Risk Analysis Refueling Nozzles > Ra Refuelling Nozzles - Generic Rev3

RISK ASSESSMENT REPORT

BANLAW PIPELINE PTY LTD Dry-Break Quick-Fill Refuelling System AUS21 Series AUS22 AUS45 800 Series 1000 Series Prepared By: Banlaw Pipeline Pty Ltd Revision 3: October 2003

The Refuelling Specialists

CONTENTS PAGE 1. Discussion of Risk Management Objectives

1

2. Details of Equipment

2

2.1 Principles of the Banlaw System

3

2.2 The 21 Series Nozzle

4

2.3 The 22 Nozzle

5

2.4 The 45 Nozzle

5

2.5 Receivers and Tank Vents

6

3. Contexts

9

3.1 Strategic Context

9

3.2 Organisational Context

9

3.2.1 Health & Safety Obligations – Employer

10

3.2.2 Health & Safety Obligations – Designer, Manufacturer, Supplier 10

3.3 Risk Management Context

11

4. Details of Authors

12

5. Outline of Risk Identification Methods

13

5.1 Action Error Analysis (AER)

13

5.2 Hazard and Operability Studies (HAZOP)

13

5.3 Fault Tree Analysis (FTA)

13

6. Outline of Risk Assessment Methods

14

7. Risks Identified

15

7.1 Action Error Analysis (AER)

15

7.2 Hazard and Operability Studies (HAZOP)

16

7.3 Fault Tree Analysis (FTA)

17

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

i

7.4 Risk Ranking

18

8. Assessment of Risks

21

9. Risk Reduction and Control Measures

23

9.1 Liquid Storage Tank Pressure Certification

26

9.2 Correct Nozzle Operation

28

9.3 Specific Actions to Reduce the Occurrence of High Probability Risks 29 9.4 Product Warranty & Disclaimer

30

9.5 Banlaw “Zero Tank Pressure” Refuelling

30

9.6 Fuel Monitoring & Accountability

31

10. Risk Monitoring and Review

32

11. References

33

Appendix A.1 Nozzle Performance Specifications A.2 Additional Information

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

ii

1.

Discussion of Risk Management Objectives

Risk management aims to reduce the probability and impact of risks. Risk assessment aims to identify the risks associated with a procedure, so that they may be effectively managed. The assessment of risks is not an easy task, particularly where there is a high level of human involvement. There are risks that may be classed as inconceivable within the bounds of proper operating procedure and “common sense”, however the potential for such risks cannot be discounted. Instead, risk management procedures can be made to incorporate measures to reduce and discourage the occurrence of risks associated with human error. In line with risk management guidelines, this report aims to identify, assess and prioritize, address, and provide guidance to manage the risks associated with the use of Banlaw Quick-Fill Dry-Break Refuelling Nozzles. The process of refuelling is an integral part of any mining operation involving mainly plant equipment and fuel farm operators. Despite quick-fill dry-break refuelling eliminating or minimizing many risks associated with conventional splash-fill refuelling, alternative risks have emerged many of which involve serious consequences. This report will address these risks, and provide procedures and advice for reducing their probability and impact. It is expected that this report will be incorporated into existing site risk management procedures. As employees of Banlaw Pipeline Pty Ltd, the authors and contributors of this report do not intend for its content to supersede existing risk management practices, but to only complement such. It remains the responsibility of site personnel/management to assess the risks identified in this report, and devise and implement adequate control measures to ensure the recommendations of this report are properly considered. Due to the many variables involved in the method of operation of quick-fill equipment between mining, railway, ports and earthmoving sites, specific control measures have not been addressed in this report. Recommendations however are given to assist site personnel in the selection of control measures. Feedback: It would prove to be mutually beneficial if future communication regarding this report could be maintained between Banlaw Pipeline and its recipient, so that future amendments and reports remain factual and productive. Risk management remains a cooperative effort between manufacturer/supplier and end-user.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

1

2.

Details of Equipment

Market leading service life and performance are the trademarks of Banlaw refuelling equipment. Each part has been designed to be efficient, safe and effective. All parts are designed using good engineering practice, and prototype equipment is thoroughly tested prior to production. Banlaw dry-break quick-fill refuelling equipment provides many advantages over conventional splash-fill methods. These include : • • • • • •

higher refuelling rates - up to 1000 litres/min. maximizing tank liquid volumes by reduced diesel foaming automatic nozzle shut-off pressurized fuel delivery system reducing incidence of contamination ingress greatly reduced incidence and magnitude of fuel spillage option of remote fuel receiver placement, i.e. refuelling at ground level

In addition to the gains in efficiency, the level of human involvement has been reduced particularly by the advantages of automatic nozzle shut-off and the option of remote receiver placement. The need to gain often difficult access to the filler port on the top surface of the fuel tank has been eliminated, thus assisting in the reduction of the number of human falls and physical strain related injuries. The constituent parts of a Banlaw nozzle are manufactured from materials including aluminium, brass, mild steel, stainless steel and rubber compounds including viton, polyurethane, hightemperature nitrile (HNBR) and Teflon (PTFE). There are 3 main models of Banlaw refuelling nozzle. The models and their recommended maximum flow-rate are : • 800 & 21 series nozzle - flow-rates <800 litres/min • 1000 & 22 nozzle - flow-rates <1100 litres/min • 45 nozzle - flow-rates <300 litres/min Banlaw Pipeline Pty Ltd currently hold Australian Patents pertaining details of the: • tank vent - valve inner diameter, and use of splash tube • modifications to a locomotive diesel fuel tank to suit a dry-break receiver, 4 failsafe air vents, 50mm drop filling tube, and quick-fill refuelling nozzle • system for identifying a vehicle during refuelling (Banlaw Fuel Monitoring System BFMS) • ball lock mechanism and rear chamber piston and spring assembly of a dry-break quick-fill refuelling nozzle • specific Patent on the use of a multi-position rear spring adjustment in the refuelling nozzles • adjustable piston spring retainer in the rear section of a refuelling nozzle (Pat. Pending) • low profile tank vent, manufactured from steel (Pat. Pending) In addition, two US Patents are currently held regarding the ball lock mechanism and rear piston and adjustable spring sensing chamber assembly of a refuelling nozzle.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

2

2.1

Principles of the Banlaw Refuelling System

Figure 2.1.1: Overview of Banlaw System The BANLAW Refuelling System uses both Dry-Break and Quick-Fill technology, producing an environmentally friendly and more efficient method of liquid refuelling. Problems associated with the conventional “splash-fill” method, such as spillage and foaming are eliminated, whilst additional advantages such as higher refuelling rates and alternative filling points make the Banlaw system a better way to refuel your equipment. A Banlaw nozzle has been designed for all existing refuelling systems found in the mining and rail industries. These include the BAM800, BAH800, BAR800, BAM1000, BAR1000, and the AUS45, catering for refuelling rate requirements between 120 and 1000L/min. Associated equipment such as tank vents, drop-tubes, nozzle receivers and receiver shells are custom fitted to each tank or vehicle, along with receiver caps, nozzle anchors and operator instruction signs to ensure the safe, trouble-free operation of the Banlaw system. After the nozzle has been connected to the receiver and turned ON, fuel is allowed to pass through the fill-point into the tank. Fluid continues to flow at the desired rate until the fuel level reaches the float balls at the base of the vent. The balls seal against an O-ring at the base of the 3/4” vent tube providing a positive air-tight seal within the tank. Fuel continues to flow until such time as the required amount of pressure is developed in the tank - typically 15-100kPa, depending on the spring setting of the nozzle, the flowrate and the specific filling application. This pressure is transferred upstream through the nozzle where it is sensed by a patented piston style unit within the nozzle, which promptly shuts the nozzle OFF thus terminating the flow of fuel into the tank. The nozzle can then be safely disconnected and mounted in a secure position - such as a nozzle anchor - ready for the next refuelling application. A 1/16” bleed hole in the vent valve allows the tank contents to gradually return to atmospheric pressure - typically between 10-60sec - after the vent has closed at the completion of refuelling. To ensure the correct operation of the Banlaw system it is important to provide a constant high flow area downstream of the nozzle with a minimum of flow directional changes. In addition, the flow of air through the vent exhaust should not be impeded by restrictions. Such measures will reduce the line pressure required through the nozzle and maximize the refuelling flow-rate. High ratios of line pressure to flow-rate can lead to premature nozzle shut-down and hence partial tank filling. All Banlaw products are manufactured in accordance with of standard AS/NZS-ISO9001. Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

3

2.2

The 800 Series Nozzle

The recently introduced 800 series nozzles replaced the earlier 21 series nozzles. There are 3 models in the 800 nozzle series; mines (BAM800), railway (BAR800), and hydraulic (BAH800). Each model has a unique nozzle body to suit the correct receiver. This distinction was made to prevent incorrect coupling of incompatible fluid types i.e. diesel and hydraulic oil, when a number of fluid types are transferred by similar refuelling equipment. The one exception is that a railway nozzle will loosely couple to a mines receiver, however these parts are installed on machinery which will rarely be used together and thus a problem with incompatibility should seldom occur. To allow a variety of shut-off pressures, each Banlaw 800 series nozzle may be used with 1 of 5 available spring settings. One of 2 piston springs may be installed in a nozzle, offering 5 distinct pressure ranges at which the nozzle will shut-off. Light (L), medium/light (ML), medium (M), medium/heavy (MH) and heavy (H) settings provide the flexibility to cater for low to high nozzle delivery head and flowrate demands. This flexibility is valuable when attempting to minimize the amount of pressure built-up within the receiving tank at the point of nozzle shut-off. Advice on the correct installation of the Banlaw 800 series nozzle and other associated parts of the Banlaw refuelling system can be obtained from [1] & [2]. As illustrated in Figures 2.2.1 and 2.2.2, two designs of operating handle are used with the 800 series and 21 series nozzles. (NOTE: A “T-style” operating handle was originally used in the first 21 series nozzles produced by Banlaw, after which the design in Figure 2.2.2 was implemented).

