Safety in LPG loading and unloading rests on two questions: which conditions must be met before transfer may start, and when something goes wrong, how fast and at which points must liquid and vapor flow be cut off? Safety interlocks, the permissive chain, answer the first: until grounding, vehicle and arm position and correct connection are confirmed, the pump or compressor will not run. The emergency shutdown (ESD) system answers the second: it closes the emergency shutoff valves near the tanker connection, stops the pump and compressor and records the event. Which functions are designed to which level of reliability is decided on each project through risk assessment.
These layers matter in LPG service because the product is a liquid under pressure: even a small leak vaporizes rapidly on release and can spread close to the ground as a heavier-than-air gas cloud. Hazards specific to cryogenic LNG transfer, such as cold surfaces and low temperatures, are covered on a separate page; this page addresses pressurized LPG transfer at ambient temperature.
Safety layers: tanker, transfer point and plant
Safety equipment at an LPG transfer point sits in three areas of ownership, and the interfaces between them need to be clearly defined:
· Tanker equipment: Valves and fittings needed for safe filling, transport and discharge of LPG road tankers are defined in a separate standard. The tanker's internal valves and their closing arrangement belong to the tanker; how the terminal interacts with them should be settled at project start.
· Transfer point equipment: Hose or arm, breakaway coupling, emergency shutoff valves on liquid and vapor lines, thermal relief valves, ground verification and local emergency stop buttons.
· Plant systems: Gas detection, fire detection, the site-wide ESD and shutoff valves on storage vessel outlets complete the protection of the transfer point.
The permissive chain: what is confirmed before transfer
In a permissive chain, each condition is confirmed by a signal, and the loss of any one stops the transfer. Typical permissives:
Permissive | What it prevents | Design decision |
Tanker grounding confirmed | Ignition from static charge accumulation | Whether clamp contact alone or a verified connection to the tanker body is monitored |
Vehicle in position and immobilized | Tanker moving while hoses are connected | Position detection method and vehicle-side interlock interface |
Arm or hose connected and not parked | Flow starting before the connection is complete | Location of position switches and arm parking sensors |
Tanker fill limit | Exceeding the permitted fill level of the tanker | Whether a fixed level gauge, meter preset or weighing is used |
Operator present | Transfer continuing unattended | Whether a periodic acknowledgment such as a deadman button is required |
ESD system healthy | Transfer with a faulty safety circuit | ESD valve position feedback and circuit monitoring |
LPG containers are never filled completely, so that the liquid has room to expand as temperature rises; the maximum permitted filling is set by regulation. The fill limit is therefore an integral part of the permissive chain in LPG loading. Which gauge or measurement it relies on is covered on the LPG Truck Loading Systems page. Having an attendant stay close to the connection throughout the transfer is also an operating requirement in many regulations.
Emergency shutdown: triggers and actions
ESD triggers include local and remote emergency stop buttons, high-level gas detection alarms, fire detection, loss of a permissive signal, abnormal pressure and a site-wide ESD command. A typical sequence after a trip:
1. Stop the pump or compressor
2. Close emergency shutoff valves on the liquid and vapor lines
3. Where defined, send a signal to close storage outlet valves and the tanker's internal valves
4. Log the event with the initiating signal and time
5. Keep the system locked out until the cause is cleared and an authorized person deliberately resets it
Valve closing time is chosen as a balance between avoiding pressure surges in the line and limiting the amount released. After an emergency shutdown, liquid LPG trapped between two closed valves builds pressure as it warms, so those sections must be protected by thermal relief valves.
Breakaway couplings and where shutoff valves go
A tanker driving away with the connection still made is one of the most serious LPG transfer scenarios. A breakaway coupling separates at a defined pull force, closes both sides and prevents the hose or arm from rupturing; it is assessed separately for the liquid and vapor lines. Emergency shutoff valves are placed close to the hose connection on the liquid line and can be closed remotely; some regulations explicitly require a remotely closable shutoff valve, or a backflow or excess-flow valve, at that point. The closer the valve is to the connection, the less product can escape after a rupture or leak.
