The Complete Guide to
API 2350
2
Content
03. AnIntroductiontoAPI2350
07. MotivatingRobustOverfillProtection
10. ImplementationofAPI2350
13. OperatingParameters
19. EquipmentandOperations
20. AutomatedOverfillPreventionSystem(AOPS)
22. SummaryandConclusions
23. Appendix
A. EquipmentSolutions
B. API2350ComplianceChecklist
C. FrequentlyAskedQuestions
D. AbouttheAuthor
3
AnIntroductiontoAPI2350
Tankoverfillsareamajorconcerntothepetroleumindustry.Inthebestcase,youhavetocleanitup.Intheworstcase,yougooutofbusiness,andendupincourt.Asaresponsetothis,theindustryhasworkedjointlytocreateanewAPI/ANSIStandard2350Edition4:“OverfillProtectionforStorageTanksinPetroleumFacilities”.Thisnewstandardisadescriptionoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.
API2350wascreatedbytheindustryfortheindustrywithcontributionsfromawiderangeofindustryrepresentativesincluding:tankownersandoperators,transporters,manufacturers,andsafetyexperts.Thistogetherwiththefactthatitsinglesoutaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks)andaspecificuse-case(overfillprevention)makethisstandardunique.Anditdoesnotcompetewithothermoregenericsafetystandards,butisintendedtocomplimentthem.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isoneexampleofhowtofulfillsomeoftherequirementsinAPI2350.
Theindustryadoptionratetothisstandardisexpectedtobeveryhighbecauseoftheobviousbenefits,combinedwiththeworld’sever-increasingneedformoresafety.ThequestionforatankowneroroperatoriswhethertheycanaffordnottoimplementAPI2350.Andbecauseofthestandard’sgenericnature,itisexpectedtobealsoappliedtonearbytanksoutsidethestandard’sspecificscope,containing,forexample,chemicalsorClass31petroleumliquids.
Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Itisintendedtobeequallyvalidandapplicableworldwide.
Thisguidewillprovidethebasicelementsforapetroleumtankowner/operatortoapplyAPI2350toneworexistingtankfacilitieswithminimaleffortandmaximalgains.Youshouldreaditbecausethisnewstandardisexpectedtobecomeagame-changer,andbyreadingityoucanbenefitfromapplyingthelatestbestpracticesforoverfillprevention.ThestandarditselfisavailableforasmallfeefromAPI’swebsite(www.api.org).
1 NFPANationalFireProtectionAssociation.Class1liquidhasaflashpointbelow100°F.Class2liquidhasaflashpointatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.
4
PurposeThetargetaudienceforthisdocumentisownersandoperatorsoffueldistributionterminals,refineries,chemicalplantsandanyotherfacilitieswhichreceivepetroleumorchemicalproductsintostorage.ThekeyindustrychangerelatedtotankoverfillsthisyearisthepublicationofanewversionofAPI2350“OverfillProtectionforStorageTanksinPetroleumFacilities”,the4theditionpublishedinMay2012.ThegoalisthentounderstandwhichchangeshaveemergedinthisnewstandardandhowtoapplythemforthepurposeofadoptionandcompliancewithAPI2350.Anyoneresponsibleforsafeoperationsatfuelmarketing,distributionterminals,refineries,oilhandling,orpipelinecompaniesshouldtakeadvantageofthestateoftheartintankoverfillpreventionasdiscussedinthisguide.WhilethescopeofAPI2350appliestothefillingofpetroleum-basedproductsassociatedwithmarketing,refining,pipelineandterminalfacilities,itsprinciplesmaybeappliedtoanytankoperationwherethereisariskofoverfillingthetank.
MostapplicationsunderAPI2350involveatmosphericorslightlypressurizedtanks,buttheprinciplesofAPI2350canbeusedforhigherpressurestorageaswell.ThescopeofAPI2350appliestooverfillprotectionforNFPA2Class1andClass2liquidsandrecommendscomplianceforClass3liquids.The“ScopeofAPI2350”(seebelow)presentsamoredetailedbreakdown.Forflammableliquidsclassifiedbyfirecodes(calledClass1liquids)API2350canmitigatethelikelihoodofspillingthesehazardousproductsandthelikelyresultingfacilityfire.Sincespillsofnon-volatileorganicliquidssuchaslubeoilsorheavyasphalticproductsareoftenconsideredanenvironmentalhazard,overfillsoftheseproductsarealsoaddressedbythenewAPI2350.
2 NFPANationalFireProtectionAssociation.Class1liquidhasaflashpointbelow100°F.Class2liquidhasaflashpointatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.
Scope of API 2350 (4th Edition)
API2350appliestopetroleumstoragetanksassociatedwithmarketing,refining,pipeline,
terminalsandsimilarfacilitiescontainingClassIorClassIIpetroleumliquids.API2350
recommendsincludingClassIIIliquids.
API 2350 does not apply to:• Undergroundstoragetanks
• Abovegroundtanksof1320USgallons(5000liters)orless
• AbovegroundtankswhichcomplywithPEI600
• Tanks(processtanksorsimilarflowthroughtanks)thatareintegraltoaprocess.
• Tankscontainingnon-petroleumliquids
• TanksstoringLPGandLNG
• TanksatServiceStations
• Loadingordeliveryfromwheeledvehicles(suchastanktrucksorrailroadtankcars)
PEIRP600RecommendedPracticesforOverfillPreventionforShop-Fabricated
AbovegroundTanksforoverfillprotectionwhereapplicableforabovegroundtanksfalling
outsidethescopeofAPI2350.
5
Fourth generation of API 2350ThecurrentAPI23503(4theditionpublishedMay2012)appliestofillingtankswithpetroleum-basedproductsforthepurposeofpreventingoverfills.Embracingradicalchangescomparedtopreviousversions,thisnewstandarddeservesaclosereview.Also,betweenthelasteditionandthecurrentedition,importantnewsafetystandardsthatapplydirectlytotankoperationshavebeenintroducedintothepublicdomain.ThecurrenteditionofAPI2350buildsonbestpracticesfromboththepetroleumindustryandfromotherindustriesandappliesthemdirectlytotankoverfillprotection.AnexampleofamajorchangeintroducedbythenewversionofAPI2350istherequirementforasafetymanagementsystem.Asaresultofthesweepingchangestothisstandard,understandingandusingitwillrequiresomepatienceandguidance.
AkeyandinfluentialeventthatshapedthecurrenteditionofAPI2350wastheBuncefieldconflagrationarisingfromapetroleumtankoverfillattheHertsfordshireOilStorageTerminal(HOSL)nearHeathrowAirport.OnDecember11th2005,thefireengulfed20tanksresultinginthetotaldestructionoftheterminalandnearbyfacilities.ThisfirewastheworstinEuropesinceWorldWarII.TheBuncefieldincidentwasalsooneofthemostintenselystudiedtankoverfilleventsofalltime.Fortunately,thelessonslearnedfromthisincidenthavebeencapturedbytheUnitedKingdom’sHSE4inreports5coveringthisincident.
API2350representstoday’sminimumbestpracticessotankownersandoperatorscannowprepareforwhatwillundoubtedlybethebenchmarkforgenerallyrecognizedgoodpracticeinthepetroleumstoragebusiness.
Learning from past experiencesThefollowingquotefromtheUnitedKingdom’sHealthSafetyExecutiveBuncefieldinvestigationshowsunsurprisingly,thatfaultsinmanagementsystemsareakeyrootcauseoftankoverfillincidents.
“Management systems in place at HOSL relating to tank filling were both deficient and
not properly followed, despite the fact that the systems were independently audited.
Pressures on staff had been increasing before the incident. The site was fed by three pipelines,
two of which control room staff had little control over in terms of flow rates and timing of
receipt. This meant that staff did not have sufficient information easily available to them to
manage precisely the storage of incoming fuel.
Throughput had increased at the site. This put more pressure on site management and staff
and further degraded their ability to monitor the receipt and storage of fuel. The pressure on staff
was made worse by a lack of engineering support from Head Office.”
Unfortunately,thescenariosdescribedaboveleadingtothisincidentarealltoocommon.Butfortunately,theAPICommitteedevelopingthenewAPI23504thedition,fullyintegratedthelessonslearnedfromBuncefieldaswellasotherincidentsandcombinedthemwiththebestpracticesfortankfillingoperationsfromeverysectorofthepetroleumindustry.Infact,theUnitedKingdom’sHSEwasoneofthecommitteememberstoensurethatalllessonslearnedfromBuncefieldwerecapturedinthe4theditionofAPI2350.
3 OverfillProtectionforStorageTanksinPetroleumFacilities,ANSI/APIStandard2350-2012,FourthEdition,May20124 HSEHealthSafetyExecutiveisagovernmentalsafetyagencyintheUnitedKingdomresponsibleforpublicandworkerhealthandsafety5 http://www.buncefieldinvestigation.gov.uk/reports/index.htm
6
TheAPIcommitteeisaconsensus-basedstandardsdevelopmentorganizationandthecurrenteditionofAPI2350ensuresaworldwideperspectiveontankoverfillprotection.Theworldwidebestpracticesfrominternationalcountries,regulatoryagenciesandcompanieshavebeenstudiedandcompiledintotheneweditionofAPI2350.
7
Reducing liabilitiesClearly,thepreventionofoverfillsisasignificant,andobviousbenefit,totankowners/operators.Alltankowners/operatorsknowthatprotectionofpublicandworkerhealthandsafety,theenvironment,andassetsareimportant.Butwhatmaynotbesoobvioustothemisthatthebenefitsthatcanresultbyapplyingthelatestthinkingrelatedtotankoverfills.ThenewmanagementsystempracticesencouragedbyAPI2350mayactuallyimprovethenormalday-to-dayoperationsandefficiencyforafacility.
ThepreviouseditionsofAPI2350canbeconsideredalistofthegoodequipmentandoperatingpracticesthatareneededtopreventoverfills.Indeed,suchlistshavevalue,buteliminatingthetankoverfillrequiresmuchmorethanjusttheuseofsuchlists.Eliminatingoverfillsrequiresaformalandcomprehensivesafetymanagementsystem.
Tankoverfillsarerelativelyrareeventssowhyaretheserareeventsofconcern?Thereasonisthattheconsequencesofoverfillscanexceedmost,ifnotallotherpotentialscenariosatapetroleumfacility.Whilerare,seriousincidentsusuallyyieldriskstothetankowners/operatorsthataredeemedunacceptable.Thefactthattheremaybepropertydamageandinjuriesorfatalitiesisonlythebeginningoftheaccidentscenario.LiabilitiesofvariouskindscangoonforpagesasareviewoftheBuncefieldincidentreportsshows.InsomecasesbeingforcedoutofbusinessistheendresultasinthecaseofCaribbeanPetroleuminthePuertoRico(October23,2009)incident.