Figure 2.2.1 – 800 Series Nozzle with “T-style” Operating Handle

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

4

Figure 2.2.2 - 21 Series Nozzle with “Knob-style” Handle 2.3

The 1000 Series Nozzles

The 1000 series nozzles were recently introduced to replace the earlier 22 series. The 22 series was established after modifications were performed to the 21 series nozzle to achieve higher flowrates at equivalent line pressures i.e. reduce the hydrodynamic pressure drop across the nozzle. The new 1000 series nozzle incorporates the same changes when compared to the 800 series equivalent. The need for a flow-rate approaching 1000litres/min was requested by various railway network authorities, in order to increase the refuelling efficiency of their diesel locomotives. The 1000 series nozzle is identical to the 800 series in external dimensions - refer Figure 2.2.1 - as all modifications have been performed internally. A distinct fuel receiver was designed to accept the 1000 nozzle and maintain high flow-rates with low flow restriction. As with the 800 series nozzle, the 1000 series offers the same ability to adjust the shut-off pressure of the nozzle by varying the type of back spring used and also the position of the back spring within the nozzle endcap. Unlike the 800 series, the 1000 series typically require the use of only 4 of the 5 available settings – the light (L) setting is not used. Advice on the correct installation of the Banlaw 1000 series nozzle and other associated parts of the Banlaw refuelling system can be obtained from [4] & [5].

2.4

The 45 Nozzle

The 45 nozzle model contains no aluminium and was specifically designed during 1995 for the underground mining industry. This nozzle incorporates an adjustable piston spring retainer - see Appendix A.1 - which was necessary for the varied and often critical refuelling conditions under which the nozzle is used.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

5

Figure 2.4.1 - 45 Nozzle The 45 nozzle is not suited to the rugged environments associated with large (heavy) vehicle refuelling, and is principally used in underground black coal mining environments, in which the use of aluminium is strictly forbidden.

2.5

Receivers and Tank Vents

A dry-break receiver and tank vent are the 2 remaining parts making up the quick-fill dry-break refuelling process. Banlaw Pipeline manufacture 2 vent tube lengths to cater for a variety of tank shapes to ensure the correct volume of air remains in the tank - ullage - at the completion of refuelling. Tanks with a relatively small fluid surface at the top of the tank with respect to tank volume e.g. horizontal cylindrical tanks, usually require a longer vent tube than uniform section or broad shaped tanks. Advice on vent positioning and the correct vent to be installed should be obtained from [6].

Nozzle

Receiver

Flowrate Capacity

AUS45 BAM800 (AUS21A) BAR800 (AUS21R) BAH800 (AUS21B) BAM1000 (AUS22)

AUS46 AUS23 AUS23R AUS23B AUS43

300LPM (79GPM) 800LPM (211GPM) 800LPM (211GPM) 800LPM (211GPM) 1000LPM (264GPM)

Table 2.5.1: Nozzle and mating Receiver NOTE: all flow capacities using diesel fuel

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

6

Vent

Relief Pressure

Maximum Recommended Flowrate*

AUS25A, 25B, 25C, 25D, 25E-H AUS25A-L, 25B-L, 25C-L, 25D-L, 25E-C 25R, 25C-R

110kPa (16psi)

800LPM (211GPM)

49kPa (7.1psi)

800LPM (211GPM)

LEGEND: * The Maximum Recommended Flowrate (MRF) of a vent defines the maximum refuelling rate at which a single tank vent may be used before the tank is subjected to a pressure of >5kPa during the refuelling – i.e. prior to the vent closing. A single vent may be used above this MRF, however the tank will be subject to increased tank pressurisation during refuelling, thus increasing the risk of only partial filling of the tank due to premature nozzle shut-off – i.e. nozzle shut-off prior to the tank vent closing. Refer to [6] for details. Flowrates in excess of the MRF will require 2 or more vents per tank.

Table 2.5.2: Banlaw Vent Specifications NOTE: all flow capacities using AIR

Figure 2.5.1 - A Typical Dry-Break Receiver (AUS23 shown)

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

7

Figure 2.5.2 - A Typical Tank Vent (AUS25A shown) The low profile vent - 25E series - is a vent used in applications where installation is restricted by limited clearance between the top surface of the tank and its surrounds. The operating principles of this vent are identical to those of the standard profile vent, despite the reduced height of the vent cap. From a risk management perspective, the risks associated with the use of a receiver and vent singularly are relatively minor compared to the refuelling nozzle. Since the operation of both parts rely on the use of the nozzle and hence any risks associated with such, the assessment conducted in this report will principally deal with the operation of a nozzle.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

8

3

Contexts

3.1

Strategic Context

Banlaw Pipeline Pty Ltd (formerly Banlaw Australia Pty Ltd) is 100% Australian owned and has supplied refuelling and fluids handling equipment to the mining, rail, and associated industries for over 25 years. The company began manufacturing its own product during the mid 1980’s, and has since developed an extensive regional, national and international customer base. Banlaw is a registered member of Lloyds Register Quality Assurance Ltd, and as such all Banlaw manufactured products are made in accordance with regulations detailed in ISO9001. Banlaw has established a comprehensive national and international distribution network, by harnessing the outreach capability and experience of many respected companies already heavily involved in the target market, often specializing in disciplines such as; refuelling, hydraulics, and mine vehicle support. - Contact Banlaw Pipeline Pty Ltd (Sales & Marketing) for the details of your nearest authorised distributor and repair agent Servicing of products is performed in the Banlaw Pipeline factory located in Newcastle NSW Australia and by authorized repair agents. Part of the Banlaw Pipeline Terms and Conditions of Sale document refers to; “the performance of Banlaw equipment is conditional upon correct installation and use in accordance with the specified operating procedures, and that the equipment has not been damaged due to accident, misuse or neglect, or repaired or tampered with by any person other than an authorized repair agent”. Banlaw accepts no liability for actions or circumstances beyond these conditions.

3.2

Organisational Context

Banlaw Pipeline Pty Ltd holds the health and safety of its customers in high regard. Monitoring the performance and operating environments of its products is often very difficult, due to the remote and isolated areas in which the products are used. As a result, communication between Banlaw, its distributors and customers, is critical to maintaining the effective monitoring and management of risks. The sales and marketing people at Banlaw endeavour to maintain regular contact with its client and distributor base in order to receive feedback on the operation of the equipment, and also spend considerable time travelling to current and prospective customers to witness the operating conditions first-hand. Any feedback received is valuable, and is passed on to the appropriate recipient for assessment. All engineering concerns are recorded on a Corrective Action Report (CAR) form for prompt consideration, in line with established Banlaw Pipeline Quality Assurance procedures. Contact details for management divisions within Banlaw Pipeline are: • Managing Director – Bill CLIFTON ([email protected]) • Production and Quality Assurance – Paul BUCKTON ([email protected]) • Sales and Marketing – Nick FORAN ([email protected]) • Fuel Monitoring and Electronics – John GREGORY ([email protected]) • Product Engineering & Design – Adam PEATTIE ([email protected]) • Finance and Accounting – Phil RANKIN ([email protected])

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

9

3.2.1 Health & Safety Obligations – Employer The underlining principle for workplace occupational health and safety is that the employer must ensure, as far as is practicable, the health, safety and welfare at work of all its employees. For example, under the NSW Occupational Health and Safety Act 2000 (Australia), an employer must: • identify hazards within the work environment • assess risks within the work environment • eliminate or control such risks • review risk control measures • provide instruction, training and information • provide adequate supervision • provide appropriate personal protective equipment (PPE) • provide suitable amenities, first aid facilities and personnel • provide adequate training and equipment in order to deal with an emergency NOTES:

1. the above example is indicative of the NSW Act only – employers must refer to the Act or Regulation relevant to their location for specific details

