considered along with other inspection priorities and included in the intervention plans for these sites.
These sites should be visited if:
17 Intervention plans for all sites should be revised to take account of the verification exercise outlined above and in particular the priority issues set out in paras 21-33. A check should be made to ensure that operators of Top Tier establishments have reviewed and revised their safety report to take account of relevant changes in the control measures and that the MAPP for LT establishments has been reviewed to take account of the recommendations in the BSTG Final Report.
18 See a summary of the follow up action for 2008-2010 [24kb].
19 The Buncefield Response Team, CI4F, will require simple feedback from site Inspectors in relation to their assessment of sites’ compliance against the BSTG recommendations. This will be used to provide an accurate picture of compliance to HID management and assurance to the MIIB. The sites’ own self reported progress returns against BSTG recommendations will be provided with an additional column for comment by the site Inspector. These forms will be distributed via HoU and these forms should be returned to Colette Fitzpatrick, CI4F, Redgrave Court, once verification has been completed. It is recognised that some Inspectors have already verified compliance on some sites.
20 Company Groupings – A site visit will be required to verify compliance however certain issues may be more efficiently addressed at a corporate level where a company has a number of Buncefield type sites. In order to maximise efficiency of resources CI are nominating a Regulatory Inspector and a C&I Specialist to act as corporate contacts for each company where required. In some instances this is the Lead Unit Inspector. The nominated inspectors should liaise with the relevant site inspectors to identify where a corporate approach is required, what issue has been identified and make arrangements to address centrally with a Company. It is anticipated that the nominated Regulatory and C&I corporate contacts would visit together. Following any central contact it is essential that feedback is given to the appropriate site inspectors. A list of sites and relevant inspectors will be circulated separately by CI4F.
21 The BSTG further recommendations were in relation to primary containment measures, PSPM’s and on-site Emergency Arrangements and these should be the main focus of HID CI’s regulatory programme covering the next 12 months for sites storing petrol. The core issues for field inspectors when looking at primary containment measures is to ensure sites have correctly determined their SIL for overfill prevention systems and that they can demonstrate achievement of that SIL.
22 BSTG Final Report required the SIL of overfill prevention systems to be determined by a Layer of protection analysis (LOPA) carried out in accordance with BS EN 61511 and this should have been completed by all sites and the relevant SIL implemented.
23 A sample selection of LOPA assessments have recently been submitted for review by HSL and a number of common errors in applying the LOPA methodology were found that could result in the incorrect SIL’s being determined for overfill prevention systems. Site specific feedback will be given to the relevant regulatory inspectors to allow follow up in relation to the conclusions of this work. A generic report of the findings of this HSL work will be made available for all regulatory/specialist inspectors. The key findings of this HSL work has also been shared with the PSLG, TA’s and wider Industry. A current PSLG Working Group is developing additional guidance for industry on these issues.
24 Detailed assessment of all LOPA’s at every site should not be considered the norm. However where a company claims their LOPA assessment has concluded they do NOT need to have an overfill prevention system that complies with BS EN 61511 and have not decided on a SIL rating of at least 1 then a robust review of that decision should be carried out. LOPA is a predictive risk assessment tool and any guidance you require on assessing the adequacy of LOPA assessments should be directed to your Unit Process Safety Band 2 lead in the first instance. It is recognised that the allocation of this work may require input from a range of disciplines and not just predictive (PS/HF and C&I) and additional resource may need to be identified by the relevant band 2 lead (John Wilkinson Human Factors, Unit band 2 Process Safety, Dave Wilson Control & Instrumentation).
25 If a minimum SIL 1 or above is determined then the focus for regulatory inspectors should be directed towards ensuring that the site have implemented that SIL level rather than reviewing the adequacy of the LOPA. Further guidance is proposed to assist industry in ensuring their LOPA has been carried out correctly in terms of risk targets, data, all risk factors, independence of protection layers, initiating events and conditional modifiers. If a LOPA study determines that a SIL 1 is adequate to meet a tolerable risk target then in addition the operator has to demonstrate that any further improvements e.g. to SIL 2 are not reasonably practicable. It is anticipated that the adequacy of the SIL determination in such circumstances would be reviewed by predictive assessors during Safety Report update.
