the complete guide to api 2350 learn about api implementation

The Complete Guide to

API 2350

2

Content

03. AnIntroductiontoAPI2350

07. MotivatingRobustOverfillProtection

10. ImplementationofAPI2350

13. OperatingParameters

19. EquipmentandOperations

20. AutomatedOverfillPreventionSystem(AOPS)

22. SummaryandConclusions

23. Appendix

A. EquipmentSolutions

B. API2350ComplianceChecklist

C. FrequentlyAskedQuestions

D. AbouttheAuthor

3

AnIntroductiontoAPI2350

Tankoverfillsareamajorconcerntothepetroleumindustry.Thebestcasescenarioisthatyouhavetocleanitup.Theworstcasescenarioinvolvesgoingoutofbusiness,andendingupincourt.Asaresponsetothis,theindustryhasworkedjointlytocreateanewAPI/ANSIStandard2350Edition4:“OverfillProtectionforStorageTanksinPetroleumFacilities”.Thisnewstandardisadescriptionoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.

API2350wascreatedbytheindustryfortheindustrywithcontributionsfromawiderangeofindustryrepresentativesincluding:tankownersandoperators,transporters,manufacturers,andsafetyexperts.Thistogetherwiththefactthatitsinglesoutaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks)andaspecificuse-case(overfillprevention)makethisstandardunique.Itdoesnotcompetewithothermoregenericsafetystandards,butisintendedascomplimentthem.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isoneexampleofhowtofulfillsomeoftherequirementsinAPI2350.

Theindustryadoptionratetothisstandardisexpectedtobeveryhighbecauseofitsobviousbenefits,combinedwiththeworld’sever-increasingneedformoresafety.ThequestionforatankowneroroperatoriswethertheycanaffordnottoimplementAPI2350.Becauseofthestandard’sgenericnature,itisexpectedtoalsobeapplicabletonearbytanksoutsidethestandard’sspecificscope,containing,forexample,chemicalsorClass31petroleumliquids.

Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Thus,itisintendedtobeequallyvalidandapplicableworldwide.

Thisguidewillprovidethebasicelementsneededforapetroleumtankowner/operatortoapplytheAPI2350toneworexistingtankfacilitieswithminimaleffortandmaximalgains.Youshouldreaditbecausethisnewstandardisexpectedtobecomeagame-changerwithinoverfillprevention,andbyreadingyourcompanycanalsoreapthebenefitsthatcomefromapplyingthelatestbestpractices.ThestandarditselfisavailableforasmallfeefromAPI’swebsite(www.api.org).

1 NFPANationalFireProtectionAssociation.Class1liquidshaveflashpointsbelow100°F.Class2liquidshaveflashpointsatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.

4

PurposeThetargetaudienceforthisguideareownersandoperatorsoffueldistributionterminals,refineries,chemicalplantsandanyotherfacilitieswhichreceivepetroleumorchemicalproductsintostorage.ThekeyindustrychangerelatedtotankoverfillsisthepublicationofanewversionofAPI2350“OverfillProtectionforStorageTanksinPetroleumFacilities”,the4theditionpublishedinMay2012.ThegoalisthentounderstandwhichchangeshaveemergedinthisnewstandardandhowtoapplythemforthepurposeofadoptionandcompliancewithAPI2350.Anyoneresponsibleforsafeoperationsatfuelmarketing,distributionterminals,refineries,oilhandling,orpipelinecompaniesshouldtakeadvantageofthestateofartintankoverfillpreventionthatwillbediscussedinthisguide.WhilethescopeofAPI2350appliestothefillingofpetroleum-basedproductsassociatedwithmarketing,refining,pipelineandterminalfacilities,itsprinciplesmaybeappliedtoanytankoperationwherethereisariskofoverfillingthetank.

MostapplicationsunderAPI2350involveatmosphericorslightlypressurizedtanks,buttheprinciplesofAPI2350canbeusedforhigherpressurestorageaswell.ThescopeofAPI2350appliestooverfillprotectionforNFPA2Class1andClass2liquidsandisalsorecommendedforcomplianceregardingClass3liquids.The“ScopeofAPI2350”(seebelow)presentsamoredetailedbreakdown.Forflammableliquidsclassifiedbyfirecodes(Class1liquids)API2350canmitigatethelikelihoodofspillingthesehazardousproductsandthelikelyresultingfacilityfire.Sincespillsofnon-volatileorganicliquidssuchaslubeoilsorheavyasphalticproductsareoftenconsideredanenvironmentalhazard,overfillsoftheseproductsarealsoaddressedbythenewAPI2350.

2 NFPANationalFireProtectionAssociation.Class1liquidshaveflashpointsbelow100°F.Class2liquidshaveflashpointsatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.

Scope of API 2350 (4th Edition)

API2350appliestopetroleumstoragetanksassociatedwithmarketing,refining,pipeline,

terminalsandsimilarfacilitiescontainingClassIorClassIIpetroleumliquids.API2350

recommendsincludingClassIIIliquids.

API 2350 does not apply to:

• Undergroundstoragetanks

• Abovegroundtanksof1320USgallons(5000liters)orless

• AbovegroundtankswhichcomplywithPEI600

• Tanks(processtanksorsimilarflowthroughtanks)thatareintegraltoaprocess.

• Tankscontainingnon-petroleumliquids

• TanksstoringLPGandLNG

• TanksatServiceStations

• Loadingordeliveryfromwheeledvehicles(suchastanktrucksorrailroadtankcars)

PEIRP600RecommendedPracticesforOverfillPreventionregardingShop-Fabricated

AboveGroundTanksforoverfillprotectionwhereapplicableforabovegroundtanksfalling

outsidethescopeofAPI2350.

5

Fourth generation of API 2350ThecurrentAPI23503appliestofillingtankswithpetroleum-basedproductsforthepurposeofpreventingoverfills.Embracingradicalchangescomparedtopreviousversions,thisnewstandarddeservesaclosereview.Also,betweenthelasteditionandthecurrentedition,importantnewsafetystandardsthatapplydirectlytotankoperationshavebeenintroducedintothepublicdomain.ThecurrenteditionofAPI2350buildsonbestpracticesfromboththepetroleumindustryandfromotherindustriesandappliesthemdirectlytotankoverfillprotection.AnexampleofamajorchangeintroducedinthenewversionofAPI2350istherequirementforasafetymanagementsystem.Asaresultofthesweepingchangestothisstandard,understandingandusingitwillrequiresomepatienceandguidance.

AkeyandinfluentialeventthatshapedthecurrenteditionofAPI2350wastheBuncefieldconflagrationarisingfromapetroleumtankoverfillattheHertsfordshireOilStorageTerminal(HOSL)nearHeathrowAirport.OnDecember11th2005,thefireengulfed20tanksresultinginthetotaldestructionoftheterminalandnearbyfacilities.ThisfirewastheworstinEuropesinceWorldWarII.TheBuncefieldincidentwasalsooneofthemostintenselystudiedtankoverfilleventsofalltime.Fortunately,thelessonslearnedfromthisincidenthavebeencapturedbytheUnitedKingdom’sHSE4inreports5coveringthisincident.

API2350representstoday’sminimumbestpracticessotankownersandoperatorscannowprepareforwhatwillundoubtedlybethebenchmarkforgenerallyrecognizedgoodpracticeinthepetroleumstoragebusiness.

Learning from past experiencesThefollowingquotefromtheUnitedKingdom’sHealthSafetyExecutiveBuncefieldinvestigationshowsunsurprisingly,thatfaultsinmanagementsystemsareakeyrootcauseoftankoverfillincidents.

“Management systems in place at HOSL relating to tank filling were both deficient and

not properly followed, despite the fact that the systems were independently audited. Pressures

on staff had been increasing before the incident. The site was fed by three pipelines, two of which

control room staff had little control over in terms of flow rates and timing of receipt. This meant

that staff did not have sufficient information easily available to them to manage precisely the

storage of incoming fuel. Throughput had increased at the site. This put more pressure on site

management and staff and further degraded their ability to monitor the receipt and storage of

fuel. The pressure on staff was made worse by a lack of engineering support from Head Office.”

Unfortunately,thescenariosdescribedaboveleadingtothisincidentarealltoocommon.Butfortunately,theAPICommitteedevelopingthenewAPI23504thedition,fullyintegratedthelessonslearnedfromBuncefieldaswellasotherincidentsandcombinedthemwiththebestpracticesfortankfillingoperationsfromeverysectorofthepetroleumindustry.Infact,theUnitedKingdom’sHSEwasoneofthecommitteememberstoensurethatalllessonslearnedfromBuncefieldwerecapturedinthe4theditionofAPI2350.

3 OverfillProtectionforStorageTanksinPetroleumFacilities,ANSI/APIStandard2350-2012,FourthEdition,May20124 HSEHealthSafetyExecutiveisagovernmentalsafetyagencyintheUnitedKingdomresponsibleforpublicandworkerhealthandsafety5 http://www.buncefieldinvestigation.gov.uk/reports/index.htm

6

TheAPIcommitteeisaconsensus-basedstandardsdevelopmentorganizationandthecurrenteditionofAPI2350ensuresaworldwideperspectiveontankoverfillprotection.Theworldwidebestpracticesfromdifferent;countries,regulatoryagencies,andcompanieshavebeenstudiedandcompiledintotheneweditionofAPI2350.

7

Reducing liabilitiesClearly,thepreventionofoverfillsisasignificantandobviousbenefittotankowners/operators.Alltankowners/operatorsknowthatprotectionofthepublicandworkershealthandsafety,theenvironment,andassetsareimportant.Butwhatmaynotbesoobvioustothemisthatthebenefitsthatcanresultbyapplyingthelatestthinkingrelatedtotankoverfills.ThenewmanagementsystempracticesencouragedbyAPI2350mayactuallyimprovethenormalday-to-dayoperationsandefficiencyforafacility.

ThepreviouseditionsofAPI2350canbeconsideredalistoftheequipmentandoperatingpracticesthatareneededtopreventoverfills.Suchlistshavevalue,buteliminatingtheriskoftankoverfillsrequiresmuchmorethanjusttheuseoflists.Eliminatingoverfillsrequiresaformalandcomprehensivesafetymanagementsystem.

Tankoverfillsarerelativelyrareeventssowhyaretheserareeventsofconcern?Thereasonisthattheconsequencesofoverfillscanexceedmost,ifnotallotherpotentialscenariosatapetroleumfacility.Whilerare,seriousincidentsusuallyyieldriskstothetankowners/operatorsthataredeemedunacceptable.Thefactthattheremaybepropertydamages,injuriesorevenfatalitiesisonlythebeginningoftheaccidentscenario.LiabilitiesofvariouskindscangoonforpagesasareviewoftheBuncefieldincidentreportsshows.InsomecasesbeingforcedoutofbusinessistheendresultasinthecaseofCaribbeanPetroleuminthePuertoRico(October23,2009)incident.