3.2.2 Health & Safety Obligations – Designer, Manufacturer, Supplier As a designer, manufacturer and supplier of plant or equipment, Banlaw Pipeline Pty Ltd must under the NSW OH&S Amendment Act 2000: • • • • •

identify hazards assess risks review risk assessment implement appropriate risk control measures supply adequate information to the supplier/user to ensure the safe and proper use of the equipment, and to thus allow the supplier/user to conduct a suitable risk assessment for a specific work environment

Under NSW OH&S Act, the enforcement and distribution of such information once received remains the responsibility of the recipient. As such, Banlaw Pipeline Pty Ltd is not responsible for actions or consequences resulting from activities performed contrary to the supplied information. The prescriptive nature of a persons obligations in a certain capacity does vary in the National Occupational Health and Safety Act and equivalent Acts of other Australian States, however the nature of the above obligations remain similar and can thus the authors of this report consider they be classed as relevant to the scope of this assessment within Australia. With respect to environmental legislation e.g. the NSW EPA Protection of the Environment Operations Act 1997, there exists requirements for persons regarding the welfare of the natural environment i.e. land, air, and water. The underlying principle of such Acts is that no person shall knowingly pollute the environment - except where a specific license has been issued by an appropriate Authority - and that all reasonable effort should be made to protect the integrity of the natural environment. As the supplier of a manufactured product, Banlaw Pipeline must therefore ensure that during proper use the product itself does not either pollute the environment or otherwise degrade its condition. This report will address any environmental risks present during the prescribed use of the equipment, however it remains the users responsibility to ensure that adequate environmental risk management procedures exist and are implemented, should an incident occur. Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

10

3.3

Risk Management Context

To the best knowledge of Banlaw Pipeline, since Banlaw began manufacturing its own product, there has been no documented case of an incident resulting in serious injury or environmental impact caused by the equipment when used in accordance with correct operating procedures. This is the standard which Banlaw Pipeline Pty Ltd strives to maintain. The objective of this study is to establish safe working procedures for low risk refuelling of equipment, and provide guidelines of effective risk management for the use of Banlaw refuelling equipment. The activities considered in this report are those normally associated with dry-break quick-fill refuelling. This being the “pressurised” transfer of fluid between two storage vessels via flexible hose and/or fixed pipe and a nozzle/receiver assembly. The receiving vessel must be certified to a pressure meeting the requirements set out in section 9.1, and includes the use of an approved tank vent and a full pressure relief device (if required). The receiver may be either fixed to the tank surface or remote located. Human involvement requires the manual manipulation of the nozzle and attached flexible hose from the nozzle mounting/anchor point onto the fuel receiver. Once the nozzle has been secured to the receiver, the operating handle is manually turned into the ON position thus permitting the flow of fluid through the otherwise normally closed nozzle and receiver assembly. After the nozzle has either been turned off manually during refuelling or has turned off automatically at the completion of refuelling, the nozzle is manually removed from the receiver and returned to the anchor point. These activities are the bounds within which this assessment was conducted. The success and relevance of this assessment and future amendments depends upon the maintenance of effective communication between Banlaw Pipeline, its distributors, and its customers. As mentioned in section 3.1, the often remote locations in which equipment is used has historically hampered efforts to maintain lines of communication between the user and supplier. Encouraging feedback remains a challenge to Banlaw staff, whose efforts have not been assisted in the past by an apparent ‘discard, forget, and reorder’ mentality of many customers. The scope of this assessment in terms of outreach will initially extend to all present and future nozzle users. Depending upon demand, the distribution of this report may also extend to tank vent customers. The similarities discussed in section 3.2 regarding equivalent safety and environment Acts, should allow widespread acceptance of this assessment and its findings regardless of legislative jurisdiction, and should also promote acceptance overseas. Through future amendments, the future relevance of this assessment will be maintained for as long as the equipment studied remains in use. Amendments will be conducted when prompted by a design modification to the subject equipment, or a change to their operating conditions or procedures. The details of such amendments will be distributed to past report recipients to ensure all Banlaw Pipeline equipment users possess up to date information.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

11

4

Details of Assessors

The details of persons responsible for the preparation and execution of this report are as follows: 1.

Adam PEATTIE Name : Company : Banlaw Pipeline Pty Ltd Title / Position : Product & Design Engineer (Mechanical) - Assistant Quality Assurance (QA) Manager - Bachelor Degree in Mechanical Engineering (Hons) Education : - Associate Diploma in Mechanical Engineering - Attended Lloyd’s OH&S Appreciation Training Course 1999 Experience : - began current role/position with Banlaw Pipeline in March 1999 - 7 years previous work experience in the bulk materials (coal) handling industry, including 4 years conducting technical performance audits on coal processing plants

2.

Paul BUCKTON Name : Company : Banlaw Pipeline Pty Ltd Title / Position : Production Manager - Quality Assurance (QA) Manager Education : - School Certificate - Fitting and Machining Trade Certificate - CNC Programming Experience : - production overseer at a pump assembly plant - 21 years trade experience in mining environment, including extensive experience in all facets of fitting and machining - 10 years as Production Manager at Banlaw Pipeline, overseeing manufacture, machining, assembly and installation of all Banlaw equipment

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

12

5

Outline of Risk Identification Methods

Risks can occur by human error, equipment failure, or a combination of both. The identification of risks associated with a process is the crucial element of risk assessment. It must be conducted systematically, in line with the objectives of the study. Not every risk can be identified, however the assessors must be confident that no significant risk has been overlooked. Of the techniques mentioned in [7] for risk identification, the following 3 methods were chosen to satisfy the objectives of this report : 1. Action Error Analysis - considering steps in a procedure and analysing the possible human errors involved i.e. extraneous act, error of sequence etc. 2. Hazard and Operability Studies (HAZOP) - review of the consequences and probability of various system abnormalities i.e. excessive line pressure etc. 3. Fault Tree Analysis (FTA) - identification of the root causes of unwanted events

5.1

Action Error Analysis (AER)

This method is based on the analysis of possible human errors. It is achieved by considering each step in a procedure and considering a series of probable errors, such as extraneous acts, selection or omission errors, or miscommunication / misinterpretation of instructions. Blatant acts in breach of correct procedure have been included in this analysis, as manually holding the nozzle in the ON position whilst refuelling has historically posed the greatest risk to persons and equipment.

5.2

Hazard and Operability Studies (HAZOP)

This method involves the systematic consideration of the probability and consequences of different system abnormalities, such as excessive flow-rate and/or line pressure. HAZOP explores the consequence of severe operating conditions, and attempts to resolve an issue that is deemed unsatisfactory due to a combination of its probability and impact. For example, high flow-rates may be necessary for high efficiency, however should this create frequent risks whose impact is deemed too severe, the requirement is reviewed and alternatives devised. Operating boundary conditions are supplied with each nozzle [8], as a result of extensive testing at the Banlaw factory. Operation of equipment outside these limits can be detrimental to the welfare and effectiveness of the system, and is not recommended.

5.3

Fault Tree Analysis (FTA)

FTA is used in establishing the fundamental causes of a defined unwanted event. The method begins with the undesired event, after which possible causes are progressively identified until the fundamental “root causes” are established. The structure often represents a tree, with the major incident representing the trunk being supported by the series of fault lines symbolizing the tree roots. There are many incidents which can be caused by either human or equipment error. Some of those risks identified using AER and HAZOP were again identified using FTA.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

13

6

Outline of Risk Assessment Methods

In [7], risk assessment is described as “ the process used to determine risk management priorities by evaluating and comparing the level of risk against predetermined standards, target risk levels or other criteria.” For persons responsible for risk management, the varying degrees of detail used in expressing the level of risk dictate the degree of effort and resources that are required. The authors of this report have detailed various statements in section 10, which should be adopted by equipment users to decide on the rationing of risk management resources. Prioritizing risks according to their probability and severity can be achieved a number of different ways. The most accurate method would involve the input of both manufacturer and user cooperatively. From the objective of this assessment and the perspective of its authors, the method used to prioritize risks will be the rapid ranking system. Estimating the extent of production loss, equipment damage, and environmental impact can effectively be achieved only by the user, and other people with a more intimate knowledge of the specific operating environment. The authors of this report, whilst experienced in the field of refuelling cannot establish an understanding of every operating site, but instead have cooperatively ranked each risk in accordance with an environment perceived as typical. The scale used to rank each risk in this report according to its probability and the likely effect on human welfare is numerical. The results are summarized in a matrix or tabular format for ready access. As recommended in [7], lists A and B are used to rank risks according to the assessed risk and the magnitude of the consequences respectively. Main actions are discussed for list A in section 9.3, whilst section 9.4 describes recommended controls for list B.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

14

7

Risks Identified

7.1

Action Error Analysis

The following information details the human errors and their corresponding risks identified using AER. 1.