How gas detection ties into ESD
Because LPG vapor is heavier than air, gas detectors are placed at low points where a leak could collect and near the transfer point. The number and layout of detectors follow from the hazardous area classification and likely leak sources. Detection logic commonly uses two stages: a first-level alarm that warns the operator and a second level that triggers automatic ESD. Voting among several detectors reduces spurious trips caused by a single faulty detector. Alarm levels and voting are project-specific and set together with the risk assessment. The protection method for electrical equipment at the transfer point is chosen from the same classification, and individual device certificates do not remove the need to assess the combined package as a whole.
How the safety integrity level (SIL) is determined
Not every safety function has to be designed to a particular safety integrity level (SIL). Whether a function is treated as a safety instrumented function, and at what level, is derived from risk assessment within the lifecycle defined by functional safety standards for the process industry. The same function can end up at different levels at two different terminals. There is therefore no general rule that an LPG ESD system must meet a given SIL; the outcome depends on layout, inventory, frequency of operation and other layers of protection. Periodic function tests and valve stroke tests after commissioning are part of the same lifecycle.
How TLY Enerji contributes
TLY Enerji provides design, procurement and engineering services for LPG truck loading and unloading stations, and its product range includes flame and gas detectors, pressure instruments and industrial valves. Depending on project scope, support can cover selection and supply of emergency shutoff valves, gas detection and permissive devices, configuration of PLC-based interlock logic, and installation, testing and commissioning. SIL targets for safety functions come from the owner's risk assessment, and the design follows that input.
Inputs needed for the safety design
· Plant risk assessment or HAZOP outputs, with any SIL targets already set
· Hazardous area classification and gas detector layout study
· Site-wide ESD architecture and the transfer point's place in it
· Internal valve and connection details for the tanker types served
· How the tanker fill limit will be controlled
· Operator working arrangements and the national LPG installation regulations that apply
Related pages
· LPG truck loading systems: Fill limits and how the loaded quantity is determined.
· LPG loading and unloading skids: Integrating safety equipment into the pre-assembled package.
· Cryogenic ESD and safety systems: Safety layers specific to low-temperature LNG transfer.
· Grounding and overfill prevention systems: Detail on ground verification and overfill permissives.
· LPG vapor return systems: Bringing the vapor line within emergency shutoff coverage.
Questions on LPG ESD and interlocks
What is the difference between an interlock and an emergency shutdown?
An interlock checks the conditions needed for transfer to start and continue: if a signal such as grounding, vehicle or arm position or the fill limit is missing, the pump will not start or will stop. An emergency shutdown acts on an abnormal situation by closing valves, stopping equipment and keeping the system locked out until a deliberate reset. Both can live in the same control system, but their functions and reliability requirements are assessed separately.
Is a particular SIL mandatory for an LPG ESD system?
There is no general mandatory level. Whether a function is designed as a safety instrumented function, and what level it needs, is set by a site-specific risk assessment. Inventory, layout, frequency of operation and other protection layers all change the result. National regulations or the operator's corporate standards may add further requirements.
Why should the emergency shutoff valve be close to the tanker connection?
The amount of product that can escape after a hose rupture or connection leak depends on the line volume between the leak point and the nearest closed valve. The closer the valve is to the connection, the smaller that volume. That is why many regulations call for a remotely closable valve near the hose connection on the liquid line, and the vapor line is assessed on the same logic.
Should transfer stop immediately on a gas alarm?
A two-stage approach is common: an alarm and operator warning at the lower level, automatic emergency shutdown at the higher level. Voting across several detectors prevents a single faulty detector from causing unnecessary trips. Alarm levels, detector layout and voting are set according to the site's risk assessment.
How is the system restarted after an ESD?
After an ESD trip the system stays locked out until the cause has been identified and cleared. Reset is a deliberate action by an authorized person, and automatic restart is generally not wanted. Before reset, the condition of liquid trapped between closed valves, the integrity of connections and the return of gas detection to normal readings should be checked.