26 The integrity and maintenance of the overfill prevention systems actually provided on site should be given the highest priority when considering primary containment. Site inspectors will need to work closely with C&I discipline specialists to establish whether sites have achieved the required SIL for their overfill prevention system.
27 HID CI’s C&I specialists have agreed they will give priority to verifying the SIL of overfill prevention systems at these sites if not already known. C&I specialists will need to agree a visit programme in discussion with site regulatory inspectors based on the priority of these sites, current knowledge of overfill prevention systems at these sites and other site priorities.
28 Nominated C&I leads within HID CI have been identified for those companies that have more than one ‘Buncefield type’ sites. This does not mean that the nominated C&I specialist will visit all such sites that would be done by the local C&I specialist where required. The purpose of the nominated C&I specialist for this work is to ensure a co-ordinated central approach by C&I to these companies, to ensure a consistent and clear message is given to operators in relation to their overfill prevention systems. It is also an efficient way of influencing the key C&I personnel within larger organisations who are often not based on the individual sites.
29 An assessment of the safety integrity level should include validation that;
30 A draft CA standard for overfill prevention systems at sites storing petrol has been circulated. This standard is for information only at this stage and is currently being discussed with PSLG and wider industry. It sets out the CA view on what is required for industry to comply with the MIIB D&O Recommendation 3 that requires ‘Buncefield sites’ to fit a high integrity, automatic operating overfill prevention system that is separate and independent from the tank gauging system. It highlights areas where further research and work is needed before all sites could achieve in particular the automatic operating overfill prevention system of this MIIB recommendation. Future developments and progress with respect to the status of this standard will be communicated when appropriate.
31 The feedback from sites’ self reporting is that many have not developed a set of leading and lagging indicators and are having difficulty with this area. It was anticipated that existing HSE guidance (HSG 254) would be utilised by Industry. Nominated PSPI Champions in each unit may be able to provide support to site inspectors if required to address this topic. The PSLG are also working to identify a system of leading and lagging performance indicators for the sector as a whole in line with current HSE guidance.
32 In preparing their response to an emergency, operators should have considered fire management requirements in response to, and mitigation of, a multiple tank fire. The emergency plan should cover the on-site consequences of such an event and off-site assistance. Any arrangements deemed necessary to deal with such an event must be capable of operating effectively even in the event of a preceding explosion.
33 Operators should have completed the emergency plan template from the BSTG's final report, which acts as a high-level document providing an overview of the site’s arrangements. Underpinning this document will be more detailed plans relating to specific incidents.
34 Operators should be able to demonstrate a logical process used to calculate the fire-fighting capability necessary to deal with foreseeable fire scenarios at their site and then how they will attain that capability, whether onsite and/or offsite. An example of this process is the ten point scheme in the BSTG Final Report based on IP19 (Fire precautions at petroleum refineries and bulk storage installations).
35 The BSTG recommendations represent good practice and can be interpreted as ‘necessary measures’ under COMAH Regulation 4. All the deadlines agreed with Industry for compliance with respect to all BSTG recommendations have passed. It is anticipated that where a ‘buncefield type’ site has not completed the BSTG recommendation then an Improvement Notice will be considered to achieve compliance.
36 Further guidance has been provided in Annex 5 in relation to the BSTG recommendation for sites to determine the appropriate Safety Integrity Level for overfill prevention systems and the requirement to ensure compliance with the BS EN 61511. It is important that where implementation of the determined SIL and in particular compliance with BS EN 61511 cannot be fully demonstrated at present then an Improvement Plan is agreed. It is also essential that in the interim the current arrangements in place are reviewed by C&I and considered suitable to prevent a tank overfill. Annex 5 outlines where enforcement action may be warranted.