2.

manually holding nozzle ON (includes attaching weighted objects to nozzle operating handle) (a) overfilling of tank (nozzle turned OFF before vent relief activated) fuel leakage through vent weep-hole whilst transporting tank (b) overfilling of tank (nozzle kept ON after vent relief activated) subsequent exhausting of fuel through vent exhaust (c) over-pressurization and possible rupture of tank (once tank full) (d) artificial pressurization of engine fuel delivery system - engine revving or flooding attempting to couple nozzle to receiver whilst nozzle ON

(a) fluid pressure forcing nozzle back against operator (b) possibility of momentary spurt of pressurised fuel from between nozzle actuator and receiver

3.

4.

failing to use correct posture and secure footing to lift, carry, engage, and disengage nozzle (a) back injury whilst lifting (b) feet slipping on unstable footing failing to securely couple nozzle and receiver

(a) fluid pressure rapidly forcing nozzle back against operator (b) possibility of momentary spurt of fuel from between nozzle actuator and receiver 5.

failing to establish air tight seal within tank - removal of or incorrect installation of tank vent (a) overfilling of tank (nozzle turned OFF before vent relief activated) fuel leakage through vent weep-hole whilst transporting tank (b) overfilling of tank (nozzle turned OFF after vent relief activated) subsequent exhausting of fuel through vent exhaust

6.

placing foreign objects into front end of nozzle or receiver e.g. attempting to force open nozzle sleeve or receiver poppet (a) fuel spurting out under pressure – eye injury, skin contact (b) damage to seals and subsequent fuel leakage (c) damage to nozzle tube or receiver poppet spindle

7.

vehicle moved or driven away whilst nozzle remains connected

(a) significant fuel spillage - particularly if no break-away valve installed (b) damage to fuel delivery components - particularly if no break-away valve installed

(c) nozzle, hose and break-away valve (if used) striking objects or persons being passed by moving vehicle Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

15

8.

installing incorrect vent(s) to tank

(a) nozzle failing to automatically shut-off at correct fuel level - overfilling and subsequent spillage of fuel from tank (b) premature automatic nozzle shut-off - tank only partially filled (c) tank remaining pressurized at completion of refuelling

9.

operating nozzle on tank not certified for use with quick-fill equipment

(a) premature automatic nozzle shut-off - tank only partially filled (b) nozzle failing to automatically shut-off - overfilling of tank, subsequent spillage from tank and possibility of tank rupture

7.2

10.

connecting (routing) vent exhaust to interior of tank (a) premature automatic nozzle shut-off - tank only partially filled

11.

installing break-away valve contrary to guidelines detailed in [9] (a) valve installed at height above eye-line level (b) valve installed in such a configuration so as to require high levels of force to create valve “break-away” operation – i.e. valve configured for tensile break, rather than the required shear or “cantilever” action

Hazard and Operability Studies (HAZOP)

There are two significant system abnormalities that can have a detrimental effect to the safety of refuelling :

1.

flow-rate through nozzle exceeding specification

(a) significant fluid leakage by removal of or damage to nozzle and receiver seals (b) excessive turbulence induced vibration, causing damage to and possible failure of receiver and nozzle components

(c) premature automatic nozzle shut-down - partial filling of tank (d) excessive fuel foaming – leakage of foam from vent, and tank only partially filled

2.

line pressure (pump head) through nozzle exceeding Safe Working Pressure – this includes “pressure spikes” or “fluid hammer” (a) excessive fatigue stress to nozzle components - premature component failure (b) rapid failure of nozzle components – rapid high pressure discharge of nozzle components and fuel. NB: nozzle failure at high pressures typically occurs as tensile break of nozzle tube or nozzle poppet, ejecting failed parts and fuel from the front end of the nozzle.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

16

7.3

Fault Tree Analysis (FTA)

This method was adopted to establish the “root causes” of hazards experienced in the refuelling process.

1. over-pressurization of fuel tank nozzle held ON during refuelling

nozzle failing to shut-off at correct pressure

incorrect nozzle or vent(s) for tank

inadequate tank design pressure

contact Banlaw agent

2. vehicle striking operator during refuelling emergency brake, wheel chocks not engaged or faulty 3. vehicle / equipment running out of fuel prematurely

OR

tank not filling to FULL indicator

nozzle shut-off prematurely fuel siphoning from tank through nozzle at completion of refuelling

is gauge working correctly

has FULL indicator been calibrated for presence of Banlaw tank vent excessive line pressure at nozzle due to high flow-rate or restriction to flow into tank

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

vent exhaust port obstructed

incorrect nozzle shut-off setting

17

4. fuel leaking from front of nozzle damaged /worn nozzle seals

damaged / worn receiver body

excessive contamination on receiver or in front area of nozzle receiver caps not used

normal wear

high level of particulate material in fuel

failing to use nozzle not serviced nozzle anchor or plug

dirty fuel filters

5. nozzle becoming detached from receiver worn receiver ball lock groove

nozzle failing to secure properly

damaged ball lock

nozzle / receiver part incompatibility

check correct operating procedure

6. fuel exhausting from vent port during refuelling nozzle failing to automatically shut-off at correct pressure incorrect nozzle model for tank / vent assembly 7.4

incorrect tank vent(s) installation

contact Banlaw agent

faulty tank vent

nozzle manually held ON

air leak in tank e.g. manual fill point

Risk Ranking

The numerical rapid ranking system used for weighting each identified risk is a combination of methods used in [7] and [10]. Initial ranking is achieved by assessing firstly the consequence of a risk - the row position on the matrix - followed by its probability - the column position on the matrix. The weighting of that risk is given by the number contained in the matrix cell chosen. One weighting exists for each of the two assessment criteria i.e. human and environmental welfare. The authors of this report have not assigned a weighting to the identified risks. This is due to many variables that affect both the probability and the consequence (impact) of a risk throughout the many varied working environments in which the Banlaw refuelling equipment is used. For example; refuelling flowrate, pump “head” pressure, configuration/design of tank and filling pipe/hose used, correct installation of vent(s) and break-away valves, and the Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

18

terrain and cleanliness of the work environment are all such variables. It would be difficult and perhaps not in the best interests of effective risk management if the authors of this report i.e. Banlaw Pipeline Pty Ltd, were to assume “typical” weightings for each risk identified. Instead, the risk weighting and subsequent rankings will be left blank to allow each site or end-user to assess each risk for their particular site and hence weight and rank each risk accordingly. The authors have however included risk reduction and control measures in section 9 of this report. The extent to which each measure is implemented and monitored will of course depend upon the ranking of each risk as assessed by the end-user. Specific control measures must be adopted for “high level” risks. The matrix format used is detailed below:

Consequence On Human Welfare

Probability Of Occurrence Very Likely

Likely

Unlikely

Very Unlikely

1

2

4

7

3

5

8

11

6

9

12

14

10

13

15

16

Kill / Permanent Disability Serious Injury / Long Term Illness Medical Attention and Sick Leave First Aid Required

Table 7.4.1 - Personal Welfare Ranking Matrix Consequence On Probability Of Occurrence Very Likely Likely Unlikely Very Unlikely Environ. Welfare Major Uncontained Spill - EPA Action

1

2

4

7

3

5

8

11

6

9

12

14

10

13

15

16

Moderate Uncontained Spill - EPA Action Major Contained or Minor U/c Spill Moderate to Minor Contained Spill

Table 7.4.2 - Environmental Welfare Ranking Matrix The weightings that are underlined are dominant or key risks that are the focus of specific risk control and reduction measures discussed later in section 9.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

19

Identified Risks and their Weighting over-pressurisation of tank – tank rupture over-pressurisation/filling of tank – spillage of fuel from vent person struck with break-away valve or hose during a drive-away ruptured fuel delivery line (no break-away valve) – fuel spillage artificial pressurisation of engine fuel supply line high pressure fuel spurt from front of nozzle – eye and skin contact nozzle / hose assembly striking persons being passed by vehicle overfilling of tank – spillage of fuel from vent during transportation nozzle “fly-off” - nozzle forced back against operator vehicle running out of fuel - tank only partially filled injury whilst lifting / carrying nozzle assembly injury due to insecure footing whilst mounting nozzle nozzle leaking fuel from front end during refuelling and storage structural failure or damage to nozzle components

Wght (H)

Wght (E)

Table 7.4.3: Risks and their Weighting – Human (H), Environmental (E) Many of the risks shown in Table 7.4.3 can occur by a number of different ways ; i.e. by human error(s) in section 7.1, by a system abnormality in section 7.2, and by an undesirable event in section 7.3. For such a risk with multiple causes, the lowest weighting value i.e. the highest conceived impact and probability for each cause, must be employed as the final weight for that risk.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

20

8

Assessment of Risks

The purpose of this section is to assist in the control of risks and to suggest methods by which the target risk level or standard may be maintained. Identified Risks and their Ranking over-pressurisation of tank – tank rupture over-pressurisation/filling of tank – spillage of fuel from vent person struck with break-away valve or hose during a drive-away ruptured fuel delivery line (no break-away valve) – fuel spillage artificial pressurisation of engine fuel supply line high pressure fuel spurt from front of nozzle – eye and skin contact nozzle / hose assembly striking persons being passed by vehicle overfilling of tank – spillage of fuel from vent during transportation nozzle “fly-off” - nozzle forced back against operator vehicle running out of fuel - tank only partially filled injury whilst lifting / carrying nozzle assembly injury due to insecure footing whilst mounting nozzle nozzle leaking fuel from front end during refuelling and storage structural failure or damage to nozzle components