Other benefitsInadditiontoreducingliabilities,therearebenefitsimpactingoverallfacilityoperationalefficiencyandreliabilityasmentionedabove.SinceAPI2350usesthelatestprinciplesofmanagementsystems,operationalimprovementsingeneralmayresultfrom:
• Simplifiedandclarifiedresponsetoalarms• Moreusabletankcapacity(explainedlater)• GeneralizedunderstandinganduseoftheManagementofChange(MOC)process• Operatortrainingandqualification• Inspection,maintenanceandtesting• Proceduresfornormalandabnormalconditions• Lessonslearnedusedtoevolvebetteroperational,maintenanceandfacilitypractices
MotivatingRobustOverfillProtection
8
Major components of API 2350 (past and present)ThekeyelementsofAPI2350maybeconsideredtocomprisethefollowingelements:
• ManagementSystem(OverfillPreventionProcessorOPP)• RiskAssessmentsystem• OperatingParameters – LevelsofConcern(LOCs)andAlarms – Categories – Responsetime – Attendance• Procedures• EquipmentSystems
Thefirsttwoelementsaremajoradditionsthatwereabsentinpreviouseditions.API2350definestheManagementSystemtobetheOverfillPreventionProcess(OPP).Inotherwords,whenyoureadorhearthetermOPP,justthinkofthemanagementsystemconcept.
Next,OperatingParameterswasatermcoinedtodesignatethetankspecificdatarequiredtousethestandard.TheseincludetheLevelsofConcern(LOCs)valueofimportantliquidlevelssuchasCriticalHigh(CH),HighHighTank(HH)andMaximumWorkingLevel(MW).AlsoincludedaretheCategoriesofoverfillprotectionsystemswhicharedesignatedbythetypeandconfigurationofequipmentbeingusedforoverfillprotection.AnotheroperatingparameteraretheResponseTime(RT)andAttendance.Alloftheseoperatingparametersarealldiscussedindetaillater.TheyshouldbethoughtofasthedataabouttankfacilitiesrequiredtouseAPI2350efficiently.
Theproceduresandequipmentsystemelementsaresimilartopasteditionsandwereupdatedtoreflectthechangesaboveaswellastoapplysomeimprovementsoverpasteditions.
Finally,perhapstheleastappliedbutbiggestchangeistheadoptionofguidanceapplicabletoSafetyInstrumentedSystemswhichcanautomatetheterminationofareceiptintheeventthattheHHLOCisexceeded.Suchsystemsaresometimescalled“automatedsafetyshutdownsystems”or“safetyinstrumentedsystems”,butinAPI2350thesearecalled“AutomatedOverfillProtectionSystems(AOPS)”.
Management systemsAManagementSystemallowsanorganizationtomanageitsprocesses,oractivities,sothatitsproductsorservicesmeettheobjectivesithassetforitself.Theobjectivescanvaryfromsatisfyingthecustomer’squalityrequirements,tocomplyingwithregulations,ortomeetingenvironmentalobjectivesandsuchasystemoftenhasmultipleobjectives.Manycompaniesusemanagementsystemstoreducesafety,healthandenvironmentalincidentstoaslowarateaspossible,giventhestateoftheartforbusinessoperationsbestpracticestoday.
ManagementsystemsareattheheartoftheneweditionofAPI2350.API2350linesupwiththecurrentindustrythinkingbyrequiringtheapplicationoftheOverfillPreventionProcess(OPP).OPPisthepeopleandequipmentassociatedwithtankfillingoperationstomaintainanoptimallytunedsystemforhighperformancewithoutoverfills.TheinclusionofOPPissignificantinthatthestandard
9
isnolongerjusttalkingabouthowtodesign,operateandmaintainsuchsystems,butistalkingabouthowthecompanyshouldrunitsprocessesandproceduresassociatedwithtankfillingoperations.
AlthoughAPI2350requiresamanagementsystemforoverfillpreventionandprotection,itdoesnotspecifyhowtodeveloporimplementone.Organizationstypicallyrelyuponmanagementsystemsthathavebeendevelopedasaresultofseriousincidentsinthepast.Thesemanagementsystemsarerelativelycommonamonglargeandmidsizeorganizations.Theseorganizationshavelearnedtousethesesystemstosystematicallyreduce,controlandmanageincidentsaswellastoimproveotheraspectsoftheirbusinesses.Inordertobeeffective,thesesystemsmustbeintegratedintothe“corporateculture”andmustbefitforpurpose.Eventhesimplestofsuchsystemsrequirelotsoftime,energyandresourcesandmustbeactivelysupportedbytheverytopleveloftheorganization.Withouttopmanagementactivesupportandpromotion,thereisnohopeforaworkingmanagementsystem.
Itisrecommendedthatorganizationswhichdonotuseanyformofsafetymanagementsystemconsiderdevelopmentandimplementationofabasic,fitforpurposesafetymanagementsystem.ThentheyensurethatthesafetymanagementsystemincorporatestherelevantprinciplesfromAPI2350.Thisrecommendationisespeciallyimportantforthosecompaniesthataregrowingorthosethatareacquiringothercompaniesintheirgrowthcycle.Anyacquisitionispotentiallyhighriskuntilallofitsmanagementsystemsaswellasitsequipmentsystemsandoperationsareintegrated.
Risk assessmentAPI2350requirestheuseofariskassessmentsystem.Eachtankunderthisstandardmusthaveariskassessmentperformedtodeterminewhetherriskreductionisrequired.Riskassessmentisameansofcombiningtheconsequenceandlikelihoodofanoverfillorotheraccident,usuallyfortwopurposes.First,acommonscaleorrankingmethodologyneedstobeappliedtothemanydifferentpossibleaccidentorlossscenariosthatafacilityissubjectto.Forexample,theriskofarogueemployeeattemptingtosabotageafacilityisdifferentthantheriskofatankoverfill.Withoutriskassessmentthereisnorationalwaytounderstandwhichscenariomaybeworse.Second,sinceresourcesarealwaysscarce,riskassessment,throughtheriskmanagementprocess,allowsacompanytocompareandprioritizetheserisksforthepurposeofallocationofbudgetsandresourcestomitigatetheminsuchawaythatthemostseriousrisksaremitigatedfirst.
Unfortunately,API2350requiresthatthetankowner/operatoruseariskassessmentsy”stemtoaddressrisk,butdoesnotprovideanyinformationorguidanceonhowtodeveloporusesuchasystem.Whilethismayseemstrange,itistheonlywaythatageneralindustrystandardcanbewrittenforageneralpopulationofhighlyvariablefacilitiesandtankowners,eachwithdifferingperceptionsofriskthreatsanddifferingcorporatevalueschemes.
AgoodstartingpointforriskassessmentresourcescanbefoundinIEC61511-3Part3:“Guidanceforthedeterminationoftherequiredsafetyintegritylevels–informative”andIEC/ISO31010“RiskManagement–RiskAssessmentTechniques.”
10
OverviewTheprimaryenablingmechanismthatallowsadoptionofAPI2350istopmanagementendorsementandsupporttomotivatethesafetymanagementsystem(OPP).Thismeansthatformalprocessesforalloftheelementscoveredin“ManagementSystems”(seebelow)willbedocumented,created,revisedandformallysetintomotionusingaformalcorporateprogramstructure.
ImplementationofAPI2350
Management Systems
Specific Elements of the Management Systems for Overfill Prevention• Formalwrittenoperatingproceduresandpracticesincludingsafetyproceduresand
emergencyresponseprocedures
• Trainedandqualifiedoperatingpersonnel
• Functionalequipmentsystems,testedandmaintainedbyqualifiedpersonnel
• Scheduledinspectionandmaintenanceprogramsforoverfillinstrumentationand
equipment
• Systemstoaddressbothnormalandabnormaloperatingconditions
• Amanagementofchange(MOC)processwhichincludespersonnelandequipment
changes
• Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents,
• Asystemtosharelessonslearned
• Afollow-upsystemtoaddressanyneededmitigationofcircumstancesleadingtonear
missesorincidents
• CommunicationsystemsprotocolswithintheOwner/Operatororganizationand
betweentheTransporterandtheOwner/Operatorthatthataredesignedtofunction
underabnormalaswellasnormalconditions
Benefits of Management Systems• Safetyandenvironmentalprotection
• Optimizationoftheworkplaceandoperatingpractices
• Inspection,testing,andmaintenance
• Equipmentandsystemselectionandinstallation
• Safeworkpractices,emergencyproceduresandtraining
• Managementofchangeprogramsrelativetotankoverfillprotection
• Inclusionofcurrenttechnologyandpracticesrelatedtoprocesscontrolandautomated
safetyinstrumentedsystems
11
Figure1(seebelow)-“ConceptualManagementPlanforImplementationofAPI2350”-givestheoverallconceptassociatedwithimplementationofAPI2350.Afirststepissettingupaprocessfordatamanagementassociatedwiththetankoverfillprotectionprogram.Theexistingtankconfigurationmustbeunderstood.Thetankconfigurationisthetypeofinstrumentationthatthetankhas,itsLOCs,alarmandgaugingsystemsandtheoperatingparametersincludinganyrelevantinformationtotheOPP.Thismeansthatallrelevantdataforeachtankneedstobecollectedandaprocessforkeepingituptodateestablished.“RiskConsiderationsforRiskAnalysis”(seepage12)examinessomeoftheinformationconsiderationsneededtoestablishrisk.Thedatabase(1)(2)involvesalltankswithinscopetobeincludedinthetankoverfillprotectionprogram.
Figure 1: Conceptual Management Plan for Implementation of API 2350 (Note:Diagramshowsconceptuallyhowonemayapproachmanagingtheprocessofbringingapopulationofexistingandproposednewtanksforexistingfacilitiesintocompliancewiththe4theditionofAPI2350)
Thedatawillprovideinformationaboutoperatingparametersandtankspecificinformationandanyotherinformationrelevanttoestablishingcompliancewiththestandard.Whilesometankconfigurationsmayhaveacceptableresidualriskothersmaynot.Itisonlyafterariskassessmentprocess(3)isappliedtoeachtankthattheacceptableconfigurationcanbeestablished.Eachtankoverfillsystemwillthenbeclassified(4)aseithercompliantornon-compliantwithAPI2350.Inotherwords,theriskiseitheracceptableorunacceptable.
Theclassificationresultsintheabilitytodoagapassessmentplan(5)whichwillshowwhatchangesareneededtobringthetanksto/withinacceptableriskandintocompliancewithAPI2350.Oncethescaleofchangesneededtobringthetanksystemintocomplianceisunderstood,ariskmanagementprocess(6)canbeusedtoprioritizerisksandtodeterminehowmuchfundingisrequiredtoclosethegapandmakealltankscompliant.
Data ManagementProcess and Tank Database
1)2)
Risk AssessmentProcess
3)
API 2350 CompliantConfiguration(acceptable configuation)
4)
Gap Assessment5)
Modified Tank Systemsand Configuration withAcceptable Risks Compliant with API 2350
8)
Risk ManagementProcess
6)
Establish OperatingParameters and Tank Data:
• Tank Category• LOCs• Alarms• Alerts• Response Time• Attendance• AOPS if applicable• Logic solvers• Final elements• Tank details• Risk data
Project Executionfor Gap Closure
7)
Existing Tank System Configuation (all tanks)
START
FINISH
Schedule for Project Execution
12
Risk Considerations for Risk Analysis
Probability or Likelihood Factors• Frequency,rateanddurationoffilling• Systemsusedtoproperlymeasureandsizereceiptstotanks• Accuratetankcalibration(bothstrappingandverifiedCriticalHigh)• Systemsusedtomonitorreceipts• Extentofmonitoring/supervisionofmanualandautomatictankgauging• ImpactofcomplexityandoperatingenvironmentontheabilityofOperating
Personneltoexecuteoverfillpreventiontasks – Fillingmultipletankssimultaneously – Switchingtanksduringreceipt.
