Upload
vokhanh
View
239
Download
7
Embed Size (px)
Citation preview
The Complete Guide to
API 2350
2
Content
03. AnIntroductiontoAPI2350
07. MotivatingRobustOverfillProtection
10. ImplementationofAPI2350
13. OperatingParameters
19. EquipmentandOperations
20. AutomatedOverfillPreventionSystem(AOPS)
22. SummaryandConclusions
23. Appendix
A. EquipmentSolutions
B. API2350ComplianceChecklist
C. FrequentlyAskedQuestions
D. AbouttheAuthor
3
AnIntroductiontoAPI2350
Tankoverfillsareamajorconcerntothepetroleumindustry.Thebestcasescenarioisthatyouhavetocleanitup.Theworstcasescenarioinvolvesgoingoutofbusiness,andendingupincourt.Asaresponsetothis,theindustryhasworkedjointlytocreateanewAPI/ANSIStandard2350Edition4:“OverfillProtectionforStorageTanksinPetroleumFacilities”.Thisnewstandardisadescriptionoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.
API2350wascreatedbytheindustryfortheindustrywithcontributionsfromawiderangeofindustryrepresentativesincluding:tankownersandoperators,transporters,manufacturers,andsafetyexperts.Thistogetherwiththefactthatitsinglesoutaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks)andaspecificuse-case(overfillprevention)makethisstandardunique.Itdoesnotcompetewithothermoregenericsafetystandards,butisintendedascomplimentthem.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isoneexampleofhowtofulfillsomeoftherequirementsinAPI2350.
Theindustryadoptionratetothisstandardisexpectedtobeveryhighbecauseofitsobviousbenefits,combinedwiththeworld’sever-increasingneedformoresafety.ThequestionforatankowneroroperatoriswethertheycanaffordnottoimplementAPI2350.Becauseofthestandard’sgenericnature,itisexpectedtoalsobeapplicabletonearbytanksoutsidethestandard’sspecificscope,containing,forexample,chemicalsorClass31petroleumliquids.
Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Thus,itisintendedtobeequallyvalidandapplicableworldwide.
Thisguidewillprovidethebasicelementsneededforapetroleumtankowner/operatortoapplytheAPI2350toneworexistingtankfacilitieswithminimaleffortandmaximalgains.Youshouldreaditbecausethisnewstandardisexpectedtobecomeagame-changerwithinoverfillprevention,andbyreadingyourcompanycanalsoreapthebenefitsthatcomefromapplyingthelatestbestpractices.ThestandarditselfisavailableforasmallfeefromAPI’swebsite(www.api.org).
1 NFPANationalFireProtectionAssociation.Class1liquidshaveflashpointsbelow100°F.Class2liquidshaveflashpointsatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.
4
PurposeThetargetaudienceforthisguideareownersandoperatorsoffueldistributionterminals,refineries,chemicalplantsandanyotherfacilitieswhichreceivepetroleumorchemicalproductsintostorage.ThekeyindustrychangerelatedtotankoverfillsisthepublicationofanewversionofAPI2350“OverfillProtectionforStorageTanksinPetroleumFacilities”,the4theditionpublishedinMay2012.ThegoalisthentounderstandwhichchangeshaveemergedinthisnewstandardandhowtoapplythemforthepurposeofadoptionandcompliancewithAPI2350.Anyoneresponsibleforsafeoperationsatfuelmarketing,distributionterminals,refineries,oilhandling,orpipelinecompaniesshouldtakeadvantageofthestateofartintankoverfillpreventionthatwillbediscussedinthisguide.WhilethescopeofAPI2350appliestothefillingofpetroleum-basedproductsassociatedwithmarketing,refining,pipelineandterminalfacilities,itsprinciplesmaybeappliedtoanytankoperationwherethereisariskofoverfillingthetank.
MostapplicationsunderAPI2350involveatmosphericorslightlypressurizedtanks,buttheprinciplesofAPI2350canbeusedforhigherpressurestorageaswell.ThescopeofAPI2350appliestooverfillprotectionforNFPA2Class1andClass2liquidsandisalsorecommendedforcomplianceregardingClass3liquids.The“ScopeofAPI2350”(seebelow)presentsamoredetailedbreakdown.Forflammableliquidsclassifiedbyfirecodes(Class1liquids)API2350canmitigatethelikelihoodofspillingthesehazardousproductsandthelikelyresultingfacilityfire.Sincespillsofnon-volatileorganicliquidssuchaslubeoilsorheavyasphalticproductsareoftenconsideredanenvironmentalhazard,overfillsoftheseproductsarealsoaddressedbythenewAPI2350.
2 NFPANationalFireProtectionAssociation.Class1liquidshaveflashpointsbelow100°F.Class2liquidshaveflashpointsatorabove100°Fandbelow140°F.Class3liquidshaveflashpointsabove140°F.
Scope of API 2350 (4th Edition)
API2350appliestopetroleumstoragetanksassociatedwithmarketing,refining,pipeline,
terminalsandsimilarfacilitiescontainingClassIorClassIIpetroleumliquids.API2350
recommendsincludingClassIIIliquids.
