1. business and industrial
2. energy
3. oil

Tank Overfill Protection
A review of API 2350
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 2
API2350 Edition 4: Scope
• Petroleum liquid products
• Atmospheric storage tanks
– Fixed roof
– Floating roof
• API2350 is generic and can often be applied on
other tank types
Spartan Controls Confidential | Page 3
Scope of API 2350
•
•
•
•
Storage tanks containing petroleum
Larger than 5m3
Non pressurized tanks
Products of Class I or II
Class
Definition
Example
I
Flash Point less than 100°F
Motor and Aviation
Gasolines
II
Flash Point equal to or greater than 100°F, Diesel Fuel, Paint Thinner
but less than 140°F
III
Flash Point equal to or greater than 140°F
Spartan Controls Confidential | Page 4
Home Heating Oil,
Lubricating Oils, Motor Oil
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 5
Why management system?
Spartan Controls Confidential | Page 6
Management System Component
• Now required by API2350 Edition 4
• A management system is the framework of processes and
procedures used to ensure that an organization can fulfill all tasks
required to achieve its objectives
• Examples:
– ISO 9001 Quality Management,
– ISO 14001 Environmental Management (Chevron benchmark)
– ISO/IEC 27001 Information Security Management,
– SA8000 Social Accountability.
Spartan Controls Confidential | Page 7
Management System Cont’d
• Key Components
–
–
–
–
–
–
–
Formal written operating procedures (including emergency response)
Trained and qualified personnel
Equipment systems testing and maintenance
Normal and abnormal operating conditions addressed
MOC (management of change)
Investigation process for near misses and incidents
Lessons learned
• API 2350 does NOT specify how to develop/deploy a
management system
Spartan Controls Confidential | Page 8
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 9
What is risk?
Risk = Consequence • Probability
Spartan Controls Confidential | Page 10
Methods of Risk Assessment
• Many methods ranging from qualitative
to semi-quantitative to quantitative:
– Checklists
– Risk matrices
– HAZOP approach
– Risk Graph
– Quantitative Methods
– Layers of Protection Analysis (LOPA)
Spartan Controls Confidential | Page 11
Example Risk Matrix
Who does the risk assessment
• Sometimes wide group of company internal competence
–
–
–
–
–
Safety/Quality department
Operators department
Maintenance engineers
Instrument Engineers
…
• Often 3rd part company
– Exida, TÜV, DNV, SISTech, …
• Other Consultant Companies
Spartan Controls Confidential | Page 12
API 2350 and Risk Assessment
• Risk Assessment now required!
• Responsibility of the owner and operator
• API 2350 does NOT specify how risk assessments should be
conducted
• IEC 31010 “Risk management – Risk assessment techniques”
lists many such methods.
Spartan Controls Confidential | Page 13
API 2350 Annex E:
•
•
•
•
•
Consider These Likelihood Factors
Frequency, rate and duration of filling
Systems used to properly measure and size receipts to tanks
Accurate tank calibration (both strapping and verified Critical High)
Systems used to monitor receipts
Extent of monitoring / supervision of manual and automatic tank
gauging
• Impact of complexity and operating environment on the ability of
Operating Personnel to execute overfill prevention tasks
– Filling multiple tanks simultaneously
– Switching tanks during receipt
– Large elevation changes between tanks and backflow
Spartan Controls Confidential | Page 14
API 2350 Annex E: Consider These Consequence Factors
• Hazard characteristics of material (product) in tank
• Volatility, flammability, dispersion, VCE potential
• Number of people onsite who might be affected by a tank
overflowing
• Number of people offsite who might be affected by a tank
overflowing
• Possibility of a tank overflowing resulting in (escalation) of hazardous
events onsite or offsite
• Possibility of impact to nearby sensitive environmental receptors
• Physical and chemical properties of product released during
overflowing
• Maximum potential overfill flow rates and duration
• Secondary containment
Spartan Controls Confidential | Page 15
Risk Reduction
• To reduce risk:
– change of operating
– by a change of operating
procedures and practices
– a change of equipment
systems and alarms
Example: Change Flowrates
Example: Increased attendance, man
power
Example: Install better Tank
Gauging, Alarms & AOPS
Spartan Controls Confidential | Page 16
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 17
Levels of concerns (LOC)
The following levels must be defined in both
volume, level & ullage for each tank
Level
Action
Critical High
Emergency Response
AOPS (if applicable)
AOPS Activation. Alarm optional
High-high Alarm
Terminate/Divert flow.
Alert optional
Max Working Level
Note:
• Alarms require actions.