Rank (H)

Rank (E)

Table 8.1: List of Ranked Risks – Human (H), Environmental (E) There is the possibility of serious injury or death whilst using the equipment detailed in this report. The probability of such an event is greatly increased if the correct operating procedures are not followed. The most severe consequence of any risk is human death. The authors consider 3 key risks as having the biggest potential for a fatality or significant injury: •

•

•

nozzle “fly-off”: the event where a refuelling nozzle disengages from the receiver during refuelling. Higher flowrates and fluid pressures leave the potential for more rapid motion and thus higher impact of the nozzle and attached hose. The height of the nozzle will also determine the impact of the nozzle onto persons (or objects) below. E.g. the location of the fuel receiver on some large mining equipment is several metres from ground level. installing a break-away valve at extended heights: as recommended in [9], a breakaway valve should not be installed above eye-level. This is to ensure in the event of a drive-away that the free end of the valve – and the attached hose – will not fall onto a person in the vicinity of the valve. As such, the use of a break-away valve on a loading arm is not advisable due to; the extended installed height of the valve, the typical use of a swivel joint on the arm to which the valve is attached thus placing the valve in tension rather than the required “cantilever” action during a drive-away, and also the force required to cause the valve to separate would typically exceed the strength of the arm, thus negating the purpose of the valve. Due to the force required to cause the valve to separate (i.e. break-away), the fuel hose often acts as an elastic band by storing energy as it is stressed, and releasing the energy once the valve breaks away. Thus the free end of the valve (and hose) will often travel at high speed at break-away. Over-pressurisation and subsequent rupture of a fuel tank: any tank fitted with quick-fill equipment must be rated to a pressure in excess of the pressure sustained during the refuelling process. In addition, due to the “popular” practice of manually holding the nozzle ON until fuel is observed exhausting from the vent exhaust – to

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

21

assure the operator the tank is indeed full – the tank must be rated to a pressure in excess of the emergency relief pressure of the Banlaw tank vent(s) fitted, or an auxillary full-relief device if such a device is used. Such practice will greatly reduce the risk of tank rupture i.e. catastrophic failure of the tank structure. Although an incompressible fluid (such as diesel) does not store significant potential energy (unlike a compressed gas) the ullage (air gap) in the top of the tank – being air – will store energy. It is thus the amount of ullage and the pressure to which it is subjected that will increase the risk of severe human injury in the event of a tank rupture. This point could be best represented as a spring coiled within the tank. The greater the ullage, the larger the spring. The higher the pressure, the greater the spring is compressed. During tank rupture this energy is released. There is a reported case of a fatality as a result of a ruptured fuel tank during refuelling – using equipment similar to Banlaw product. Hence the need to control the risk of tank rupture is important. A number of the risks occur contrary to established correct procedure. Users must ensure that all operators are properly trained and educated on the process of refuelling, and should not become complacent by classing the task as “routine” or “one without substantial risk”. Many people tend to fall into the danger of considering the task as “too familiar” or second nature, and although the process of refuelling is not complex, there are hazards that may occur if simple checks and procedures are not carried out. Most risks would be eliminated if operators were informed of the principles of quick-fill refuelling and the correct operating procedure. Actions such as manually holding the nozzle in the ON position or removing the tank vent would thus become informed hazards.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

22

9

Risk Reduction and Control Measures

“Risk treatment is the selection and implementation of appropriate options for dealing with risk” [7]. On analysis of the risks identified and their root causes, the following key actions were identified to reduce both the probability and severity of their occurrence. Many risks have multiple causes, however control of all risks is best achieved by observing the following actions : 1. Ensure adequate training and education of all refuelling operators, on the principles of the Banlaw system, correct nozzle, vent and receiver operation, and the hazards associated with their misuse. Banlaw manufacture a printed steel sign that should be displayed at each refuelling point. 2. Discontinue use of damaged or misused equipment. Contact only an authorised Banlaw agent for prompt repair of Banlaw equipment. 3. Ensure each tank is tested and certified to a pressure representative of the vent(s) used on the tank - see section 9.1. All tanks should be regularly inspected for corrosion and other damage. Contact the tank manufacturer (OEM) for confirmation of the Safe Working Pressure (SWP) for a specific tank. 4. Promptly cease operation of equipment which is failing to operate correctly. Contact a Banlaw agent as soon as practicable should any fault be detected with Banlaw equipment and to arrange prompt replacement or repair. Equipment that is clearly worn or otherwise faulty should be promptly removed from service. 5. Cease or implement measures to discourage unauthorised modification of or tampering with refuelling equipment. Such activities may damage equipment or otherwise affect their proper operation 6. Install a Banlaw break-away valve to minimise both the risk of significant fuel spillage and damage to refuelling equipment in the event of a vehicle “drive-away”. 7. Ensure all refuelling equipment – including break-away valves – is installed correctly and properly maintained. Such information is contained in Technical Bulletins drafted by Banlaw for their equipment. Contact your Banlaw agent for further details. 8. Ensure familiarity with the safe working specifications – i.e. flowrate and pressure – of all Banlaw equipment used on-site. Refer to [8] for details, or contact your Banlaw agent for confirmation. 1. The proper training and education of all refuelling operators is imperative in the effective treatment of risks. Many risks occur as a result of ill-informed actions and poor judgement by operators. The principles of the Banlaw system (see section 2.1) should be common knowledge to an operator. Each person should be aware of the roles of each component - nozzle, vent, receiver, receiver cap, nozzle anchor, and break-away valve - and the implications of their misuse. Banlaw strongly recommend users display a sign - available from Banlaw - describing the correct stepwise operation of a nozzle. This will encourage proper procedure, and will provide instruction for untrained operators should it be required. The practice of manually holding the nozzle ON whilst refuelling poses a significant risk to safety, whether the act be one of operator ignorance or contempt for correct operating procedure. Educating each person on legitimate nozzle operation and the risks associated with misuse will deter such actions. 2. Another common error encountered is the continuing use of damaged equipment. Damage such as structural damage to the tank or refuelling parts must be corrected prior to any further use. It must be understood that some sites operate refuelling equipment at considerable fluid (fuel) pressure, and as such, the failure of such equipment must be treated as posing a significant risk to operator safety. Equipment that is damaged or otherwise not working correctly should be promptly removed from service and replaced. Banlaw have drafted a Preventative Maintenance Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

23

Program for their equipment, which states recommended change-out intervals for refuelling system components. Refer to [11] for details. 3. As most work-sites have a variety of vehicles and storage tanks, the improper combination of a nozzle and tank can occur. For instance, the use of a nozzle setup on a heavy (H), mediumheavy (MH), or medium (M) shut-off pressure setting typically requires tanks to be fitted with a standard series tank vent (110kPa relief pressure). A good example of this would be the use of a medium (or higher) setting nozzle for the refuelling of a small lighting plant or skid pump fitted with a “light” series vent (49kPa relief pressure), typically refuelled with a lighter setting nozzle. The use of a higher setting nozzle to refuel a tank setup to accept a lighter setting nozzle greatly increases the risk of tank overpressurisation and its associated risks. NOTE: there are exemptions to this recommendation, for instance if it can be proved that the maximum tank pressure at nozzle shut-off is <49kPa, then a light series vent may be used on that tank – contact Banlaw for further details. Conversely, if a light setting nozzle is used on a refuelling application typically undertaken with a higher setting nozzle e.g. medium, the nozzle will suffer from premature shut-off, thus leading to partial tank filling, and the need to manually hold the nozzle ON until the tank is filled. To ensure the correct combination of tank vents and refuelling nozzles, it is important that a competent person is involved in the selection of the refuelling equipment. Such persons include an authorised Banlaw distributor, or Banlaw Pipeline direct. Proper selection of vents and nozzles will minimise the risk of both tank overpressurisation and premature nozzle shut-off. To make the identification of vent relief settings easier, Banlaw recently introduced colour coding of all vent caps. The light series vents (49kPa) are fitted with a dark green cap, whilst the standard series vents (110kPa) are fitted with red caps. All tanks fitted with a quick-fill tank vent – such as the Banlaw vent – must be rated to a pressure in excess of the vent relief pressure. That is, the Safe Working Pressure (SWP) of a tank must be greater than the relief pressure of the vent fitted. The SWP of a tank should be obtained from the tank manufacturer (OEM). As stated later in section 9.1, the Banlaw tank vent is NOT a full pressure relief device for the range of flowrates for which it is rated – see Table 2.5.2. Thus, a dedicated full relief device rated to the required flowrate must be installed if the tank pressure is not to exceed the SWP of the tank. Such devices include burst discs and resettable spring biased relief valves. Refer to section 9.5 for information on the Banlaw FillSafe™ System – a system which terminates the refuelling process without the need for tank pressurisation. 4. Another example of improper use is the continuing operation of equipment that is clearly not functioning correctly. Such problems as premature nozzle shut-off, overfilling of the tank, nozzle failing to couple to receiver securely, and fuel exhausting from the vent can occur due to faulty equipment or an incorrectly specified installation. Other more minor problems such as fuel leakage from the nozzle or fuel receiver, indicate the part is worn and is due for replacement or a service. Any attempt to rectify a serious fault or malfunction must be performed by a competent person. All Banlaw equipment should be serviced by an authorised Banlaw repair agent. 5. Dry-break technology was introduced to; increase the rate of refuelling, allow refuelling from ground level, and to reduce the incidence of fuel spillage. Quick-fill equipment also makes the theft of fuel more difficult, due to its “dry-break” technology. This practice whilst made more difficult still occurs, and in some instances accounts for an unacceptable proportion of a user’s fuel costs. Common methods include a person forcing the receiver poppet or nozzle sleeve open with a screwdriver or similar object to drain fuel, or removing the tank vent in order to siphon the Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

