the complete guide to api 2350 - · pdf filethe complete guide to api 2350. 2 content 03. an...

The Complete Guide to

API 2350

2

Content

03. AnIntroductiontoAPI2350

07. MotivatingRobustOverfillProtection

10. ImplementationofAPI2350

13. OperatingParameters

19. EquipmentandOperations

20. AutomatedOverfillPreventionSystem(AOPS)

22. SummaryandConclusions

23. Appendix

A. EquipmentSolutions

B. API2350ComplianceChecklist

C. FrequentlyAskedQuestions

D. AbouttheAuthor

3

AnIntroductiontoAPI2350

Tankoverfillsareamajorconcerntothepetroleumindustry.Inthebestcase,youhavetocleanitup.Intheworstcase,yougooutofbusiness,andendupincourt.Asaresponsetothis,theindustryhasworkedjointlytocreateanewAPI/ANSIStandard2350Edition4:“OverfillProtectionforStorageTanksinPetroleumFacilities”.Thisnewstandardisadescriptionoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.

API2350wascreatedbytheindustryfortheindustrywithcontributionsfromawiderangeofindustryrepresentativesincluding:tankownersandoperators,transporters,manufacturers,andsafetyexperts.Thistogetherwiththefactthatitsinglesoutaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks)andaspecificuse-case(overfillprevention)makethisstandardunique.Anditdoesnotcompetewithothermoregenericsafetystandards,butisintendedtocomplimentthem.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isoneexampleofhowtofulfillsomeoftherequirementsinAPI2350.

Theindustryadoptionratetothisstandardisexpectedtobeveryhighbecauseoftheobviousbenefits,combinedwiththeworld’sever-increasingneedformoresafety.ThequestionforatankowneroroperatoriswhethertheycanaffordnottoimplementAPI2350.Andbecauseofthestandard’sgenericnature,itisexpectedtobealsoappliedtonearbytanksoutsidethestandard’sspecificscope,containing,forexample,chemicalsorClass31petroleumliquids.

Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Itisintendedtobeequallyvalidandapplicableworldwide.

Thisguidewillprovidethebasicelementsforapetroleumtankowner/operatortoapplyAPI2350toneworexistingtankfacilitieswithminimaleffortandmaximalgains.Youshouldreaditbecausethisnewstandardisexpectedtobecomeagame-changer,andbyreadingityoucanbenefitfromapplyingthelatestbestpracticesforoverfillprevention.ThestandarditselfisavailableforasmallfeefromAPI’swebsite(www.api.org).

1 NFPANationalFireProtectionAssociation.Class1liquidhasaflashpointbelow100°F.Class2liquidhasaflashpointatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.

4

PurposeThetargetaudienceforthisdocumentisownersandoperatorsoffueldistributionterminals,refineries,chemicalplantsandanyotherfacilitieswhichreceivepetroleumorchemicalproductsintostorage.ThekeyindustrychangerelatedtotankoverfillsthisyearisthepublicationofanewversionofAPI2350“OverfillProtectionforStorageTanksinPetroleumFacilities”,the4theditionpublishedinMay2012.ThegoalisthentounderstandwhichchangeshaveemergedinthisnewstandardandhowtoapplythemforthepurposeofadoptionandcompliancewithAPI2350.Anyoneresponsibleforsafeoperationsatfuelmarketing,distributionterminals,refineries,oilhandling,orpipelinecompaniesshouldtakeadvantageofthestateoftheartintankoverfillpreventionasdiscussedinthisguide.WhilethescopeofAPI2350appliestothefillingofpetroleum-basedproductsassociatedwithmarketing,refining,pipelineandterminalfacilities,itsprinciplesmaybeappliedtoanytankoperationwherethereisariskofoverfillingthetank.

MostapplicationsunderAPI2350involveatmosphericorslightlypressurizedtanks,buttheprinciplesofAPI2350canbeusedforhigherpressurestorageaswell.ThescopeofAPI2350appliestooverfillprotectionforNFPA2Class1andClass2liquidsandrecommendscomplianceforClass3liquids.The“ScopeofAPI2350”(seebelow)presentsamoredetailedbreakdown.Forflammableliquidsclassifiedbyfirecodes(calledClass1liquids)API2350canmitigatethelikelihoodofspillingthesehazardousproductsandthelikelyresultingfacilityfire.Sincespillsofnon-volatileorganicliquidssuchaslubeoilsorheavyasphalticproductsareoftenconsideredanenvironmentalhazard,overfillsoftheseproductsarealsoaddressedbythenewAPI2350.

2 NFPANationalFireProtectionAssociation.Class1liquidhasaflashpointbelow100°F.Class2liquidhasaflashpointatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.

Scope of API 2350 (4th Edition)

API2350appliestopetroleumstoragetanksassociatedwithmarketing,refining,pipeline,

terminalsandsimilarfacilitiescontainingClassIorClassIIpetroleumliquids.API2350

recommendsincludingClassIIIliquids.

API 2350 does not apply to:• Undergroundstoragetanks

• Abovegroundtanksof1320USgallons(5000liters)orless

• AbovegroundtankswhichcomplywithPEI600

• Tanks(processtanksorsimilarflowthroughtanks)thatareintegraltoaprocess.

• Tankscontainingnon-petroleumliquids

• TanksstoringLPGandLNG

• TanksatServiceStations

• Loadingordeliveryfromwheeledvehicles(suchastanktrucksorrailroadtankcars)

PEIRP600RecommendedPracticesforOverfillPreventionforShop-Fabricated

AbovegroundTanksforoverfillprotectionwhereapplicableforabovegroundtanksfalling

outsidethescopeofAPI2350.

5

Fourth generation of API 2350ThecurrentAPI23503(4theditionpublishedMay2012)appliestofillingtankswithpetroleum-basedproductsforthepurposeofpreventingoverfills.Embracingradicalchangescomparedtopreviousversions,thisnewstandarddeservesaclosereview.Also,betweenthelasteditionandthecurrentedition,importantnewsafetystandardsthatapplydirectlytotankoperationshavebeenintroducedintothepublicdomain.ThecurrenteditionofAPI2350buildsonbestpracticesfromboththepetroleumindustryandfromotherindustriesandappliesthemdirectlytotankoverfillprotection.AnexampleofamajorchangeintroducedbythenewversionofAPI2350istherequirementforasafetymanagementsystem.Asaresultofthesweepingchangestothisstandard,understandingandusingitwillrequiresomepatienceandguidance.

AkeyandinfluentialeventthatshapedthecurrenteditionofAPI2350wastheBuncefieldconflagrationarisingfromapetroleumtankoverfillattheHertsfordshireOilStorageTerminal(HOSL)nearHeathrowAirport.OnDecember11th2005,thefireengulfed20tanksresultinginthetotaldestructionoftheterminalandnearbyfacilities.ThisfirewastheworstinEuropesinceWorldWarII.TheBuncefieldincidentwasalsooneofthemostintenselystudiedtankoverfilleventsofalltime.Fortunately,thelessonslearnedfromthisincidenthavebeencapturedbytheUnitedKingdom’sHSE4inreports5coveringthisincident.

API2350representstoday’sminimumbestpracticessotankownersandoperatorscannowprepareforwhatwillundoubtedlybethebenchmarkforgenerallyrecognizedgoodpracticeinthepetroleumstoragebusiness.

Learning from past experiencesThefollowingquotefromtheUnitedKingdom’sHealthSafetyExecutiveBuncefieldinvestigationshowsunsurprisingly,thatfaultsinmanagementsystemsareakeyrootcauseoftankoverfillincidents.

“Management systems in place at HOSL relating to tank filling were both deficient and

not properly followed, despite the fact that the systems were independently audited.

Pressures on staff had been increasing before the incident. The site was fed by three pipelines,

two of which control room staff had little control over in terms of flow rates and timing of

receipt. This meant that staff did not have sufficient information easily available to them to

manage precisely the storage of incoming fuel.

Throughput had increased at the site. This put more pressure on site management and staff

and further degraded their ability to monitor the receipt and storage of fuel. The pressure on staff

was made worse by a lack of engineering support from Head Office.”

Unfortunately,thescenariosdescribedaboveleadingtothisincidentarealltoocommon.Butfortunately,theAPICommitteedevelopingthenewAPI23504thedition,fullyintegratedthelessonslearnedfromBuncefieldaswellasotherincidentsandcombinedthemwiththebestpracticesfortankfillingoperationsfromeverysectorofthepetroleumindustry.Infact,theUnitedKingdom’sHSEwasoneofthecommitteememberstoensurethatalllessonslearnedfromBuncefieldwerecapturedinthe4theditionofAPI2350.

3 OverfillProtectionforStorageTanksinPetroleumFacilities,ANSI/APIStandard2350-2012,FourthEdition,May20124 HSEHealthSafetyExecutiveisagovernmentalsafetyagencyintheUnitedKingdomresponsibleforpublicandworkerhealthandsafety5 http://www.buncefieldinvestigation.gov.uk/reports/index.htm

6

TheAPIcommitteeisaconsensus-basedstandardsdevelopmentorganizationandthecurrenteditionofAPI2350ensuresaworldwideperspectiveontankoverfillprotection.Theworldwidebestpracticesfrominternationalcountries,regulatoryagenciesandcompanieshavebeenstudiedandcompiledintotheneweditionofAPI2350.

7

Reducing liabilitiesClearly,thepreventionofoverfillsisasignificant,andobviousbenefit,totankowners/operators.Alltankowners/operatorsknowthatprotectionofpublicandworkerhealthandsafety,theenvironment,andassetsareimportant.Butwhatmaynotbesoobvioustothemisthatthebenefitsthatcanresultbyapplyingthelatestthinkingrelatedtotankoverfills.ThenewmanagementsystempracticesencouragedbyAPI2350mayactuallyimprovethenormalday-to-dayoperationsandefficiencyforafacility.

ThepreviouseditionsofAPI2350canbeconsideredalistofthegoodequipmentandoperatingpracticesthatareneededtopreventoverfills.Indeed,suchlistshavevalue,buteliminatingthetankoverfillrequiresmuchmorethanjusttheuseofsuchlists.Eliminatingoverfillsrequiresaformalandcomprehensivesafetymanagementsystem.

Tankoverfillsarerelativelyrareeventssowhyaretheserareeventsofconcern?Thereasonisthattheconsequencesofoverfillscanexceedmost,ifnotallotherpotentialscenariosatapetroleumfacility.Whilerare,seriousincidentsusuallyyieldriskstothetankowners/operatorsthataredeemedunacceptable.Thefactthattheremaybepropertydamageandinjuriesorfatalitiesisonlythebeginningoftheaccidentscenario.LiabilitiesofvariouskindscangoonforpagesasareviewoftheBuncefieldincidentreportsshows.InsomecasesbeingforcedoutofbusinessistheendresultasinthecaseofCaribbeanPetroleuminthePuertoRico(October23,2009)incident.