Consequence Factors – Impact of Hazardous Material Release on Vulnerable Exposures Hazard characteristics of material (product) in tank volatility, flammability, dispersion, VCE potential• Numberofpeopleonsitewhomightbeaffectedbyatankoverflowing• Numberofpeopleoffsitewhomightbeaffectedbyatankoverflowing• Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite• Possibilityofimpacttonearbysensitiveenvironmentalreceptors• Physicalandchemicalpropertiesofproductreleasedduringoverflowing• Maximumpotentialoverfillflowratesandduration
Oncetheriskmanagementprocess(6)iscompleted,theprojectengineeringandexecutionphases(7)forimplementationofchangescanbegin.Closingthegapwilltakesometimeanditisafundamentalprincipleofriskmanagementthattheworstrisksshouldbereducedfirst.Thegapclosureplanshouldbebuiltwiththisprincipleinmind.Ultimately,theprocessaimstokeeptheowner/operatorincompliance(8).
Theprocessabovewillalsoaddressproposednewtanksthatareaddedtothesystem.Theymustbeevaluatedtothesamecriteriaandrunthroughtheprocess,butunlikeexistingtankstheywillnormallybebuilttobecompliantduringconstruction.
Theprojectexecutionphaseshould,ofcourse,usetheManagementofChange(MOC)processesandinteractwiththedatamanagementsystemtoensurethatinformationinthetankdatabaseisupdatedwhenchangesaremade.
Moredetailonthesestepsfollows.
13
InitializationPartofthedatamanagementprocessisdeterminationofwhatAPI2350callsoperatingparameters.Tankowners/operatorswhoadoptAPI2350mustestablishorvalidatethetankoperatingparameters.Theseincludeknowingthetankcategories,LevelofConcerns(LOCs),alarms,alerts,AutomaticOverfillPreventionSystem(AOPS)(ifapplicable),andattendancetype.
CategoriesAlltanksmustbecategorizedaccordingtoAPI2350.RefertoFigure2(seebelow)-“DefinitionofOverfillProtectionSystemCategories”.Categoriesareameansofgroupingallofthemanydifferentpossibletankoverfillgaugingconfigurationsintothreebroadconfigurationcategories.Whilethestandardsaysnothingaboutwhichcategoryis“better”westatethatgivenallthingsequal,thehigherthecategorythemorereliableisthegaugingandalarmsystem.
OperatingParameters
Figure 2: Definition of Overfill Protection System Categories
14
Category ICategory1systemsareessentiallymanualsystemssuchasmeasurementofthelevelby“sticking”,insertionofatapeorrodwhichindicatesthelevelofoilonit.WhileanAutomaticTankGauging(ATG)maybeatthetankandusedforlevelmeasurement,ithasnocapabilitytotransmitlevelsignalssoallinformationaboutlevelislocalizedtothetank.Thiscategoryshouldonlybeusedwhentherisksarelow(noClass1liquids),thereceiptoperationisinfrequent,therateoflevelriseisslowandwheretheoperationissosimplethatanoperatorhasvirtuallynochanceofmakingamistake.Category1systemsmayonlybeusedforafullyattendedoperation.
Category 2Category2systemshavetheabilitytotransmitlevelandalarminformationtoacentralizedorremotecontrolcenter.ButthealarmisdependentsothatanATGfailurecancausetotallossofinformationaboutthetanklevelsaswellasthealarms.Category2systemshavenoredundancyandsoshouldonlybeusedifthefailurerateoftheATGandlevelsystemisextremelylow(i.e.thebestpossibletechnologyavailable).Category2ispermittedonlyforattendedandsemi-attendedfacilities.WhilemosttankfacilitiesarefittedwithCategory2systems,mostarealsofittedwithunreliableautomatictankgaugesmakingtheseparticularlyvulnerabletoanoverfillevent.
Category 3Category3systemsarelikeCategory2systemsbutarecharacterizedbyhavinganindependentalarm.TheindependentalarmensuresthatanATGfailurewillnotcauseafailureofthealarmfunction.Category3systemsareconsideredthebestavailableconfigurationandtechnologyfortankfillingoperationsandalarmsystems.Theymaybeusedatafacilitywhichisattended,semi-attendedorunattended.
Automatic Overfill Prevention System (AOPS) NotethatAOPSisasystemwhichisindependentoftheBasicProcessControlSystemorBPCS(whichinmostcasesistheoperations)andisindependentofandinadditiontotheBPCS.TheAOPSinFigure2(page17)canbecombinedwithanyofthecategories,however,inmostcases,itwouldmakesensetocombineitwitheitheraCategory2or3overfillpreventionsystem.SometimesAOPSisalsocalled“Category4”.
Other ConfigurationsAPI2350makesabroadclassificationofsystemsbutcannotcoverallcases.Forexample,sometankowners/operatorsuse2ATGsinlieuofasingleATGandpoint-levelalarm.TheseconfigurationsshouldbeconsideredCategory3sincethisconfigurationisusedinthesamewayasaCategory3system.However,itismorerobustbecauseoftheextralevelinformationavailable.Forexample,adualATGsystemcannotonlyalarmatHHbutonavariationbetweenthetwoATGsprovidinganotherdimensionofreliability.
API2350acknowledgesthatitcannotcoverallcasesandtheprinciplesestablishedinAPI2350shouldserveasaguidewhenthesesituationsarise.
Level of Concerns (LOCs)LOCsaretheoreticallevels.Thatis,theydonothavetohaveequipmentassociatedwiththem.Theyarejustliquidlevelpositionsthatarerecordedintheoperatorsdocumentationsuchasinstraptables,inthecontrolroomdisplaysorprocedures.
15
Critical HighForexample,letusstartwiththehighestLOC.ThisistheliquidlevelatwhichanoverflowordamagecanoccurandiscalledtheCriticalHigh(CH).SeeFigure3below.Notethatthereisnoequipmentrelatedtotankgaugingplacedatthislevel.
Figure 3: API 2350 Tank Levels of Concern (LOCs) – Category 2 and 3 Configurations
High HighMovingdowntothenextLOCwehaveHighHigh(HH).Thisisthealarmforhighlevel.ItisalsotheonlyalarmrequiredbyAPI2350.Currently,mostoperatorsusebothaHighandHighHighalarm.API2350nowrequiresonlyonealarm.An“alert”maybeusedinlieuoftheHighalarmifsodesired.Thereasonfordispensingwiththesecondalarmisalongstory,butmaybesummarizedbystatingthattheHighHighisacriticalalarmandproceduresmustreflectthisfact.Itmustalwaysresultinaspecificactionbytheoperatortoterminatethereceipt.HumanFactorsEngineeringshowsthathavingthesecondalarmreallydoesnotappreciablychangetheoverallsystemintegrity.
Havingsaidthis,onespecificreasontostickwiththeoldermethodoftwoalarmsmaybeduetotheunreliabilityofthealarmsensors.Iftheyarenothighlyreliable,thenthesecondsensorgivestheoperatora“secondchance”bystillalarmingeventhoughoneofthesensorshasfailed.
ThisimprovedreliabilitywasintroducedintothetankbusinessinpreviouseditionsofAPI2350aswellastheNFPA630FireCodewhichusedtheconceptofredundancyofsensorsystems.However,
16
usingthehighlyreliablesensorsthatcanbefoundtoday,asinglehighreliabilityalarmcanbebetterthantwounreliablealarmsandsoonlyonealarmisneededandrequired.Thedecisiontotakeadvantageoftheone-alarmrequirementshouldbebasedonmanyfactors,butperhaps,mostimportantly,onaformalmanagementofchangeforthetankoverfillsystems.
Maximum Working (MW) Level Movingdownagain,theMWlevelmayormaynothaveanylevelsensors.Analertmayormaynotbeusedatthisleveliftheoperatorchooses.
Automated Overfill Protection System (AOPS) Level IfanAOPSisappliedthenitwillbesetatorabovetheHH.ThelevelatwhichtheAOPSissetiscalledtheAOPSlevel
Updating and Management of Change (MOC)AccordingtotheOPPtheLOCsmustbeperiodicallyreviewedandupdated.AnMOCshallbeusedwheneverchangessuchasthoselistedin“SomeManagementofChange(MOC)Triggers”(seebelow)occur.
Some Management of Change (MOC) Triggers
Tank Modifications That Trigger MOC• Newtank• Changeinfloatingrooftankseals• Installationofgeodesicdomesorotherkindsoffixedroofs(e.g.whenexternal
floatingrooftanksreceiveretrofitcovers).• Newinternalorexternalfloatingroof• Sideventchanges• Shellextensions• Newtankbottom• Additionofancillaryequipmentsuchasfoamchambers• Recalibrationorre-strappingofthetank• Changeoftankgaugingequipment• Additionofagaugetubewithdatumorchangeindatum/strikeplate
Operating Changes Trigger MOC• Changeinproduct• Changeinincomingoroutgoinglines• Changeinflowrates,• Changeinserviceifitimpactsstructuralintegrity(corrosion,temporaryrepairs,etc.)• Changeinoperations,suchas:paralleltank,floatingorhighsuction,continuousmixer
operation• Changeinresponsetimeresultingfromstaffing,operationorequipmentchanges
6 NationalFireProtectionAssociation30FlammableandCombustibleLiquids
17
AttendanceTanksfacilitiesaregroupedaccordingtowhetherassignedpersonnelareonthepremisescontinuouslyduringtheentirereceiptoperation(fullyattended),onthepremisesjustduringthebeginningandendingofthereceipt(semi-attended)ornotpresentduringanypartofthereceipt(unattended).Thetankowner/operatormustensurethatthefacilityoperationisconsistentwiththisdefinitionsothatthecorrectcategoryoftankdescribednextcanbeassignedtotheseattendancelevels.Table1(seebelow)-“MonitoringProductReceipt”-presentsattendancerequirementsformonitoringreceipts.
