Overfilling of a “vessel” can generally occur in one of two ways:
a. A liquid pressure source capable of exceeding the design pressure of the vessel is present, and a mechanism exists to block the liquid outlet.
b. A liquid pressure source capable of exceeding the design pressure of the item is present, and the liquid inlet flow rate can exceed the maximum outlet flow rate. In this case, a mechanism for blocking the liquid outlet is not required to make overfilling a credible causes of overpressure.
Common examples of the overfilling contingency are accidental overfilling of a storage vessel (either a pressure vessel or a low-pressure tank) due to operator error or level-control failure, and overfilling of certain process vessels (separators, surge tanks, and reflux accumulators) due to level control failure, outlet pump failure, or an increase in inlet flow rate.
Consideration should be given to the probability of the vessel being overfilled. For example, if the liquid inlet flow rate is small relative to the vessel size and a high level alarm or shutdown is present, the potential for the vessel to be overfilled is significantly reduced. API 521 recommends an assumption of a typical operator response time of 20 minutes. Therefore if a mechanism exists to alert the operator (LAH, etc.), and the inlet flow rate is small enough that vessel will not overfill within 20 minutes of the alert, then overfilling may not be considered a credible causes of overpressure. However, shutdown systems alone that are designed to prevent overfilling are generally not considered adequate to prevent the contingency. In any case, the rationale for excluding overfilling as a potential contingency should be documented.