Other benefitsInadditiontoreducingliabilities,therearebenefitsimpactingoverallfacilityoperationalefficiencyandreliabilityasmentionedabove.SinceAPI2350usesthelatestprinciplesofmanagementsystems,operationalimprovementsingeneralmayresultfrom:

• Simplifiedandclarifiedresponsetoalarms• Moreusabletankcapacity(explainedlater)• GeneralizedunderstandinganduseoftheManagementofChange(MOC)process• Operatortrainingandqualification• Inspection,maintenanceandtesting• Proceduresfornormalandabnormalconditions• Lessonslearnedusedtoevolvebetteroperational,maintenanceandfacilitypractices

MotivatingRobustOverfillProtection

8

Major components of API 2350 (past and present)ThekeyelementsofAPI2350maybeconsideredtocomprisethefollowingelements:

• ManagementSystem(OverfillPreventionProcessorOPP)• RiskAssessmentsystem• OperatingParameters – LevelsofConcern(LOCs)andAlarms – Categories – Responsetime – Attendance• Procedures• EquipmentSystems

Thefirsttwoelementsaremajoradditionsthatwereabsentinpreviouseditions.API2350definestheManagementSystemtobetheOverfillPreventionProcess(OPP).Inotherwords,whenyoureadorhearthetermOPP,justthinkofthemanagementsystemconcept.

Next,OperatingParameterswasatermcoinedtodesignatethetankspecificdatarequiredtousethestandard.TheseincludetheLevelsofConcern(LOCs)valueofimportantliquidlevelssuchasCriticalHigh(CH),HighHighTank(HH)andMaximumWorkingLevel(MW).AlsoincludedaretheCategoriesofoverfillprotectionsystemswhicharedesignatedbythetypeandconfigurationofequipmentbeingusedforoverfillprotection.AnotheroperatingparameteraretheResponseTime(RT)andAttendance.Alloftheseoperatingparametersarealldiscussedindetaillater.TheyshouldbethoughtofasthedataabouttankfacilitiesrequiredtouseAPI2350efficiently.

Theproceduresandequipmentsystemelementsaresimilartopasteditionsandwereupdatedtoreflectthechangesaboveaswellastoapplysomeimprovementsoverpasteditions.

Finally,perhapstheleastappliedbutbiggestchangeistheadoptionofguidanceapplicabletoSafetyInstrumentedSystemswhichcanautomatetheterminationofareceiptintheeventthattheHHLOCisexceeded.Suchsystemsaresometimescalled“automatedsafetyshutdownsystems”or“safetyinstrumentedsystems”,butinAPI2350thesearecalled“AutomatedOverfillProtectionSystems(AOPS)”.

Management systemsAManagementSystemallowsanorganizationtomanageitsprocesses,oractivities,sothatitsproductsorservicesmeettheobjectivesithassetforitself.Theobjectivescanvaryfromsatisfyingthecustomer’squalityrequirements,tocomplyingwithregulations,ortomeetingenvironmentalobjectivesandsuchasystemoftenhasmultipleobjectives.Manycompaniesusemanagementsystemstoreducesafety,healthandenvironmentalincidentstoaslowarateaspossible,giventhestateoftheartforbusinessoperationsbestpracticestoday.

ManagementsystemsareattheheartoftheneweditionofAPI2350.API2350linesupwiththecurrentindustrythinkingbyrequiringtheapplicationoftheOverfillPreventionProcess(OPP).OPPisthepeopleandequipmentassociatedwithtankfillingoperationstomaintainanoptimallytunedsystemforhighperformancewithoutoverfills.TheinclusionofOPPissignificantinthatthestandard

9

isnolongerjusttalkingabouthowtodesign,operateandmaintainsuchsystems,butistalkingabouthowthecompanyshouldrunitsprocessesandproceduresassociatedwithtankfillingoperations.

AlthoughAPI2350requiresamanagementsystemforoverfillpreventionandprotection,itdoesnotspecifyhowtodeveloporimplementone.Organizationstypicallyrelyuponmanagementsystemsthathavebeendevelopedasaresultofseriousincidentsinthepast.Thesemanagementsystemsarerelativelycommonamonglargeandmidsizeorganizations.Theseorganizationshavelearnedtousethesesystemstosystematicallyreduce,controlandmanageincidentsaswellastoimproveotheraspectsoftheirbusinesses.Inordertobeeffective,thesesystemsmustbeintegratedintothe“corporateculture”andmustbefitforpurpose.Eventhesimplestofsuchsystemsrequirelotsoftime,energyandresourcesandmustbeactivelysupportedbytheverytopleveloftheorganization.Withouttopmanagementactivesupportandpromotion,thereisnohopeforaworkingmanagementsystem.

Itisrecommendedthatorganizationswhichdonotuseanyformofsafetymanagementsystemconsiderdevelopmentandimplementationofabasic,fitforpurposesafetymanagementsystem.ThentheyensurethatthesafetymanagementsystemincorporatestherelevantprinciplesfromAPI2350.Thisrecommendationisespeciallyimportantforthosecompaniesthataregrowingorthosethatareacquiringothercompaniesintheirgrowthcycle.Anyacquisitionispotentiallyhighriskuntilallofitsmanagementsystemsaswellasitsequipmentsystemsandoperationsareintegrated.

Risk assessmentAPI2350requirestheuseofariskassessmentsystem.Eachtankunderthisstandardmusthaveariskassessmentperformedtodeterminewhetherriskreductionisrequired.Riskassessmentisameansofcombiningtheconsequenceandlikelihoodofanoverfillorotheraccident,usuallyfortwopurposes.First,acommonscaleorrankingmethodologyneedstobeappliedtothemanydifferentpossibleaccidentorlossscenariosthatafacilityissubjectto.Forexample,theriskofarogueemployeeattemptingtosabotageafacilityisdifferentthantheriskofatankoverfill.Withoutriskassessmentthereisnorationalwaytounderstandwhichscenariomaybeworse.Second,sinceresourcesarealwaysscarce,riskassessment,throughtheriskmanagementprocess,allowsacompanytocompareandprioritizetheserisksforthepurposeofallocationofbudgetsandresourcestomitigatetheminsuchawaythatthemostseriousrisksaremitigatedfirst.

Unfortunately,API2350requiresthatthetankowner/operatoruseariskassessmentsy”stemtoaddressrisk,butdoesnotprovideanyinformationorguidanceonhowtodeveloporusesuchasystem.Whilethismayseemstrange,itistheonlywaythatageneralindustrystandardcanbewrittenforageneralpopulationofhighlyvariablefacilitiesandtankowners,eachwithdifferingperceptionsofriskthreatsanddifferingcorporatevalueschemes.

AgoodstartingpointforriskassessmentresourcescanbefoundinIEC61511-3Part3:“Guidanceforthedeterminationoftherequiredsafetyintegritylevels–informative”andIEC/ISO31010“RiskManagement–RiskAssessmentTechniques.”

10

OverviewTheprimaryenablingmechanismthatallowsadoptionofAPI2350istopmanagementendorsementandsupporttomotivatethesafetymanagementsystem(OPP).Thismeansthatformalprocessesforalloftheelementscoveredin“ManagementSystems”(seebelow)willbedocumented,created,revisedandformallysetintomotionusingaformalcorporateprogramstructure.

ImplementationofAPI2350

Management Systems

Specific Elements of the Management Systems for Overfill Prevention• Formalwrittenoperatingproceduresandpracticesincludingsafetyproceduresand

emergencyresponseprocedures

• Trainedandqualifiedoperatingpersonnel

• Functionalequipmentsystems,testedandmaintainedbyqualifiedpersonnel

• Scheduledinspectionandmaintenanceprogramsforoverfillinstrumentationand

equipment

• Systemstoaddressbothnormalandabnormaloperatingconditions

• Amanagementofchange(MOC)processwhichincludespersonnelandequipment

changes

• Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents,

• Asystemtosharelessonslearned

• Afollow-upsystemtoaddressanyneededmitigationofcircumstancesleadingtonear

missesorincidents

• CommunicationsystemsprotocolswithintheOwner/Operatororganizationand

betweentheTransporterandtheOwner/Operatorthatthataredesignedtofunction

underabnormalaswellasnormalconditions

Benefits of Management Systems• Safetyandenvironmentalprotection

• Optimizationoftheworkplaceandoperatingpractices

• Inspection,testing,andmaintenance

• Equipmentandsystemselectionandinstallation

• Safeworkpractices,emergencyproceduresandtraining

• Managementofchangeprogramsrelativetotankoverfillprotection

• Inclusionofcurrenttechnologyandpracticesrelatedtoprocesscontrolandautomated

safetyinstrumentedsystems

11

Figure1(seebelow)-“ConceptualManagementPlanforImplementationofAPI2350”-givestheoverallconceptassociatedwithimplementationofAPI2350.Afirststepissettingupaprocessfordatamanagementassociatedwiththetankoverfillprotectionprogram.Theexistingtankconfigurationmustbeunderstood.Thetankconfigurationisthetypeofinstrumentationthatthetankhas,itsLOCs,alarmandgaugingsystemsandtheoperatingparametersincludinganyrelevantinformationtotheOPP.Thismeansthatallrelevantdataforeachtankneedstobecollectedandaprocessforkeepingituptodateestablished.“RiskConsiderationsforRiskAnalysis”(seepage12)examinessomeoftheinformationconsiderationsneededtoestablishrisk.Thedatabase(1)(2)involvesalltankswithinscopetobeincludedinthetankoverfillprotectionprogram.

Figure 1: Conceptual Management Plan for Implementation of API 2350 (Note:Diagramshowsconceptuallyhowonemayapproachmanagingtheprocessofbringingapopulationofexistingandproposednewtanksforexistingfacilitiesintocompliancewiththe4theditionofAPI2350)

Thedatawillprovideinformationaboutoperatingparametersandtankspecificinformationandanyotherinformationrelevanttoestablishingcompliancewiththestandard.Whilesometankconfigurationsmayhaveacceptableresidualriskothersmaynot.Itisonlyafterariskassessmentprocess(3)isappliedtoeachtankthattheacceptableconfigurationcanbeestablished.Eachtankoverfillsystemwillthenbeclassified(4)aseithercompliantornon-compliantwithAPI2350.Inotherwords,theriskiseitheracceptableorunacceptable.