Table 1: Monitoring Product Receipt
Categories vs Attendance Level
Category1Facilities
MustBeAttended
Continuouslyduringfirst
hourofreceipt
Everyhourduringreceipt
Continuouslyduringthelast
hourofreceipt
Category2Facilities
IFSemi-Attended
Emergencyconditions
(equipmentmalfunctionor
powerfailure)mayrequire
operationasaCategory1
facility(see4.5.3.6)
Continuouslyduringthefirst
30minutesofreceipt
hourlynotapplicable
Continuouslyduringthelast
30minutesofreceipt
Category3Facilities
IFUnattended
Emergencyconditions
(equipmentmalfunctionor
powerfailure)mayrequire
operationasaCategory1
facility(see4.5.3.6)
Nolocalmonitoring
requirements.For
unattendedfacilities,
continuousmonitoring
duringreceiptbythe
Operator,Transporter,orby
computer.
seeabove
seeabove
Response TimeResponsetimeisthetimenecessaryfortheoperatorundermostoperatingconditionstoterminateareceiptaftertheHHalarminitiates.Theresponsetimeshouldbecarefullydocumentedandestablishedforeachtank.Manyoperatorswillchoosetouseasetfixedtime,suchas15minutestoterminatethereceiptifthelongestresponsetimeislessthan15minutessincethissimplifiestheoperatingprocedures.However,untiltheresponsetimeisformallyestablishedAPI2350requiresverylongresponsetimesasgiveninTable2(seepage18)-“DefaultMinimumHigh-HighResponseTime”.Becauseofthisitisclearthatcomputingandauditingtheactualresponsetimewillpayoffinthelongrun.Itisalsorequiredforthelongtermandonlymakessense.
18
Table 2: Default Minimum High-High (HH) Response Time
TimeallocatedforoperationstoterminateareceiptpriortoreachingeitherAOPSifitexistsorcritical
high(CH.
Minimum High-High Tank (HH) Response Time (if not calculated)
Category
1
2
3
Time in Minutes
45
30
15
Thesevaluesmaybereducedonlyiftheactualresponsetimesarevalidated.
19
ProceduresAmostimportantaspectofproceduresisthattheOverfillPreventionSystem(OPS)componentsshouldbetestedrigorouslyaccordingtothestandard.ThereareseveraltypesoftestsoutlinedinAPI2350anditisimportantthateachtestbedoneproperly.ThisoneaspectofOPSmaybethesinglemostimportantintermsofprovidingahighdegreeofreliabilityfortheOPSsystemsandfortheoperator.
EquipmentSignificantprogressinthedesignandreliabilityoftankgaugingandalarmsystemshasbeenmadeinrecentyears.OnereasonthatAPI2350onlyrequiresonealarmisthattheATGsandalarmsystemcanbesoreliablethattheyfarexceedthereliabilityofanyATGswhenpreviouseditionsofAPI2350werewritten.However,thereisasignificantCaveat.API2350doesnotgetintowhichequipmentortechnologyshouldbeused,soitisquitepossiblethatsometankowner/operatorswantingtoincreasecapacitywilleliminatetheHighalert,anddependsolelyontheonealarm,butnotusethebestpossibletechnology.Unfortunately,thisisarecipefordisastersincealarmreliabilitymustbeextremelygoodinthecasethatthereisnoredundancy.
Proof TestingTheimportanceofprooftestingcannotbeoveremphasized.Whensystemssuchastankalerts,alarmsorAOPSfailthefailuresareforthemostpartunrevealed.Forexample,supposeanoperatordependsonasensorlocatedatHHtothealarmincasethereisafailuretoterminatethereceipt.Ifthisalarmisfailedthentherewillmostlikelybeanoverfill.Thistypeoffailureisreferredtoasadangerous,undetectedfailureifthepurposeofthealarmsystemisforsafety.WhilegreatadvanceshavebeenmadeforselfdiagnosticelectronicsensorsandATGSwhichmonitormanyifnotmostofthefailuremodesandoutputadiagnosticalarminsuchcases,nosystemhasa100%probabilityofdiagnosingsystemfaults.Theonlywaytopositivelyfindallpotentialdangerousundetectedfaultsistoprooftesttheentireloopfromthesensortothefinaloutput(sensor,logicsolver,andfinalelementorvalve).ItisrecommendedthatprooftestingrequirementsasspecifiedforAOPSbeappliedtoallalarmsaswell.
API2350requiresallcomponentsinvolvedtoterminateareceipttobeproof-testedatleastannually,unlessotherwisesupportedbyatechnicaljustification(i.e.aprobabilityoffailureondemandcalculation).Point-levelsensorsshallbeconductedsemi-annually.TestingofhandgaugesshallcomplywiththerequirementsinAPIMPMSCh.3.1A,andcontinuouslevelgaugesshallcomplywithAPIMPMSCh.3.1A.
EquipmentandOperations
20
General considerationsAlthoughcurrentlyAutomatedOverfillPreventionSystems(AOPS)isinfrequentlyfoundincurrenttankfillingoperations,theywillbecomeanimportanttoolinthetoolboxofoverfillprevention.Intheworldofsafetyinstrumentedsystems,specificindustrystandardshavebeendevelopedwhichapplytoelectricaland/orelectronicand/orprogrammableelectronicdevicestocontroldangerousprocesses.Thesestandardscoverpossiblehazardscausedbyfailureofthesafetyfunctionsbythesafety-relatedsystems.Thesestandardsrepresentthebestpossiblemethodologiestoensurethatsafetysystemsoperateasintended.Thesesafetyinstrumentedsystemsareappliedtorailwaysignalingsystems,remotemonitoringandoperationofprocessplants,emergencyshutdownsystems,burnermanagementsystemsandmanymore.Bytheirveryconstruct,whencombinedwithnormaloperatingsystemsandbasicprocesscontrolsystems,theycanachievealevelorriskreductionthatcannotbeachievedwithoutthem.Sowhythehesitancytousethem?
Onekeyreasonisthatiftheyareimproperlydesignedapipelinecanberupturedbyclosingoffaflowingtankreceiptdeliveringfrompipeline.Inordertodothiswithoutsignificantproblems,thevalveclosuretimemustbesufficientsothatthereisnopossibilityofalinerupture.Asignificantamountofdatacollectionandengineeringanalysisisrequiredtopreventtheriskofapipelinerupture.Onmarinereceipts,thetemporaryhosesthatconnectshiptoterminalcandisengageorruptureduetohydraulictransientsandaspilloverwaterisgenerallymoreseriousthanaspillintheterminal.GreatcaremustbeexercisedwhenapplyingAOPStoanymarineorpipelineoperation.
ThinkingaboutAOPSasakindofinsurancepolicyisuseful.TheAOPSshouldneverbeusedifoperationsaresufficientlygoodthatnooverfillsoccur.Butifnot,theAOPSwillkickinandbringthetankfillingprocesstoasafestate,basicallypayingoutthepremiumforthesesystems.Thingsarecomplicatedbythefactthatthepipelinedeliverycompanyisaseparatebusinessentityfromtheterminal,sothequestionbecomes“Wheredoyouwanttheincidenttooccur?”.Theterminaloperatormostlikelydoesnotwantaspillonhispropertyandlikewisethepipelineoperatorwouldratherhavethespillintheterminalthansomewhereoffsiteinthepipeline.SeriousdiscussionandnegotiationisrequiredbyboththepipelineoperatorandtheterminaloperatortodetermineifandhowanAOPSwillbeusedandacarefulagreementnegotiatedthatmaximizesthebenefitstoallparties.WhileuseofAOPScanreducerisk,itcanalsoincreaseitifnotproperlyappliedanddesignedmeaningthatalloftherequirementsofIEC61511aretotallycompliedwith.
AutomatedOverfillPreventionSystem
21
Two options for AOPS (existing and new tank systems)TherearetwooptionsforinstallingAOPSontankoverfillsystems.WhenthefacilitiesareexistingthenAppendixAofAPI2350isrequiredasaminimum.TheappendixisacompilationofbestpracticesthatshouldachieveariskreductioncomparabletoSIL1(safetyintegritylevel1perIEC61511)orariskreductionfactorof10to100.ThisoptionwasincludedbecauseitissimplynotpracticaltoattempttoapplyIEC61511tooldertankfacilities.
22
Fornewfacilities,theuseofIEC61511isrequired.AnyrequiredminimumSafetyIntegrityLevel(SIL)hashowevernotbeenspecified,althoughthereweremembersinthecommitteeadvocatingthistobedone.ItislikelythatfuturerevisionsofthisstandardwillcomewitharequirementforminimumSIL2,anditisthereforewisetousethisasaguidancewhendesigningnewAOPS.AdoptingthenewAPI2350isasignificantchallengeandeffort.Butthepayoffcanbeworththeef-fortbecausemanyoftheprocessessuchastheuseofsafetymanagementsystemsandriskassess-mentarealreadyacceptedbytheindustryasthemostefficientandappropriatewaytodealwithrisk.Thedatacollectioneffortisanimportantonebecauseitisthefirststeptoassessingtheoverallsystemriskthatthetankfillingoperationsposeinyourfacilities.Inaddition,oncedataiscollectedaboutthesystemthenthehighriskfacilitiescanbeidentifiedandriskreductionstarted.Forex-ample,asimplerequirementtoensurethatalltankalarmsaretestedandthatthealarmresponseismandatedtobeactionableasrequiredbyAPI2350willsignificantlyreducerisksifthesepracticesarenotalreadybeingfollowed.Asimplesurveycanbeusedtostartidentifyingwhatkindsofequip-mentareinplace.
Butbeyondtheselowhangingfruitthereareresourcesandcoststhatmustbeallocatedtotheworthycauseofeliminatingoverfillsfromyourportfoliooftankfacilities.Theyarejusttooseriousathreattoignore.
Manytankoverfillincidentsresultedfromfaultyinstrumentation.Inaddition,whenthealarmshavebeenworking,itisnotuncommonthatoperatorsdidnotbelievethealarmsbecauseofpastproblemswiththeinstrumentationsystems.Ineithercase,overfillsresulted.Today,thehigh-tech,self-diagnosticequipmentavailablehasoutstandingreliability.Itisworthconsideringamigrationprocesswherethehighestrisktankfacilitiesaresystematicallyupgradedtothebestoverfillpreventionequipment.
For additional information:• IntheAppendixyouwillfindaAPI2350-compliancechecklistandsomeexamples
ofdifferentAPI2350-compliantequipmentsolutions• Downloadthestandardfromwww.api.org• Visitwww.rosemount-tg.com/safety• ContactyourlocalEmersonrepresentative
SummaryandConclusions
23
Appendix
A. EquipmentSolutions
B. API2350ComplianceChecklist
C. FrequentlyAskedQuestions
D. AbouttheAuthors
I
A.EquipmentSolutions
Solution 1: Category #2 System per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 1 OF 11
Raptor_API2350_Ed4_Overfill_Prevention_RevBFile name: Rev.
High-High Alarm
Category #2 System per API2350 Edition 4
Rosemount 2240SMulti-Point Temperature
(optional)Rosemount 5900SRadar Level Gauge
Rosemount 2230Graphical Display
(optional)
Rosemount FCUData Concentrator
TankMasterTank Gauging System
Includes Visual & AudibleLevel Alert High and LevelAlarm High-High (LAHH)
Rosemount 2410Tank Hub
Relay Output(optional)
Independent Alarm Panel (optional)Connected to Tank Hub directly
Raptor Tank Gauging SolutionATG: 5900S, LAHH: Integrated in ATG
II
Solution 2: Category #3 System per API 2350 Edition 4
High-High Alarm
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 2 OF 11
Raptor_API2350_Ed4_Overfill_Prevention_RevBFile name: Rev.