37 The PSLG have examined the potential for different tank types and different substances to generate a flammable vapour cloud following a large uncontrolled tank overfill event. The results of the work confirmed the tanks in scope as defined by the BSTG initial report:
38 Furthermore the results of this work indicated that:
39 The results of this work are currently being developed into a form for publication. This will be made available within HID and to industry when this has been completed on the Buncefield Web Site. The PSLG aim to identify the number and range of sites in scope via the TA’s with a view to making a recommendation as to the implications for any sites storing such substances within scope. The CA will be involved in these discussions. No decision has been made by the CA at this point in relation to additional requirements or implementation timescales for such ‘new’ sites. CA inspectors will be advised in due course. In the interim sites should take what action they deem necessary to deal with this new information.
Further information
40 Please contact CI4F if you require further information or advice on issues raised by this SPC:
Jane Lassey (01905 74 3607/VPN 536 3607) or
Colette Fitzpatrick (0151 951/VPN 523 4078,
Buncefield Response Programme Team,
HID CI4F,
5S2 Redgrave Court,
Bootle,
Or visit the Buncefield Inspectors Community Web Site; (http://webcommunities.hse.gov.uk/inovem/inovem.ti/buncefield.inspectors/groupHome)
1 The safe management of product transfer will be improved by receiving site operators positively confirming that they can safely receive the product package before transfer starts and are able to initiate emergency shutdown if necessary. This will be achieved through the use of a standardised consignment transfer agreement. [by January 2007].
2 Tank-operating practices, staffing levels and systems, must provide effective safety margins to prevent a release [by January 2007].
3 The overall systems for tank-filling control must be of high integrity – with sufficient independence to ensure timely and safe shutdown to prevent tank overflow. Site operators should meet the latest international standards [by June 2007].
4 Fire Safe Shut-Off Valves must be fitted close to the tank on both inlet and outlet pipes. These valves should conform to an appropriate fire safe standard7 or be intrinsically fire-safe [by April 2007].
5 An assessment against HSG 244 should be completed and Remotely Operated Shut Off-Valves (ROSOVs) for the emergency isolation of hazardous substances should fail safe [by June 2007].
6 Joints in bunds must be capable of resisting fire. Existing bunds should be modified to meet this requirement [by May 2007].
7 Tertiary containment measures must be capable of preventing the uncontrolled escape of firewater and other products to the environment. [Site action plans to achieve this should be drawn up by January 2007 - to inform the production of further guidance by June 2007].
8 Effective shift/crew handover communication arrangements must be in place to ensure the safe continuation of operations [by January 2007].
| Topic | Completion date |
|---|---|
| Systematic assessment of Safety Integrity Levels (SILs) | |
| Incorporating the findings of SIL assessments into COMAH safety reports | Existing safety reports should be reviewed to incorporate a demonstration that:
|
| Protecting against loss of primary containment using high-integrity systems | |
| Safe management of fuel transfer | Ensure that suitable ‘job factors’ are provided to facilitate safe fuel transfer; to be reviewed by the end of December 2007. Receiving sites to develop procedures for transfer planning and review them with their senders and appropriate intermediates by the end of December 2007. Ensure that written procedures are in place, and consistent with current good practice, for safety-critical operating activities in the transfer and storage of fuel by the end of June 2008. |
| Engineering against loss of secondary and tertiary containment | |
| Leak-tight bunds | Bund wall and floor construction and penetration joints should be leak-tight. Should already be in place as good practice. |
| Bund capacity | Bund capacity at existing installations should be a minimum of 110% of the largest contained tank. Should already be in place as good practice. |
| Firewater management and control measures | Site-specific planning of firewater management and control measures should be undertaken with active participation of the local Fire and Rescue Service. To be completed by the end of June 2008. |
| High reliability organisations | |
| Roles, responsibilities and competence | Identification of roles and responsibilities by the end of September 2007. Implement a competence management system by the end of June 2008. |
| Staffing and shift work arrangements | Demonstrate adequate staffing arrangements by the end of March 2008. Ensure that shift work is adequately managed to control risks from fatigue by the end of June 2008. |
| Organisational change and management of contractors | Policies and procedures in place by the end of December 2007. |
| Performance evaluation and process safety performance measurement | Ensure suitable active monitoring programme and develop a set of leading and lagging indicators by the end of December 2007. Procedures for investigation of incidents and near misses and the audit and review of the control of major accident hazards should already be in place. |
| Emergency arrangements | |
| Principles for emergency arrangements | Arrangements for on-site emergency response implemented by the end of January 2008. |
| On-site emergency plan | Template for the on-site emergency plan completed by the end of January 2008. |
| Firefighting planning and preparation | Firefighting planning and preparations implemented by the end of January 2008. |
1 Prioritisation has been carried out by consideration of the surrounding populations around the sites meeting the BSTG definition of sites storing petroleum.