24

tank contents. Both practices pose a threat to the welfare of the equipment, and hence the safety of the refuelling operation. Damage occurring to either part may jeopardise its proper function, whilst failing to reinstall the vent correctly may prevent an airtight seal forming within the tank during refuelling. Whilst pilferage of fuel is difficult to prevent, inspection of the nozzle, vent and receiver may indicate damage sustained as a result of fuel theft. Fuel theft is such a problem on some sites that it has prompted management to install surveillance cameras and user identification systems – such as key-tags – in an effort to reduce the volume of unaccounted fuel. To further decrease the ease by which valuable fuel can be stolen, Banlaw manufacture an electronic fuel monitoring system “FuelTrack™” which is used to account for every litre of fuel & oil dispensed. Theft can be prevented by installing “automatic identification” refuelling equipment and by enabling the “fuel security” option. This capability is only offered with the FuelTrack™ system – no other fuel monitoring/management system in the world provides such security. The system is available with 3 user/vehicle identification options; keypad, key-tag, or fully-automatic identification. Refer to section 9.6 for further details. 6. The high incidence of vehicle “drive-away” with the nozzle connected prompted Banlaw to design a break-away valve, to be installed at the start of the flexible hose section leading to the nozzle. This valve limits the damage sustained by becoming the structural weak-link in the fluid delivery line. Its function is to separate into halves under excessive shear load, providing a liquid tight seal in each half of the delivery line. Spillage of fuel and tank siphoning are prevented so long as the valve remains intact with the hose connected to the nozzle. With no break-away valve installed, the magnitude of both damage and spillage would be much greater in the event of a drive-away. To decrease the probability of an operator moving a vehicle whilst the nozzle remains connected, warning signs or strobe lights could be installed to remind operators to ensure the nozzle has been disconnected. Alternatively, the control of the warning lights could be via a limit switch installed on the nozzle anchor or storage point. Thus the status of the light is controlled by whether the nozzle is secured in its storage location, or located elsewhere i.e. connected to a vehicle. Refer to [9] for guidelines on the installation and maintenance of the Banlaw break-away valve. 7. Banlaw compose various Technical Bulletins and other publications to assist in the correct installation, operation, and maintenance of its equipment. Copies of such publications should be obtained from a Banlaw agent or from Banlaw direct – such information is also available from the Banlaw Pipeline website or from the Banlaw Pipeline promotional CD. End-users must ensure that such information is freely available to all persons responsible for the installation and maintenance of refuelling equipment. 8. Banlaw conducts extensive testing of its products to ensure each item operates safely and performs its proper function when used within the boundaries of its specification. Such boundaries include; safe working pressures, burst pressures, and maximum recommended flowrate. An end-user must ensure that all Banlaw equipment is used within these boundaries, and must understand that the risks associated with the use of any item outside the specification may have serious and unpredictable consequences. Such specifications are listed in [8], and will include installation guidelines detailed in the relevant Technical Bulletins.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

25

9.1

Liquid Storage Tank Pressure Certification

Detailed below are recommendations for the pressure testing and subsequent certification of flammable or combustible liquid storage tanks, which are commonly used with Banlaw refuelling equipment. These guidelines were established after consultation with the Standards Association of Australia (SAA), and Banlaw’s own investigation into relevant Standards and current practice. Unless specified in various laws, regulations or practices, Australian Standards are not mandatory but do reflect good safe practice which can be used as a guide for industry and any court action. Laws are generally changing from a prescriptive (detailed) to a performance basis, leaving details to the various parties and their suitable risk management. Users should check with their State or Territory authority to establish specific details. AS1692 “Tanks for Flammable and Combustible Liquids”, is the standard to which most existing non-pressurised liquid storage tanks were designed and tested. This standard is based on a maximum vapour space pressure of 35kPa, for both testing and working pressures, which places it below the conditions experienced using a typical quick-fill nozzle and tank vent. For working pressures below 50kPa, AS/NZS1200 - which covers AS1210 - will permit “good engineering practice” to be used for the design of liquid storage vessels. AS1210 “Pressure Vessels”, is applicable to liquid storage tanks subject to an internal pressure in excess of that stipulated by AS1692. Whilst it is intended to apply to internal pressures exceeding 50kPa, it may be used if desired as a design and manufacturing standard for applications below that value. It is a requirement of AS1210 that any tank subject to a pressure greater than 50kPa be designed and tested in accordance with its guidelines, and that any such tank is registered with authorities, e.g. Dept of Mineral Resources, WorkCover etc. Any tank designed under AS1210 would require a full relief device to be installed, limiting pressure to a maximum of 1.2 times the maximum allowable working pressure. According to SAA, the correct test pressure for a tank should be : (a) in accordance with AS1692 for tanks within its scope (b) at least 1.5 times the designers stated maximum allowable working pressure measured at the top of the tank (c) at least 2 times the expected maximum allowable working pressure, elected by a responsible person (d) greater than both the emergency relief pressure of the Banlaw tank vent, and the relief pressure of any full relief device installed (e) applied with extreme care if air is used as the test medium - e.g. in accordance with AS4037 “Pressure Equipment – Examination & Testing”. The expected maximum working pressure is the maximum pressure experienced in the tank during a normal filling operation, which should occur at the time of nozzle shut-down. To estimate this pressure within the top of the tank at shut-down, the following information is required to calculate the “pressure margin” i.e. the pressure required within the tank to initiate nozzle shut-off: •

obtain the shut-off pressure for the nozzle specific to the refuelling flowrate. This pressure is measured at the inlet to the nozzle swivel, and has been determined by Banlaw after exhaustive flow testing of the nozzle for each spring setting (shut-off

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

26

• •

•

pressure) available i.e. Light (L), Medium-Light (ML), Medium (M), Medium-Heavy (MH) and Heavy (H) the static fluid head present between the nozzle and the top of the tank. For every metre of static head (height) between the nozzle and top of the tank, the head pressure is approximately 8.25kPa (diesel @ S.G. 0.84). Thus 2m is equal to 16.5kPa, etc. the dynamic head loss developed between the inlet to the nozzle swivel and the fuel entry into the tank – an engineer or person with fluid mechanics knowledge will need to calculate this loss. This loss must include the head loss through the swivel, refuelling nozzle and fuel receiver. The remaining loss will be due to the losses through pipe, hose, bends, fittings, valves, sudden contractions, sudden enlargements, etc. the pressure margin (i.e. the tank pressure at nozzle shut-off) is therefore approximately equal to: pressure margin = (shut-off pressure) - (static head) – (dynamic head)

NOTE: all shut-off pressure and head loss data for the Banlaw refuelling nozzle is available in Appendix A.2. Alternatively a pressure gauge may be placed into the top of the tank, and the maximum pressure at nozzle shut-off is observed. Banlaw Pipeline technical staff can assist the end-user in determining the estimated maximum tank pressure, provided the end-user contact Banlaw direct and provide any information required by Banlaw to perform the calculations. Any modifications performed e.g. welding, additional fittings, must be done in accordance with the most recent design standard or code relevant to the tank. Such standards within Australia may include; AS1200 “Pressure Equipment”, AS1554.1 “Structural Steel Welding – welding of steel structures”, or AS/NZS3992 “Pressure Equipment – welding and brazing qualification”. Depending upon the application of the tank i.e. fixed storage, vehicle fuel tank, or transportable fuel pod, there may be other standards relevant to the tank construction and usage. In addition, tank bunding, signage, support structure, ventilation, testing procedures and storage location details remain the responsibility of the user. AS1940 “The Storage and Handling of Flammable and Combustible Liquids”, is one such standard which may be used for reference. There are “sitespecific” design codes and standards of practice which apply to mines i.e. Mine Design Guidelines, which may contain information on liquid storage tanks and their use. Site Engineers should be aware of any such regulations and hence be able to ascertain any reference to tanks or vessels likely to be associated with quick-fill refuelling. The Banlaw vent is not designed as a full pressure relief device. The emergency relief feature of the vent is designed as a partial relief device, to exhaust any excess vapour pressure from within the tank interior. Should a full relief device be required, then a suitable item must be installed. Such devices include burst discs and resettable poppet valves. Refer to Table 2.5.2 for Banlaw vent specifications. Tanks should be regularly inspected by a responsible person for damage, corrosion and other factors that may jeopardise their safe operation. Inspection intervals and other details will depend upon such factors as frequency of use, nature of liquid stored, and recommendations supplied by the tank manufacturer or contained in the design code or standard for the tank. Banlaw is not a tank manufacturer or supplier, and as such is not responsible for such details.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