Other benefitsInadditiontoreducingliabilities,therearebenefitsimpactingoverallfacilityoperationalefficiencyandreliabilityasmentionedabove.SinceAPI2350usesthelatestprinciplesofmanagementsystems,operationalimprovementsingeneralmayresultfrom:

• Simplifiedandclarifiedresponsetoalarms• Moreusabletankcapacity(explainedlater)• GeneralizedunderstandinganduseoftheManagementofChange(MOC)process• Operatortrainingandqualification• Inspection,maintenanceandtesting• Proceduresfornormalandabnormalconditions• Lessonslearnedusedtoevolvebetteroperational,maintenanceandfacilitypractices

MotivatingRobustOverfillProtection

8

Major components of API 2350 (past and present)ThekeyelementsofAPI2350maybeconsideredtocomprisethefollowingelements:

• ManagementSystem(OverfillPreventionProcessorOPP)• RiskAssessmentsystem• OperatingParameters – LevelsofConcern(LOCs)andAlarms – Categories – Responsetime – Attendance• Procedures• EquipmentSystems

Thefirsttwoelementsaremajoradditionsthatwereabsentinpreviouseditions.API2350definestheManagementSystemtobetheOverfillPreventionProcess(OPP).Inotherwords,whenyoureadorhearthetermOPP,justthinkofthemanagementsystemconcept.

Next,OperatingParameterswasatermcoinedtodesignatethetankspecificdatarequiredtousethestandard.TheseincludetheLevelsofConcern(LOCs)valueofimportantliquidlevelssuchasCriticalHigh(CH),HighHighTank(HH)andMaximumWorkingLevel(MW).AlsoincludedaretheCategoriesofoverfillprotectionsystemswhicharedesignatedbythetypeandconfigurationofequipmentbeingusedforoverfillprotection.AnotheroperatingparameteraretheResponseTime(RT)andAttendance.Alloftheseoperatingparametersarediscussedindetaillater.TheyshouldbethoughtofasthedataabouttankfacilitiesrequiredtouseAPI2350efficiently.

Theproceduresandequipmentsystemelementsaresimilartopasteditionsandwereupdatedtoreflectthechangesaboveaswellastoapplysomeimprovementsoverpasteditions.

Finally,perhapstheleastappliedbutbiggestchangeistheadoptionofguidanceapplicabletoSafetyInstrumentedSystemswhichcanautomatetheterminationofareceiptintheeventthattheHHLOCisexceeded.Suchsystemsaresometimescalled“automatedsafetyshutdownsystems”or“safetyinstrumentedsystems”,butinAPI2350thesearecalled“AutomatedOverfillProtectionSystems(AOPS)”.

Management systemsAManagementSystemallowsanorganizationtomanageitsprocessesoractivitiessothatitsproductsorservicesmeettheobjectivesandtermsset.Theobjectivescanvaryfrom;satisfyingthecustomer’squalityrequirements,complyingwithregulations,ortomeetenvironmentalobjectivesandmanagementsystemsoftenhavemultipleobjectives.Manycompaniesusemanagementsystemstoreducesafety,healthandenvironmentalincidentstoaslowarateaspossible,giventhestateoftheartforbusinessoperationsbestpracticestoday.

ManagementsystemsareattheheartoftheneweditionofAPI2350.API2350linesupwiththecurrentindustrythinkingbyrequiringtheapplicationoftheOverfillPreventionProcess(OPP).OPPisthepeopleandequipmentassociatedwithtankfillingoperationstomaintainanoptimallytunedsystemforhighperformancewithoutoverfills.TheinclusionofOPPissignificantinthatthestandard

9

isnolongerjusttalkingabouthowtodesign,operateandmaintainsuchsystems,butistalkingabouthowthecompanyshouldrunitsprocessesandproceduresassociatedwithtankfillingoperations.

AlthoughAPI2350requiresamanagementsystemforoverfillpreventionandprotection,itdoesnotspecifyhowtodeveloporimplementone.Organizationstypicallyrelyuponmanagementsystemsthathavebeendevelopedasaresultofseriousincidentsinthepast.Thesemanagementsystemsarerelativelycommonamonglargeandmidsizeorganizations.Theseorganizationshavelearnedtousethesesystemstosystematicallyreduce,controlandmanageincidentsaswellastoimproveotheraspectsoftheirbusinesses.Inordertobeeffective,thesesystemsmustbeintegratedintothe“corporateculture”andmustbefitforpurpose.Eventhesimplestofsuchsystemsrequirelotsoftime,energyandresourcesandmustbeactivelysupportedbytheverytopleveloftheorganization.Withouttopmanagementactivesupportandpromotion,thereisnohopeforaworkingmanagementsystem.

Itisrecommendedthatorganizationswhichdonotuseanyformofsafetymanagementsystemconsiderdevelopmentandimplementationofabasic,fitforpurposesafetymanagementsystem.ThentheyensurethatthesafetymanagementsystemincorporatestherelevantprinciplesfromAPI2350.Thisrecommendationisespeciallyimportantforthosecompaniesthataregrowingorthosethatareacquiringothercompaniesintheirgrowthcycle.Anyacquisitionispotentiallyhighriskuntilallofitsmanagementsystemsaswellasitsequipmentsystemsandoperationsareintegrated.

Risk assessmentAPI2350requirestheuseofariskassessmentsystem.Eachtankunderthisstandardmusthaveariskassessmentperformedtodeterminewhetherriskreductionisrequired.Riskassessmentisameansofcombiningtheconsequenceandlikelihoodofanoverfillorotheraccidents,usuallyfortwopurposes.First,acommonscaleorrankingmethodologyneedstobeappliedtothemanydifferentpossibleaccidentsorlossscenariosthatafacilityisexposedto.Forexample,theriskofarogueemployeeattemptingtosabotageafacilityisdifferentthantheriskofatankoverfill.Withoutriskassessmentthereisnorationalwaytounderstandwhichscenariomaybeworse.Second,sinceresourcesarealwaysscarce,riskassessment,throughtheriskmanagementprocess,allowsacompanytocompareandprioritizetheserisksforthepurposeofallocationofbudgetsandresourcestomitigatetheminsuchawaythatthemostseriousrisksaremitigatedfirst.

Unfortunately,API2350requiresthatthetankowner/operatoruseariskassessmentsystemtoaddressrisk,butdoesnotprovideanyinformationorguidanceonhowtodeveloporusesuchasystem.Whilethismayseemstrange,itistheonlywaythatageneralindustrystandardcanbewrittenforageneralpopulationofhighlyvariablefacilitiesandtankowners,eachwithdifferingperceptionsofriskthreatsanddifferingcorporatevalueschemes.

AgoodstartingpointforriskassessmentresourcescanbefoundinIEC61511-3Part3:“Guidanceforthedeterminationoftherequiredsafetyintegritylevels–informative”andIEC/ISO31010“RiskManagement–RiskAssessmentTechniques.”

10

OverviewTheprimaryenablingmechanismthatallowsadoptionofAPI2350istopmanagementendorsementandsupportforthesafetymanagementsystem(OPP).Thismeansthatformalprocessesforalloftheelementscoveredin“ManagementSystems”(seebelow)willbedocumented,created,revisedandformallysetintomotionusingaformalcorporateprogramstructure.

ImplementationofAPI2350

Management Systems

Specific Elements of the Management Systems for Overfill Prevention

• Formalwrittenoperatingproceduresandpracticesincludingsafetyproceduresand

emergencyresponseprocedures

• Trainedandqualifiedoperatingpersonnel

• Functionalequipmentsystems,testedandmaintainedbyqualifiedpersonnel

• Scheduledinspectionandmaintenanceprogramsforoverfillinstrumentationand

equipment

• Systemstoaddressbothnormalandabnormaloperatingconditions

• Amanagementofchange(MOC)processwhichincludespersonnelandequipment

changes

• Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents,

• Asystemtosharelessonslearned

• Afollow-upsystemtoaddressanyneededmitigationofcircumstancesleadingtonear

missesorincidents

• CommunicationsystemsprotocolswithintheOwner/Operatororganizationandbetween

theTransporterandtheOwner/Operatorthataredesignedtofunctionunderabnormalas

wellasnormalconditions

Benefits of Management Systems

• Safetyandenvironmentalprotection

• Optimizationoftheworkplaceandoperatingpractices

• Inspection,testing,andmaintenance

• Equipmentandsystemselectionandinstallation

• Safeworkpractices,emergencyproceduresandtraining

• Managementofchangeprogramsrelativetotankoverfillprotection

• Inclusionofcurrenttechnologyandpracticesrelatedtoprocesscontrolandautomated

safetyinstrumentedsystems

11

Figure1(seebelow)-“ConceptualManagementPlanforImplementationofAPI2350”-givestheoverallconceptassociatedwithimplementationofAPI2350.Afirststepissettingupaprocessfordatamanagementassociatedwiththetankoverfillprotectionprogram.Theexistingtankconfigurationmustbeunderstood.Thetankconfigurationisthetypeofinstrumentationthatthetankhas,itsLOCs,alarmandgaugingsystemsandtheoperatingparametersincludinganyrelevantinformationtotheOPP.Thismeansthatallrelevantdataforeachtankneedstobecollectedandaprocessforkeepingituptodateestablished.“RiskConsiderationsforRiskAnalysis”(seepage12)examinessomeoftheinformationconsiderationsneededtoestablishrisk.Thedatabase(1)(2)involvesalltankswithinscopetobeincludedinthetankoverfillprotectionprogram.

Figure 1: Conceptual Management Plan for Implementation of API 2350 (Note:Diagramshowsconceptuallyhowonemayapproachmanagingtheprocessofbringingapopulationofexistingandproposednewtanksforexistingfacilitiesintocompliancewiththe4theditionofAPI2350)

Thedatawillprovideinformationaboutoperatingparameters,tankspecificinformationandanyotherinformationrelevanttoestablishingcompliancewiththestandard.Whilesometankconfigurationsmayhaveacceptableresidualriskothersmaynot.Itisonlyafterariskassessmentprocess(3)isappliedtoeachtankthattheacceptableconfigurationcanbeestablished.Eachtankoverfillsystemwillthenbeclassified(4)aseithercompliantornon-compliantwithAPI2350.Inotherwords,theriskiseitheracceptableorunacceptable.

Theclassificationresultsintheabilitytodoagapassessmentplan(5)whichwillshowwhatchangesareneededtobringthetanksto/withinacceptableriskandintocompliancewithAPI2350.Oncethescaleofchangesneededtobringthetanksystemintocomplianceisunderstood,ariskmanagementprocess(6)canbeusedtoprioritizerisksandtodeterminehowmuchfundingisrequiredtoclosethegapandmakealltankscompliant.