Theclassificationresultsintheabilitytodoagapassessmentplan(5)whichwillshowwhatchangesareneededtobringthetanksto/withinacceptableriskandintocompliancewithAPI2350.Oncethescaleofchangesneededtobringthetanksystemintocomplianceisunderstood,ariskmanagementprocess(6)canbeusedtoprioritizerisksandtodeterminehowmuchfundingisrequiredtoclosethegapandmakealltankscompliant.

Data ManagementProcess and Tank Database

1)2)

Risk AssessmentProcess

3)

API 2350 CompliantConfiguration(acceptable configuation)

4)

Gap Assessment5)

Modified Tank Systemsand Configuration withAcceptable Risks Compliant with API 2350

8)

Risk ManagementProcess

6)

Establish OperatingParameters and Tank Data:

• Tank Category• LOCs• Alarms• Alerts• Response Time• Attendance• AOPS if applicable• Logic solvers• Final elements• Tank details• Risk data

Project Executionfor Gap Closure

7)

Existing Tank System Configuation (all tanks)

START

FINISH

Schedule for Project Execution

12

Risk Considerations for Risk Analysis

Probability or Likelihood Factors• Frequency,rateanddurationoffilling• Systemsusedtoproperlymeasureandsizereceiptstotanks• Accuratetankcalibration(bothstrappingandverifiedCriticalHigh)• Systemsusedtomonitorreceipts• Extentofmonitoring/supervisionofmanualandautomatictankgauging• ImpactofcomplexityandoperatingenvironmentontheabilityofOperating

Personneltoexecuteoverfillpreventiontasks – Fillingmultipletankssimultaneously – Switchingtanksduringreceipt.

Consequence Factors – Impact of Hazardous Material Release on Vulnerable Exposures Hazard characteristics of material (product) in tank volatility, flammability, dispersion, VCE potential• Numberofpeopleonsitewhomightbeaffectedbyatankoverflowing• Numberofpeopleoffsitewhomightbeaffectedbyatankoverflowing• Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite• Possibilityofimpacttonearbysensitiveenvironmentalreceptors• Physicalandchemicalpropertiesofproductreleasedduringoverflowing• Maximumpotentialoverfillflowratesandduration

Oncetheriskmanagementprocess(6)iscompleted,theprojectengineeringandexecutionphases(7)forimplementationofchangescanbegin.Closingthegapwilltakesometimeanditisafundamentalprincipleofriskmanagementthattheworstrisksshouldbereducedfirst.Thegapclosureplanshouldbebuiltwiththisprincipleinmind.Ultimately,theprocessaimstokeeptheowner/operatorincompliance(8).

Theprocessabovewillalsoaddressproposednewtanksthatareaddedtothesystem.Theymustbeevaluatedtothesamecriteriaandrunthroughtheprocess,butunlikeexistingtankstheywillnormallybebuilttobecompliantduringconstruction.

Theprojectexecutionphaseshould,ofcourse,usetheManagementofChange(MOC)processesandinteractwiththedatamanagementsystemtoensurethatinformationinthetankdatabaseisupdatedwhenchangesaremade.

Moredetailonthesestepsfollows.

13

InitializationPartofthedatamanagementprocessisdeterminationofwhatAPI2350callsoperatingparameters.Tankowners/operatorswhoadoptAPI2350mustestablishorvalidatethetankoperatingparameters.Theseincludeknowingthetankcategories,LevelofConcerns(LOCs),alarms,alerts,AutomaticOverfillPreventionSystem(AOPS)(ifapplicable),andattendancetype.

CategoriesAlltanksmustbecategorizedaccordingtoAPI2350.RefertoFigure2(seebelow)-“DefinitionofOverfillProtectionSystemCategories”.Categoriesareameansofgroupingallofthemanydifferentpossibletankoverfillgaugingconfigurationsintothreebroadconfigurationcategories.Whilethestandardsaysnothingaboutwhichcategoryis“better”westatethatgivenallthingsequal,thehigherthecategorythemorereliableisthegaugingandalarmsystem.

OperatingParameters

Figure 2: Definition of Overfill Protection System Categories

14

Category ICategory1systemsareessentiallymanualsystemssuchasmeasurementofthelevelby“sticking”,insertionofatapeorrodwhichindicatesthelevelofoilonit.WhileanAutomaticTankGauging(ATG)maybeatthetankandusedforlevelmeasurement,ithasnocapabilitytotransmitlevelsignalssoallinformationaboutlevelislocalizedtothetank.Thiscategoryshouldonlybeusedwhentherisksarelow(noClass1liquids),thereceiptoperationisinfrequent,therateoflevelriseisslowandwheretheoperationissosimplethatanoperatorhasvirtuallynochanceofmakingamistake.Category1systemsmayonlybeusedforafullyattendedoperation.

Category 2Category2systemshavetheabilitytotransmitlevelandalarminformationtoacentralizedorremotecontrolcenter.ButthealarmisdependentsothatanATGfailurecancausetotallossofinformationaboutthetanklevelsaswellasthealarms.Category2systemshavenoredundancyandsoshouldonlybeusedifthefailurerateoftheATGandlevelsystemisextremelylow(i.e.thebestpossibletechnologyavailable).Category2ispermittedonlyforattendedandsemi-attendedfacilities.WhilemosttankfacilitiesarefittedwithCategory2systems,mostarealsofittedwithunreliableautomatictankgaugesmakingtheseparticularlyvulnerabletoanoverfillevent.

Category 3Category3systemsarelikeCategory2systemsbutarecharacterizedbyhavinganindependentalarm.TheindependentalarmensuresthatanATGfailurewillnotcauseafailureofthealarmfunction.Category3systemsareconsideredthebestavailableconfigurationandtechnologyfortankfillingoperationsandalarmsystems.Theymaybeusedatafacilitywhichisattended,semi-attendedorunattended.

Automatic Overfill Prevention System (AOPS) NotethatAOPSisasystemwhichisindependentoftheBasicProcessControlSystemorBPCS(whichinmostcasesistheoperations)andisindependentofandinadditiontotheBPCS.TheAOPSinFigure2(page17)canbecombinedwithanyofthecategories,however,inmostcases,itwouldmakesensetocombineitwitheitheraCategory2or3overfillpreventionsystem.SometimesAOPSisalsocalled“Category4”.

Other ConfigurationsAPI2350makesabroadclassificationofsystemsbutcannotcoverallcases.Forexample,sometankowners/operatorsuse2ATGsinlieuofasingleATGandpoint-levelalarm.TheseconfigurationsshouldbeconsideredCategory3sincethisconfigurationisusedinthesamewayasaCategory3system.However,itismorerobustbecauseoftheextralevelinformationavailable.Forexample,adualATGsystemcannotonlyalarmatHHbutonavariationbetweenthetwoATGsprovidinganotherdimensionofreliability.

API2350acknowledgesthatitcannotcoverallcasesandtheprinciplesestablishedinAPI2350shouldserveasaguidewhenthesesituationsarise.

Level of Concerns (LOCs)LOCsaretheoreticallevels.Thatis,theydonothavetohaveequipmentassociatedwiththem.Theyarejustliquidlevelpositionsthatarerecordedintheoperatorsdocumentationsuchasinstraptables,inthecontrolroomdisplaysorprocedures.

15

Critical HighForexample,letusstartwiththehighestLOC.ThisistheliquidlevelatwhichanoverflowordamagecanoccurandiscalledtheCriticalHigh(CH).SeeFigure3below.Notethatthereisnoequipmentrelatedtotankgaugingplacedatthislevel.

Figure 3: API 2350 Tank Levels of Concern (LOCs) – Category 2 and 3 Configurations

High HighMovingdowntothenextLOCwehaveHighHigh(HH).Thisisthealarmforhighlevel.ItisalsotheonlyalarmrequiredbyAPI2350.Currently,mostoperatorsusebothaHighandHighHighalarm.API2350nowrequiresonlyonealarm.An“alert”maybeusedinlieuoftheHighalarmifsodesired.Thereasonfordispensingwiththesecondalarmisalongstory,butmaybesummarizedbystatingthattheHighHighisacriticalalarmandproceduresmustreflectthisfact.Itmustalwaysresultinaspecificactionbytheoperatortoterminatethereceipt.HumanFactorsEngineeringshowsthathavingthesecondalarmreallydoesnotappreciablychangetheoverallsystemintegrity.

Havingsaidthis,onespecificreasontostickwiththeoldermethodoftwoalarmsmaybeduetotheunreliabilityofthealarmsensors.Iftheyarenothighlyreliable,thenthesecondsensorgivestheoperatora“secondchance”bystillalarmingeventhoughoneofthesensorshasfailed.

ThisimprovedreliabilitywasintroducedintothetankbusinessinpreviouseditionsofAPI2350aswellastheNFPA630FireCodewhichusedtheconceptofredundancyofsensorsystems.However,

16

usingthehighlyreliablesensorsthatcanbefoundtoday,asinglehighreliabilityalarmcanbebetterthantwounreliablealarmsandsoonlyonealarmisneededandrequired.Thedecisiontotakeadvantageoftheone-alarmrequirementshouldbebasedonmanyfactors,butperhaps,mostimportantly,onaformalmanagementofchangeforthetankoverfillsystems.

Maximum Working (MW) Level Movingdownagain,theMWlevelmayormaynothaveanylevelsensors.Analertmayormaynotbeusedatthisleveliftheoperatorchooses.

Automated Overfill Protection System (AOPS) Level IfanAOPSisappliedthenitwillbesetatorabovetheHH.ThelevelatwhichtheAOPSissetiscalledtheAOPSlevel

Updating and Management of Change (MOC)AccordingtotheOPPtheLOCsmustbeperiodicallyreviewedandupdated.AnMOCshallbeusedwheneverchangessuchasthoselistedin“SomeManagementofChange(MOC)Triggers”(seebelow)occur.

Some Management of Change (MOC) Triggers

Tank Modifications That Trigger MOC• Newtank• Changeinfloatingrooftankseals• Installationofgeodesicdomesorotherkindsoffixedroofs(e.g.whenexternal

floatingrooftanksreceiveretrofitcovers).• Newinternalorexternalfloatingroof• Sideventchanges• Shellextensions• Newtankbottom• Additionofancillaryequipmentsuchasfoamchambers• Recalibrationorre-strappingofthetank• Changeoftankgaugingequipment• Additionofagaugetubewithdatumorchangeindatum/strikeplate

Operating Changes Trigger MOC• Changeinproduct• Changeinincomingoroutgoinglines• Changeinflowrates,• Changeinserviceifitimpactsstructuralintegrity(corrosion,temporaryrepairs,etc.)• Changeinoperations,suchas:paralleltank,floatingorhighsuction,continuousmixer

operation• Changeinresponsetimeresultingfromstaffing,operationorequipmentchanges

6 NationalFireProtectionAssociation30FlammableandCombustibleLiquids

17

AttendanceTanksfacilitiesaregroupedaccordingtowhetherassignedpersonnelareonthepremisescontinuouslyduringtheentirereceiptoperation(fullyattended),onthepremisesjustduringthebeginningandendingofthereceipt(semi-attended)ornotpresentduringanypartofthereceipt(unattended).Thetankowner/operatormustensurethatthefacilityoperationisconsistentwiththisdefinitionsothatthecorrectcategoryoftankdescribednextcanbeassignedtotheseattendancelevels.Table1(seebelow)-“MonitoringProductReceipt”-presentsattendancerequirementsformonitoringreceipts.

