Failure overfilling protection

Fig. 9.45 Flow sheet and fault tree for the failure of the overfilling protection of a tank...

OverfiUing is not a relevant base cause for the scenario Catastrophic rupture - Instantaneous . Therefore the overfill protection will not lead to a failure frequency reduction and the standard failure frequency of 5 x 10 per year should be used ... 

This guidance is not intended to replace BS EN 61511 but to supplement it specifically in relation to tank overfill protection SIS. It does not cover all the requirements of BS EN 61511. Where guidance is not given on any requirement, such as protection against systematic failures, then reference should be made to the standard. 

The System 80+ Standard Design has a Main Feedwater Isolation System (see CESSAR-DC Section 10.4.7.2.2) to protect the SGs from overfill. The system includes redundant remotely operated isolation valves in each main feedwater line to each SG. The valve actuation system (see CESSAR-DC Section 7.3.1.1.10.3) is composed of redundant trains A and B, and each train s instrumentation and controls are physically and electrically separate from and independent of those of the other train. A failure of one train will not impair the action of the other. The main feedwater isolation valves are automatically actuated by a Main Steam Isolation Signal (MSIS) from the Engineered Safety Features Actuation System (ESFAS, see CESSAR-DC Section 7.3.1). High SG water level, in a 2-out-of-4 logic, is one of the initiators for the MSIS. The main feedwater isolation valves can be in-service tested in accordance with ASME Code Section XI, Subsection IWV. A Technical Specification (CESSAR-DC Chapter 16) will establish testing requirements for the valve actuation system. These requirements will also be incorporated into the plant maintenance procedures. 

Whether the power supplies for an automated overfill system are independent from the BPCS used for tank level indication and provides redundancy for protection against common mode failure (Note that if the Final Element fails safe on loss of power, a new independent power supply may not be reasonably practicable). 

Any of these devices will provide protection against a cylinder bursting from excessive temperature, except in the case where an intense flame impinging on the sidewall of a cylinder may weaken the metal at that point and cause a local failure before the heat or pressure cause the safety relief device to operate. Devices 3 and 4 may not provide protection in cases where a liquefied gas cylinder has been overfilled and exposed to a high temperature that is below the fusible metal s melting point. Because of this, extreme care should be used when filling liquefied gas cylinders and filling should never be attempted by the user. Never tamper or attempt to remove or block a cylinder s pressure relief devices since this could cause an extremely hazardous condition. 

---