Data ManagementProcess and Tank Database

1)2)

Risk AssessmentProcess

3)

API 2350 CompliantConfiguration(acceptable configuation)

4)

Gap Assessment5)

Modified Tank Systemsand Configuration withAcceptable Risks Compliant with API 2350

8)

Risk ManagementProcess

6)

Establish OperatingParameters and Tank Data:

• Tank Category• LOCs• Alarms• Alerts• Response Time• Attendance• AOPS if applicable• Logic solvers• Final elements• Tank details• Risk data

Project Executionfor Gap Closure

7)

Existing Tank System Configuation (all tanks)

START

FINISH

Schedule for Project Execution

12

Risk Considerations for Risk Analysis

Probability or Likelihood Factors• Frequency,rateanddurationoffilling• Systemsusedtoproperlymeasureandsizereceiptstotanks• Accuratetankcalibration(bothstrappingandverifiedCriticalHigh)• Systemsusedtomonitorreceipts• Extentofmonitoring/supervisionofmanualandautomatictankgauging• ImpactofcomplexityandoperatingenvironmentontheabilityofOperating

Personneltoexecuteoverfillpreventiontasks – Fillingmultipletankssimultaneously – Switchingtanksduringreceipt.

Consequence Factors – Impact of Hazardous Material Release on Vulnerable Exposures Hazard characteristics of material (product) in tank volatility, flammability, dispersion, VCE potential• Numberofpeopleonsitewhomightbeaffectedbyatankoverflowing• Numberofpeopleoffsitewhomightbeaffectedbyatankoverflowing• Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite• Possibilityofimpacttonearbysensitiveenvironmentalreceptors• Physicalandchemicalpropertiesofproductreleasedduringoverflowing• Maximumpotentialoverfillflowratesandduration

Oncetheriskmanagementprocess(6)iscompleted,theprojectengineeringandexecutionphases(7)forimplementationofchangescanbegin.Closingthegapwilltakesometimeanditisafundamentalprincipleofriskmanagementthattheworstrisksshouldbereducedfirst.Thegapclosureplanshouldbebuiltwiththisprincipleinmind.Ultimately,theprocessaimstokeeptheowner/operatorcomplianttoregulations(8).

Theprocessabovewillalsoaddressproposednewtanksthatareaddedtothesystem.Theymustbeevaluatedtothesamecriteriaandrunthroughtheprocess,butunlikeexistingtankstheywillnormallybebuilttobecompliantduringconstruction.

Theprojectexecutionphaseshould,ofcourse,usetheManagementofChange(MOC)processesandinteractwiththedatamanagementsystemtoensurethatinformationinthetankdatabaseisupdatedwhenchangesaremade.Moredetailonthesestepsfollows.

13

InitializationPartofthedatamanagementprocessisthedeterminationofwhatAPI2350callsoperatingparameters.Tankowners/operatorswhoadoptAPI2350mustestablishorvalidatethetankoperatingparameters.Theseincludeknowledgeaboutthetankcategories,LevelsofConcern(LOCs),alarms,alerts,AutomaticOverfillPreventionSystem(AOPS)(ifapplicable),andattendancetype.

CategoriesAlltanksmustbecategorizedaccordingtoAPI2350asshowninFigure2(seebelow)-“DefinitionofOverfillProtectionSystemCategories”.Thecategoriesareameansofgroupingallofthemanydifferentpossibletankoverfillgaugingconfigurationsintothreebroadconfigurationcategories.Whilethestandardsaysnothingaboutwhichcategoryis“better”westatethatgivenallthingsequal,thehigherthecategorynumberthemorereliableisthegaugingandalarmsystem.

OperatingParameters

Figure 2: Definition of Overfill Protection System Categories

• Local and/or remote Manual Operations• Tank levels given by ATG• Transmittable levels and alarming• Independent Level Alarm High High (LAHH)• Overfill protection dependant on manual intervention by local and/or remote Operator

• Automatic Overfill Prevention System

• Local and/or remote Manual Operations• Tank levels may be read using ATG or sensor(s) located on tankwith ability to transmit a signal and/or annuniciate alarm(s)• May use dependent alarm• Overfill protection dependant on manual intervention by local and/or remote Operator or automated, dependent, shutdown

• Local Manual Operations• Taking receipts depends on using hand gauging or ATG• Does not have transmittable alarms or any mechanism to annunciate alarms• Overfill protection dependant on manual intervention by local Operator

LAHH

Category I System Category II System

Category III System AOPS System

LAH

ATG

LAHH

ATGATG

LAHH LSH

Logic Solver

LAH

ATG

14

Category ICategory1systemsareessentiallymanualsystemssuchasmeasurementofthelevelby“sticking”,insertionofatapeorrodwhichindicatesthelevelofoilonit.WhileanAutomaticTankGauging(ATG)maybeatthetankandusedforlevelmeasurement,ithasnocapabilitytotransmitlevelsignalssoallinformationaboutlevelislocalizedtothetank.Thiscategoryshouldonlybeusedwhentherisksarelow(noClass1liquids),thereceiptoperationisinfrequent,therateoflevelriseisslowandwheretheoperationissosimplethatanoperatorhasvirtuallynochanceofmakingamistake.Category1systemsmayonlybeusedforafullyattendedoperation.

Category 2Category2systemshavetheabilitytotransmitlevelandalarminformationtoacentralizedorremotecontrolcenter.ButthealarmisdependentsothatanATGfailurecancausetotallossofinformationaboutthetanklevelsaswellasthealarms.Category2systemshavenoredundancyandsoshouldonlybeusedifthefailurerateoftheATGandlevelsystemisextremelylow(i.e.thebestpossibletechnologyavailable).Category2ispermittedonlyforattendedandsemi-attendedfacilities.WhilemosttankfacilitiesarefittedwithCategory2systems,mostarealsofittedwithunreliableautomatictankgaugesmakingtheseparticularlyvulnerabletoanoverfillevent.

Category 3Category3systemsarelikeCategory2systemsbutarecharacterizedbyhavinganindependentalarm.TheindependentalarmensuresthatanATGfailurewillnotcauseafailureofthealarmfunction.Category3systemsareconsideredthebestavailableconfigurationandtechnologyfortankfillingoperationsandalarmsystems.Theymaybeusedatafacilitywhichisattended,semi-attendedorunattended.

Automatic Overfill Prevention System (AOPS) NotethatAOPSisasystemwhichisindependentoftheBasicProcessControlSystem(BPCS).TheAOPSinFigure2(page17)canbecombinedwithanyofthecategories,however,inmostcases,itwouldmakesensetocombineitwitheitheraCategory2or3overfillpreventionsystem.SometimesAOPSisalsocalled“Category4”.

Other ConfigurationsAPI2350makesabroadclassificationofsystemsbutcannotcoverallcases.Forexample,sometankowners/operatorsuse2ATGsinsteadofasingleATGandpoint-levelalarm.TheseconfigurationsshouldbeconsideredCategory3sincethisconfigurationisusedinthesamewayasaCategory3system.However,itismorerobustbecauseoftheextralevelinformationavailable.Forexample,adualATGsystemcannotonlyalarmatHHbutonavariationbetweenthetwoATGsprovidinganotherdimensionofreliability.

API2350cannotcoveralldifferentcasesandinthosecasesthestandardcouldneverthelessbeusedasaguide.Alternatesolutionsthanthosethatarerecommendedinthisguidecanbeapprovediftheyarebetterandmoresafethatwhatissuggestedinthestandard.

Levels of Concern (LOCs)LOCsaretheoreticallevels.Thatis,theydonothavetohaveequipmentassociatedwiththem.Theyarejustliquidlevelpositionsthatarerecordedintheoperatorsdocumentationsuchasinstraptables,inthecontrolroomdisplaysorprocedures.

15

Critical HighForexample,letusstartwiththehighestLOC.ThisistheliquidlevelatwhichanoverflowordamagecanoccuranditiscalledtheCriticalHigh(CH).SeeFigure3above.Notethatthereisnoequipmentrelatedtotankgaugingplacedatthislevel.

High HighMovingdowntothenextLOCwehaveHighHigh(HH).Thisisthealarmforhighlevel.ItisalsotheonlyalarmrequiredbyAPI2350.Currently,mostoperatorsusebothaHighandHighHighalarm.API2350nowrequiresonlyonealarm.An“alert”maybeusedinsteadoftheHighalarmifdesired.

Havingsaidthis,onespecificreasontostickwiththeoldermethodoftwoalarmsmaybeduetotheunreliabilityofthealarmsensors.Iftheyarenothighlyreliable,thenthesecondsensorgivestheoperatora“secondchance”bystillalarmingeventhoughoneofthesensorshasfailed.

Figure 3: API 2350 Tank Levels of Concern (LOCs) – Category 2 and 3 Configurations

ThisimprovedreliabilitywasintroducedintothetankbusinessinpreviouseditionsofAPI2350aswellastheNFPA630FireCodewhichusedtheconceptofredundancyofsensorsystems.

6 NationalFireProtectionAssociation30FlammableandCombustibleLiquids

16

However,usingthehighlyreliablesensorsthatareonthemarkettoday,asinglehighreliabilityalarmcanbebetterthantwounreliablealarmsandsoonlyonealarmisneededandrequired.Thedecisiontotakeadvantageoftheone-alarmrequirementshouldbebasedonmanyfactors,butperhaps,mostimportantly,onaformalmanagementofchangeforthetankoverfillsystems.

Maximum Working (MW) Level Movingdownagain,theMWlevelmayormaynothaveanylevelsensors.Analertmaybeusedatthisleveliftheoperatorchooses.

Automated Overfill Protection System (AOPS) Level IfanAOPSisappliedthenitwillbesetatorabovetheHH.ThelevelatwhichtheAOPSissetiscalledtheAOPSlevel.

Updating and Management of Change (MOC)AccordingtotheOPPtheLOCsmustbeperiodicallyreviewedandupdated.AnMOCshallbeusedwheneverchangessuchasthoselistedin“SomeManagementofChange(MOC)Triggers”(seebelow)occur.

Some Management of Change (MOC) Triggers

Tank Modifications That Trigger MOC• Newtank• Changeinfloatingrooftankseals• Installationofgeodesicdomesorotherkindsoffixedroofs(e.g.whenexternal

floatingrooftanksreceiveretrofitcovers).• Newinternalorexternalfloatingroof• Sideventchanges• Shellextensions• Newtankbottom• Additionofancillaryequipmentsuchasfoamchambers• Recalibrationorre-strappingofthetank• Changeoftankgaugingequipment• Additionofagaugetubewithdatumorchangeindatum/strikeplate

Operating Changes Trigger MOC• Changeinproduct• Changeinincomingoroutgoinglines• Changeinflowrates,• Changeinserviceifitimpactsstructuralintegrity(corrosion,temporaryrepairs,etc.)• Changeinoperations,suchas:paralleltank,floatingorhighsuction,continuousmixer

operation• Changeinresponsetimeresultingfromstaffing,operationorequipmentchanges

17

AttendanceTanksfacilitiesaregroupedaccordingtowhetherassignedpersonnelareonthepremisescontinuouslyduringtheentirereceiptoperation(fullyattended),onthepremisesjustduringthebeginningandendingofthereceipt(semi-attended)ornotpresentduringanypartofthereceipt(unattended).Thetankowner/operatormustensurethatthefacilityoperationisconsistentwiththisdefinitionsothatthecorrectcategoryoftankdescribednextcanbeassignedtotheseattendancelevels.Table1(seebelow)-“MonitoringProductReceipt”-presentsattendancerequirementsformonitoringreceipts.