API 2350 does not apply to:
• Undergroundstoragetanks
• Abovegroundtanksof1320USgallons(5000liters)orless
• AbovegroundtankswhichcomplywithPEI600
• Tanks(processtanksorsimilarflowthroughtanks)thatareintegraltoaprocess.
• Tankscontainingnon-petroleumliquids
• TanksstoringLPGandLNG
• TanksatServiceStations
• Loadingordeliveryfromwheeledvehicles(suchastanktrucksorrailroadtankcars)
PEIRP600RecommendedPracticesforOverfillPreventionregardingShop-Fabricated
AboveGroundTanksforoverfillprotectionwhereapplicableforabovegroundtanksfalling
outsidethescopeofAPI2350.
5
Fourth generation of API 2350ThecurrentAPI23503appliestofillingtankswithpetroleum-basedproductsforthepurposeofpreventingoverfills.Embracingradicalchangescomparedtopreviousversions,thisnewstandarddeservesaclosereview.Also,betweenthelasteditionandthecurrentedition,importantnewsafetystandardsthatapplydirectlytotankoperationshavebeenintroducedintothepublicdomain.ThecurrenteditionofAPI2350buildsonbestpracticesfromboththepetroleumindustryandfromotherindustriesandappliesthemdirectlytotankoverfillprotection.AnexampleofamajorchangeintroducedinthenewversionofAPI2350istherequirementforasafetymanagementsystem.Asaresultofthesweepingchangestothisstandard,understandingandusingitwillrequiresomepatienceandguidance.
AkeyandinfluentialeventthatshapedthecurrenteditionofAPI2350wastheBuncefieldconflagrationarisingfromapetroleumtankoverfillattheHertsfordshireOilStorageTerminal(HOSL)nearHeathrowAirport.OnDecember11th2005,thefireengulfed20tanksresultinginthetotaldestructionoftheterminalandnearbyfacilities.ThisfirewastheworstinEuropesinceWorldWarII.TheBuncefieldincidentwasalsooneofthemostintenselystudiedtankoverfilleventsofalltime.Fortunately,thelessonslearnedfromthisincidenthavebeencapturedbytheUnitedKingdom’sHSE4inreports5coveringthisincident.
API2350representstoday’sminimumbestpracticessotankownersandoperatorscannowprepareforwhatwillundoubtedlybethebenchmarkforgenerallyrecognizedgoodpracticeinthepetroleumstoragebusiness.
Learning from past experiencesThefollowingquotefromtheUnitedKingdom’sHealthSafetyExecutiveBuncefieldinvestigationshowsunsurprisingly,thatfaultsinmanagementsystemsareakeyrootcauseoftankoverfillincidents.
“Management systems in place at HOSL relating to tank filling were both deficient and
not properly followed, despite the fact that the systems were independently audited. Pressures
on staff had been increasing before the incident. The site was fed by three pipelines, two of which
control room staff had little control over in terms of flow rates and timing of receipt. This meant
that staff did not have sufficient information easily available to them to manage precisely the
storage of incoming fuel. Throughput had increased at the site. This put more pressure on site
management and staff and further degraded their ability to monitor the receipt and storage of
fuel. The pressure on staff was made worse by a lack of engineering support from Head Office.”
Unfortunately,thescenariosdescribedaboveleadingtothisincidentarealltoocommon.Butfortunately,theAPICommitteedevelopingthenewAPI23504thedition,fullyintegratedthelessonslearnedfromBuncefieldaswellasotherincidentsandcombinedthemwiththebestpracticesfortankfillingoperationsfromeverysectorofthepetroleumindustry.Infact,theUnitedKingdom’sHSEwasoneofthecommitteememberstoensurethatalllessonslearnedfromBuncefieldwerecapturedinthe4theditionofAPI2350.
3 OverfillProtectionforStorageTanksinPetroleumFacilities,ANSI/APIStandard2350-2012,FourthEdition,May20124 HSEHealthSafetyExecutiveisagovernmentalsafetyagencyintheUnitedKingdomresponsibleforpublicandworkerhealthandsafety5 http://www.buncefieldinvestigation.gov.uk/reports/index.htm
6
TheAPIcommitteeisaconsensus-basedstandardsdevelopmentorganizationandthecurrenteditionofAPI2350ensuresaworldwideperspectiveontankoverfillprotection.Theworldwidebestpracticesfromdifferent;countries,regulatoryagencies,andcompanieshavebeenstudiedandcompiledintotheneweditionofAPI2350.
7
Reducing liabilitiesClearly,thepreventionofoverfillsisasignificantandobviousbenefittotankowners/operators.Alltankowners/operatorsknowthatprotectionofthepublicandworkershealthandsafety,theenvironment,andassetsareimportant.Butwhatmaynotbesoobvioustothemisthatthebenefitsthatcanresultbyapplyingthelatestthinkingrelatedtotankoverfills.ThenewmanagementsystempracticesencouragedbyAPI2350mayactuallyimprovethenormalday-to-dayoperationsandefficiencyforafacility.