Table 1: Monitoring Product Receipt

Categories vs Attendance Level

Category1Facilities

MustBeAttended

Continuouslyduringfirst

hourofreceipt

Everyhourduringreceipt

Continuouslyduringthelast

hourofreceipt

Category2Facilities

IFSemi-Attended

Emergencyconditions

(equipmentmalfunctionor

powerfailure)mayrequire

operationasaCategory1

facility(see4.5.3.6)

Continuouslyduringthefirst

30minutesofreceipt

hourlynotapplicable

Continuouslyduringthelast

30minutesofreceipt

Category3Facilities

IFUnattended

Emergencyconditions

(equipmentmalfunctionor

powerfailure)mayrequire

operationasaCategory1

facility(see4.5.3.6)

Nolocalmonitoring

requirements.For

unattendedfacilities,

continuousmonitoring

duringreceiptbythe

Operator,Transporter,orby

computer.

seeabove

seeabove

Response TimeResponsetimeisthetimenecessaryfortheoperatorundermostoperatingconditionstoterminateareceiptaftertheHHalarminitiates.Theresponsetimeshouldbecarefullydocumentedandestablishedforeachtank.Manyoperatorswillchoosetouseasetfixedtime,suchas15minutestoterminatethereceiptifthelongestresponsetimeislessthan15minutessincethissimplifiestheoperatingprocedures.However,untiltheresponsetimeisformallyestablishedAPI2350requiresverylongresponsetimesasgiveninTable2(seepage18)-“DefaultMinimumHigh-HighResponseTime”.Becauseofthisitisclearthatcomputingandauditingtheactualresponsetimewillpayoffinthelongrun.Itisalsorequiredforthelongtermandonlymakessense.

18

Table 2: Default Minimum High-High (HH) Response Time

TimeallocatedforoperationstoterminateareceiptpriortoreachingeitherAOPSifitexistsorcritical

high(CH.

Minimum High-High Tank (HH) Response Time (if not calculated)

Category

1

2

3

Time in Minutes

45

30

15

Thesevaluesmaybereducedonlyiftheactualresponsetimesarevalidated.

19

ProceduresAmostimportantaspectofproceduresisthattheOverfillPreventionSystem(OPS)componentsshouldbetestedrigorouslyaccordingtothestandard.ThereareseveraltypesoftestsoutlinedinAPI2350anditisimportantthateachtestbedoneproperly.ThisoneaspectofOPSmaybethesinglemostimportantintermsofprovidingahighdegreeofreliabilityfortheOPSsystemsandfortheoperator.

EquipmentSignificantprogressinthedesignandreliabilityoftankgaugingandalarmsystemshasbeenmadeinrecentyears.OnereasonthatAPI2350onlyrequiresonealarmisthattheATGsandalarmsystemcanbesoreliablethattheyfarexceedthereliabilityofanyATGswhenpreviouseditionsofAPI2350werewritten.However,thereisasignificantCaveat.API2350doesnotgetintowhichequipmentortechnologyshouldbeused,soitisquitepossiblethatsometankowner/operatorswantingtoincreasecapacitywilleliminatetheHighalert,anddependsolelyontheonealarm,butnotusethebestpossibletechnology.Unfortunately,thisisarecipefordisastersincealarmreliabilitymustbeextremelygoodinthecasethatthereisnoredundancy.

Proof TestingTheimportanceofprooftestingcannotbeoveremphasized.Whensystemssuchastankalerts,alarmsorAOPSfailthefailuresareforthemostpartunrevealed.Forexample,supposeanoperatordependsonasensorlocatedatHHtothealarmincasethereisafailuretoterminatethereceipt.Ifthisalarmisfailedthentherewillmostlikelybeanoverfill.Thistypeoffailureisreferredtoasadangerous,undetectedfailureifthepurposeofthealarmsystemisforsafety.WhilegreatadvanceshavebeenmadeforselfdiagnosticelectronicsensorsandATGSwhichmonitormanyifnotmostofthefailuremodesandoutputadiagnosticalarminsuchcases,nosystemhasa100%probabilityofdiagnosingsystemfaults.Theonlywaytopositivelyfindallpotentialdangerousundetectedfaultsistoprooftesttheentireloopfromthesensortothefinaloutput(sensor,logicsolver,andfinalelementorvalve).ItisrecommendedthatprooftestingrequirementsasspecifiedforAOPSbeappliedtoallalarmsaswell.

API2350requiresallcomponentsinvolvedtoterminateareceipttobeproof-testedatleastannually,unlessotherwisesupportedbyatechnicaljustification(i.e.aprobabilityoffailureondemandcalculation).Point-levelsensorsshallbeconductedsemi-annually.TestingofhandgaugesshallcomplywiththerequirementsinAPIMPMSCh.3.1A,andcontinuouslevelgaugesshallcomplywithAPIMPMSCh.3.1A.

EquipmentandOperations

20

General considerationsAlthoughcurrentlyAutomatedOverfillPreventionSystems(AOPS)isinfrequentlyfoundincurrenttankfillingoperations,theywillbecomeanimportanttoolinthetoolboxofoverfillprevention.Intheworldofsafetyinstrumentedsystems,specificindustrystandardshavebeendevelopedwhichapplytoelectricaland/orelectronicand/orprogrammableelectronicdevicestocontroldangerousprocesses.Thesestandardscoverpossiblehazardscausedbyfailureofthesafetyfunctionsbythesafety-relatedsystems.Thesestandardsrepresentthebestpossiblemethodologiestoensurethatsafetysystemsoperateasintended.Thesesafetyinstrumentedsystemsareappliedtorailwaysignalingsystems,remotemonitoringandoperationofprocessplants,emergencyshutdownsystems,burnermanagementsystemsandmanymore.Bytheirveryconstruct,whencombinedwithnormaloperatingsystemsandbasicprocesscontrolsystems,theycanachievealevelorriskreductionthatcannotbeachievedwithoutthem.Sowhythehesitancytousethem?

Onekeyreasonisthatiftheyareimproperlydesignedapipelinecanberupturedbyclosingoffaflowingtankreceiptdeliveringfrompipeline.Inordertodothiswithoutsignificantproblems,thevalveclosuretimemustbesufficientsothatthereisnopossibilityofalinerupture.Asignificantamountofdatacollectionandengineeringanalysisisrequiredtopreventtheriskofapipelinerupture.Onmarinereceipts,thetemporaryhosesthatconnectshiptoterminalcandisengageorruptureduetohydraulictransientsandaspilloverwaterisgenerallymoreseriousthanaspillintheterminal.GreatcaremustbeexercisedwhenapplyingAOPStoanymarineorpipelineoperation.

ThinkingaboutAOPSasakindofinsurancepolicyisuseful.TheAOPSshouldneverbeusedifoperationsaresufficientlygoodthatnooverfillsoccur.Butifnot,theAOPSwillkickinandbringthetankfillingprocesstoasafestate,basicallypayingoutthepremiumforthesesystems.Thingsarecomplicatedbythefactthatthepipelinedeliverycompanyisaseparatebusinessentityfromtheterminal,sothequestionbecomes“Wheredoyouwanttheincidenttooccur?”.Theterminaloperatormostlikelydoesnotwantaspillonhispropertyandlikewisethepipelineoperatorwouldratherhavethespillintheterminalthansomewhereoffsiteinthepipeline.SeriousdiscussionandnegotiationisrequiredbyboththepipelineoperatorandtheterminaloperatortodetermineifandhowanAOPSwillbeusedandacarefulagreementnegotiatedthatmaximizesthebenefitstoallparties.WhileuseofAOPScanreducerisk,itcanalsoincreaseitifnotproperlyappliedanddesignedmeaningthatalloftherequirementsofIEC61511aretotallycompliedwith.

AutomatedOverfillPreventionSystem

21

Two options for AOPS (existing and new tank systems)TherearetwooptionsforinstallingAOPSontankoverfillsystems.WhenthefacilitiesareexistingthenAppendixAofAPI2350isrequiredasaminimum.TheappendixisacompilationofbestpracticesthatshouldachieveariskreductioncomparabletoSIL1(safetyintegritylevel1perIEC61511)orariskreductionfactorof10to100.ThisoptionwasincludedbecauseitissimplynotpracticaltoattempttoapplyIEC61511tooldertankfacilities.

22

Fornewfacilities,theuseofIEC61511isrequired.AnyrequiredminimumSafetyIntegrityLevel(SIL)hashowevernotbeenspecified,althoughthereweremembersinthecommitteeadvocatingthistobedone.ItislikelythatfuturerevisionsofthisstandardwillcomewitharequirementforminimumSIL2,anditisthereforewisetousethisasaguidancewhendesigningnewAOPS.AdoptingthenewAPI2350isasignificantchallengeandeffort.Butthepayoffcanbeworththeef-fortbecausemanyoftheprocessessuchastheuseofsafetymanagementsystemsandriskassess-mentarealreadyacceptedbytheindustryasthemostefficientandappropriatewaytodealwithrisk.Thedatacollectioneffortisanimportantonebecauseitisthefirststeptoassessingtheoverallsystemriskthatthetankfillingoperationsposeinyourfacilities.Inaddition,oncedataiscollectedaboutthesystemthenthehighriskfacilitiescanbeidentifiedandriskreductionstarted.Forex-ample,asimplerequirementtoensurethatalltankalarmsaretestedandthatthealarmresponseismandatedtobeactionableasrequiredbyAPI2350willsignificantlyreducerisksifthesepracticesarenotalreadybeingfollowed.Asimplesurveycanbeusedtostartidentifyingwhatkindsofequip-mentareinplace.

Butbeyondtheselowhangingfruitthereareresourcesandcoststhatmustbeallocatedtotheworthycauseofeliminatingoverfillsfromyourportfoliooftankfacilities.Theyarejusttooseriousathreattoignore.

Manytankoverfillincidentsresultedfromfaultyinstrumentation.Inaddition,whenthealarmshavebeenworking,itisnotuncommonthatoperatorsdidnotbelievethealarmsbecauseofpastproblemswiththeinstrumentationsystems.Ineithercase,overfillsresulted.Today,thehigh-tech,self-diagnosticequipmentavailablehasoutstandingreliability.Itisworthconsideringamigrationprocesswherethehighestrisktankfacilitiesaresystematicallyupgradedtothebestoverfillpreventionequipment.