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount FCUData Concentrator
Rosemount 2410Tank Hub
Rosemount 5900SRadar Level Gauge
Rosemount 2410Tank Hub
Rosemount 5900SRadar Level Gauge
Connection toTankMaster(optional)
Rosemount FCUData Concentrator
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
IndependentAlarm Panel
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5900S
Analog, Relay orDigital Communication
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Category #3 System per API2350 Edition 4
III
Solution 3: Category #3 System per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 3 OF 11
File name: Rev.
High-High Alarm
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount FCUData Concentrator
Rosemount 2410Tank Hub
Rosemount 2410Tank Hub
Rosemount 5400Pulse Radar Level Gauge
Connection toTankMaster(optional)
Rosemount FCUData Concentrator
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
IndependentAlarm Panel
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5400
Analog, Relay orDigital Communication
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Category #3 System per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB
Rosemount5900S FMCWRadar Level
Gauge
IV
Solution 4: Category #3 System per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 4 OF 11
File name: Rev.
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5300
High-High Alarm
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount FCUData Concentrator
Rosemount 2410Tank Hub
Rosemount 2410Tank Hub
Rosemount 5300Guided Wave Radar
Connection toTankMaster(optional)
Rosemount FCUData Concentrator
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
IndependentAlarm Panel
Analog, Relay orDigital Communication
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Category #3 System per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB
Rosemount5900S FMCWRadar Level
Gauge
V
Solution 5: Category #3 System per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
A
Scale: None Sheet: 5 OF 11
File name: Rev.
High-High Alarm
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount FCUData Concentrator
Rosemount 2410Tank Hub
Rosemount 5900SRadar Level Gauge
Rosemount 2120Vibrating Fork
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
IndependentAlarm Panel
Relay/DiscreteOutput
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 2120
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Category #3 System per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB
VI
Solution 6: Category #3 System per API 2350 Edition 4
High-High Alarm
Independent Alarm Panel
Leve
l
Ove
rfill
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 6 OF 11
File name: Rev.
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount 2410Tank Hub
Rosemount 2410Tank Hub
Connection toTankMaster(optional)
Rosemount FCUData Concentrator
Rosemount FCUData Concentrator
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Raptor Tank Gauging SolutionATG: 5900S 2-in-1, LAHH: 5900S 2-in-1
Rosemount 5900S 2-in-1Radar Level Gauge
Rosemount 2240SMulti-Point
Temperature(optional)
Analog, Relay orDigital Communication
Category #3 System per API2350 Edition 4
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Raptor_API2350_Ed4_Overfill_Prevention_RevB
VII
Solution 7: AOPS (Category #4) per API 2350 Edition 4
High-High Alarm
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 7 OF 11
Rev.File name:
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount FCUData Concentrator
Rosemount 2410Tank Hub
Rosemount 5900SRadar Level Gauge
Rosemount 2410Tank Hub
Rosemount 5900SRadar Level Gauge
Connection toTankMaster(optional)
Rosemount FCUData Concentrator
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
Automatic OverfillPrevention System
(AOPS)
SIL2/SIL3Discrete Signal
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5900S SIL2/3 AOPS
AOPS (Category #4) per API2350 Edition 4
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Raptor_API2350_Ed4_Overfill_Prevention_RevB
VIII
Solution 8: AOPS (Category #4) per API 2350 Edition 4
High-High Alarm
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 8 OF 11
File name: Rev.
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount FCUData Concentrator
Rosemount 2410Tank Hub
Rosemount5900S FMCWRadar Level
Gauge
Rosemount 5400Pulse Radar Level Gauge
Connection toTankMaster(optional)
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
SIL 1 Analog4-20 mA Signal
Automatic OverfillPrevention System
(AOPS)
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5400 SIL2 AOPS
AOPS (Category #4) per API2350 Edition 4
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Raptor_API2350_Ed4_Overfill_Prevention_RevB
IX
Solution 9: AOPS (Category #4) per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 9 OF 11
File name: Rev.
High-High Alarm
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount 2410Tank Hub
Rosemount 5300Guided Wave Radar
Connection toTankMaster(optional)
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
SIL 2 Analog4-20 mA Signal
Automatic OverfillPrevention System
(AOPS)
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 5300 SIL2 AOPS
Rosemount FCUData Concentrator
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
AOPS (Category #4) per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB
Rosemount5900S FMCWRadar Level
Gauge
X
Solution 10: AOPS (Category #4) per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 10 OF 11
File name: Rev.
Leve
l
Ove
rfill
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
Rosemount 2410Tank Hub
Rosemount 2410Tank Hub
Connection toTankMaster(optional)
Rosemount FCUData Concentrator
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 5900S 2-in-1Radar Level Gauge
Rosemount 2240SMulti-Point
Temperature(optional)
Raptor Tank Gauging SolutionATG: 5900S 2-in-1,LAHH: 5900S 2-in-1 SIL2 AOPS
High-High Alarm
Automatic OverfillPrevention System
(AOPS)
SIL2 DiscreteOutput
Rosemount FCUData Concentrator
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
AOPS (Category #4) per API2350 Edition 4Raptor_API2350_Ed4_Overfill_Prevention_RevB
XI
Solution 11: AOPS (Category #4) per API 2350 Edition 4
Rosemount Tank Gauging
Drawn by: G. Nordberg 05/07/2012
B
Scale: None Sheet: 11 OF 11
File name: Rev.
Rosemount 2410Tank Hub
Rosemount 5900SRadar Level Gauge
Rosemount 2120Vibrating Fork
Rosemount 2230Graphical Display
(optional)
TankMasterTank Gauging System
Rosemount 2240SMulti-Point Temperature
(optional)
High-High Alarm
Connection toTankMaster(optional)
SIL 2 DiscreteOutput
Automatic OverfillPrevention System
(AOPS)
Raptor Tank Gauging SolutionATG: 5900S, LAHH: 2120 SIL2 AOPS
Automatic Tank Gauging (ATG)Independent Level Alarm High-High (LAHH)
AOPS (Category #4) per API2350 Edition 4
Rosemount FCUData Concentrator
Includes Visual & AudibleLevel Alert High and
Level Alarm High-High(optional)
Raptor_API2350_Ed4_Overfill_Prevention_RevB
B.API2350Edition4ComplianceChecklist
Introduction Thischecklistprovidesatoolforverificationofcompliancewiththenewstandardforoverfillprevention:API2350,Edition4,May2012.Itcanalsohelpyoutobetterunderstandtherequirementsandrecommendedpracticesthatcomprisethenewstandard.Thechecklistisintendedtobeappliedonatankbytankbasis.Duplicatethechecklistforusagewithmultipletanks(e.g.forassessmentofanentiretankfarm).Thechecklistisorganizedintofourconsecutivesteps(seefigureB1):
Step 1: Management System
Step 2: Risk Assessment
Step 3: Tank & Operations
Step 4: Compliance Summary
Eachstepisbrieflydescribedbelow.Additionalinformationcanbefoundin”TheCompleteGuidetoAPI2350”availableathttp://www.api-2350.com.Foracompletelistofallrequirements,refertothestandarditself.YoucanobtaintheAPI2350standardathttp://publications.api.org.
Figure B.1: Checklist step by step overview
Managemenet System (MS)
Amanagementsystemisdefinedastheframeworkofadministrativeprocessesandproceduresusedtoenabletheownerandoperatortofulfillthetasksrequiredtoreduceoverfillstoanacceptablelevel.AmanagementsystemisrequiredforconformacewithAPI2350,butthestandarddoesnotspecifyhowtoimplementsuchasystem.
Thefirststepofthechecklistoutlinesalltheele-mentsrequiredbyAPI2350tobeincludedinamanagementsystem.Yourmanagementsystemmustmeetalloftherequirementsinthechecklisttobecompliantwiththestandard.
Is the tank compliant with API 2350 Edition 4?
Are administrative processes and procedures in compliance with API 2350?
4.ComplianceSummary
Is the risk, associated with tank overfills, accepatable to responsible stakeholders?
2.RiskAssessment
Are tank data and operating parameters in compliance with API 2350?
Sub-Steps: 3a.DataCollection3b.ScopeCheck3c.TankCategorization3d.LOCandResponseTime3e.Equipment
3.Tank&Operations
1.ManagementSystem
XII
Click for printable MS Checklist
Risk Assessment (RA)
Tank & Operations (TO)
API2350requiresariskassessment,associatedwithtankoverfills,tobeconductedandproperlydocumented.Thestandarddoesnothoweverspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletoresponsiblestakeholders.
TheRiskAssessmentChecklist(seepageXVII)isoutlinedaseithermeetingornotmeetingcriteriasetbystakeholders.Stakeholderstakenintoconsiderationareowners,operators,employees,authorities,transportersandpublic.Ifanyofthestakeholdersfindthattheriskisunacceptable,thenriskreductionisrequired.Thismaybeaccomplishedbyachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(e.g.attendance),achangeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.
Theriskassessmentprocessshallbeconductedbypeoplewhoarefamiliarwithtankfacilitiesandoperationsaswellastheriskassessmentprocess.Thechecklistisintendedforonetankonly.Duplicatethechecklistforusagewithmultipletanks.
ThethirdstepconcernstankconfigurationforconformancewithAPI2350.Here,specifictankdataandoperatingparametersarecollectedandcomparedwiththerequirementsinAPI2350.ThisisrequiredforeachtankwithinscopeoftheAPI2350complianceprogram.
TheTank&OperationsChecklist(seepageXIX)isdividedintofivesub-steps.Thefirststepisintendedfortankdatacollectiononly.Thisdataisthenusedinsubsequentstepstoassessthetank´scompliancewithAPI2350.Morespecific,thedatahelpsyoutoanswerquestionssuchas:IsyourtankwithinthescopeofAPI2350?Whatpre-definedcategoryisyourtank?and,Doesyourtankmeettheequipmentrequirementsforselectedcategory?
RESET
API2350alsorequires,asaminimum,threeLevelsofConcern(LOCs)tobeestablished.Eachofthesethreeshallbedefinedinlevel,ullageandvolumeseperately.Theexactvaluesdependonoperatingparameterssuchasfillrateandresponsetime.
Compliance Summary (CS)
ThefinalsectionconstitutesaComplianceSummaryforthespecifictank.TheComplianceSummaryChecklist(seepageXXV)servesasafinalverificationofthistank scompliancewithAPI2350.Yoursummarymustmeetalloftherequirementstobecompliantwiththestandard.
Click for printable TO Checklist
Click for printable RA Checklist
XIII
Itisadvisable,butnotrequired,toinitiatethefollowingactivitiesbeforestartingtheverificationprocess:
• Createanexperiencedassessmentteamwithcompetentpeoplespanningalldisciplinesrequired (e.g.design,operation,maintenance,instrumentation,safety,qualitydepartments)• Setup/Clarifyresponsibilities• Definethescopeandtimelineofthetankcomplianceprogram• Createproceduresformanagingthedataobtainedandcreatedduringthecomplianceprocess• AcquireacopyoftheAPI2350standardathttp://publications.api.org
NotethatAPI2350isastandardofminimumrequirements.Alternateapproachesthatprovideequivalentormorerobustoverfillpreventionareacceptedandrecommendedbythestandarditself.Forexample,Emersonalwaysadvocatestheusageofthehighestcategoryequipment(automatictankgauging+independentoverfillalarm)foralltankswithinthescopeofthisstandard,sincethecostdifferenceisusualllyminimal.