Table 1: Monitoring Product Receipt

Categories vs Attendance Level

Category1Facilities

MustBeAttended

Continuouslyduringfirst

hourofreceipt

Everyhourduringreceipt

Continuouslyduringthe

lasthourofreceipt

Category2Facilities

IfSemi-Attended

Emergencyconditions

(equipmentmalfunctionor

powerfailure)mayrequire

operationasaCategory1

facility(see4.5.3.6)

Continuouslyduringthefirst

30minutesofreceipt

Hourlynotapplicable

Continuouslyduringthelast

30minutesofreceipt

Category3Facilities

IfUnattended

Emergencyconditions

(equipmentmalfunctionor

powerfailure)mayrequire

operationasaCategory1

facility(see4.5.3.6)

Nolocalmonitoring

requirements.For

unattendedfacilities,

continuousmonitoring

duringreceiptbythe

operator,transporter,orby

computer.

Seeabove

Seeabove

Response TimeResponsetimeisthetimenecessaryfortheoperator,undermostoperatingconditions,toterminateareceiptafteraHHalarminitiates.Theresponsetimeshouldbecarefullydocumentedandestablishedforeachtank.Manyoperatorswillchoosetouseasetfixedtime,suchas15minutestoterminatethereceiptsincethissimplifiestheoperatingprocedures.However,untiltheresponsetimeisformallyestablishedAPI2350requiresverylongresponsetimesasseeninTable2(seepage18)-“DefaultMinimumHigh-HighResponseTime”.Becauseofthisitisclearthatcomputingandauditingtheactualresponsetimewillpayoffinthelongrun,anditisalsoarequirement.

18

Table 2: Default Minimum High-High (HH) Response Time

TimeallocatedforoperationstoterminateareceiptpriortoreachingeitherAOPSifitexistsorcritical

high(CH).

Minimum High-High Tank (HH) Response Time (if not calculated)

Category

1

2

3

Time in Minutes

45

30

15

Thesevaluesmaybereducedonlyiftheactualresponsetimesarevalidated.

19

ProceduresOverfillPreventionSystem(OPS)isusuallyassociatedtotheequipment,butequallyimportantisthatitisoperatedproperlyaccordingtotheprocedures.That’swhyalargeportionofAPI2350focusesontheseprocedures,e.g.proof-testingwhichisdescribedbelow.

EquipmentSignificantprogressinthedesignandreliabilityoftankgaugingandalarmsystemshasbeenmadeinrecentyears.However,API2350doesnotgetintowhichequipmentortechnologyshouldbeused.

Proof TestingTheimportanceofprooftestingcannotbeoveremphasized.Whensystemssuchastankalerts,alarmsorAOPSfailthefailuresareforthemostpartunrevealed.Forexample,supposeanoperatordependsonasensorlocatedatHHtothealarmincasethereisafailuretoterminatethereceipt.Ifthisalarmisfailedthentherewillmostlikelybeanoverfill.Thistypeoffailureisreferredtoasadangerous,undetectedfailureifthepurposeofthealarmsystemisforsafety.WhilegreatadvanceshavebeenmadeforselfdiagnosticelectronicsensorsandATGS,whichmonitormanyifnotmostofthefailuremodesandoutputadiagnosticalarminsuchcases,howevernosystemhasa100%probabilityofdiagnosingsystemfaults.Theonlywaytopositivelyfindallpotentialdangerousundetectedfaultsistoprooftesttheentireloopfromthesensortothefinaloutput(sensor,logicsolver,andfinalelementorvalve).ItisrecommendedthatprooftestingrequirementsasspecifiedforAOPSbeappliedtoallalarmsaswell.

API2350requiresallcomponentsinvolvedtoterminateareceipttobeproof-testedatleastannually,unlessotherwisesupportedbyatechnicaljustification(i.e.aprobabilityoffailureondemandcalculation).Point-levelsensorsshallbeevaluatedsemi-annually.TestingofhandgaugesshallcomplywiththerequirementsinAPIManualOfPetroleumMeasurementStandards(MPMS)Ch.3.1A,andcontinuouslevelgaugesshallalsocomplywithAPIMPMSCh.3.1B.

EquipmentandOperations

20

General considerationsAlthoughcurrentlyAutomatedOverfillPreventionSystems(AOPS)isinfrequentlyfoundincurrenttankfillingoperations,theywillbecomeanimportanttoolinthetoolboxofoverfillprevention.Intheworldofsafetyinstrumentedsystems,specificindustrystandardshavebeendevelopedwhichapplytoelectricaland/orelectronicand/orprogrammableelectronicdevicestocontroldangerousprocesses.Thesestandardscoverpossiblehazardscausedbyfailureofthesafetyfunctionsbythesafety-relatedsystems.Thesestandardsrepresentthebestpossiblemethodologiestoensurethatsafetysystemsoperateasintended.Thesesafetyinstrumentedsystemsareappliedtorailwaysignalingsystems,remotemonitoringandoperationofprocessplants,emergencyshutdownsystems,burnermanagementsystemsandmanymore.Bytheirveryconstruct,whencombinedwithnormaloperatingsystemsandbasicprocesscontrolsystems,theycanachievealevelorriskreductionthatcannotbeachievedwithoutthem.Sowhythehesitancytousethem?

Onekeyreasonisthatiftheyareimproperlydesignedapipelinecanberupturedbyclosingoffaflowingtankreceiptdeliveringfromapipeline.Inordertodothiswithoutsignificantproblems,thevalveclosuretimemustbesufficientsothatthereisnopossibilityofalinerupture.Asignificantamountofdatacollectionandengineeringanalysisisrequiredtopreventtheriskofapipelinerupture.Onmarinereceipts,thetemporaryhosesthatconnectshiptoterminalcandisengageorruptureduetohydraulictransientsandaspilloverwaterisgenerallymoreseriousthanaspillintheterminal.GreatcaremustbeexercisedwhenapplyingAOPStoanymarineorpipelineoperation.

ThinkingaboutAOPSasakindofinsurancepolicyisuseful.TheAOPSshouldneverbeusedifoperationsaresufficientlygoodthatnooverfillsoccur.Butifnot,theAOPSwillkickinandbringthetankfillingprocesstoasafestate,basicallypayingoutthepremiumforthesesystems.Thingsarecomplicatedbythefactthatthepipelinedeliverycompanyisaseparatebusinessentityfromtheterminal,sothequestionbecomes“Wheredoyouwanttheincidenttooccur?”.Theterminaloperatormostlikelydoesnotwantaspillonhispropertyandlikewisethepipelineoperatorwouldratherhavethespillintheterminalthansomewhereoffsiteinthepipeline.SeriousdiscussionandnegotiationisrequiredbyboththepipelineoperatorandtheterminaloperatortodetermineifandhowanAOPSwillbeusedandacarefulagreementnegotiatedthatmaximizesthebenefitstoallparties.WhileuseofAOPScanreducerisk,itcanalsoincreaseitifnotproperlyappliedanddesignedmeaningthatalloftherequirementsofIEC61511aretotallycompliedwith.

AutomatedOverfillPreventionSystem

21

Two options for AOPS (existing and new tank systems)TherearetwooptionsforinstallingAOPSontankoverfillsystems.WhenthefacilitiesareexistingthenAppendixAofAPI2350isrequiredasaminimum.TheappendixisacompilationofbestpracticesthatshouldachieveariskreductioncomparabletoSIL1(safetyintegritylevel1perIEC61511)orariskreductionfactorof10to100.ThisoptionwasincludedbecauseitissimplynotpracticaltoattempttoapplyIEC61511tooldertankfacilities.

22

Fornewfacilities,theuseofIEC61511isrequired.ArequiredminimumSafetyIntegrityLevel(SIL)hashowevernotbeenspecified,althoughthereweremembersinthecommitteeadvocatingforthistobedone.ItislikelythatfuturerevisionsofthisstandardwillcomewitharequirementforminimumSIL2,anditisthereforewisetousethisforguidancewhendesigningnewAOPS.

AdoptingthenewAPI2350isasignificantchallengeandrequiressomeeffort.Butthepayoffcanbeworththeeffortbecausemanyoftheprocessessuchastheuseofsafetymanagementsystemsandriskassessmentarealreadyacceptedbytheindustryasthemostefficientandappropriatewaytodealwithrisk.Thedatacollectioneffortisimportantbecauseitisthefirststeptoassessingtheoverallsystemriskthatthetankfillingoperationsposeinyourfacilities.

Inaddition,oncedataaboutthesystemiscollected,thehighriskfacilitiescanbeidentifiedandriskreductionstarted.Forexample,asimplerequirementistoensurethatalltankalarmsaretestedandthatthealarmresponseismandatedtobeactionableasrequiredbyAPI2350.Thiswillsignificantlyreducerisksassociatedwithoverfill.Asimplesurveycanbeusedtostartidentifyingwhatkindsofequipmentthatisinplace.

Butbeyondtheselowhangingfruitsthereareresourcesandcoststhatmustbeallocatedtotheworthycauseofeliminatingoverfillsfromyourportfoliooftankfacilities.Theyarejusttooseriousathreattoignore.

Manytankoverfillincidentsresultedfromfaultyinstrumentation.Inaddition,whenthealarmshavebeenworking,itisnotuncommonthatoperatorsdidnotbelievethealarmsbecauseofpastproblemswiththeinstrumentationsystems.Ineithercase,overfillsresulted.Today,thehigh-tech,self-diagnosticequipmentavailablehasoutstandingreliability.Itisworthconsideringamigrationprocesswherethehighestrisktankfacilitiesaresystematicallyupgradedtothebestoverfillpreventionequipment.