2 The spreadsheet provided to CI operational team leaders provides various data (numbers of residential properties, residential night time population, day time term time residential populations, day time non-term time residential populations, numbers of schools, hospitals, care homes and their populations, potential retail populations and the number of workplaces) for each of the new 4 zone land use planning scheme taken from the National Population Database tool. The tool currently does not provide workplace populations (but these will be available from mid-2008) or on-site populations.
3 The sites have been prioritised by considering the populations etc surrounding the sites with closer populations being at greater risk. The prioritisation has been banded into four segments.
4 High priority – these sites have populations close in to the site (especially within the 150 metre development proximity zone (DPZ) and the 250 metre inner zone). These sites are considered to be worse located than Buncefield.
5 Medium priority – these sites have some population surrounding them but at greater distances (primarily within the 300 metre middle zone and the 400 metre outer zone or consultation zone (CD)).
6 Low priority – these sites have very low close-in populations (especially residential populations) and primarily commercial operations at 3-400 metre distant.
7 Very low priority – these sites essentially have no off-site populations within the CD.
8 The 4 zone maps for all relevant sites, indicating the various off site populations, will be sent directly to the relevant team leaders for each site.
| Issue | Enforcement line |
|---|---|
| A. All sites - gasoline storage tanks | |
| This guidance is intended to provide a broad steer on the line to take on enforcement (Initial Enforcement Expectation) and should not be viewed as prescriptive direction. In all cases the individual circumstances on site should be taken into account and enforcement decisions should be made in consultation with the relevant specialist inspectors. In line with the EMM both duty holder and strategic factors will need to be taken into consideration. Inspectors should reach a balanced view on the likelihood of an overfilling incident having considered all the relevant factors important to reducing risk to ALARP. The differences between consideration of a CPN (COMAH PN) and a PN (HSWA) should be understood and Band 1 level agreement should usually be sought before serving a CPN - further guidance is available in the COMAH Manual. CPN - The CA must decide whether failings, inadequacies, or deficiencies amount to a serious deficiency in the measures taken to prevent a major accident in order to serve a CPN. The only way that this can be satisfactorily undertaken is to conduct a site visit with necessary staff to be able to judge the seriousness of problems identified. It is most often likely that inspectors will need to check management systems and competencies as well as any technical issues involved. A multi disciplinary or team approach may be necessary. Where there is a deficiency in the arrangements to prevent tank overfill and hence prevent a major accident but they are not considered to constitute ‘serious deficiencies’ as a whole then at least an IN is likely. |
|
1a SIL Assessment completed using an appropriately calibrated risk assessment tool. 1b Where LOPA is used the assessment must meet good practice with appropriate values selected for failure mechanisms, layers of protection and conditional modifiers. |
IN should be considered if SIL Assessment not undertaken or SIL assessment methodology considered to be inadequate Tolerability of Risk (TOR) criteria may be an issue and advice from predictive/process safety specialists should be sought as appropriate. |
| 2 All layers of protection identified in the SIL assessment should comply with recognised good practice to reduce the risk from overfill protection. (Independent safety instrumented system layer discussed in 3 below) |