27

IMPORTANT NOTE: Although the consequence of risks associated with quick-fill refuelling equipped tanks may be less than say a pressurised gas storage tank, unfortunately no specific standard applies to quick-fill equipped tanks. The consequence of risks is greatly reduced by the relatively low proportion of compressed vapour (air) in a tank, and the relatively low tank pressures involved that are sustained for only a relatively brief period of time. Granted, these factors do reduce the consequences of risks associated with tank rupture – compared to the broader scope of AS1210 – however the fact remains that all tanks subject to a working pressure >50kPa are required to comply with AS1210. The authors of this report therefore recommend that all tanks fitted with quick-fill equipment do comply with the relevant sections of all applicable Standards.

9.2

Correct Nozzle Operation

The nozzle is the main component of the refuelling operation. A safe working environment depends upon the use of a nozzle within the bounds of both technical specification and correct operating procedure. Refer to [8], [1], [2], [3], [4] and [5] for these details. The correct procedure for nozzle operation is as follows : 1. 2. 3. 4. 5. 6. 7.

remove receiver cap from receiver remove nozzle from anchor, or remove plug from front of nozzle check mating surfaces of nozzle and receiver are clean ensure nozzle is locked in the OFF position retract nozzle actuator fully towards rear of nozzle, then push nozzle onto receiver allow and ensure actuator returns to its fully forward “home” position pull back on nozzle and move slightly from side to side to ensure nozzle is firmly connected to the receiver, whilst actuator remains fully forward 8. once connected, fuel flow is activated by releasing the operating handle catch and rotating the handle into the ON position 9. the nozzle will automatically shut-off when additional fluid pressure is developed within the tank once the tank vent closes at tank full condition. If nozzle fails to remain on until vent closes, or fails to shut-off automatically after the vent closes, manually turn nozzle OFF and contact an authorised Banlaw agent. 10. AT NO STAGE SHOULD THE NOZZLE BE MANUALLY HELD IN THE ON POSITION. DO NOT ATTEMPT TO FORCE ADDITIONAL FUEL INTO TANK ONCE VENT HAS CLOSED AND NOZZLE HAS TURNED OFF. 11. once nozzle has shut-off, ensure operating handle is locked in the OFF position 12. nozzle may be removed from receiver with operating handle locked OFF, by pulling back with low force on nozzle whilst actuator is fully retracted 13. replace nozzle plug or return nozzle to anchor 14. replace receiver cap

The above operating guidelines are listed on the Banlaw Nozzle Operating Sign, available for purchase from a Banlaw agent or Banlaw direct.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

28

9.3

Specific Actions to Reduce Occurrence of High Probability & High Consequence Risks

High probability and high consequence risks are those risks assigned a rank of 1, 2, or 3 as per the risk ranking matrix detailed in Tables 7.4.1 and 7.4.2. The authors of this report cannot determine with any certainty specific risks that fall into this category. Competent persons employed by the end-user are responsible for the assessment of such risks and are therefore responsible for specific actions to reduce or eliminate the probability of such risks occurring for a particular site or refuelling installation. The authors of this report consider that if all control measures outlined in earlier clauses of section 9 are duly considered and implemented, then no risk associated with the activity of quick-fill refuelling using Banlaw equipment is deemed to be of “high probability and high consequence”. The following risks are typically found to be the most common and unfortunately potentially the most hazardous in quick-fill refuelling, and can thus be treated as high probability and high consequence risks: a) tank over-filling: • •

• •

nozzle spring setting too high – incorrect nozzle setting for tank and tank vents tank unable to properly pressurise once tank vent closes, thus leading to overfilling of the tank and the risk of tank overpressurisation prior to nozzle shut-off. Such causes include; faulty vent(s), leaks from tank or tank fittings, incorrect placement of the vent(s) within the tank, refuelling whilst the tank is on a relatively high gradient or incorrect vent model used for the subject tank (e.g. installing a standard length vent in a tank requiring a long series vent). manually holding the nozzle in the ON position – either by hand or by the attachment of weights or tie-down rope to the operating handle of the nozzle. Many operators do not believe the tank is full until such time as fuel is sighted exhausting from the tank vent a mechanical fault with the nozzle – nozzle requires a service by an authorised Banlaw repairer

b) premature nozzle shut-off: • • • • •

nozzle spring setting too low – incorrect setting for the tank and refuelling flowrate excessive restriction (pressure loss) within the refuelling line leading into the tank – such causes include a partially closed valve, the recent installation of a check valve (or similar fitting), or the recent replacement of hose or pipework with smaller diameter items recent change (increase or decrease) of the refuelling flowrate blockage of vent exhaust port – including the vent breather hose. Check all vents on the tank, if more than one fitted. any other factor which has changed the line pressure through the nozzle

Specific control measures have been identified in earlier clauses of section 9.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

29

9.4

Product Warranty and Disclaimer

All repairs, modifications, or upgrades to Banlaw Pipeline refuelling equipment must be performed by an authorised Banlaw Pipeline repair agent. Banlaw Pipeline Pty Ltd cannot warrant the use of its products if any repairs, modifications or upgrades have been performed by an unauthorised repairer. It is also outside the scope of this report for the assessment of risks associated with unauthorised repairs, modifications or otherwise tampering with Banlaw Pipeline refuelling equipment. The authors of this report are aware of persons conducting unauthorised repairs on Banlaw refuelling equipment, and are willing to assist them in the proper repair of the equipment upon request. However Banlaw Pipeline cannot offer any product warranty or guarantee of performance unless the equipment is repaired – or inspected – by an authorised repair agent. In addition, Banlaw Pipeline cannot offer any responsibility for actions or consequences as a result of unauthorised repairs. In summary, as a manufacturer and supplier of equipment, Banlaw Pipeline cannot accept any responsibility for the proper operation of its refuelling equipment if said equipment has been modified or repaired by an unauthorised repairer. As a manufacturer and supplier of equipment, Banlaw Pipeline is however obligated to assist an end-user by reasonable means to ensure the safe and proper use of its product. This may include the supply of repair guidelines to assist a person in the proper repair of the equipment, however as the licensed holder of Patent and other Intellectual Property rights for its equipment, Banlaw Pipeline reserves the right to refuse issue of such information to any person whom it considers a threat to such rights.

9.5

Banlaw “Zero Tank Pressure” Refuelling

Banlaw Pipeline manufacture a tank level sensing system, designed to be incorporated into existing quick-fill refuelling equipment (and other types of filling means). This system is called “FillSafe™”, and consists of up to 4 main components to detect tank “full” condition and promptly terminate the flow of fuel into the tank prior to any tank pressurisation. This system thus greatly reduces the probability of tank overpressurisation and overfilling. In the event of a fault with the System, the standard “pressurised” quick-fill system acts as a backup to terminate the refuelling process. The System comprises the following components: • • • •

a level sensor unit, mounted on the tank a “transmitter” unit – used to monitor the status of the level sensor, and transmit its status to the “receiver” unit. (Alternatively, the transmitter unit may be connected directly to the solenoid valve, thus bypassing the receiver unit.) a “receiver” unit – used to control the solenoid valve (or pump control relay), in response to the status message from the “transmitter” unit solenoid valve (optional) – used to physically control the flow of fuel into the tank. The valve is optional, as the receiver unit can be set up to control the refuelling pump control relay

The FillSafe™ System offers significant advantages over similar systems on the market: • • • •

cost effective to purchase and install relatively maintenance free robust components, built to withstand the often harsh operating environments completely compatible with existing quick-fill refuelling equipment

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

30

• • •

operates as the primary means of detecting tank “full” condition, whilst the standard (existing) quick-fill system remains as a back-up once the System detects the tank is full, no additional fuel can enter the tank – regardless of whether the refuelling nozzle is manually held ON. may be used for any refuelling flowrate

From a risk reduction and control perspective, the installation of the FillSafe™ System brings obvious benefits in the control of tank overpressurisation and overfilling – two key risks identified in this report.