For additional information:• IntheAppendixyouwillfindaAPI2350-compliancechecklistandsomeexamples

ofdifferentAPI2350-compliantequipmentsolutions• Downloadthestandardfromwww.api.org• Visitwww.rosemount-tg.com/safety• ContactyourlocalEmersonrepresentative

SummaryandConclusions

I

AppendixA. EquipmentSolutions:Sortedbytechnicalsolution

B. EquipmentSolutions:Sortedbytanktype

C. API2350ComplianceChecklist

D. FrequentlyAskedQuestions

E. AbouttheAuthors

Chapter explanations Abbreviations:MOPS: Manual Overfill Prevention System, API 2350 Category 3 AOPS: Automatic Overfill Prevention System, API 2350 Category 3 (sometimes called category 4)

Ranking system:This example shows a solutions that has ranked in the following way:

Reliability: 4/20Installation: 8/20Proof-testing: 4/20Approvals: 4/20Independence: 20/20

Total score: 40/100

Mechanical level switch

Float and tape level measurement

Reliability

Installation

Proof-testing Approvals

Independence

II

A.EquipmentSolutions:Sortedbytechnicalsolution

Point-Level Solution: 2100 + 5900S

Example: Fixed Roof tank

SIL 2

HiHi

Hi

MWL

Connection toTankMaster(optional)

Rosemount2100 LevelSwitch

SafetyInstrumentedSystem (SIS)

TankMaster InventoryManagement Software

Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)

Automatic Tank Gauging (ATG)Automatic Overfill Prevention System (AOPS)

Rosemount5900S RadarLevel Gauge

Rosemount2240S withMultiple PointTemperature

Rosemount 2460System Hub

Rosemount 2410Tank Hub

Rosemount 2230Graphical Field

Display

SIL 2RelaySignal

Reliability

Installation


Independence

Total score: 64/100

III

Wireless Point Level Solution: 2160 + 5900S


Connection toTankMaster

(optional)

IndependentAlarm Panel

1400 SmartWireless Gateway

Rosemount2160 WirelessLevel Switch

WirelessSignal

HiHi

Hi

MWL


Automatic Tank Gauging (ATG)




Manual Overfill Prevention System (MOPS)




Display

PLC /Scada /

RTU /Safety

System

High-High Alarm


Reliability

Installation


Independence

Total score: 56/100

IV

Point-Level Solution: DS21D + 5900S

Example: Floating Roof tank


High-High Alarm


Mobrey DS21DFloating RoofAlarm Switch


ArrayAntenna

with Hatch







Display



DiscreteSignal

HiHi

Hi

MWL

Reliability

Installation


Independence

Total score: 52/100

V

2-wire Pulse Radar Solution: 5400 + 5900S


SIL 2






Automatic Overfill Prevention System (AOPS)


Rosemount 5400Radar LevelTransmitter(Pulse)



Display

Rosemount5900S RadarLevel Gauge(FMCW)


SIL 24-20 mAAnalogSignal

Reliability

Installation


Independence

Total score: 72/100

VI

2-wire Guided Wave Radar Solution: 5300 + 5900S

Example: Bullet tank


Rosemount644 withSingle PointTemperature

Rosemount5900S RadarLevel Gaugewith PressureTransmitter(FMCW)Safety

InstrumentedSystem (SIS)


SIL 24-20 mAAnalogSignal



Display





VerificationPin

Rosemount 5300Guided WaveRadar LevelTransmitter

SIL

2

SIL 2

Also applicable for:

Fixed Roof

Reliability

Installation


Independence

Total score: 76/100

VII

Wireless Guided Wave Radar Solution: 3308 + 5900S

Example: Bullet tank



(optional)


WirelessSignal

Rosemount3308 WirelessGuided WaveRadar LevelTransmitter

Rosemount5900S RadarLevel Gaugewith PressureTransmitter



Display




VerificationPin


PLC /Scada /

RTU /Safety

System

High-High Alarm



Fixed Roof

Reliability

Installation


Independence

Total score: 64/100

VIII

SIL 2SIL 3

FMCW Radar Solution: 5900C + 5900S

Example: Sphere tank

SIL 2


Rosemount 644with Single PointTemperature


SIL 2Discrete

Signal


VerificationPin

Rosemount5900C RadarLevel Gauge

with PressureTransmitter




(optional)





TankMasterInventory Management Software



Display

SIL 2 SIL 2

SIL 2SIL

2


Bullet Fixed Roof Floating Roof(Pipe)

Floating Roof (Roof-plate)

Reliability

Installation


Independence

Total score: 80/100

IX

SIL 2SIL 3

SIL 2

FMCW Radar Solution: 5900S + 5900S


SIL 2

SIL 3

SIL 2

SIL 3


Bullet Sphere Fixed Roof Floating Roof (Roof-plate)

SIL 2

SIL 3

SIL 2 / SIL 3Discrete

Signal



ArrayAntenna

with Hatch





(optional)








Display


Reliability

Installation


Independence

Total score: 92/100

X

2-in-1 Solution: 5900S 2-in-1


Rosemount5900S 2-in-1Radar Level

Gauge

Leve

l

SIL 2

Ove

rfill

SIL 2Discrete

Signal







Display



(optional)





SIL 2

Leve

l

Ove

rfill

SIL 2

Leve

l

Ove

rfill

SIL 2

Leve

l

Ove

rfill


Bullet Sphere Fixed Roof

SIL 2

Reliability

Installation


Independence

Total score: 88/100

XI

Fixed Roof Tank Solutions

SIL 3

SIL 3

SIL 3

Delta VSIS

SIL-PAC(Fisher DVC +

Bettis Actuator)FisherValve



High-High Alarm



SmartWireless

THUM™ Adapter










Display

B.EquipmentSolutions:Sortedbytanktype

SIL 2SIL 2

SIL 3

SIL 2

Leve

l

Ove

rfill

SIL 2

Point-level (2100) Wireless Point-level (2160) 2-wire Pulse Radar (5400) 2-wire Guided Wave Radar (5300)

Wireless Guided Wave Radar (3308) FMCW Radar (5900C) FMCW Radar (5900S) FMCW Radar 2-in-1

SIL 2

SIL 2

XII

Floating Roof Tank Solutions

SIL 3

SIL 3

Rosemount5900S 2-in-1Radar Level

Gauge

Leve

l

SIL 2

Over

fill



Display


Delta VSIS




High-High Alarm



SmartWireless

THUM™ Adapter






SIL 2

SIL 2

SIL 2

SIL 3

Point-level (DS21D) FMCW Radar (5900C) FMCW Radar (5900C) FMCW Radar (5900S) (Pipe) (Roof Plate) (Pipe)

SIL 2SIL 3

Leve

l

SIL 2

Ove

rfill

FMCW Radar (5900S) FMCW Radar 2-in-1 (Roof Plate)

XIII

SIL 2

Leve

l

Ove

rfill

Bullet Tank Solutions

2-wire Guided Wave Radar (5300) Wireless Guided Wave Radar (3308) FMCW Radar (5900C)

FMCW Radar (5900S) FMCW Radar 2-in-1

SIL 2

SIL 2

SIL 3

SIL

2

SIL 3

SIL 3

Rosemount644 withSingle PointTemperature



Delta VSIS




High-High Alarm



Smart Wireless THUM™ Adapter






Display

VerificationPin



SIL 3

XIV

FMCW Radar (5900C) FMCW Radar (5900S) FMCW Radar 2-in-1

SIL 2

Leve

l

Ove

rfill

SIL 2

VerificationPin




with PressureTransmitter


Delta VSIS


Bettis Actuator)

FisherValve


High-High Alarm



Smart Wireless THUM™ Adapter






Display



SIL 3

SIL 3

SIL 3

Sphere Tank Solutions

FMCW Radar (5900C) FMCW Radar (5900S) FMCW Radar 2-in-1

C.API2350Edition4ComplianceChecklist

Introduction Thischecklistprovidesatoolforverificationofcompliancewiththenewstandardforoverfillprevention:API2350,Edition4,May2012.Itcanalsohelpyoutobetterunderstandtherequirementsandrecommendedpracticesthatcomprisethenewstandard.Thechecklistisintendedtobeappliedonatankbytankbasis.Duplicatethechecklistforusagewithmultipletanks(e.g.forassessmentofanentiretankfarm).Thechecklistisorganizedintofourconsecutivesteps(seefigureB1):

Step 1: Management System

Step 2: Risk Assessment

Step 3: Tank & Operations

Step 4: Compliance Summary

Eachstepisbrieflydescribedbelow.Additionalinformationcanbefoundin”TheCompleteGuidetoAPI2350”availableathttp://www.api-2350.com.Foracompletelistofallrequirements,werefertothestandarditself.YoucanobtaintheAPI2350standardathttp://publications.api.org.

Figure C.1: Checklist step by step overview

Managemenet System (MS)

Amanagementsystemisdefinedastheframeworkofadministrativeprocessesandproceduresusedtoenabletheownerandoperatortofulfillthetasksrequiredtoreduceoverfillstoanacceptablelevel.AmanagementsystemisrequiredforconformancewithAPI2350,butthestandarddoesnotspecifyhowtoimplementsuchasystem.

Thefirststepofthechecklistoutlinesalltheele-mentsrequiredbyAPI2350tobeincludedinamanagementsystem.Yourmanagementsystemmustmeetalloftherequirementsinthechecklisttobecompliantwiththestandard.

Is the tank compliant with API 2350 Edition 4?

Are administrative processes and procedures in compliance with API 2350?

4.ComplianceSummary

Is the risk, associated with tank overfills, acceptable to responsible stakeholders?

2.RiskAssessment

Are tank data and operating parameters in compliance with API 2350?

Sub-Steps: 3a.DataCollection3b.ScopeCheck3c.TankCategorization3d.LOCandResponseTime3e.Equipment

3.Tank&Operations

1.ManagementSystem

XV

Click for printable MS Checklist

Risk Assessment (RA)

Tank & Operations (TO)

API2350requiresariskassessment,associatedwithtankoverfills,tobeconductedandproperlydocumented.Thestandarddoesnothoweverspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletoresponsiblestakeholders.

TheRiskAssessmentChecklist(seepageXVII)isoutlinedaseithermeetingornotmeetingcriteriasetbystakeholders.Stakeholderstakenintoconsiderationareowners,operators,employees,authorities,transportersandpublic.Ifanyofthestakeholdersfindthattheriskisunacceptable,thenriskreductionisrequired.Thismaybeaccomplishedbyachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(e.g.attendance),achangeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.

Theriskassessmentprocessshallbeconductedbypeoplewhoarefamiliarwithtankfacilitiesandoperationsaswellastheriskassessmentprocess.Thechecklistisintendedforonetankonly.Duplicatethechecklistforusagewithmultipletanks.

ThethirdstepconcernstankconfigurationforconformancewithAPI2350.Here,specifictankdataandoperatingparametersarecollectedandcomparedwiththerequirementsinAPI2350.ThisisrequiredforeachtankwithinscopeoftheAPI2350complianceprogram.

TheTank&OperationsChecklist(seepageXIX)isdividedintofivesub-steps.Thefirststepisintendedfortankdatacollectiononly.Thisdataisthenusedinsubsequentstepstoassessthetank´scompliancewithAPI2350.Morespecific,thedatahelpsyoutoanswerquestionssuchas:IsyourtankwithinthescopeofAPI2350?Whatpre-definedcategoryisyourtank?and,Doesyourtankmeettheequipmentrequirementsforselectedcategory?

RESET

API2350alsorequires,asaminimum,threeLevelsofConcern(LOCs)tobeestablished.Eachofthesethreeshallbedefinedinlevel,ullageandvolumeseperately.Theexactvaluesdependonoperatingparameterssuchasfillrateandresponsetime.

Compliance Summary (CS)

ThefinalsectionconstitutesaComplianceSummaryforthespecifictank.TheComplianceSummaryChecklist(seepageXXV)servesasafinalverificationofthistank scompliancewithAPI2350.Yoursummarymustmeetalloftherequirementstobecompliantwiththestandard.