• Alerts are optional (e.g. Hi-Alert)
Spartan Controls Confidential | Page 18
LOC Determination
LOC’s shall take the
floating roof into
account
Spartan Controls Confidential | Page 19
Annex D provides some guidance
for determining LOC’s
Spartan Controls Confidential | Page 20
Determining Response Time
•
•
•
•
•
Flow rate
Verification of the Alarm
Communication Time
Action time
Completion time
Spartan Controls Confidential | Page 21
LOC Considerations
• LOC shall be up-to-date and a periodic review required no more
than 5 yrs apart
• Changes require a review of the LOC
– Physical Changes to the tank
– Recalibration or re-strapping of the tank
– Change of tank gauging equipment
– Change of valves
– Operational Changes e.g. product & response time
– Modified flow-rate / pump-velocity
Spartan Controls Confidential | Page 22
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 23
Overfill prevention systems
• What are the requirements for an overfill prevention system?
• It depends on the risk
• It depends how the tank is operated
Spartan Controls Confidential | Page 24
Tank Categories
• Operators/Owners shall categorize each tank
• A way to classify tank overfill systems
• The API 2350 defines
– Cat. 1
– Cat. 2
2
– Cat. 3
1
Spartan Controls Confidential | Page 25
3
Tank Categories
Attendance
Category #3
Monitored from local or
remote control center
Personnel at the premises
Monitored from local or
for local monitoring of
remote control center
receipt
Complex facility, multiple
tanks are being filled
Transfers
simultaneously, or
operator may be
distracted
Spartan Controls Confidential | Page 26
Category 3
– Configuration
 Tank level and alarm are transmitted to
remote location (control room).
 Alarm is independent of ATG system and
set at High-High LOC.
 Requires Local “manual” shutdown or
diversion
 For unattended operation, alarm shall
automatically notify transporter or
automatically terminate receipt (AOPS)
and receipt termination shall commence
in event of power outage
Spartan Controls Confidential | Page 27
27
Other Tank Categories
Attendance
Category #3
Monitored from
local or remote
control center
Category #2
Semi-attended
facility
Personnel at the
premises for local
monitoring of
receipt
Monitored from
local or remote
control center
- Continuously
during the first
and last 30
minutes of
receipt
Transfers
Complex facility,
multiple tanks are
being filled
simultaneously, or
operator may be
distracted
Same as
category 3
Spartan Controls Confidential | Page 28
Category 2
– Configuration
 Tank level (ATG required) and alarm is
transmitted to remote location (control
room)
 ATG Alarm set at LOC: HH
 Alarm are not independent of ATG
system (same sensor for ATG and alarm)
 May use Cat 2 at fully or semi attended
facility if receipts monitored at the
control room
 On site monitoring required 30 minutes
at start, at end of receipt; for semi
attended transporter must participate in
monitoring
 Alerts recommended at LOC: H
Spartan Controls Confidential | Page 29
29
Other Tank Categories
Category #3
Category
#2
Category #1
Monitored from local
or remote control
center
Semiattended
facility
Fully-attended facility
(locally monitored)
Personnel at the
premises for local
monitoring of
receipt
Monitored from local
or remote control
center
- Continuously
during the first
and last 30
minutes of
receipt
- Continuously during first
and last hour
of receipt
- Once every hour during
receipt
Transfers
Complex facility,
multiple tanks are
being filled
simultaneously, or
operator may be
distracted
Same as
category 3
Full focus on one receipt
at a time, and not
distracted with other
duties or responsibilities
Attendance
Spartan Controls Confidential | Page 30
Category I
– Configuration
 Does not have transmitted alarms
 Tank Level is determined by HAND
gauging or local Automatic Tank Gauging
(ATG) system.
 Requires Local “manual” shutdown or
diversion or transporter shutdown after
receiving “manual” communications from
facility
 Use only at fully-attended facilities
 Monitor continuously first and last and
every in-between hour of receipt
 Do not use for high frequency or complex
receipt operations
Spartan Controls Confidential | Page 31
31
If response-time is not calculated...
Description
Min HiHi-Level
Response Time @
max fill rate*
1
Manual reading
45 minutes
2
Automatic Tank Gauging (ATG)
30 minutes
3
ATG + Independent Overfill
15 minutes
Category
*) Guideline by API for manually operated overprevention systems (unless a detailed
response time has been calculated for the specific tank). 3 in. at a minimum.
Consequently According to API 2350:
Installing a Tank Gauging System and overfill alarm
can increase the tank’s storage capacity
Spartan Controls Confidential | Page 32
Critical
High
HiHi
Modern tank farm operations call
for a Category 3 configuration
Cat3
Cat2
Cat1
Spartan Controls Confidential | Page 33
We always advocate the usage of category 3 systems since:
• Required for most tanks
• Given all things equal
– Higher category equipment safer than lower
• Cat 3 suggested even if not required today
– Makes the installation future-proof
– Allows for operations efficiency improvements ($$$)
– Maximizes tank utilization ($$$)
Spartan Controls Confidential | Page 34
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Overfill Prevention Procedures
• AOPS
• Proof testing
• Wireless
Spartan Controls Confidential | Page 35
What is an AOPS?