For additional information:• IntheAppendixyouwillfindaAPI2350-compliancechecklistandsomeexamples

ofdifferentAPI2350-compliantequipmentsolutions• Downloadthestandardfromwww.api.org• Visitwww.rosemount-tg.com/safety• ContactyourlocalEmersonrepresentative

SummaryandConclusions

23

Appendix

A. EquipmentSolutions

B. API2350ComplianceChecklist

C. FrequentlyAskedQuestions

D. AbouttheAuthors

I

A.EquipmentSolutions

Solution 1: Category #2 System per API 2350 Edition 4

Rosemount Tank Gauging

Drawn by: G. Nordberg 05/07/2012

B

Scale: None Sheet: 1 OF 11

Raptor_API2350_Ed4_Overfill_Prevention_RevBFile name: Rev.

High-High Alarm

Category #2 System per API2350 Edition 4

Rosemount 2240SMulti-Point Temperature

(optional)Rosemount 5900SRadar Level Gauge

Rosemount 2230Graphical Display

(optional)

Rosemount FCUData Concentrator

TankMasterTank Gauging System

Includes Visual & AudibleLevel Alert High and LevelAlarm High-High (LAHH)

Rosemount 2410Tank Hub

Relay Output(optional)

Independent Alarm Panel (optional)Connected to Tank Hub directly

Raptor Tank Gauging SolutionATG: 5900S, LAHH: Integrated in ATG

TankMasterk Gauging System

IncludesLevel AlAlarm H

II


High-High Alarm



B


Raptor_API2350_Ed4_Overfill_Prevention_RevBFile name: Rev.

Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)



Rosemount 5900SRadar Level Gauge



Connection toTankMaster(optional)



(optional)



(optional)

IndependentAlarm Panel

Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5900S

Analog, Relay orDigital Communication

Includes Visual & AudibleLevel Alert High and

Level Alarm High-High(optional)


TankMasternk Gauging System

III




B


File name: Rev.

High-High Alarm





Rosemount 5400Pulse Radar Level Gauge




(optional)



(optional)


Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5400




Category #3 System per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB

Rosemount5900S FMCWRadar Level

Gauge


IV




B


File name: Rev.


High-High Alarm





Rosemount 5300Guided Wave Radar




(optional)



(optional)







Gauge


V




A


File name: Rev.

High-High Alarm





Rosemount 2120Vibrating Fork


(optional)



(optional)


Relay/DiscreteOutput






VI


High-High Alarm

Independent Alarm Panel

Leve

l

Ove

rfill



B


File name: Rev.








(optional)


Raptor Tank Gauging SolutionATG: 5900S 2-in-1, LAHH: 5900S 2-in-1

Rosemount 5900S 2-in-1Radar Level Gauge

Rosemount 2240SMulti-Point

Temperature(optional)





Raptor_API2350_Ed4_Overfill_Prevention_RevB

TankMasterk Gauging System

VII

Solution 7: AOPS (Category #4) per API 2350 Edition 4

High-High Alarm



B


Rev.File name:










(optional)



(optional)

Automatic OverfillPrevention System

(AOPS)

SIL2/SIL3Discrete Signal

Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5900S SIL2/3 AOPS

AOPS (Category #4) per API2350 Edition 4





VIII


High-High Alarm



B


File name: Rev.





Gauge

Rosemount 5400Pulse Radar Level Gauge



(optional)



(optional)

SIL 1 Analog4-20 mA Signal


(AOPS)

Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5400 SIL2 AOPS





TankMasterank Gauging System

IX




B


File name: Rev.

High-High Alarm



Rosemount 5300Guided Wave Radar



(optional)



(optional)

SIL 2 Analog4-20 mA Signal


(AOPS)





AOPS (Category #4) per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB


Gauge


X




B


File name: Rev.

Leve

l

Ove

rfill







(optional)


Rosemount 5900S 2-in-1Radar Level Gauge

Rosemount 2240SMulti-Point

Temperature(optional)

Raptor Tank Gauging SolutionATG: 5900S 2-in-1,LAHH: 5900S 2-in-1 SIL2 AOPS

High-High Alarm


(AOPS)

SIL2 DiscreteOutput




AOPS (Category #4) per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB


XI




B


File name: Rev.



Rosemount 2120Vibrating Fork


(optional)



(optional)

High-High Alarm


SIL 2 DiscreteOutput


(AOPS)









B.API2350Edition4ComplianceChecklist

Introduction Thischecklistprovidesatoolforverificationofcompliancewiththenewstandardforoverfillprevention:API2350,Edition4,May2012.Itcanalsohelpyoutobetterunderstandtherequirementsandrecommendedpracticesthatcomprisethenewstandard.Thechecklistisintendedtobeappliedonatankbytankbasis.Duplicatethechecklistforusagewithmultipletanks(e.g.forassessmentofanentiretankfarm).Thechecklistisorganizedintofourconsecutivesteps(seefigureB1):

Step 1: Management System

Step 2: Risk Assessment

Step 3: Tank & Operations

Step 4: Compliance Summary

Eachstepisbrieflydescribedbelow.Additionalinformationcanbefoundin”TheCompleteGuidetoAPI2350”availableathttp://www.api-2350.com.Foracompletelistofallrequirements,refertothestandarditself.YoucanobtaintheAPI2350standardathttp://publications.api.org.

Figure B.1: Checklist step by step overview

Management System (MS)

Amanagementsystemisdefinedastheframeworkofadministrativeprocessesandproceduresusedtoenabletheownerandoperatortofulfillthetasksrequiredtoreduceoverfillstoanacceptablelevel.AmanagementsystemisrequiredforconformancewithAPI2350,butthestandarddoesnotspecifyhowtoimplementsuchasystem.

Thefirststepofthechecklistoutlinesalltheele-mentsrequiredbyAPI2350tobeincludedinamanagementsystem.Yourmanagementsystemmustmeetalloftherequirementsinthechecklisttobecompliantwiththestandard.

Is the tank compliant with API 2350 Edition 4?

Are administrative processes and procedures in compliance with API 2350?

4.ComplianceSummary

Is the risk, associated with tank overfi lls, accepatable to responsible stakeholders?

2.RiskAssessment

Are tank data and operating parameters in compliance with API 2350?

Sub-Steps: 3a.DataCollection3b.ScopeCheck3c.TankCategorization3d.LOCandResponseTime3e.Equipment

3.Tank&Operations

1.ManagementSystem

XII

Risk Assessment (RA)

Tank & Operations (TO)

API2350requiresariskassessment,associatedwithtankoverfills,tobeconductedandproperlydocumented.Thestandarddoesnothoweverspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletoresponsiblestakeholders.

TheRiskAssessmentChecklist(seepageXVII)isoutlinedaseithermeetingornotmeetingcriteriasetbystakeholders.Stakeholderstakenintoconsiderationareowners,operators,employees,authorities,transportersandpublic.Ifanyofthestakeholdersfindthattheriskisunacceptable,thenriskreductionisrequired.Thismaybeaccomplishedbyachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(e.g.attendance),achangeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.

Theriskassessmentprocessshallbeconductedbypeoplewhoarefamiliarwithtankfacilitiesandoperationsaswellastheriskassessmentprocess.Thechecklistisintendedforonetankonly.Duplicatethechecklistforusagewithmultipletanks.

ThethirdstepconcernstankconfigurationforconformancewithAPI2350.Here,specifictankdataandoperatingparametersarecollectedandcomparedwiththerequirementsinAPI2350.ThisisrequiredforeachtankwithinscopeoftheAPI2350complianceprogram.

TheTank&OperationsChecklist(seepageXIX)isdividedintofivesub-steps.Thefirststepisintendedfortankdatacollectiononly.Thisdataisthenusedinsubsequentstepstoassessthetank´scompliancewithAPI2350.Morespecific,thedatahelpsyoutoanswerquestionssuchas:IsyourtankwithinthescopeofAPI2350?Whatpre-definedcategoryisyourtank?and,Doesyourtankmeettheequipmentrequirementsforselectedcategory?

RESET

API2350alsorequires,asaminimum,threeLevelsofConcern(LOCs)tobeestablished.Eachofthesethreeshallbedefinedinlevel,ullageandvolumeseparately.Theexactvaluesdependonoperatingparameterssuchasfillrateandresponsetime.

Compliance Summary (CS)

ThefinalsectionconstitutesaComplianceSummaryforthespecifictank.TheComplianceSummaryChecklist(seepageXXV)servesasafinalverificationofthistank scompliancewithAPI2350.Yoursummarymustmeetalloftherequirementstobecompliantwiththestandard.

XIII

Itisadvisable,butnotrequired,toinitiatethefollowingactivitiesbeforestartingtheverificationprocess:

• Createanexperiencedassessmentteamwithcompetentpeoplespanningalldisciplinesrequired (e.g.design,operation,maintenance,instrumentation,safety,qualitydepartments)• Setup/Clarifyresponsibilities• Definethescopeandtimelineofthetankcomplianceprogram• Createproceduresformanagingthedataobtainedandcreatedduringthecomplianceprocess• AcquireacopyoftheAPI2350standardathttp://publications.api.org

NotethatAPI2350isastandardofminimumrequirements.Alternateapproachesthatprovideequivalentormorerobustoverfillpreventionareacceptedandrecommendedbythestandarditself.Forexample,Emersonalwaysadvocatestheusageofthehighestcategoryequipment(automatictankgauging+independentoverfillalarm)foralltankswithinthescopeofthisstandard,sincethecostdifferenceisusuallyminimal.

AlsonotethatthischecklistsummarizestherequirementsinAPI2350,anddoesnotnecessarilyreflectEmerson’sview.Ifanydiscrepanciesorunclaritiesoccur,alwaysrefertotheoriginalsource.Theremayalsobeadditionallocalregulation(e.g.country,federal,statelaws)thatmustbetakenintoconsideration.Ultimately,thisistheresponsibilityofthetankfarmowner/operator.

Incaseyouneedassistance,orhaveanysuggestions,pleasecontactyourlocalRosemountTankGaugingrepresentativeormailto:[email protected].

Incasethetankisnon-compliantwithAPI2350,thecollectedinformationcanbeusedtoperformagapassessment,whichshouldbefollowedbyacomplianceproject.ThisprocessisfurtherdescribedinTheCompleteGuidetoAPI2350,wherefigure1(seepage11)providesanoverviewoftheentireverificationandimplementationprocess.

Recommendations

XIV

Your management system shall include (as a minimum)... Is your management system

compliant with requirement?