Click for printable TO Checklist

Click for printable RA Checklist

XVI

Itisadvisable,butnotrequired,toinitiatethefollowingactivitiesbeforestartingtheverificationprocess:

• Createanexperiencedassessmentteamwithcompetentpeoplespanningalldisciplinesrequired (e.g.design,operation,maintenance,instrumentation,safety,qualitydepartments)• Setup/Clarifyresponsibilities• Definethescopeandtimelineofthetankcomplianceprogram• Createproceduresformanagingthedataobtainedandcreatedduringthecomplianceprocess• AcquireacopyoftheAPI2350standardathttp://publications.api.org

NotethatAPI2350isastandardofminimumrequirements.Alternateapproachesthatprovideequivalentormorerobustoverfillpreventionareacceptedandrecommendedbythestandarditself.Forexample,Emersonalwaysadvocatestheusageofthehighestcategoryequipment(automatictankgauging+independentoverfillalarm)foralltankswithinthescopeofthisstandard,sincethecostdifferenceisusualllyminimal.

AlsonotethatthischecklistsummarizestherequirementsinAPI2350,anddoesnotnecessarilyreflectEmerson’sview.Ifanydiscrepanciesorunclaritiesoccur,alwaysrefertotheoriginalsource.Theremayalsobeadditionallocalregulation(e.g.country,federal,statelaws)thatmustbetakenintoconsideration.Ultimately,thisistheresponsibilityofthetankfarmowner/operator.

Incaseyouneedassistance,orhaveanysuggestions,pleasecontactyourlocalRosemountTankGaugingrepresentativeormailto:[email protected].

Incasethetankisnon-compliantwithAPI2350,thecollectedinformationcanbeusedtoperformagapassessment,whichshouldbefollowedbyacomplianceproject.ThisprocessisfurtherdescribedinTheCompleteGuidetoAPI2350,wherefigure1(seepage11)providesanoverviewoftheentireverificationandimplementationprocess.

Recommendations

Click for printable CS Checklist

XVII

Your management system shall include (as a minimum)... Is your management system

compliant with requirement?

1. Formaldocumentedoperatingproceduresandpractices,includingsafetyproce-duresandemergencyresponseprocedures.

Yes No

2. Establishedanddocumentedproceduresforpre-receiptplanning.Theproce-dureshallrequiretheproductquantitytobereceivedtobecomparedtogaugedavailablereceivingtankcapacityaheadoftheactualtransfer.Thisinformationshallberecordedonthetankproducttransferorreceiptrecord(s)andshallbemadeavailabletothetransporter.

Yes No

3. Establishedanddocumentedproceduresforactivitiesduringthereceipt.Thestan-dardrequiresregularlyscheduledcomparisonsofproductlevelsduringreceipts.

Yes No

4. Documentedprocedureforpostreceiptactivities(e.g.closevalves). Yes No

5. Writtenprocedureswhichestablishtheminimumlocalattendancelevelsduringreceipt.1.1

Yes No

6. PoliciesandproceduresshallprohibittheuseofHigh-hightanklevelalarmsandAOPSforroutineoperationorcontroloftankfillingoperations.

Yes No

7. Recordsshowingthatallpersonnelinvolvedintheproducttransferarecompetent1.2andhavereceivedadequatetrainingforthespecifictaskarerequired.

Yes No

8. Functionalequipmentsystems,testedandmaintainedbycompetent1.2personnel. Yes No

9. Drawings,operatinginstructions,inspections,testingandmaintenanceplansshallbeestablishedanddocumentedforthetankgaugingsystem,overfillpreventionsystemandotherequipmentasapplicable.Documentationrelatingtoinspectionandmaintenanceofsystemsshallbemaintainedforaminimumofoneyear.

Yes No

ManagementSystemChecklist

Step 1: Management System (MS) Checklist

Section 4.2 and 4.5http://publications.api.org

Is your MS compliant with API 2350 Ed.4 ?Fill out the following form to check if yourmanagement system is compliant with API2350.Thissheetisintendedforonetankonly.Duplicate the sheet for multiple usage. Foradditional information, see “The CompleteGuidetoAPI2350”.

Tank-farm Facility/Site

Date Revision DataStorageLocation

Issue

1.Name Position 4.Name Position



AssessmentTeam

RESET

XVIII

XVIII

RESET

10. Systemsandprocedurestoaddressbothnormalandabnormaloperatingconditions.

Yes No

11. AManagementofChange(MOC)processthatincludespersonnel,equipmentandproceduralchanges.

Yes No

12. Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents.

Yes No

13. Afollow-upsystemtosharelessonslearnedandtoaddressanyneededmitigationofcircumstancesleadingtonearmissesorincidents.

Yes No

14. Documentedcommunicationprotocolswithintheownerandoperatororganiza-tionandbetweenthetransporterandtheownerandoperatorthataredesignedtofunctionunderabnormalaswellasnormalconditions.

Yes No

15. ProceduresforperiodicreviewoftheLevelofConcerns(LOCs).Maxreviewtimeisfiveyears.

Yes No

Ifalloftheanswersareequaltoyes,thenyourmanagementsystemiscompliantwiththere-quirementsinAPI2350Edition4.

IsyourmanagementsystemcompliantwithAPI2350?

Yes No

Note1.1: Category1:Localattendanceon-sitecontinuouslyduringthefirstandlasthourofreceipt,andataminimumhourlyduringthereceipt.Category2: Maybesemi-attended,butrequiresattendancecontinuouslyduringthefirstandlast30minutesofreceipt.Category3:Nolocalmonitoringrequirements.

Note1.2: API2350definesacompetentpersonas“anindividualwhoiscapableandabletoperformtheassigneddutiesasdeterminedbymanagementina specificareaofoperations.”(3.10)


XIX

Step 2: Risk Assessment (RA) Checklist

Is risk, associated to tank overfills, acceptable to responsible stakeholders?API2350requiresariskassessmenttobeconductedandproperlydocu-mented.Thestandarddoeshowevernotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletotheowner,operatorandotherresponsiblestakeholders.AccordingtoAPI2350,itistheresponsibilityoftheownerandoperatortoconductariskassessmentcoveringtherisksassociatedwithpotentialtankoverfills.

RiskAssessmentChecklist

Minimum risk requirement Risk acceptable?

1. Theriskassessmenthasbeenconductedandproperlydocumentedforthespecifictank. Yes No

2. Theriskassessment´sresidualriskisacceptable...

2a. totheOWNER. Yes No

2b. totheOPERATOR. Yes No

2c. totheEMPLOYEES. Yes No

2d. totheAUTHORITIES/REGULATION. Yes No

2e. totheTRANSPORTER. Yes No

2f. tothePUBLIC. Yes No

Ifalloftheanswersareequaltoyes,thentheriskassessmentiscompliantwiththerequirementsinAPI2350Edition4.2.1

Istheriskacceptabletoresponsiblestakeholders? Yes No

RESET

Is the RA acceptable to stakeholders?Filloutthefollowingformtocheckiftheriskassessment is compliant with API 2350 re-quirements. This sheet is intended for onetank only. Duplicate the sheet for multipleusage. For additional information, see “TheCompleteGuidetoAPI2350”.

RESET




AssessmentTeam


Issue

Section 4.3http://publications.api.org

Note2.1: Ifthestakeholdersfindthattherisksdonotmeetthegapassessmentcriteria,thenriskreductionisrequired.Thismaybeaccomplished byachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(i.e.attendance),a changeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.


XX

ProbabilityandConsequenceFactors(OptionalSection)

Factor considered in the risk assessment?Probability Factors

A.1 Frequency,rateanddurationoffilling. Yes No

A.2 Systemsusedtoproperlymeasureandsizereceiptstotanks. Yes No

A.3 Accuratetankcalibration(bothstrappingandverifiedCriticalHighlevel. Yes No

A.4 Systemsusedtomonitoringandsupervisionofmanualandautomatictankgauging. Yes No

A.5 Extentofmonitoringandsupervisionofmanualandautomatictankgauging. Yes No

A.6 Impactofcomplexityandoperatingenvironment. Yes No

A.7 Fillingmultipletankssimultaneously. Yes No

A.8 Switchingtanksduringreceipt. Yes No

Factor considered in the risk assessment?Consequence Factors

B.1 Hazardcharacteristicofmaterial(product)intank. Yes No

B.2 Volatility,flammability,dispersion,VCEpotential. Yes No

B.3 Numberofpeopleonsitewhomaybeaffectedbyatankoverflowing. Yes No

B.4 Numberofpeopleoffsitewhomaybeaffectedbyatankoverflowing. Yes No

B.5 Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite.

Yes No

B.6 Possibilityofimpacttonearbysensitiveenvironmentalreceptors. Yes No

B.7 Physicalandchemicalpropertiesofproductreleasedduringoverflowing. Yes No

B.8 Maximumpotentialoverfillflowratesandduration. Yes No

API2350doesnotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist.Butgenerally,riskisacombinationofconsequencemultipliedbytheprobabilityforaspecificeventorscenariothatresultsinharmordamage.Thereforethestandard(seeAnnexE)recommendsthatatleastthefollowingprobabilityandconsequencefactorsareconsideredintheriskassessment.

RESET

Section 4.3 and Annex Chttp://publications.api.org

XXI

Step 3: Tank & Operations (TO) Checklist

DescriptionofATGLevelMeasurement ATGTagName Technology(e.g.radar)

TankGaugingSystemTypeofappliedTankGaugingSystem?

None/ManualTankGauging(sectionN/A)AutomaticTankGauging(ATG)


Is your TO compliant with API 2350 Ed.4 ?Filloutthefollowingformtodefineandcon-figure your tank according to API 2350. Thissheetisintendedforonetankonly.Duplicatethe sheet for multiple usage. For additionalinformation,see“TheCompleteGuidetoAPI2350”.

RESET




AssessmentTeam

Figure 1: Overview tank parameters, internal /external floating roof tanks respectively

TypeofLiquidProduct(e.g.crudeoil) Max/MinDensityorSpecificGravity3.1

TankType(e.g.fixedorfloatingroof) TankHeight(TH)/CriticalHigh(CH)3.2

Strapping-tableisuptodate?3.3

EffectiveFloatingRoofThickness(FR)(fromliquidleveltotopsealextension)

Yes No

GeneralTankData

3a. Data Collection

RESET

NotApplicable

OperationalTankDataMaxFillRate MaxWorkingLevel(MW) High-HighLevel(HH) WorstCaseResponseTime(RT)3.4

Note3.1: DensitycaninfluenceCriticalHigh(CH)andEffectiveFloatingRoofThickness(FR).

Note3.2: AccordingtoAPI23503.13:CriticalHigh(CH)isthehighestlevelinthetankthatproductcanreachwithoutdetrimentalimpacts(i.e.productoverflowortankdamage). Foradditionalinformation,seeAPI2350AnnexD.

Note3.3 Max15yearintervalforunchangedtanksaccordingtoAPIManualofPetroleumMeasurementStandards(MPMS)2.2.