AlsonotethatthischecklistsummarizestherequirementsinAPI2350,anddoesnotnecessarilyreflectEmerson’sview.Ifanydiscrepanciesorunclaritiesoccur,alwaysrefertotheoriginalsource.Theremayalsobeadditionallocalregulation(e.g.country,federal,statelaws)thatmustbetakenintoconsideration.Ultimately,thisistheresponsibilityofthetankfarmowner/operator.
Incaseyouneedassistance,orhaveanysuggestions,pleasecontactyourlocalRosemountTankGaugingrepresentativeormailto:[email protected].
Incasethetankisnon-compliantwithAPI2350,thecollectedinformationcanbeusedtoperformagapassessment,whichshouldbefollowedbyacomplianceproject.ThisprocessisfurtherdescribedinTheCompleteGuidetoAPI2350,wherefigure1(seepage11)providesanoverviewoftheentireverificationandimplementationprocess.
Recommendations
Click for printable CS Checklist
XIV
Your mangement system shall include (as a minimum)... Is your management system
compliant with requirement?
1. Formaldocumentedoperatingproceduresandpractices,includingsafetyproce-duresandemergencyresponseprocedures.
Yes No
2. Establishedanddocumentedproceduresforpre-receiptplanning.Theproce-dureshallrequiretheproductquantitytobereceivedtobecomparedtogaugedavailablereceivingtankcapacityaheadoftheactualtransfer.Thisinformationshallberecordedonthetankproducttransferorreceiptrecord(s)andshallbemadeavailabletothetrasporter.
Yes No
3. Establishedanddocumentedproceduresforactivitiesduringthereceipt.Thestan-dardrequiresregularlyscheduledcomparisonsofproductlevelsduringreceipts.
Yes No
4. Documentedprocedureforpostreceiptactivities(e.g.closevalves). Yes No
5. Writtenprocedureswhichestablishtheminimumlocalattendancelevelsduringreceipt.1.1
Yes No
6. PoliciesandproceduresshallprohibittheuseofHigh-hightanklevelalarmsandAOPSforroutineoperationorcontroloftankfillingoperations.
Yes No
7. Recordsshowingthatallpersonnelinvolvedintheproducttransferarecompetent1.2andhavereceivedadequatetrainingforthespecifictaskarerequired.
Yes No
8. Functionalequipmentsystems,testedandmaintainedbycompetent1.2personnel. Yes No
9. Drawings,operatinginstructions,inspections,testingandmaintenanceplansshallbeestablishedanddocumentedforthetankgaugingsystem,overfillpreventionsystemandotherequipmentasapplicable.Documentationrelatingtoinspectionandmaintenanceofsystemsshallbemaintainedforaminimumofoneyear.
Yes No
ManagementSystemChecklist
Step 1: Management System (MS) Checklist
Section 4.2 and 4.5http://publications.api.org
Is your MS compliant with API 2350 Ed.4 ?Fill out the following form to check if yourmanagement system is compliant with API2350.Thissheetisintendedforonetankonly.Duplicate the sheet for multiple usage. Foradditional information, see “The CompleteGuidetoAPI2350”.
Tank-farm Facility/Site
Assessment for
TANK NO.TankLocation
Date Revision DataStorageLocation
Issue
1.Name Postion 4.Name Postion
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
RESET
XV
RESET
10. Systemsandprocedurestoaddressbothnormalandabnormaloperatingconditions.
Yes No
11. AManagementofChange(MOC)processthatincludespersonnel,equipmentandproceduralchanges.
Yes No
12. Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents.
Yes No
13. Afollow-upsystemtosharelessonslearnedandtoaddressanyneededmitigationofcircumstancesleadingtonearmissesorincidents.
Yes No
14. Documentedcommunicationprotocolswithintheownerandoperatororganiza-tionandbetweenthetransporterandtheownerandoperatorthataredesignedtofunctionunderabnormalaswellasnormalconditions.
Yes No
15. ProceduresforperiodicreviewoftheLevelofConcerns(LOCs).Maxreviewtimeisfiveyears.
Yes No
Ifalloftheanswersareequaltoyes,thenyourmanagementsystemiscompliantwiththere-quirementsinAPI2350Edition4.
IsyourmanagementsystemcompliantwithAPI2350?
Yes No
Note1.1: Category1:Localattendanceon-sitecontinoulsyduringthefirstandlasthourofreceipt,andataminimumhourlyduringthereceipt.Category2: Maybesemi-attended,butrequiresattendancecontinouslyduringthefirstandlast30minutesofreceipt.Category3:Nolocalmonitoringrequirements.
Note1.2: API2350definesacompetentpersonas“anindividualwhoiscapableandabletoperformtheassigneddutiesasdeterminedbymanagementina specificareaofoperations.”(3.10)
Section 4.2 and 4.5http://publications.api.org
XVI
Assessment for
TANK NO.TankLocation
Step 2: Risk Assessment (RA) Checklist
Is risk, associated to tank overfills, acceptable to responsible stakeholders?API2350requiresariskassessmenttobeconductedandproperlydocu-mented.Thestandarddoeshowevernotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletotheowner,operatorandotherresponsiblestakeholders.AcordingtoAPI2350,itistheresponsibilityoftheownerandoperatortoconductariskassessmentcoveringtherisksassociatedwithpotentialtankoverfills.
RiskAssessmentChecklist
Minimum risk requirement Risk acceptable?
1. Theriskassessmenthasbeenconductedandproperlydocumentedforthespecifictank. Yes No
2. Theriskassessment´sresidualriskisacceptable...
2a. totheOWNER. Yes No
2b. totheOPERATOR. Yes No
2c. totheEMPLOYEES. Yes No
2d. totheAUTHORITIES/REGULATION. Yes No
2e. totheTRANSPORTER. Yes No
2f. tothePUBLIC. Yes No
Ifalloftheanswersareequaltoyes,thentheriskassessmentiscompliantwiththerequirementsinAPI2350Edition4.2.1
Istheriskacceptabletoresponsiblestakeholders? Yes No
RESET
Is the RA acceptable to stakeholders?Filloutthefollowingformtocheckiftheriskassessment is compliant with API 2350 re-quirements. This sheet is intended for onetank only. Duplicate the sheet for multipleusage. For additional information, see “TheCompleteGuidetoAPI2350”.
RESET
1.Name Postion 4.Name Postion
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
Date Revision DataStorageLocation
Issue
Section 4.3http://publications.api.org
Note2.1: Ifthestakeholdersfindthattherisksdonotmeetthegapassessmentcriteria,thenriskreductionisrequired.Thismaybeaccomplished byachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(i.e.attendance),a changeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.
Tank-farm Facility/Site
XVII
ProbabilityandConsequenceFactors(OptionalSection)
Factor considered in the risk assessment?Probability Factors
A.1 Frequency,rateanddurationoffilling. Yes No
A.2 Systemsusedtoproperlymeasureandsizereceiptstotanks. Yes No
A.3 Acuratetankcalibration(bothstarppingandverifiedCriticalHighlevel. Yes No
A.4 Systemsusedtomonitoringandsupervisionofmanualandautomatictankgauging. Yes No
A.5 Extentofmonitoringandsupervisionofmanualandautomatictankgauging. Yes No
A.6 Impactofcomplexityandoperatingenvironment. Yes No
A.7 Fillingmultipletankssimultanoulsy. Yes No
A.8 Switchingtanksduringreceipt. Yes No
Factor considered in the risk assessment?Consequence Factors
B.1 Hazardcharacteristicofmaterial(product)intank. Yes No
B.2 Volatility,flammability,dispersion,VCEpotential. Yes No
B.3 Numberofpeopleonsitewhomaybeaffectedbyatankoverflowing. Yes No
B.4 Numberofpeopleoffsitewhomaybeaffectedbyatankoverflowing. Yes No
B.5 Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite.
Yes No
B.6 Possibilityofimpacttonearbysensitiveenvironmentalreceptors. Yes No
B.7 Physicalandchemicalpropertiesofproductreleasedduringoverflowing. Yes No
B.8 Maximumpotentialoverfillflowratesandduration. Yes No
API2350doesnotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist.Butgenerally,riskisacombinationofconsequencemultipliedbytheprobabilityforaspecificeventorscenariothatresultsinharmordamage.Thereforethestandard(seeAnnexE)recommendsthatatleastthefollowingprobabilityandconsequencefactorsareconsideredintheriskassessment.
RESET
Section 4.3 and Annex Chttp://publications.api.org
XVIII
Assessment for
TANK NO.TankLocation
Step 3: Tank & Operations (TO) Checklist
DescriptionofATGLevelMeasurement ATGTagName Technology(e.g.radar)
TankGaugingSystemTypeofappliedTankGaugingSystem?
None/ManualTankGauging(sectionN/A)AutomaticTankGauging(ATG)
Section 4.4http://publications.api.org
Is your TO compliant with API 2350 Ed.4 ?Filloutthefollowingformtodefineandcon-figure your tank according to API 2350. Thissheetisintendedforonetankonly.Duplicatethe sheet for multiple usage. For additionalinformation,see“TheCompleteGuidetoAPI2350”.
RESET
1.Name Postion 4.Name Postion
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
Figure 1: Overview tank parameters, internal /external floating roof tanks respectively
TypeofLiquidProduct(e.g.crudeoil) Max/MinDensityorSpecificGravity3.1
TankType(e.g.fixedorfloatingroof) TankHeight(TH)/CriticalHigh(CH)3.2
Strapping-tableisuptodate?3.3
EffectiveFloatingRoofThickness(FR)(fromliquidleveltotopsealextension)
Yes No
GeneralTankData
3a. Data Collection
RESET
NotApplicable
OperationalTankDataMaxFillRate MaxWorkingLevel(MW) High-HighLevel(HH) WorstCaseResponseTime(RT)3.4
Note3.1: DensitycaninfluenceCriticalHigh(CH)andEffectiveFloatingRoofThickness(FR).
Note3.2: AccordingtoAPI23503.13:CriticalHigh(CH)isthehighestlevelinthetankthatproductcanreachwithoutdetrimentalimpacts(i.e.productoverflowortankdamage). Foradditionalinformation,seeAPI2350AnnexD.
Note3.3 Max15yearintervalforunchangedtanksaccordingtoAPIManualofPetroleumMeasurementStandards(MPMS)2.2.
Note3.4: ResponseTimeistheperiodoftimerequiredtoterminateareceipt.API23504.4.2.5providesguidanceonhowthiscanbecalculated.Alternatively,thedefault responseratesdefinedbythestandardcanbeused,seesection3e.LevelsofConcern(LOCs)Determination.