9.6

Fuel Monitoring and Accountability

Banlaw Pipeline have designed and developed an electronic fuel monitoring system called “FuelTrack™”. This system is capable of providing accountability for every litre of fuel & oil delivered to site. The System monitors both the amount of fuel/oil used, in addition to where the fuel/oil is used i.e. what vehicle the liquid is dispensed into. The System is available with 3 methods of identifying a vehicle; manual keypad entry, electronic “Smart-Key”, and fully automatic identification. The System is modular, allowing the end-user to customise the System to suit their individual requirements. In terms of the objectives of this report, the FuelTrack™ System offers one key risk control feature – accountability of fuel. The System will detect any loss of fuel from pipelines, storage tanks and other means of transporting or storing fuel. Such a feature brings obvious benefits in the endeavour to detect and minimise environmental contamination. Leaks in underground pipework can often go unnoticed for extended periods of time, by which stage a large amount of fuel has already contaminated the environment.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

31

10

Risk Monitoring and Review

A program designed to monitor the occurrence of risks should be incorporated into any workplace. Accident or near miss reporting protocol should apply to all facets of refuelling. Such events must be investigated, regardless of their apparent severity, and safeguards instigated should they be required. Any damage sustained to equipment must be promptly reported for immediate attention. The extent and severity of any damage must be thoroughly investigated by a suitably qualified person, and the appropriate action enforced. A record of all accidents, near misses, or equipment damage must be kept for the purposes of future reference. A risk monitoring program should incorporate an incident report recording such information as: • date, time, and location • nature of the incident • identity and number of people affected • nature and severity of injury • identity and type of machinery involved • extent of damage detected • outcome / results of the investigation • further action i.e. recommendations and safeguards • details of persons involved in the investigation Such records will allow an assessment of incidents that have occurred, providing valuable insight into the effectiveness of current risk management procedures. Regular reviews of incident records will highlight areas in need of improvement i.e. worker training and education, improved equipment maintenance, improved safeguards etc. Risk management should be both proactive and reactive. The ability to foresee the occurrence of hazards by both the analysis of historical records and effective risk identification establishes a proactive approach, whilst the derivation and implementation of effective risk monitoring and review strategies maintains a reactive and flexible management program. To establish a practical risk management program for the equipment featured in this report, the following details should be observed: • any damage or malfunction to Banlaw Pipeline refuelling equipment likely to affect its proper operation must be repaired promptly by an authorised Banlaw repair agent • to assist all end-users in effective risk management, any high level risks that occur should be reported to Banlaw Pipeline. The details of such events will be assessed and this report revised where necessary • all risk control measures discussed in section 9 must be considered when implementing a workplace risk management strategy • all risk management tasks created by this report should be incorporated into other existing and future risk management programs • risk management should be incorporated into other management activities i.e. operations management • a risk monitoring program be established to ensure all incidents are reported, addressed and acted upon by qualified personnel • existing and future risk review programs should be structured to best suit the findings of the risk monitoring program • risk management strategies should be regularly updated to incorporate the recommendations of the risk review program

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

32

11

References

[1]

Banlaw Pipeline Technical Publication: “800LPM System Schematic”

[2]

Banlaw Pipeline Technical Bulletin: “800LPM System Installation Guidelines”

[3]

Banlaw Pipeline Technical Bulletin: “Nozzle Shut-off Mechanism”

[4]

Banlaw Pipeline Technical Publication: “1000LPM System Schematic”

[5]

Banlaw Pipeline Technical Bulletin: “1000LPM System Installation Guidelines”

[6]

Banlaw Pipeline Technical Bulletin: “Quick-Fill Tank Vents”

[7]

NSW Dept Of Mineral Resources: “Risk Management Handbook for the Mining Industry - MDG1010”, May 1997

[8]

Banlaw Pipeline Technical Publication: “Hydrostatic Pressure & Flowrate Test Results”

[9]

Banlaw Pipeline Technical Bulletin – “Break-away Valves”

[10]

WorkCover Authority of NSW: “HAZPAK”, issue received June 1999

[11]

Banlaw Pipeline Technical Publication: “Preventative Maintenance Program for QuickFill Refuelling Equipment”

[12]

NSW Occupational Health and Safety Act 2002

[13]

NSW Dept Of Mineral Resources: “Guide to Reviewing a Risk Assessment of Mine Equipment and Operations - MDG1014”, July 1997

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

33

APPENDIX A.1

Adjustable Refuelling Nozzle

This section provides information specific to the adjustable piston spring retainer facility currently used in the 45 series Banlaw adjustable nozzles. The ability to calibrate the shut-off pressure of a refuelling nozzle to a particular application provides the opportunity to minimize tank pressurization at nozzle shut-off. As all refuelling applications are unique, differences in line pressure and flow-rate can be accounted for when calibrating a nozzle on-site. The principles of operation of the adjustable nozzle are identical to those of a conventional unit. The operating procedure remains the same as that mentioned in Section 9.2.

Figure 2.4.1 - 45 Nozzle To limit the amount of fine tuning required on-site, details of the nozzle installation are requested by Banlaw prior to factory testing and shipment. These details will enable Banlaw to test and subsequently set-up the nozzle to those conditions which the customer has supplied, including: • • •

flow-rate required maximum working or limiting pressure of the tank tank and delivery line layout i.e. magnitude of static head, bore of pipe/hose, nature of delivery line “geometry”

If no such details are supplied, Banlaw chooses test conditions which it perceives the nozzle would typically encounter during normal service. Frequent on-site adjustment of the nozzle should not be required and is not recommended. A single nozzle should not be used for a diverse range of refuelling conditions, requiring frequent Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

I

retainer adjustment. The application of the adjustable nozzle remains the same as a conventional non-adjustable model, such that a single nozzle should only be used for refuelling applications with similar delivery head and flow-rate requirements. The adjustment facility of the nozzle is not designed for frequent or repeated adjustment, but instead to allow fine tuning of a nozzle for a number of similar refuelling tasks. Frequent retainer adjustment will create a greater probability of risks associated with premature nozzle shut-off, over-pressurisation of tanks, and/or fuel exhausting from tank vent. Fine tuning of the nozzle shut-off pressure can be undertaken on-site by a competent person i.e. fitter or engineer, by following these guidelines. Note that adjustment is easier with the nozzle in the ON position, however adjustment should never be made whilst refuelling. Turn the supply pump OFF, or disconnect the nozzle from the receiver during adjustment. - 45 Nozzle Model 1. remove threaded inspection plug from rear of nozzle 2. visual inspection of the end cap interior will identify the rear side of the piston, piston spring, spring retainer, and operating handle links. The retainer is the threaded annular member supporting the spring force applied to the piston. Holes are present on the rear side of the retainer to assist in adjustment. 3. the position of the retainer may be varied by its rotation with respect to the end cap Moving the retainer towards the front of the nozzle i.e. clockwise rotation, will increase the force applied to the spring and hence raise the shut-down pressure of the nozzle. Conversely, the spring force and hence shut-off pressure is decreased by moving the retainer towards the rear of the nozzle by anti-clockwise rotation. 4. only subtle variations in retainer position are required for fine tuning the shut-down pressure of the nozzle. Large increments of retainer adjustment towards the front of the nozzle should be avoided unless dramatic increases in shut-off pressure are required. Be aware of such risks as tank rupture and fuel exhausting from the vent should the shut-off pressure be set too high. 5. the optimum shut-off pressure for all refuelling nozzles is that level obtained shortly after the tank vent has closed at tank full condition. This level is also governed by the nozzle just remaining in the ON position during refuelling at the required flow-rate shortly prior to the tank becoming full. To ensure the nozzle remains on whilst refuelling similar equipment, a low “safety margin” should be used to ensure the nozzle remains on despite subtle differences in delivery head demands, such as variations in flow-rate and intrinsic differences in similar machinery and storage tanks. This safety margin will ensure the nozzle remains on for all the required refuelling applications. 6. once adjustment is complete, the cover plug must be re-installed and secured with Loctite, if deemed necessary, to discourage tampering and unauthorised adjustment NOTE : As with all refuelling nozzles, the shut-off pressure must be maintained at a level such that both the tank vent emergency relief pressure and the maximum recommended tank working pressure are not exceeded.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

II

A.2

Nozzle Performance Specifications

Following are the results of testing conducted by Banlaw on their refuelling nozzle models : • BAM800 Refuelling Nozzle – using the AUS21A029 Back Spring - Shut-off pressure settings Light (L), Medium-Light (ML), and Medium (M) • BAM800 Refuelling Nozzle – using the AUS21A027 Back Spring - Shut-off pressure settings Medium-Heavy (MH), and Heavy (H) • BAM1000 Refuelling Nozzle – using the AUS21A029 Back Spring - Shut-off pressure settings Medium-Light (ML), and Medium (M) • BAM1000 Refuelling Nozzle – using the AUS21A027 Back Spring - Shut-off pressure settings Medium-Heavy (MH), and Heavy (H) NOTE: All flow testing was conducted in the Banlaw Pipeline factory using diesel fuel as the test medium.

Generic Refuelling Nozzle Risk Assessment Rev. 3 2003

III