1. Formaldocumentedoperatingproceduresandpractices,includingsafetyproce-duresandemergencyresponseprocedures.

Yes No

2. Establishedanddocumentedproceduresforpre-receiptplanning.Theproce-dureshallrequiretheproductquantitytobereceivedtobecomparedtogaugedavailablereceivingtankcapacityaheadoftheactualtransfer.Thisinformationshallberecordedonthetankproducttransferorreceiptrecord(s)andshallbemadeavailabletothetransporter.

Yes No

3. Establishedanddocumentedproceduresforactivitiesduringthereceipt.Thestan-dardrequiresregularlyscheduledcomparisonsofproductlevelsduringreceipts.

Yes No

4. Documentedprocedureforpostreceiptactivities(e.g.closevalves). Yes No

5. Writtenprocedureswhichestablishtheminimumlocalattendancelevelsduringreceipt.1.1

Yes No

6. PoliciesandproceduresshallprohibittheuseofHigh-hightanklevelalarmsandAOPSforroutineoperationorcontroloftankfillingoperations.

Yes No

7. Recordsshowingthatallpersonnelinvolvedintheproducttransferarecompetent1.2andhavereceivedadequatetrainingforthespecifictaskarerequired.

Yes No

8. Functionalequipmentsystems,testedandmaintainedbycompetent1.2personnel. Yes No

9. Drawings,operatinginstructions,inspections,testingandmaintenanceplansshallbeestablishedanddocumentedforthetankgaugingsystem,overfillpreventionsystemandotherequipmentasapplicable.Documentationrelatingtoinspectionandmaintenanceofsystemsshallbemaintainedforaminimumofoneyear.

Yes No

ManagementSystemChecklist

Step 1: Management System (MS) Checklist

Section 4.2 and 4.5http://publications.api.org

Is your MS compliant with API 2350 Ed.4 ?Fill out the following form to check if yourmanagement system is compliant with API2350.Thissheetisintendedforonetankonly.Duplicate the sheet for multiple usage. Foradditional information, see “The CompleteGuidetoAPI2350”.

Tank-farm Facility/Site

Date Revision DataStorageLocation

Issue

1.Name Position 4.Name Position



AssessmentTeam

RESET

Section 4.2 and 4.5http://publications.api.org

XV

TankLocation

Assessment for

TANK NO.

RESET

10. Systemsandprocedurestoaddressbothnormalandabnormaloperatingconditions.

Yes No

11. AManagementofChange(MOC)processthatincludespersonnel,equipmentandproceduralchanges.

Yes No

12. Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents.

Yes No

13. Afollow-upsystemtosharelessonslearnedandtoaddressanyneededmitigationofcircumstancesleadingtonearmissesorincidents.

Yes No

14. Documentedcommunicationprotocolswithintheownerandoperatororganiza-tionandbetweenthetransporterandtheownerandoperatorthataredesignedtofunctionunderabnormalaswellasnormalconditions.

Yes No

15. ProceduresforperiodicreviewoftheLevelofConcerns(LOCs).Maxreviewtimeisfiveyears.

Yes No

Ifalloftheanswersareequaltoyes,thenyourmanagementsystemiscompliantwiththere-quirementsinAPI2350Edition4.

IsyourmanagementsystemcompliantwithAPI2350?

Yes No

Note1.1: Category1:Localattendanceon-sitecontinouslyduringthefirstandlasthourofreceipt,andataminimumhourlyduringthereceipt.Category2: Maybesemi-attended,butrequiresattendancecontinouslyduringthefirstandlast30minutesofreceipt.Category3:Nolocalmonitoringrequirements.

Note1.2: API2350definesacompetentpersonas“anindividualwhoiscapableandabletoperformtheassigneddutiesasdeterminedbymanagementina specificareaofoperations.”(3.10)

Section 4.2 and 4.5http://publications.api.orgSection 4.2 and 4.5http://publications.api.org

XVI

Step 2: Risk Assessment (RA) Checklist

Is risk, associated to tank overfi lls, acceptable to responsible stakeholders?API2350requiresariskassessmenttobeconductedandproperlydocu-mented.Thestandarddoeshowevernotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletotheowner,operatorandotherresponsiblestakeholders.AcordingtoAPI2350,itistheresponsibilityoftheownerandoperatortoconductariskassessmentcoveringtherisksassociatedwithpotentialtankoverfills.

RiskAssessmentChecklist

Minimum risk requirement Risk acceptable?

1. Theriskassessmenthasbeenconductedandproperlydocumentedforthespecifictank. Yes No

2. Theriskassessment´sresidualriskisacceptable...

2a. totheOWNER. Yes No

2b. totheOPERATOR. Yes No

2c. totheEMPLOYEES. Yes No

2d. totheAUTHORITIES/REGULATION. Yes No

2e. totheTRANSPORTER. Yes No

2f. tothePUBLIC. Yes No

Ifalloftheanswersareequaltoyes,thentheriskassessmentiscompliantwiththerequirementsinAPI2350Edition4.2.1

Istheriskacceptabletoresponsiblestakeholders? Yes No

RESET

Is the RA acceptable to stakeholders?Filloutthefollowingformtocheckiftheriskassessment is compliant with API 2350 re-quirements. This sheet is intended for onetank only. Duplicate the sheet for multipleusage. For additional information, see “TheCompleteGuidetoAPI2350”.

RESET




AssessmentTeam


Issue

Section 4.3http://publications.api.org

Note2.1: Ifthestakeholdersfindthattherisksdonotmeetthegapassessmentcriteria,thenriskreductionisrequired.Thismaybeaccomplished byachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(i.e.attendance),a changeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.



XVII

TankLocation

Assessment for

TANK NO.

ProbabilityandConsequenceFactors(OptionalSection)

Factor considered in the risk assessment?Probability Factors

A.1 Frequency,rateanddurationoffilling. Yes No

A.2 Systemsusedtoproperlymeasureandsizereceiptstotanks. Yes No

A.3 Accuratetankcalibration(bothstrappingandverifiedCriticalHighlevel. Yes No

A.4 Systemsusedtomonitoringandsupervisionofmanualandautomatictankgauging. Yes No

A.5 Extentofmonitoringandsupervisionofmanualandautomatictankgauging. Yes No

A.6 Impactofcomplexityandoperatingenvironment. Yes No

A.7 Fillingmultipletankssimultaneoulsy. Yes No

A.8 Switchingtanksduringreceipt. Yes No

Factor considered in the risk assessment?Consequence Factors

B.1 Hazardcharacteristicofmaterial(product)intank. Yes No

B.2 Volatility,flammability,dispersion,VCEpotential. Yes No

B.3 Numberofpeopleonsitewhomaybeaffectedbyatankoverflowing. Yes No

B.4 Numberofpeopleoffsitewhomaybeaffectedbyatankoverflowing. Yes No

B.5 Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite.

Yes No

B.6 Possibilityofimpacttonearbysensitiveenvironmentalreceptors. Yes No

B.7 Physicalandchemicalpropertiesofproductreleasedduringoverflowing. Yes No

B.8 Maximumpotentialoverfillflowratesandduration. Yes No

API2350doesnotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist.Butgenerally,riskisacombinationofconsequencemultipliedbytheprobabilityforaspecificeventorscenariothatresultsinharmordamage.Thereforethestandard(seeAnnexE)recommendsthatatleastthefollowingprobabilityandconsequencefactorsareconsideredintheriskassessment.

RESET

Section 4.3 and Annex Chttp://publications.api.orgSection 4.3 and Annex Chttp://publications.api.org

XVIII

Step 3: Tank & Operations (TO) Checklist

DescriptionofATGLevelMeasurement ATGTagName Technology(e.g.radar)

TankGaugingSystemTypeofappliedTankGaugingSystem?

None/ManualTankGauging(sectionN/A)AutomaticTankGauging(ATG)


Is your TO compliant with API 2350 Ed.4 ?Filloutthefollowingformtodefineandcon-figure your tank according to API 2350. Thissheetisintendedforonetankonly.Duplicatethe sheet for multiple usage. For additionalinformation,see“TheCompleteGuidetoAPI2350”.

RESET




AssessmentTeam

Figure 1: Overview tank parameters, internal /external fl oating roof tanks respectively

TypeofLiquidProduct(e.g.crudeoil) Max/MinDensityorSpecificGravity3.1

TankType(e.g.fixedorfloatingroof) TankHeight(TH)/CriticalHigh(CH)3.2

Strapping-tableisuptodate?3.3

EffectiveFloatingRoofThickness(FR)(fromliquidleveltotopsealextension)

Yes No

GeneralTankData

3a. Data Collection

RESET

NotApplicable

OperationalTankDataMaxFillRate MaxWorkingLevel(MW) High-HighLevel(HH) WorstCaseResponseTime(RT)3.4

Note3.1: DensitycaninfluenceCriticalHigh(CH)andEffectiveFloatingRoofThickness(FR).

Note3.2: AccordingtoAPI23503.13:CriticalHigh(CH)isthehighestlevelinthetankthatproductcanreachwithoutdetrimentalimpacts(i.e.productoverflowortankdamage). Foradditionalinformation,seeAPI2350AnnexD.

Note3.3 Max15yearintervalforunchangedtanksaccordingtoAPIManualofPetroleumMeasurementStandards(MPMS)2.2.

Note3.4: ResponseTimeistheperiodoftimerequiredtoterminateareceipt.API23504.4.2.5providesguidanceonhowthiscanbecalculated.Alternatively,thedefault responseratesdefinedbythestandardcanbeused,seesection3e.LevelsofConcern(LOCs)Determination.


Issue



XIX

TankLocation

Assessment for

TANK NO.

3b. Scope Check

Is your tank within the scope of API 2350?ThescopeofAPI2350isintendedforabovegroundatmosphericstoragetanksassociatedwithpetroleumfacilitiesincludingrefineries,marketingterminals,bulkplantsandpipelineterminalsthatreceiveClassIorClassIIpetroleumliquids.Useisrecom-mendedforClassIIIpetroleumliquids.3.7

Note3.7: NFPA30-2008definesclassesofliquids.ClassIliquid:aflammableliquidwithaclosedcupflashpointbelow100°F(37.8°C)andareidvaporpressure notexceeding40poundspersquareinchabsolute(2068millimetersofmercury)at100°F(37.8°C).ClassIIliquid:acombustibleliquidwithaclosedcup flashpointatorabove100°F(37.8°C)andbelow140°F(60°C).ClassIIIliquid:aliquidwithflashpointsabove140°F(60°C).

Note3.8: PEI600RecommendedPracticesforOverfillPreventionforShop-fabricatedAbovegroundTanksisavailableathttp://www.pei.org.