The degree of any enforcement should be based on an evaluation of the significance of the shortfall in the control measure(s) designed to prevent a tank overfill. All layers of protection e.g manning levels, maintenance, etc combine to reducing risk and demonstrate ALARP and a risk assessment tool like LOPA basically tries to evaluate likelihood and consequence effects to provide a judgement on risk level. The SIS should be specified at the appropriate level but also each individual layer must also meet minimum good practice in its own right. For example a SIS could be appropriately designed and installed to SIL2 but be poorly maintained and so in this case consideration of enforcement e.g. IN for maintenance may be appropriate. e.g Inadequate manning levels during tank filling operations for a system heavily reliant on operator executive action; e.g Poorly maintained or malfunctioning tank gauging system e.g No form of existing independent overfill protection system linked to an alarm present. In all of the above a CPN should be considered and the decision on ‘serious deficiency’ will be dependant upon the extent of the evidence available to ascertain the gap in compliance - as a minimum a HSWA IN would be required. |
| 3 The outcome of the SIL assessment should be a clear definition of the safety requirements for the independent high level protection system. This should include a clear description of the system functionality and the target reliability levels (SIL Level) that are to be achieved. For pipeline fed gasoline storage tanks (Type B) a SIL 1 automatic system is expected as a minimum standard. (Special note should be taken for ship to shore applications (Type C).See note below) |
At this stage for pipeline fed gasoline storage tanks (Type B) it will not be expected that all existing independent overfill protection systems will meet the minimum SIL1 levels. However, there should be a clear improvement plan with timescales defining when the system will be implemented. An IN should be considered where timescales have not been defined or are unrealistically long. The timescale will be dependant on the size and scale of the changes required. |
| 4 Suitable inspection, testing and maintenance regimes should also be in place to maintain integrity of tank gauging systems. Although at this stage it is not be expected that all existing independent overfill protection systems will meet SIL1 levels it is expected that the basic good practice recommended by BSEN61511, e.g periodic maintenance and regular proof testing is being applied to ensure continuing system integrity |
IN should be considered if adequate inspection and testing regimes are not in place. A CPN should be considered if the failure to maintain critical elements of the control systemic where a potential major accident could occur as a result of tank overfill. A CPN should be considered where incorrect fitting and locking of TAV switches (subject to an earlier safety alert) is found. |
| 5 Suitably competent staffing in place to comply with layers of protection. The SIL assessment should identify critical tasks and roles of staff in relation to controlling tank filling. Operators should be able to demonstrate that at all times during filling operations that suitable numbers of competent staff are available to undertake functions. |
Enforcement action should be considered where inadequate staffing levels or staff competence impacts on the prevention of overfilling. For sites relying heavily on human intervention then such shortfalls could be considered as a serious deficiency especially if the circumstances give rise to a risk of overfilling. The strength of evidence would dictate whether this would a CPN or IN – Specialist Human Factors input would be essential. |
| 6 Site fully in control of shutdown system. Initiation of emergency shutdown should be entirely in the control of the site operator. | Reliance on 3rd parties for emergency shut down should not in itself be regarded as a serious deficiency unless there is evidence that the ability to shut down in the event of an emergency is jeopardised by the availability or competency of the 3rd party to execute a shutdown. The ability of a 3rd party to execute a shutdown should be a priority inspection topic. Regardless reliance on a 3rd party is not considered good practice and an IN should be considered if this control could be reasonably re-configured or re-located on the operational site. Remotely filled unmanned locations under the control of a single operator with full executive control of shutdown should be considered acceptable until an upgrade to a fully automatic shutdown system is implemented under the programmes outlined in B or C below. |
| 7 Suitable controls should be in place to prevent unauthorised override of alarms and/or trips associated with safety instrumented systems and also for those that may be associated with process gauging systems. | IN enforcement action should be considered if there is inadequate control over software or hardware override of high level alarms / shut down systems. |