Note3.4: ResponseTimeistheperiodoftimerequiredtoterminateareceipt.API23504.4.2.5providesguidanceonhowthiscanbecalculated.Alternatively,thedefault responseratesdefinedbythestandardcanbeused,seesection3e.LevelsofConcern(LOCs)Determination.


Issue


XXII

3b. Scope Check

Is your tank within the scope of API 2350?ThescopeofAPI2350isintendedforabovegroundatmosphericstoragetanksassociatedwithpetroleumfacilitiesincludingrefineries,marketingterminals,bulkplantsandpipelineterminalsthatreceiveClassIorClassIIpetroleumliquids.Useisrecom-mendedforClassIIIpetroleumliquids.3.7

Note3.7: NFPA30-2008definesclassesofliquids.ClassIliquid:aflammableliquidwithaclosedcupflashpointbelow100°F(37.8°C)andareidvaporpressure notexceeding40poundspersquareinchabsolute(2068millimetersofmercury)at100°F(37.8°C).ClassIIliquid:acombustibleliquidwithaclosedcup flashpointatorabove100°F(37.8°C)andbelow140°F(60°C).ClassIIIliquid:aliquidwithflashpointsabove140°F(60°C).

Note3.8: PEI600RecommendedPracticesforOverfillPreventionforShop-fabricatedAbovegroundTanksisavailableathttp://www.pei.org.

RESET

The Tank is...Is your tank compliant

with the statement?

1. Anabovegroundstoragetankof1320USgallons(5000liters)ormore. Yes No

2. ContainingClassIorClassIIpetroleumliquids(optional:ClassIIIpetroleumliquids).3.7 Yes No

Is your tank compliant with the statement?The Tank is NOT...

3. Apressurevessel. Yes No

4. Shop-fabricatedorcompliantwithPEI6003.8. Yes No

5. Locatedataservicestation. Yes No

6. Filledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars). Yes No

8. StoringLPGorLNG. Yes No

If all of the answers are equal to yes, thenthetankiswithinthescopeofAPI2350Edi-tion4.

IsyourtankwithinthescopeofAPI2350? Yes No

ScopeofAPI2350

IndependentOverfillPreventionSystemTypeofappliedOverfillPreventionSystem?

ManualOverfillPreventionSystem(MOPS)3.5

AutomaticOverfillPreventionSystem(AOPS)3.6

None(sectionN/A)

TypeofLevelAlarmHigh-HighSensor Actuator:AlarmSignalSystem OperationalExperience(e.g.replacements,alarms,etc.)

TypeofLogicSolver Actuator:FinalElement

Documentedproof-testprocedureexists?

Proof-testInterval MostRecentProof-testResultandDate

(months)Yes No

RESET


Note3.5: Anoverfillpreventionsystemrequiringoperatingpersonnelactiontofunction(API23503.29).

Note3.6: Anoverfillpreventionsystemnotrequiringtheinterventionofoperatingpersonnelactiontofunction(API23503.6).

Datacommunicationtolocalorremotecontrolexists?

OperationalExperience(e.g.replacements,alarms,etc.)

Documentedverificationtestprocedureexists?

VerificationInterval MostRecentVerificationResultandTestDate

(months)

RESET

Yes No

Yes No

XXIII

3d. Equipment Requirements

TankEquipmentRequirements

Category 3

Yes(requirement)

Yes(requirement)

LiquidlevelandindependentLAHHistransmittedtocontrolcenter

Category 2

Yes(requirement)

Notrequired

Liquidlevelistrans-mittedtocontrolcenter

Category 1

Notrequired

Notrequired

Nodatacommuni-cationwithcontrolcenterrequired

ATG-System

Independent LAHH Sensor

Availability of measured level data

Tankfulfillsrequirementsforselectedcategory?(Yes,ifallboxesarecheckedforselectedcategory)

Yes No

Does your tank meet the equipment requirements?Thewaythetankisoperated,orequallyitscategory,determinestheminimumrequirementsfortheoverfillpreventionsystem.Givenallthingsequal,ahighercategoryoverfillpreventionsystem(e.g.category3)issaferthanalowercategorysystem(e.g.2).Ahighercategorysystemalsoallowsformoreefficienttankoperationswithlesspersonnelandhighertankutilization.Ahighercategoryoverfillpreventionsystemthanrequiredcanbeusedsinceitisastandardofminimumrequirements.Selectthepreferredtankcategorybelow,andevaluateifyourtankfullfillstheminiumrequirements.Exampleofequipmentsolutionscanbefoundin“TheCompleteGuidetoAPI2350”,AppendixA.

3c. Tank Categorization

Which API 2350 pre-defined category does your tank belong to?API2350requireseachtanktobecategorizedaccordingtohowitisoperated.Mostmodernfacilitiesareoperatedremotelyfromacontrolcenterandwillthereforefallundertankcategory3.

Category 1 Category 2 Category 3

Attendance

Cat.1:Fullyattendedfacility(locallymonitored)

Cat.2:Semi-attendedfacility(locallyandremotelymoni-tored)

Cat.3:Unattendedfacility(remotelymonitored)

Monitoring

Cat.1:Continuouslyduringfirstandlasthourofreceiptandonceeveryhourduringreceipt

Cat.2:Continuouslyduringthefirstandlast30minutesofreceipt

Cat.3:Monitoredfromlocalorremotecontrolcenter

Operator

Cat.1:Fullfocusononereceiptatatime,andnotdistractedbyotherduties.

Cat.2:Focusonmultipletanks/receiptssimultaneously,oroperatormaybedistractedbyotherduties

Cat.3:Samerequirementasincategory2

Tankiscategorizedas..?(equalsthehighestcatgoryselectedabove) Category1 Category2 Category3

TankCategorization

RESET

RESETSection 4.4 and 4.5http://publications.api.org

XXIV

TheATGsystemisoneofthemostcriticalcomponentstopreventoverfillsfromoccurring.Thisisrecog-nizedinAPI2350,andthereforethestandardrequiressoundengineeringprinciplestobeappliedalsotothispartofthefacility.Thissectionismandatoryforcategory2and3tanks,andoptionalforcategory1.

Automatic Tank Gauging (ATG) System - applies to category 2 and 3

TankequippedwithATGsystem?

ATG system conforms to the following principlesIs your ATG system compliant

with the statement?

1. TheATGsystemisdesignedandconfiguredtoinitiateadistinctvisualandaudiblealarmincasetheliquidsurfacereachestheHighhighLevelAlarm(LAHH)point.

Yes No

2. Written maintenance and verification plans, encompassing all components in the tankgauging system,shallexist.Testingofcontinous-levelsensorsshallcomplywiththere-quirementsinAPIManualofPetroleumMeasurement3.1Bandthemanufacturer’sinstruc-tions.

Yes No

3. Tankandfacilityshallallowformanualshutdownincaseoffailure(e.g.equipmentorcablefailures,powerloss).

Yes No

Ifallof theanswersareequal toyes, thentheATGsystemiscompliantwiththerequirementsinAPI2350Edition4.

IsyourATGsystemcompliantwithAPI2350?

Yes No

AutomaticTankGauingSystem

RESET

Yes No(sectionN/A)


Independent overfill prevention system conforms to the following principlesIs your independent OPS

compliant with the principle?

1. TheequipmentusedintheOPsystemshallnotbeapartoftheATGsystem Yes No

2. AdistinctvisualandaudiblealarmthatisnotapartoftheATGsystem Yes No

3. Documentedproof-testingproceduresandmaintenanceplanshallexistforallcompo-nentsintheoverfillpreventionsystem:-High-HighLevelAlarmSensor-Alarmpanel-LogicSolver(e.g.PLC)-Valves-Communicationsequipment

Yes No

4. TheProof-testingmethodsshall:-beincompliancewiththemanufacturers’instructions-donotput(orleave)thetankinanunsafeoperatingmode(e.g.itisnotrecommendedtofillthetankaboveitsminimumworkinglevel)-forcontinuouslevelsensors:complywiththerequirementsinAPIMPMS3.1B

Yes No

IndependentOverfillPreventionSystem

Independent Overfill Prevention System (OPS) - applies to category 3

AnindependentOverfillPreventionSystem(OPS)isrequiredforalltanksoperatedascategory3,whichisthemajorityoftanksoperatingtoday.Traditionally,electro-mechanicalpoint-levelsensorshavebeenusedastheHigh-HighLevelAlarm(LAHH)Sensor.Theusageof“continuous”typeleveltechnologyisrap-idlybecomingthedesiredchoicetoreplace“point”typeswitches;theobviousadvantageisthe‘online’levelmeasurementwhichcanbecomparedwiththeATGforproof-testing.

Tankequippedwithindependentoverfillpreventionsystem?

Yes No(sectionN/A)

XXV


AutomaticOverfillPreventionSystem:GenericRequirements

AOP system conforms to the following principlesIs your AOPS compliant

with the principle?

Existing Facilities ConformtoAnnexAinAPI2350orIEC61511 Yes No

New facilities ConformwithrequirementsinIEC61511orANSI/ISA84.00.01-2004 Yes No

Wireless AOPSdoesnotdependonWirelesscommunication3.9 Yes No

Safe state Allequipmentshallbedesignedtomovetheprocessintoasafestateintheeventofapowerlossordevicefailure.

Yes No

Automatic Overfill Prevention System (AOPS) - if used

AutomaticOverfillPreventionSystems(AOPS)areoptional.Butifoneisbeingem-ployed,thenitisrequiredtoconformtotheminimumrequirementsbelow.

RESET

TankequippedwithAOPS?

Yes No(sectionN/A)

Note3.9: WirelesscommunicationisacceptableforanythingbutAOPS.AnAOPScannotdependsolelyonwireless,butitcanbeusedasredundant communication(e.g.deviceconfiguration).

RESET

CHLevelset-point:expressedasLevel CHLevelset-point:expressedasVolume CHLevelset-point:expressedasUllage

MinimumRequirement CHLeveliscompliantwiththeminimumrequirement?

Highestlevelintankthatproductcanreachwithoutinitiatingoverflowortankdamage.Ifapplicable,thethicknessofthefloatingroofshallbetakenintoconsideration. Yes No

CriticalHighLevel

3e. Levels of Concern (LOCs) Determination

ThestandardrequiresataminimumthefollowingthreeLOCstobedefined:CriticalHighLevel(CH),High-HighLevel(HH)andMaximumWorkingLevel(MW).EachLevelofConcernshallbedefinedinlevel,ullageandvolume.UsageofHi-Alertsisoptional.FigureC.2outlinestheLOCs.

5. Resultfromproof-testingshallbeproperlydocumentedandthetestintervalismaxi-mum-Point-levelSensor(ifexist):6months-Allothercomponentsintheoverfillpreventionsystem:12months

Yes No

6. High-HighLevelAlarmSensorshallbeabletoalsomeasureliquidproductontopofthefloatingroof(ifapplicable)

Yes No

If all of the answers are equal to yes, then theIOP system is compliant with the principles inAPI2350Edition4.