RESET

The Tank is...Is your tank compliant

with the statement?

1. Anabovegroundstoragetankof1320USgallons(5000liters)ormore. Yes No

2. ContainingClassIorClassIIpetroleumliquids(optional:ClassIIIpetroleumliquids).3.7 Yes No

Is your tank compliant with the statement?The Tank is NOT...

3. Apressurevessel. Yes No

4. Shop-fabricatedorcompliantwithPEI6003.8. Yes No

5. Locatedataservicestation. Yes No

6. Filledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars). Yes No

7. StoringLPGorLNG. Yes No

If all of the answers are equal to yes, thenthetankiswithinthescopeofAPI2350Edi-tion4.

IsyourtankwithinthescopeofAPI2350? Yes No

ScopeofAPI2350

IndependentOverfillPreventionSystemTypeofappliedOverfillPreventionSystem?

ManualOverfillPreventionSystem(MOPS)3.5

AutomaticOverfillPreventionSystem(AOPS)3.6

None(sectionN/A)

TypeofLevelAlarmHigh-HighSensor Actuator:AlarmSignalSystem OperationalExperience(e.g.replacements,alarms,etc.)

TypeofLogicSolver Actuator:FinalElement

Documentedproof-testprocedureexists?

Proof-testInterval MostRecentProof-testResultandDate

(months)Yes No

RESET


Note3.5: Anoverfillpreventionsystemrequiringoperatingpersonnelactiontofunction(API23503.29).

Note3.6: Anoverfillpreventionsystemnotrequiringtheinterventionofoperatingpersonnelactiontofunction(API23503.6).

Datacommunicationtolocalorremotecontrolexists?

OperationalExperience(e.g.replacements,alarms,etc.)

Documentedverificationtestprocedureexists?

VerificationInterval MostRecentVerificationResultandTestDate

(months)

RESET

Yes No

Yes No


XX

3d. Equipment Requirements

TankEquipmentRequirements

Category 3

Yes(requirement)

Yes(requirement)

LiquidlevelandindependentLAHHistransmittedtocontrolcenter

Category 2

Yes(requirement)

Notrequired

Liquidlevelistrans-mittedtocontrolcenter

Category 1

Notrequired

Notrequired

Nodatacommuni-cationwithcontrolcenterrequired

ATG-System

Independent LAHH Sensor

Availability of measured level data

Tankfulfillsrequirementsforselectedcategory?(Yes,ifallboxesarecheckedforselectedcategory)

Yes No

Does your tank meet the equipment requirements?Thewaythetankisoperated,orequallyitscategory,determinestheminimumrequirementsfortheoverfillpreventionsystem.Givenallthingsequal,ahighercategoryoverfillpreventionsystem(e.g.category3)issaferthanalowercategorysystem(e.g.2).Ahighercategorysystemalsoallowsformoreefficienttankoperationswithlesspersonnelandhighertankutilization.Ahighercategoryoverfillpreventionsystemthanrequiredcanbeusedsinceitisastandardofminimumrequirements.Selectthepreferredtankcategorybelow,andevaluateifyourtankfulfillstheminimumrequirements.Exampleofequipmentsolutionscanbefoundin“TheCompleteGuidetoAPI2350”,AppendixA.

3c. Tank Categorization

Which API 2350 pre-defi ned category does your tank belong to?API2350requireseachtanktobecategorizedaccordingtohowitisoperated.Mostmodernfacilitiesareoperatedremotelyfromacontrolcenterandwillthereforefallundertankcategory3.

Category 1 Category 2 Category 3

Attendance

Cat.1:Fullyattendedfacility(locallymonitored)

Cat.2:Semi-attendedfacility(locallyandremotelymoni-tored)

Cat.3:Unattendedfacility(remotelymonitored)

Monitoring

Cat.1:Continuouslyduringfirstandlasthourofreceiptandonceeveryhourduringreceipt

Cat.2:Continuouslyduringthefirstandlast30minutesofreceipt

Cat.3:Monitoredfromlocalorremotecontrolcenter

Operator

Cat.1:Fullfocusononereceiptatatime,andnotdistractedbyotherduties.

Cat.2:Focusonmultipletanks/receiptssimultaneously,oroperatormaybedistractedbyotherduties

Cat.3:Samerequirementasincategory2

Tankiscategorizedas..?(equalsthehighestcategoryselectedabove) Category1 Category2 Category3

TankCategorization

RESET

RESETSection 4.4 and 4.5http://publications.api.orgSection 4.4 and 4.5http://publications.api.org

XXI

TheATGsystemisoneofthemostcriticalcomponentstopreventoverfillsfromoccurring.Thisisrecog-nizedinAPI2350,andthereforethestandardrequiressoundengineeringprinciplestobeappliedalsotothispartofthefacility.Thissectionismandatoryforcategory2and3tanks,andoptionalforcategory1.

Automatic Tank Gauging (ATG) System - applies to category 2 and 3

TankequippedwithATGsystem?

ATG system conforms to the following principlesIs your ATG system compliant

with the statement?

1. TheATGsystemisdesignedandconfiguredtoinitiateadistinctvisualandaudiblealarmincasetheliquidsurfacereachestheHighhighLevelAlarm(LAHH)point.

Yes No

2. Written maintenance and verification plans, encompassing all components in the tankgaugingsystem,shallexist.Testingofcontinuous-levelsensorsshallcomplywiththere-quirementsinAPIManualofPetroleumMeasurement3.1Bandthemanufacturer’sinstruc-tions.

Yes No

3. Tankandfacilityshallallowformanualshutdownincaseoffailure(e.g.equipmentorcablefailures,powerloss).

Yes No

Ifallof theanswersareequal toyes, thentheATGsystemiscompliantwiththerequirementsinAPI2350Edition4.

IsyourATGsystemcompliantwithAPI2350?

Yes No

AutomaticTankGaugingSystem

RESET

Yes No(sectionN/A)

Section 4.4 and 4.5http://publications.api.orgSection 4.4 and 4.5http://publications.api.org

Independent overfi ll prevention system conforms to the folllowing principlesIs your independent OPS

compliant with the principle?

1. TheequipmentusedintheOPsystemshallnotbeapartoftheATGsystem Yes No

2. AdistinctvisualandaudiblealarmthatisnotapartoftheATGsystem Yes No

3. Documentedproof-testingproceduresandmaintenanceplanshallexistforallcompo-nentsintheoverfillpreventionsystem:-High-HighLevelAlarmSensor-Alarmpanel-LogicSolver(e.g.PLC)-Valves-Communicationsequipment

Yes No

4. TheProof-testingmethodsshall:-beincompliancewiththemanufacturers’instructions-donotput(orleave)thetankinanunsafeoperatingmode(e.g.itisnotrecommendedtofillthetankaboveitsminimumworkinglevel)-forcontinuouslevelsensors:complywiththerequirementsinAPIMPMS3.1B

Yes No

IndependentOverfillPreventionSystem

Independent Overfill Prevention System (OPS) - applies to category 3

AnindependentOverfillPreventionSystem(OPS)isrequiredforalltanksoperatedascategory3,whichisthemajorityoftanksoperatingtoday.Traditionally,electro-mechanicalpoint-levelsensorshavebeenusedastheHigh-HighLevelAlarm(LAHH)Sensor.Theusageof“continuous”typeleveltechnologyisrap-idlybecomingthedesiredchoicetoreplace“point”typeswitches;theobviousadvantageisthe‘online’levelmeasurementwhichcanbecomparedwiththeATGforproof-testing.

Tankequippedwithindependentoverfillpreventionsystem?

Yes No(sectionN/A)

XXII


AutomaticOverfillPreventionSystem:GenericRequirements

AOP system conforms to the following principlesIs your AOPS compliant

with the principle?

Existing Facilities ConformtoAnnexAinAPI2350orIEC61511 Yes No

New facilities ConformwithrequirementsinIEC61511orANSI/ISA84.00.01-2004 Yes No

Wireless AOPSdoesnotdependonWirelesscommunication3.9 Yes No

Safe state Allequipmentshallbedesignedtomovetheprocessintoasafestateintheeventofapowerlossordevicefailure.

Yes No

Automatic Overfill Prevention System (AOPS) - if used

AutomaticOverfillPreventionSystems(AOPS)areoptional.Butifoneisbeingem-ployed,thenitisrequiredtoconformtotheminimumrequirementsbelow.

RESET

TankequippedwithAOPS?

Yes No(sectionN/A)

Note3.9: WirelesscommunicationisacceptableforanythingbutAOPS.AnAOPScannotdependsolelyonwireless,butitcanbeusedasredundant communication(e.g.deviceconfiguration).

RESET

CHLevelset-point:expressedasLevel CHLevelset-point:expressedasVolume CHLevelset-point:expressedasUllage

MinimumRequirement CHLeveliscompliantwiththeminimumrequirement?

Highestlevelintankthatproductcanreachwithoutinitiatingoverflowortankdamage.Ifapplicable,thethicknessofthefloatingroofshallbetakenintoconsidiration. Yes No

CriticalHighLevel

3e. Levels of Concern (LOCs) Determination

ThestandardrequiresataminimumthefollowingthreeLOCstobedefined:CriticalHighLevel(CH),High-HighLevel(HH)andMaximumWorkingLevel(MW).EachLevelofConcernshallbedefinedinlevel,ullageandvolume.UsageofHi-Alertsisoptional.FigureB.2outlinestheLOCs.

5. Resultfromproof-testingshallbeproperlydocumentedandthetestintervalismaxi-mum-Point-levelSensor(ifexist):6months-Allothercomponentsintheoverfillpreventionsystem:12months

Yes No

6. High-HighLevelAlarmSensorshallbeabletoalsomeasureliquidproductontopofthefloatingroof(ifapplicable)

Yes No

If all of the answers are equal to yes, then theIOP system is compliant with the principles inAPI2350Edition4.

IsyourindependentOPScompliantwithAPI2350?

Yes No

RESET

AOPSLevelset-point:expressedasLevel AOPSLevelset-point:expressedasVolume AOPSLevelset-point:expressedasUllage

MinimumRequirement AOPSLeveliscompliantwiththemin.requirement?

Level/VolumeequivalenttodistancefromCHtocalculatedAOPSresponsetimeatmaxflowrate.Distance(btw.CHlevelandAOPSlevel)shallnotbelessthanthree(3)inches.

Yes No

AutomaticOverfillPreventionSystem:Set-point

RESET


XXIII

Level Required action for specifi ed level Requirement fulfi lled?