| 8 Process and control/instrument diagrams of the safety instrumented system should be kept up to date and readily available | IN enforcement action should be considered if diagrams are not up to date and readily available |
| 9 Records should be kept on system incidents / errors/ over fills/ gauge failures / alarm / trip failures/ number of tests. The site should keep records of the performance of the overfill prevention system. Information should be provided on the reliability of tank gauges, level alarms and shut down systems. This information should be used to validate the values assigned to these elements in the LOPA study. |
The importance of recording this information is in demonstrating the continued reliability of equipment. An IN should be considered to ensure operators establish a system for keeping records of such failures and other relevant reliability data. |
| 10 Tank capacities have been correctly designated. | Clear tank capacities should have been established and designated according to the BSTG guidance. IN enforcement action should be considered if tank capacities have not been adequately designated. |
| B. Pipeline fed gasoline storage tanks | |
| Industry has given an undertaking to meet SIL 1 or above and to implement fully automatic, independent shut down systems at these sites. Sites will be asked to produce improvement plans by the end of December 2008 to implement any improvements. | |
| 11 Compliance with items 1 – 10above. | As above. |
| 12 The site should meet the designated SIL level identified in the SIL Assessment study. This should be a minimum of SIL 1. As part of any necessary improvements the site should also be in compliance with all aspects of BS61511 in respect of gasoline storage tanks. | The operator should draw up a time bound improvement plan to move to full compliance with BS61511 and to meet the appropriate SIL rating. For sites not falling within category C improvement plans should be drawn up by the end of December 2008 (this deadline is subject to final agreement with the PSLG on 26 Sept 08). This doesn't necessarily mean new equipment has to be installed. Qualification of existing equipment and lifecycle controls can be done retrospectively - although due to the time consuming task to demonstrate compliance in such cases many sites opt for installation of new equipment. IN enforcement action should be considered in the event of delays beyond end of Dec 2008 in preparing improvement plans. |
| 13 Gasoline storage tanks should be fitted with fully automatic, shutdown systems independent to the tank gauging system. | The operator should draw up a time bound plan to implement automatic shutdown systems. For sites not falling within category C improvement plans should be drawn up by the end of December 2008 (this deadline is subject to final agreement with the PSLG on 26 Sept 08). IN enforcement action should be considered in the event of delays beyond end of Dec 2008 in preparing improvement plans. |
| C. Ship to shore or refinery process gasoline storage tanks | |
| The industry is working with the CA to identify practical solutions to the safe emergency shutdown of ship to shore transfers and refinery fed run down storage tanks. Once these solutions have been identified and agreed then a programme of improvements will be developed with industry. Some sites have already identified within their SIL Assessment studies that they need to meet SIL 1 or above to reduce risks to ALARP which includes full compliance with BS61511. As the CA/industry programme develops further additional guidance will be given on the enforcement line to be taken. |
|
| 14 Compliance with items 1 – 10 above. | As above. |
| 15 The site should meet as far as possible the designated SIL level identified in their SIL Assessment study. However, it is recognised that there may be a requirement to install additional systems to reduce the risk of overfill for ship to shore applications. This may involve for example, diversions to dump tanks, links from ship to land based ESD systems, or slow closing ESD valves. In these cases improvements to meet the designated SIL level and the requirements of BS EN 61511 may need to be delayed. | The operator should draw up a time bound improvement plan to meet the appropriate SIL level and the requirements of EN BS61511. In order to do this they need to consider the most appropriate means of reducing the risk of overfill protection to ALARP and decide on the most appropriate method. IN enforcement action should be considered in the event of delays beyond end of Dec 2008 in preparing improvement plans. |