Date Revision DataStorageLocation
Issue
Tank-farm Facility/Site
XIX
3b. Scope Check
Is your tank within the scope of API 2350?ThescopeofAPI2350isintendedforabovegroundatmosphericstoragetanksassociatedwithpetroleumfacilitiesincludingrefineries,marketingterminals,bulkplantsandpipelineterminalsthatreceiveClassIorClassIIpetroleumliquids.Useisrecom-mendedforClassIIIpetroleumliquids.3.7
Note3.7: NFPA30-2008definesclassesofliquids.ClassIliquid:aflammableliquidwithaclosedcupflashpointbelow100°F(37.8°C)andareidvaporpressure notexceeding40poundspersquareinchabsolute(2068millimetersofmercury)at100°F(37.8°C).ClassIIliquid:acombustibleliquidwithaclosedcup flashpointatorabove100°F(37.8°C)andbelow140°F(60°C).ClassIIIliquid:aliquidwithflashpointsabove140°F(60°C).
Note3.8: PEI600RecommendedPracticesforOverfillPreventionforShop-fabricatedAbovegroundTanksisavailableathttp://www.pei.org.
RESET
The Tank is...Is your tank compliant
with the statement?
1. Anabovegroundstoragetankof1320USgallons(5000liters)ormore. Yes No
2. ContainingClassIorClassIIpetroleumliquids(optional:ClassIIIpetroleumliquids).3.7 Yes No
Is your tank compliant with the statement?The Tank is NOT...
3. Apressurevessel. Yes No
4. Shop-fabricatedorcompliantwithPEI6003.8. Yes No
5. Locatedataservicestation. Yes No
6. Filledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars). Yes No
8. StoringLPGorLNG. Yes No
If all of the answers are equal to yes, thenthetankiswithinthescopeofAPI2350Edi-tion4.
IsyourtankwithinthescopeofAPI2350? Yes No
ScopeofAPI2350
IndependentOverfillPreventionSystemTypeofappliedOverfillPreventionSystem?
ManualOverfillPreventionSystem(MOPS)3.5
AutomaticOverfillPreventionSystem(AOPS)3.6
None(sectionN/A)
TypeofLevelAlarmHigh-HighSensor Actuator:AlarmSignalSystem OperationalExperience(e.g.replacements,alarms,etc.)
TypeofLogicSolver Actuator:FinalElement
Documentedproof-testprocedureexists?
Proof-testInterval MostRecentProof-testResultandDate
(months)Yes No
RESET
Section 1.1http://publications.api.org
Note3.5: Anoverfillpreventionsystemrequiringoperatingpersonnelactiontofunction(API23503.29).
Note3.6: Anoverfillpreventionsystemnotrequiringtheinterventionofoperatingpersonnelactiontofunction(API23503.6).
Datacommunicationtolocalorremotecontrolexists?
OperationalExperience(e.g.replacements,alarms,etc.)
Documentedverificationtestprocedureexists?
VerficationInterval MostRecentVerificationResultandTestDate
(months)
RESET
Yes No
Yes No
XX
3d. Equipment Requirements
TankEquipmentRequirements
Category 3
Yes(requirement)
Yes(requirement)
LiquidlevelandindependentLAHHistransmittedtocontrolcenter
Category 2
Yes(requirement)
Notrequired
Liquidlevelistrans-mittedtocontrolcenter
Category 1
Notrequired
Notrequired
Nodatacommuni-cationwithcontrolcenterrequired
ATG-System
Independent LAHH Sensor
Availability of measured level data
Tankfulfillsrequirementsforselectedcategory?(Yes,ifallboxesarecheckedforselectedcategory)
Yes No
Does your tank meet the equipment requirements?Thewaythetankisoperated,orequallyitscategory,determinestheminimumrequirementsfortheoverfillpreventionsystem.Givenallthingsequal,ahighercategoryoverfillpreventionsystem(e.g.category3)issaferthanalowercategorysystem(e.g.2).Ahighercategorysystemalsoallowsformoreefficienttankoperationswithlesspersonnelandhighertankutilization.Ahighercategoryoverfillpreventionsystemthanrequiredcanbeusedsinceitisastandardofminimumrequirements.Selectthepreferredtankcategorybelow,andevaluateifyourtankfullfillstheminiumrequirements.Exampleofequipmentsolutionscanbefoundin“TheCompleteGuidetoAPI2350”,AppendixA.
3c. Tank Categorization
Which API 2350 pre-defined category does your tank belong to?API2350requireseachtanktobecategorizedaccordingtohowitisoperated.Mostmodernfacilitiesareoperatedremotelyfromacontrolcenterandwillthereforefallundertankcategory3.
Category 1 Category 2 Category 3
Attendance
Cat.1:Fullyattendedfacility(locallymonitored)
Cat.2:Semi-attendedfacility(locallyandremotelymoni-tored)
Cat.3:Unattendedfacility(remotelymonitored)
Monitoring
Cat.1:Continouslyduringfirstandlasthourofreceiptandonceeveryhourduringreceipt
Cat.2:Continuoslyduringthefirstandlast30minutesofreceipt
Cat.3:Monitoredfromlocalorremotecontrolcenter
Operator
Cat.1:Fullfocusononereceiptatatime,andnotdistractedbyotherduties.
Cat.2:Focusonmultipletanks/receiptssimultanously,oroperatormaybedistarctedbyotherduties
Cat.3:Samerequirementasincategory2
Tankiscategorizedas..?(equalsthehighestcatgoryselectedabove) Category1 Category2 Category3
TankCategorization
RESET
RESETSection 4.4 and 4.5http://publications.api.org
XXI
TheATGsystemisoneofthemostcriticalcomponentstopreventoverfillsfromoccurring.Thisisrecog-nizedinAPI2350,andthereforethestandardrequiressoundengineeringprinciplestobeappliedalsotothispartofthefacility.Thissectionismandatoryforcategory2and3tanks,andoptionalforcategory1.
Automatic Tank Gauging (ATG) System - applies to category 2 and 3
TankequippedwithATGsystem?
ATG system conforms to the following principlesIs your ATG system compliant
with the statement?
1. TheATGsystemisdesignedandconfiguredtoinitiateadistinctvisualandaudiblealarmincasetheliquidsurfacereachestheHighhighLevelAlarm(LAHH)point.
Yes No
2. Written maintenance and verification plans, encompassing all components in the tankgauging system,shallexist.Testingofcontinous-levelsensorsshallcomplywiththere-quirementsinAPIManualofPetroleumMeasurement3.1Bandthemanufacturer’sinstruc-tions.
Yes No
3. Tankandfacilityshallallowformanualshutdownincaseoffailure(e.g.equipmentorcablefailures,powerloss).
Yes No
Ifallof theanswersareequal toyes, thentheATGsystemiscompliantwiththerequirementsinAPI2350Edition4.
IsyourATGsystemcompliantwithAPI2350?
Yes No
AutomaticTankGauingSystem
RESET
Yes No(sectionN/A)
Section 4.4 and 4.5http://publications.api.org
Independent overfill prevention system conforms to the folllowing principlesIs your independent OPS
compliant with the principle?
1. TheequipmentusedintheOPsystemshallnotbeapartoftheATGsystem Yes No
2. AdistinctvisualandaudiblealarmthatisnotapartoftheATGsystem Yes No
3. Documentedproof-testingproceduresandmaintenanceplanshallexistforallcompo-nentsintheoverfillpreventionsystem:-High-HighLevelAlarmSensor-Alarmpanel-LogicSolver(e.g.PLC)-Valves-Communicationsequipment
Yes No
4. TheProof-testingmethodsshall:-beincompliancewiththemanufacturers’instructions-donotput(orleave)thetankinanusafeoperatingmode(e.g.itisnotrecommendedtofillthetankaboveitsminimumworkinglevel)-forcontinuouslevelsensors:complywiththerequirementsinAPIMPMS3.1B
Yes No
IndependentOverfillPreventionSystem
Independent Overfill Prevention System (OPS) - applies to category 3
AnindependentOverfillPreventionSystem(OPS)isrequiredforalltanksoperatedascategory3,whichisthemajorityoftanksoperatingtoday.Traditionally,electro-mechanicalpoint-levelsensorshavebeenused as the High-High Level Alarm (LAHH) Sensor. The usage of “continuous” type level technology israpidlybecomingthedesiredchoicetoreplace“point”typeswitches;theobviousadvatageisthe‘online’levelmeaurementwhichcanbecomparedwiththeATGforproof-testing.
Tankequippedwithindependentoverfillpreventionsystem?
Yes No(sectionN/A)
XXII
Section 4.4http://publications.api.org
AutomaticOverfillPreventionSystem:GenericRequirements
AOP system conforms to the following principlesIs your AOPS compliant
with the principle?
Existing Facilities ConformtoAnnexAinAPI2350orIEC61511 Yes No
New facilities ConformwithrequirementsinIEC61511orANSI/ISA84.00.01-2004 Yes No
Wireless AOPSdoesnotdependonWirelesscommunication3.9 Yes No
Safe state Allequipmentshallbedesignedtomovetheprocessintoasafestateintheeventofapowerlossordevicefailure.
Yes No
Automatic Overfill Prevention System (AOPS) - if used
AutomaticOverfillPreventionSystems(AOPS)areoptional.Butifoneisbeingem-ployed,thenitisrequiredtoconformtotheminimumrequirementsbelow.
RESET
TankequippedwithAOPS?
Yes No(sectionN/A)
Note3.9: WirelesscommunicationisacceptableforanythingbutAOPS.AnAOPScannotdependsolelyonwireless,butitcanbeusedasredundant communication(e.g.deviceconfiguration).
RESET
CHLevelset-point:expressedasLevel CHLevelset-point:expressedasVolume CHLevelset-point:expressedasUllage
MinimumRequirement CHLeveliscompliantwiththeminimumrequirement?
Highestlevelintankthatproductcanreachwithoutinitiatingoverflowortankdamage.Ifapplicable,thethicknessofthefloatingroofshallbetakenintoconsidiration. Yes No
CriticalHighLevel
3e. Levels of Concern (LOCs) Determination
ThestandardrequiresataminimumthefollowingthreeLOCstobedefined:CriticalHighLevel(CH),High-HighLevel(HH)andMaximumWorkingLevel(MW).EachLevelofConcernshallbedefinedinlevel,ullageandvolume.UsageofHi-Alertsisoptional.FigureB.2outlinestheLOCs.
5. Resultfromproof-testingshallbeproperlydocumentedandthetestintervalismaxi-mum-Point-levelSensor(ifexist):6months-Allothercomponentsintheoverfillpreventionsystem:12months
Yes No
6. High-HighLevelAlarmSensorshallbeabletoalsomeasureliquidproductontopofthefloatingroof(ifapplicable)
Yes No
If all of the answers are equal to yes, then theIOP system is compliant with the principles inAPI2350Edition4.
IsyourindependentOPScompliantwithAPI2350?
Yes No
RESET
AOPSLevelset-point:expressedasLevel AOPSLevelset-point:expressedasVolume AOPSLevelset-point:expressedasUllage
MinimumRequirement AOPSLeveliscompliantwiththemin.requirement?