CriticalHigh(CH) Anemergencymanagementresponseshallbeinitiated.Procedureshallbedocumented

Yes No

HighHigh(HH) Alarmgeneratedanddocumentedproceduresrequiringoperatorstoinitiateimmediatetermination• Category1:Alarmoptional• Category2:AlarmgeneratedbyATG-system.• Category3:RedundantAlarmsgeneratedbyATGandIOPS

Yes No

ActionRequirements

Are actions and procedures documented?API2350requiresdocumentedactionsincasetheliquidproductsurfacereachesCriticalHigh(CH)orHigh-High(HH).

RESET

HHset-point:Level HHset-point:Volume HHset-point:Ullage

MinimumRequirement

Ataminimum,verticaldistancebetweenCHandHHcorre-spondstothefollowingresponsetime(atmaxflowrate)3.10:• Category1=45minutes• Category2=30minutes• Category3=15minutesThree(3)inchminimumlevelforallcategories.

HHiscompliantwiththeminimumrequirement?

HighHighLevel

Figure B.2: Overview Levels of Concern (LOCs)

HHiscompliantwiththeminimum Yes No

RESETNote3.10: Thesearethedefaultresponsetimesforeachcategory. Alternatively,thetankspecificresponsetimecanbeused.

MWLevelset-point:expressedasLevel MWLevelset-point:expressedasVolume MWLevelset-point:expressedasUllage

MinimumRequirement MWLevelcompliantwithmin.requirement?

Ataminimum.verticaldistancebetweenHHandMWcorrespondstocalculatedfacilityoperationsresponsetime3.11. Yes No

MaxWorkingLevel

RESETNote3.11: Responsetimeistheperiodoftimerequiredtoterminateareceipt.

Section 4.4http://publications.api.orgSection 4.4http://publications.api.org

Level Description Action and Alarm/Alert Requirements

The level at which damage or overflow occurs

A spill management emergency response shall be initiated. Procedure shall be documented. Alarm is required.

The level at which termination of product receipt triggers

Critical High (CH)

Max. Working (MW)

AOPS Level

High-High Tank (HH) The action alarm level to enable termination of product receipt

The highest level to which the tank may routinely be filled

Level only applies if AOPS is used. Alarm is optional.

Action response required. Procedures shall be documented. Alarm is required for Cat. 2 and 3.

Alert is recommended but not required.

Note: High tank level is not required

XXIV

Step 4: Compliance Summary (CS) Checklist

Is tank compliant with API 2350?Filloutthefollowingformtoverifyifthetankis compliant with API 2350. This sheet is in-tendedforonetankonly.Duplicatethesheetformultipleusage.Foradditionalinformation,see“TheCompleteGuidetoAPI2350”.

RESET




AssessmentTeam



Issue

ComplianceSummaryChecklist

1. MangementSystemoftankincludesallelementspresentedinSection1,MSChecklist? Yes No

2. Ariskassessmenthasbeenconductedandproperlydocumented,andtheassessment´sresidualriskisacceptabletoresponsiblestakeholders?

Yes No

3. DatacollectionandtankconfigurationhasbeenconductedinaccordancewithSection3,TOChecklist?

Yes No

3a. Data,requiredfortheassessmentoftank,hasbeenproperlycollected? Yes No

3b. ThetankiswithinthescopeofAPI2350? Yes No

3c. ThetankhasbeencategorizedinaccordancewithAPI2350? Yes No

Ifyes,thespecifictankiscategorizedas: Cat.1 Cat.2 Cat.3

3d. Thetankfulfillstheequipmentrequirementsforselectedcategory? Yes No

ATGSystemcompliantwithAPI2350? N/a Yes No

IOPSystemcompliantwithAPI2350? N/a Yes No

3e. LevelsofConcern(CH,HHandMW)havebeenestablishedinaccordancewithAPI2350?

Yes No

Ifalloftheanswersareequaltoyes,thenthetankiscompliantwithAPI2350Edi-tion4.

IstankcompliantwithAPI2350Edition4? Yes No

RESET

XXV

TankLocation

Assessment for

TANK NO.

XXVI

C.FrequentlyAskedQuestions

Who should care about API 2350?Thepurposeofthestandardistocoverminimumoverfill(anddamage)preventionpracticesforabovegroundstoragetanksinpetroleumfacilities,includingrefineries,marketingterminals,bulkplants,andpipelineterminalsthatreceiveflammableandcombustibleliquids.Thestandardassistsowner/operatorsandoperatingpersonnelinthepreventionoftankoverfillsbyimplementationofacomprehensiveoverfillpreventionprocess(OPP).Thegoalistoreceiveproductintotheintendedstoragetankwithoutoverfillorlossofcontainment.Anybodyinvolvedinthisprocessbenefitofunderstandingandapplyingthisstandard,rangingfromtankowner/operators,operatingandmaintenancepersonnel,transporters,engineering,safetystaff,suppliers,andgovernmentofficials,justtomentionafew.

What’s the scope of API 2350?API2350isintendedforstoragetanksassociatedwithmarketing,refining,pipelineandterminalscontainingClassIorClassIIpetroleumliquids.UseisrecommendedforClassIIIpetroleumliquids.API2350doesnotapplyto:• undergroundstoragetanks;• abovegroundtanksof1320USgallons(5000liters)orless;• abovegroundtankswhichcomplywithPEI600;• pressurevessels;• tankscontainingnon-petroleumliquids;• tanksstoringLPGandLNG;• tanksatservicestations;• tanksfilledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars);and• tankscoveredbyOSHA29CFR1910.119andEPA40CFR68orsimilarregulations.

Why should API 2350 be used and not some other safety standard?API2350isasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Itwascreatedbytheindustryfortheindustry.Awidespectrumofindustryrepresentativesparticipatedinitscreation:tankownersandoperators,transporters,manufacturers,andsafetyexperts,justtomentionafew.Itisacompilationoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.Anditdoesnotcompetewithothermoregenericsafetystandards,butinsteadactsasacomplement.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingsomeoftherequirementsinAPI2350.

XXVII

Is API 2350 required by any law?API2350isastandardcreatedbytheindustrycommunity,andnotalegaldocument.However,inmanycasestheapplicablelawsrequiretheoperationtobecompliantwithrecognizedindustrybestpractices.Often,APIpublicationsareusedasthebenchmark,therebyindirectlyreferencingtoAPI2350incaseoftankoverfills.ItishoweverimportanttorecognizethatAPI2350doesnotsupersedeanylocal,stateorfederallawsandregulations,whichalwaysmustbetakenintoconsideration.

What’s the difference between API 2350 and 61508/61511?IEC61508/615011aregenericsafetystandardsdescribingtheuseofsafetyinstrumentedsystems(SIS).API2350ontheotherhandisasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Thesetwostandardsdonotcompetewitheachother,butinsteadactascomplements,withmanysimilarities.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingmanyoftherequirementsinAPI2350.

Is API 2350 applicable outside the US?Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Itisintendedtobeequallyvalidandapplicableworldwide.

Where can I get API 2350?Thestandardcanbedownloadedfromwww.api.orgforasmallfee.

What does API 2350 say about Wireless communication?AccordingtoAPI2350,theuseofwirelesscommunicationisacceptable,exceptforonespecificuse-case:“AOPSshallnotrelyonwirelesscommunicationtoinitiatediversionorterminationofreceipt”(AnnexA).InAOPS,wiredandwirelesscommunicationcanhoweverbeusedsimultaneously,ifthewirelesslinkisusedfordeviceanddiagnosticsmonitoring,andnottoinitiatediversionorterminationofreceipt.

XXVIII

D.AbouttheAuthors

Phil E. Myers, API 2350 Committee Chairman

PhilE.MyershaschairednumeroustaskgroupsfortheAmericanPetroleumInstitute,includingAPI2350.Currently,heisthedirectorofPEMYConsulting.HehasalsoworkedatChevronCorporationwherehewasamechanicalintegrityspecialistfortanks,pipingandpressurevesselsspecializinginsafetyandrisk.MyersholdsaBScinChemicalEngineeringfromUCBerkeleyandanMScinTheoreticalandAppliedStatisticsfromCaliforniaStateUniversity.

Carl-Johan Roos, Emerson Safety Expert

Carl-Johan“CJ”Rooshasover10yearsofglobalexperiencefromvarioustechnicalandmanagerialpositionsintheprocess-andtankgaugingindustry.BesidesAPI2350,hehasactivelyparticipatedinnumerousproductspecificIEC61508-CertificationsandsitespecificIEC61511-relatedprojects,besideshisusualworkasbusinessdevelopmentmanageratEmerson’sProcessLeveldivisionwhereheoftenaddressesnationaloverfillpreventionregulationsuchasTÜV/DIBtWHGinGermany.RooshasaMScinElectricalandComputerEngineeringfromGeorgiaTechandChalmersUniversity,andaMBAfromtheUniversityofGothenburg.

HeadquartersEmersonProcessManagementRosemountTankGaugingBox13045SE-40251GothenburgSWEDENTel:+46313370000Fax:+4631253022E-mail:[email protected]

RosemountisaregisteredtrademarkofRosemountInc.FoundationisatrademarkoftheFieldbusFoundation.TheEmersonlogoisatrademarkandservicemarkofEmersonElectricCo.

Thecontentsofthispublicationarepresentedforinformationpurposesonly,andwhileeffortshavebeenmadetoensuretheiraccuracy,theyarenottobeconstruedaswarrantiesorguarantees,expressedorimplied,regardingtheproductsorservicesdescribedhereinortheiruseorapplicability.Allsalesaregovernedbyourtermsandconditions,whichareavailableonrequest.Wereservetherighttomodifyorimprovethedesignsorspecificationsofourproductsatanytimewithoutnotice.RosemountTankRadarABacceptsnoresponsibilityforanyerrorsthatmayappearinthispublication.

©R

osem

ount

Tan

kRa

darA

B.R

ef.N

o.9

0103

0en.

Rev

BA

,Feb

ruar

y20

13

North America EmersonProcessManagementRosemountTankGaugingNorthAmericaInc.6005RogerdaleRoadMailStopNC13677072TXHoustonUNITEDSTATESPrimaryPhone:+12819884000SecondaryPhone:+18007222865E-mail:[email protected]

Asia PacificEmersonProcessManagementAsiaPacificPteLtd1PandanCrescentSINGAPORE128461Tel:+6567778211Fax:+6567770947E-mail:[email protected]

Middle East & AfricaEmersonProcessManagementRosemountTankGaugingMiddleEast&AfricaP.OBox20048ManamaBAHRAINTel:+97317226610Fax:+97317227771E-mail:[email protected]

www.rosemount-tg.com

Local Tank Gauging ExpertFindyourlocalTankGaugingExpertatwww.rosemount-tg.com/contacts

the complete guide to api 2350 - · pdf filethe complete guide to api 2350. 2 content 03. an...

Documents