• Automatic Overfill Prevention System
Sensor
• Closed Loop Control
Spartan Controls Confidential | Page 36
Logic Solver
Actuator
Requirements for AOPS
AOPS are optional
Facility
Existing facilities
New facilities
Requirements
Comply with Annex A
Comply with IEC61511
/S84 aka ”SIL”
Remember:
These requirements are likely to change in the future i.e. becoming more
stringent
Spartan Controls Confidential | Page 37
Annex A: AOPS
•
•
•
•
•
•
Design to fail safe
No wireless
Be able to operate manually
Logic solver shall be equipped with watchdog
Procedures to handle any failures
Proper documentation
Spartan Controls Confidential | Page 38
New tanks:
AOPS 2x5900
Independent High-High Level Alarm
Automatic Tank Gauge
Rosemount 5900
Radar Level Gauge
Rosemount 5900
Radar Level Gauge
High-High Alarm
AOPS
Rosemount FCU
Data Concentrator
Rosemount 2410
Tank Hub
Rosemount 2410
SIL2/SIL3 Discrete Signal
Tank Hub
Connection to
TankMaster (optional)
Rosemount FCU
Data Concentrator
Spartan Controls Confidential | Page 39
Includes
Visual & Audible
Alerts (optional)
TankMaster
Tank Gauging System
Rosemount 5900 2in1
Radar Level Gauge
Automatic Tank Gauge
Level
Independent High-High Level Alarm
Overfill
New tanks: AOPS 2in1
High-High Alarm
AOPS
SIL2 Discrete
Output
Rosemount FCU
Data Concentrator
Rosemount 2410
Tank Hub
Rosemount 2410
Tank Hub
Connection to
TankMaster (optional)
Rosemount FCU
Data Concentrator
Spartan Controls Confidential | Page 40
Includes
Visual & Audible
Alerts (optional)
TankMaster
Tank Gauging System
New tanks: AOPS 5900+2120
Independent High-High Level Alarm
Automatic Tank Gauge
Rosemount 5900
Radar Level Gauge
Rosemount 2130
Vibrating Fork
SIL 2 Discrete Output
Rosemount FCU
Data Concentrator
Rosemount 2410
Tank Hub
High-High Alarm
Automatic Overfill
Prevention System
(AOPS)
Connection to
TankMaster (optional)
Includes
Visual & Audible
Alerts (optional)
Spartan Controls Confidential | Page 41
TankMaster
Tank Gauging System
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Overfill Prevention Procedures
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 42
Proof testing
• OPS shall be tested upon initial installation
• OPS shall be re-tested during operation
• Schedules and testing procedures shall be documented for
periodic testing, inspection, and maintenance
– Level Gauge, Logic Solver, Final Element, Alarm (if applicable)
• Device Manufacturer’s proof-test procedures shall be
adhered
– Wet test not required
– Test can be partial
– Do not fill tank above max working level
Spartan Controls Confidential | Page 43
Hand Gauges
• Testing of hand gauges shall comply with requirements in API MPMS
Ch. 3.1A
– Comparison with a reference at least annually
Spartan Controls Confidential | Page 44
Level Gauges
• Testing of continuous-level sensors shall comply with
requirements in API MPMS Ch. 3.1B
– Gauge verification quarterly
– Can be pushed out to annually if stable operating experience
• Point- level sensor shall be tested 2 / years
– Unless supported by technical justification (i.e. a probability of failure
on demand calculation);
• All other OPS components required to terminate the receipt
(e.g. alarm) shall be tested at least annualy
Spartan Controls Confidential | Page 45
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Overfill Prevention Procedures
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 46
The Wireless Options
• API 2350 gives no guidance; the technology was considered to
premature. However the interpretation from experts is that:
• Wireless is OK except for AOPS
Spartan Controls Confidential | Page 47
Wireless OK for category 1, 2 and 3 (but not AOPS)
TankMaster
5300
Spartan Controls Confidential | Page 48
AOPS with Advisory Wireless TG
Sensor
TG-System
Controller/
Logic Solver
Optional SIL2/3
TÜV/DIBt WHG Approved
Relay Output (optional)
Actuator
Spartan Controls Confidential | Page 49
API2350 Edition 4
• Scope
• Management System
Requirements
• Risk Assessment
• Level Of Concerns
• Overfill Prevention System
• Proof testing
• AOPS
• Wireless
Spartan Controls Confidential | Page 50
More Reading
• Module I: API2350 Overview
– Authored by Phil Myers, API2350
Committee chairman
• Module II: Example Solutions
– Emerson-solutions for category 1-4
Go to
www.rosemount-tg.com
Spartan Controls Confidential | Page 51