Level/VolumeequivalenttodistancefromCHtocalculatedAOPSresponsetimeatmaxflowrate.Distance(btw.CHlevelandAOPSlevel)shallnotbelessthanthree(3)inches.
Yes No
AutomaticOverfillPreventionSystem:Set-point
RESET
XXIII
Level Required action for specified level Requirement fulfilled?
CriricalHigh(CH) Anemergencymanagementresponseshallbeinitiated.Procedureshallbedocumented
Yes No
HighHigh(HH) Alarmgeneratedanddocumentedproceduresrequiringoperatorstoinitiateimmediatetermination• Category1:Alarmoptional• Category2:AlarmgeneratedbyATG-system.• Category3:RedundantAlarmsgeneratedbyATGandIOPS
Yes No
ActionRequirements
Are actions and procedures documented?API2350requiresdocumentedactionsincasetheliquidproductsurfacereachesCriticalHigh(CH)orHigh-High(HH).
RESET
HHset-point:Level HHset-point:Volume HHset-point:Ullage
MinimumRequirement
Ataminimum,verticaldistancebetweenCHandHHcorre-spondstothefollowingresponsetime(atmaxflowrate)3.10:• Category1=45minutes• Category2=30minutes• Category3=15minutesThree(3)inchminimumlevelforallcategories.
HHiscompliantwiththeminimumrequirement?
HighHighLevel
Figure B.2: Overview Levels of Concern (LOCs)
Yes No
RESETNote3.10: Thesearethedefaultresponsetimesforeachcategory. Alternatively,thetankspecificresponsetimecanbeused.
MWLevelset-point:expressedasLevel MWLevelset-point:expressedasVolume MWLevelset-point:expressedasUllage
MinimumRequirement MWLevelcompliantwithmin.requirement?
Ataminimum.verticaldistancebetweenHHandMWcorrespondstocalculatedfacilityoperationsresponsetime3.11. Yes No
MaxWorkingLevel
RESETNote3.11: Responsetimeistheperiodoftimerequiredtoterminateareceipt.
Section 4.4http://publications.api.org
Level Description Action and Alarm/Alert Requirements
The level at which damage or overflow occurs
A spill management emergency response shall be initiated. Procedure shall be documented. Alarm is required.
The level at which termination of product receipt triggers
Critical High (CH)
Max. Working (MW)
AOPS Level
High-High Tank (HH) The action alarm level to enable termination of product receipt
The highest level to which the tank may routinely be filled
Level only applies if AOPS is used. Alarm is optional.
Action response required. Procedures shall be documented. Alarm is required for Cat. 2 and 3.
Alert is recommended but not required.
Note: High tank level is not required
XXIV
Step 4: Compliance Summary (CS) Checklist
Is tank compliant with API 2350?Filloutthefollowingformtoverifyifthetankis compliant with API 2350. This sheet is in-tendedforonetankonly.Duplicatethesheetformultipleusage.Foradditionalinformation,see“TheCompleteGuidetoAPI2350”.
RESET
1.Name Postion 4.Name Postion
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
Tank-farm Facility/Site
Assessment for
TANK NO.TankLocation
Date Revision DataStorageLocation
Issue
ComplianceSummaryChecklist
1. MangementSystemoftankincludesallelementspresentedinSection1,MSChecklist? Yes No
2. Ariskassessmenthasbeenconductedandproperlydocumented,andtheassessment´sresidualriskisacceptabletoresponsiblestakeholders?
Yes No
3. DatacollectionandtankconfigurationhasbeenconductedinaccordancewithSection3,TOChecklist?
Yes No
3a. Data,requiredfortheassessmentoftank,hasbeenproperlycollected? Yes No
3b. ThetankiswithinthescopeofAPI2350? Yes No
3c. ThetankhasbeencategorizedinaccordancewithAPI2350? Yes No
Ifyes,thespecifictankiscategorizedas: Cat.1 Cat.2 Cat.3
3d. Thetankfullfillstheequipmentrequirementsforselectedcategory? Yes No
ATGSystemcompliantwithAPI2350? N/a Yes No
IOPSystemcompliantwithAPI2350? N/a Yes No
3e. LevelsofConcern(CH,HHandMW)havebeenestablishedinaccordancewithAPI2350?
Yes No
Ifalloftheanswersareequaltoyes,thenthetankiscompliantwithAPI2350Edi-tion4.
IstankcompliantwithAPI2350Edition4? Yes No
RESET
XXV
XXVI
C.FrequentlyAskedQuestions
Who should care about API 2350?Thepurposeofthestandardistocoverminimumoverfill(anddamage)preventionpracticesforabovegroundstoragetanksinpetroleumfacilities,includingrefineries,marketingterminals,bulkplants,andpipelineterminalsthatreceiveflammableandcombustibleliquids.Thestandardassistsowner/operatorsandoperatingpersonnelinthepreventionoftankoverfillsbyimplementationofacomprehensiveoverfillpreventionprocess(OPP).Thegoalistoreceiveproductintotheintendedstoragetankwithoutoverfillorlossofcontainment.Anybodyinvolvedinthisprocessbenefitofunderstandingandapplyingthisstandard,rangingfromtankowner/operators,operatingandmaintenancepersonnel,transporters,engineering,safetystaff,suppliers,andgovernmentofficials,justtomentionafew.
What’s the scope of API 2350?API2350isintendedforstoragetanksassociatedwithmarketing,refining,pipelineandterminalscontainingClassIorClassIIpetroleumliquids.UseisrecommendedforClassIIIpetroleumliquids.API2350doesnotapplyto:• undergroundstoragetanks;• abovegroundtanksof1320USgallons(5000liters)orless;• abovegroundtankswhichcomplywithPEI600;• pressurevessels;• tankscontainingnon-petroleumliquids;• tanksstoringLPGandLNG;• tanksatservicestations;• tanksfilledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars);and• tankscoveredbyOSHA29CFR1910.119andEPA40CFR68orsimilarregulations.
Why should API 2350 be used and not some other safety standard?API2350isasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Itwascreatedbytheindustryfortheindustry.Awidespectrumofindustryrepresentativesparticipatedinitscreation:tankownersandoperators,transporters,manufacturers,andsafetyexperts,justtomentionafew.Itisacompilationoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.Anditdoesnotcompetewithothermoregenericsafetystandards,butinsteadactsasacomplement.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingsomeoftherequirementsinAPI2350.
XXVII
Is API 2350 required by any law?API2350isastandardcreatedbytheindustrycommunity,andnotalegaldocument.However,inmanycasestheapplicablelawsrequiretheoperationtobecompliantwithrecognizedindustrybestpractices.Often,APIpublicationsareusedasthebenchmark,therebyindirectlyreferencingtoAPI2350incaseoftankoverfills.ItishoweverimportanttorecognizethatAPI2350doesnotsupersedeanylocal,stateorfederallawsandregulations,whichalwaysmustbetakenintoconsideration.
What’s the difference between API 2350 and 61508/61511?IEC61508/615011aregenericsafetystandardsdescribingtheuseofsafetyinstrumentedsystems(SIS).API2350ontheotherhandisasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Thesetwostandardsdonotcompetewitheachother,butinsteadactascomplements,withmanysimilarities.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingmanyoftherequirementsinAPI2350.
Is API 2350 applicable outside the US?Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Itisintendedtobeequallyvalidandapplicableworldwide.
Where can I get API 2350?Thestandardcanbedownloadedfromwww.api.orgforasmallfee.
What does API 2350 say about Wireless communication?AccordingtoAPI2350,theuseofwirelesscommunicationisacceptable,exceptforonespecificuse-case:“AOPSshallnotrelyonwirelesscommunicationtoinitiatediversionorterminationofreceipt”(AnnexA).InAOPS,wiredandwirelesscommunicationcanhoweverbeusedsimultaneously,ifthewirelesslinkisusedfordeviceanddiagnosticsmonitoring,andnottoinitiatediversionorterminationofreceipt.
XXVIII
D.AbouttheAuthors
Phil E. Myers, API 2350 Committee Chairman
PhilE.MyershaschairednumeroustaskgroupsfortheAmericanPetroleumInstitute,includingAPI2350.Currently,heisthedirectorofPEMYConsulting.HehasalsoworkedatChevronCorporationwherehewasamechanicalintegrityspecialistfortanks,pipingandpressurevesselsspecializinginsafetyandrisk.MyersholdsaBScinChemicalEngineeringfromUCBerkeleyandanMScinTheoreticalandAppliedStatisticsfromCaliforniaStateUniversity.
Carl-Johan Roos, Emerson Safety Expert
Carl-Johan“CJ”Rooshasover10yearsofglobalexperiencefromvarioustechnicalandmanagerialpositionsintheprocess-andtankgaugingindustry.BesidesAPI2350,hehasactivelyparticipatedinnumerousproductspecificIEC61508-CertificationsandsitespecificIEC61511-relatedprojects,besideshisusualworkasbusinessdevelopmentmanageratEmerson’sProcessLeveldivisionwhereheoftenaddressesnationaloverfillpreventionregulationsuchasTÜV/DIBtWHGinGermany.RooshasaMScinElectricalandComputerEngineeringfromGeorgiaTechandChalmersUniversity,andaMBAfromtheUniversityofGothenburg.
HeadquartersEmersonProcessManagementRosemountTankGaugingBox13045SE-40251GothenburgSWEDENTel:+46313370000Fax:+4631253022E-mail:[email protected]
RosemountisaregisteredtrademarkofRosemountInc.FoundationisatrademarkoftheFieldbusFoundation.TheEmersonlogoisatrademarkandservicemarkofEmersonElectricCo.
Thecontentsofthispublicationarepresentedforinformationpurposesonly,andwhileeffortshavebeenmadetoensuretheiraccuracy,theyarenottobeconstruedaswarrantiesorguarantees,expressedorimplied,regardingtheproductsorservicesdescribedhereinortheiruseorapplicability.Allsalesaregovernedbyourtermsandconditions,whichareavailableonrequest.Wereservetherighttomodifyorimprovethedesignsorspecificationsofourproductsatanytimewithoutnotice.RosemountTankRadarABacceptsnoresponsibilityforanyerrorsthatmayappearinthispublication.
©R
osem
ount
Tan
kRa
darA
B.R
ef.N
o.9
0103
0en.
Rev
BA
,Feb
ruar
y20
13
North America EmersonProcessManagementRosemountTankGaugingNorthAmericaInc.6005RogerdaleRoadMailStopNC13677072TXHoustonUNITEDSTATESPrimaryPhone:+12819884000SecondaryPhone:+18007222865E-mail:[email protected]
Asia PacificEmersonProcessManagementAsiaPacificPteLtd1PandanCrescentSINGAPORE128461Tel:+6567778211Fax:+6567770947E-mail:[email protected]
Middle East & AfricaEmersonProcessManagementRosemountTankGaugingMiddleEast&AfricaP.OBox20048ManamaBAHRAINTel:+97317226610Fax:+97317227771E-mail:[email protected]
www.rosemount-tg.com
Local Tank Gauging ExpertFindyourlocalTankGaugingExpertatwww.rosemount-tg.com/contacts