IsyourindependentOPScompliantwithAPI2350?

Yes No

RESET

AOPSLevelset-point:expressedasLevel AOPSLevelset-point:expressedasVolume AOPSLevelset-point:expressedasUllage

MinimumRequirement AOPSLeveliscompliantwiththemin.requirement?

Level/VolumeequivalenttodistancefromCHtocalculatedAOPSresponsetimeatmaxflowrate.Distance(btw.CHlevelandAOPSlevel)shallnotbelessthanthree(3)inches.

Yes No

AutomaticOverfillPreventionSystem:Set-point

RESET

XXVI

Level Required action for specified level Requirement fulfilled?

CriricalHigh(CH) Anemergencymanagementresponseshallbeinitiated.Procedureshallbedocumented

Yes No

HighHigh(HH) Alarmgeneratedanddocumentedproceduresrequiringoperatorstoinitiateimmediatetermination• Category1:Alarmoptional• Category2:AlarmgeneratedbyATG-system.• Category3:RedundantAlarmsgeneratedbyATGandIOPS

Yes No

ActionRequirements

Are actions and procedures documented?API2350requiresdocumentedactionsincasetheliquidproductsurfacereachesCriticalHigh(CH)orHigh-High(HH).

RESET

HHset-point:Level HHset-point:Volume HHset-point:Ullage

MinimumRequirement

Ataminimum,verticaldistancebetweenCHandHHcorre-spondstothefollowingresponsetime(atmaxflowrate)3.10:• Category1=45minutes• Category2=30minutes• Category3=15minutesThree(3)inchminimumlevelforallcategories.

HHiscompliantwiththeminimumrequirement?

HighHighLevel

Figure B.2: Overview Levels of Concern (LOCs)

Yes No

RESETNote3.10: Thesearethedefaultresponsetimesforeachcategory. Alternatively,thetankspecificresponsetimecanbeused.

MWLevelset-point:expressedasLevel MWLevelset-point:expressedasVolume MWLevelset-point:expressedasUllage

MinimumRequirement MWLevelcompliantwithmin.requirement?

AtaminimumverticaldistancebetweenHHandMWcorrespondstocalculatedfacilityoperationsresponsetime3.11. Yes No

MaxWorkingLevel

RESETNote3.11: Responsetimeistheperiodoftimerequiredtoterminateareceipt.


Level Description Action and Alarm/Alert Requirements

The level at which damage or overflow occurs

A spill management emergency response shall be initiated. Procedure shall be documented. Alarm is required.

The level at which termination of product receipt triggers

Critical High (CH)

Max. Working (MW)

AOPS Level

High-High Tank (HH) The action alarm level to enable termination of product receipt

The highest level to which the tank may routinely be filled

Level only applies if AOPS is used. Alarm is optional.

Action response required. Procedures shall be documented. Alarm is required for Cat. 2 and 3.

Alert is recommended but not required.

Note: High tank level is not required

XXVII

Step 4: Compliance Summary (CS) Checklist

Is tank compliant with API 2350?Filloutthefollowingformtoverifyifthetankis compliant with API 2350. This sheet is in-tendedforonetankonly.Duplicatethesheetformultipleusage.Foradditionalinformation,see“TheCompleteGuidetoAPI2350”.

RESET




AssessmentTeam



Issue

ComplianceSummaryChecklist

1. ManagementSystemoftankincludesallelementspresentedinSection1,MSCheck-list?

Yes No

2. Ariskassessmenthasbeenconductedandproperlydocumented,andtheassessment´sresidualriskisacceptabletoresponsiblestakeholders?

Yes No

3. DatacollectionandtankconfigurationhasbeenconductedinaccordancewithSection3,TOChecklist?

Yes No

3a. Datarequiredfortheassessmentoftankhasbeenproperlycollected? Yes No

3b. ThetankiswithinthescopeofAPI2350? Yes No

3c. ThetankhasbeencategorizedinaccordancewithAPI2350? Yes No

Ifyes,thespecifictankiscategorizedas: Cat.1 Cat.2 Cat.3

3d. Thetankfulfillstheequipmentrequirementsforselectedcategory? Yes No

ATGSystemcompliantwithAPI2350? N/a Yes No

IOPSystemcompliantwithAPI2350? N/a Yes No

3e. LevelsofConcern(CH,HHandMW)havebeenestablishedinaccordancewithAPI2350?

Yes No

Ifalloftheanswersareequaltoyes,thenthetankiscompliantwithAPI2350Edi-tion4.

IstankcompliantwithAPI2350Edition4? Yes No

RESET

XXVIII

XXIX

C.FrequentlyAskedQuestions

Who should care about API 2350?Thepurposeofthestandardistocoverminimumoverfill(anddamage)preventionpracticesforabovegroundstoragetanksinpetroleumfacilities,includingrefineries,marketingterminals,bulkplants,andpipelineterminalsthatreceiveflammableandcombustibleliquids.Thestandardassistsowner/operatorsandoperatingpersonnelinthepreventionoftankoverfillsbyimplementationofacomprehensiveoverfillpreventionprocess(OPP).Thegoalistoreceiveproductintotheintendedstoragetankwithoutoverfillorlossofcontainment.Anybodyinvolvedinthisprocessbenefitsfromunderstandingandapplyingthisstandard,rangingfromtankowner/operators,operatingandmaintenancepersonnel,transporters,engineering,safetystaff,suppliers,andgovernmentofficials,justtomentionafew.

What’s the scope of API 2350?API2350isintendedforstoragetanksassociatedwithmarketing,refining,pipelineandterminalscontainingClassIorClassIIpetroleumliquids.UseofthestandardisrecommendedforClassIIIpetroleumliquids.API2350doesnotapplyto:• undergroundstoragetanks;• abovegroundtanksof1320USgallons(5000liters)orless;• abovegroundtankswhichcomplywithPEI600;• pressurevessels;• tankscontainingnon-petroleumliquids;• tanksstoringLPGandLNG;• tanksatservicestations;• tanksfilledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars);and• tankscoveredbyOSHA29CFR1910.119andEPA40CFR68orsimilarregulations.

Why should API 2350 be used and not some other safety standard?API2350isasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Itwascreatedbytheindustryfortheindustry.Awidespectrumofindustryrepresentativesparticipatedinitscreation:tankownersandoperators,transporters,manufacturers,andsafetyexperts,justtomentionafew.Itisacompilationoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.Anditdoesnotcompetewithothermoregenericsafetystandards,butinsteadactsasacomplement.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingsomeoftherequirementsinAPI2350.

XXX

Is API 2350 required by any law?API2350isastandardcreatedbytheindustrycommunity,andnotalegaldocument.However,inmanycasestheapplicablelawsrequiretheoperationtobecompliantwithrecognizedindustrybestpractices.Often,APIpublicationsareusedasthebenchmark,therebyindirectlyreferencingtoAPI2350incaseoftankoverfills.ItishoweverimportanttorecognizethatAPI2350doesnotsupersedeanylocal,stateorfederallawsandregulations,whichalwaysmustbetakenintoconsideration.

What’s the difference between API 2350 and 61508/61511?IEC61508/615011aregenericsafetystandardsdescribingtheuseofsafetyinstrumentedsystems(SIS).API2350ontheotherhandisasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Thesetwostandardsdonotcompetewitheachother,butinsteadactascomplements,withmanysimilarities.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingmanyoftherequirementsinAPI2350.

Is API 2350 applicable outside the US?Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Itisintendedtobeequallyvalidandapplicableworldwide.

Where can I get API 2350?Thestandardcanbedownloadedfromwww.api.orgforasmallfee.

What does API 2350 say about Wireless communication?AccordingtoAPI2350,theuseofwirelesscommunicationisacceptable,exceptforonespecificuse-case:“AOPSshallnotrelyonwirelesscommunicationtoinitiatediversionorterminationofreceipt”(AnnexA).InAOPS,wiredandwirelesscommunicationcanhoweverbeusedsimultaneously,ifthewirelesslinkisusedfordeviceanddiagnosticsmonitoring,andnottoinitiatediversionorterminationofreceipt.

XXXI

D.AbouttheAuthors

Phil E. Myers, API 2350 Committee Chairman

PhilE.MyershaschairednumeroustaskgroupsfortheAmericanPetroleumInstitute,includingAPI2350.Currently,heisthedirectorofPEMYConsulting.HehasalsoworkedatChevronCorporationwherehewasamechanicalintegrityspecialistfortanks,pipingandpressurevesselsspecializinginsafetyandrisk.MyersholdsaBScinChemicalEngineeringfromUCBerkeleyandanMScinTheoreticalandAppliedStatisticsfromCaliforniaStateUniversity.

Carl-Johan Roos, Emerson Safety Expert

Carl-Johan“CJ”Rooshasover10yearsofglobalexperiencefromvarioustechnicalandmanagerialpositionsintheprocess-andtankgaugingindustry.BesidesAPI2350hehasactivelyparticipatedinnumerousproductspecificIEC61508-CertificationsandsitespecificIEC61511-relatedprojects,besideshisusualworkasbusinessdevelopmentmanageratEmerson’sProcessLeveldivisionwhereheoftenaddressesnationaloverfillpreventionregulationsuchasTÜV/DIBtWHGinGermany.RooshasaMScinElectricalandComputerEngineeringfromGeorgiaTechandChalmersUniversity,andaMBAfromtheUniversityofGothenburg.

Global Headquarters and Europe Regional OfficeTank GaugingEmerson Process ManagementBox150(Visitingaddress:Layoutvägen1)SE-43523Mö[email protected]

North America Regional OfficeTank GaugingEmerson Process Management6005RogerdaleRoadMailStopNC136Houston,TX77072,[email protected]

Latin America Regional OfficeEmerson Process Management1300ConcordTerrace,Suite400Sunrise,Florida,33323,[email protected]

Asia Pacific Regional OfficeEmerson Process Management Asia Pacific Pte Ltd1PandanCrescentSingapore128461+6567778211+6567770947Specialist-OneLevel.RTM-AP@emerson.com

Middle East and Africa Regional OfficeTank GaugingEmerson Process ManagementP.O.Box20048ManamaBahrain+97317226610+97317227771rtgmea.sales@emerson.com

StandardTermsandConditionsofSalecanbefoundat:www.Emerson.com/en-us/pages/Terms-of-Use.aspxTheEmersonlogoisatrademarkandservicemarkofEmersonElectricCo.TankMaster,TankRadar,RosemountandRosemountlogotypearetrademarksofEmersonProcessManagement.Allothermarksarethepropertyoftheirrespectiveowners.©2015EmersonProcessManagement.Allrightsreserved.

The Complete Guide to API 2350 00821-0100-5100,RevCA November2015

EmersonProcess.com/Rosemount

Linkedin.com/company/Emerson-Process-Management

Twitter.com/Rosemount_News

Facebook.com/Rosemount

Youtube.com/user/RosemountMeasurement

Google.com/+RosemountMeasurement

the complete guide to api 2350 learn about api implementation

Documents