ThepreviouseditionsofAPI2350canbeconsideredalistoftheequipmentandoperatingpracticesthatareneededtopreventoverfills.Suchlistshavevalue,buteliminatingtheriskoftankoverfillsrequiresmuchmorethanjusttheuseoflists.Eliminatingoverfillsrequiresaformalandcomprehensivesafetymanagementsystem.
Tankoverfillsarerelativelyrareeventssowhyaretheserareeventsofconcern?Thereasonisthattheconsequencesofoverfillscanexceedmost,ifnotallotherpotentialscenariosatapetroleumfacility.Whilerare,seriousincidentsusuallyyieldriskstothetankowners/operatorsthataredeemedunacceptable.Thefactthattheremaybepropertydamages,injuriesorevenfatalitiesisonlythebeginningoftheaccidentscenario.LiabilitiesofvariouskindscangoonforpagesasareviewoftheBuncefieldincidentreportsshows.InsomecasesbeingforcedoutofbusinessistheendresultasinthecaseofCaribbeanPetroleuminthePuertoRico(October23,2009)incident.
Other benefitsInadditiontoreducingliabilities,therearebenefitsimpactingoverallfacilityoperationalefficiencyandreliabilityasmentionedabove.SinceAPI2350usesthelatestprinciplesofmanagementsystems,operationalimprovementsingeneralmayresultfrom:
• Simplifiedandclarifiedresponsetoalarms• Moreusabletankcapacity(explainedlater)• GeneralizedunderstandinganduseoftheManagementofChange(MOC)process• Operatortrainingandqualification• Inspection,maintenanceandtesting• Proceduresfornormalandabnormalconditions• Lessonslearnedusedtoevolvebetteroperational,maintenanceandfacilitypractices
MotivatingRobustOverfillProtection
8
Major components of API 2350 (past and present)ThekeyelementsofAPI2350maybeconsideredtocomprisethefollowingelements:
• ManagementSystem(OverfillPreventionProcessorOPP)• RiskAssessmentsystem• OperatingParameters – LevelsofConcern(LOCs)andAlarms – Categories – Responsetime – Attendance• Procedures• EquipmentSystems
Thefirsttwoelementsaremajoradditionsthatwereabsentinpreviouseditions.API2350definestheManagementSystemtobetheOverfillPreventionProcess(OPP).Inotherwords,whenyoureadorhearthetermOPP,justthinkofthemanagementsystemconcept.
Next,OperatingParameterswasatermcoinedtodesignatethetankspecificdatarequiredtousethestandard.TheseincludetheLevelsofConcern(LOCs)valueofimportantliquidlevelssuchasCriticalHigh(CH),HighHighTank(HH)andMaximumWorkingLevel(MW).AlsoincludedaretheCategoriesofoverfillprotectionsystemswhicharedesignatedbythetypeandconfigurationofequipmentbeingusedforoverfillprotection.AnotheroperatingparameteraretheResponseTime(RT)andAttendance.Alloftheseoperatingparametersarediscussedindetaillater.TheyshouldbethoughtofasthedataabouttankfacilitiesrequiredtouseAPI2350efficiently.
Theproceduresandequipmentsystemelementsaresimilartopasteditionsandwereupdatedtoreflectthechangesaboveaswellastoapplysomeimprovementsoverpasteditions.
Finally,perhapstheleastappliedbutbiggestchangeistheadoptionofguidanceapplicabletoSafetyInstrumentedSystemswhichcanautomatetheterminationofareceiptintheeventthattheHHLOCisexceeded.Suchsystemsaresometimescalled“automatedsafetyshutdownsystems”or“safetyinstrumentedsystems”,butinAPI2350thesearecalled“AutomatedOverfillProtectionSystems(AOPS)”.
Management systemsAManagementSystemallowsanorganizationtomanageitsprocessesoractivitiessothatitsproductsorservicesmeettheobjectivesandtermsset.Theobjectivescanvaryfrom;satisfyingthecustomer’squalityrequirements,complyingwithregulations,ortomeetenvironmentalobjectivesandmanagementsystemsoftenhavemultipleobjectives.Manycompaniesusemanagementsystemstoreducesafety,healthandenvironmentalincidentstoaslowarateaspossible,giventhestateoftheartforbusinessoperationsbestpracticestoday.
ManagementsystemsareattheheartoftheneweditionofAPI2350.API2350linesupwiththecurrentindustrythinkingbyrequiringtheapplicationoftheOverfillPreventionProcess(OPP).OPPisthepeopleandequipmentassociatedwithtankfillingoperationstomaintainanoptimallytunedsystemforhighperformancewithoutoverfills.TheinclusionofOPPissignificantinthatthestandard
9
isnolongerjusttalkingabouthowtodesign,operateandmaintainsuchsystems,butistalkingabouthowthecompanyshouldrunitsprocessesandproceduresassociatedwithtankfillingoperations.
AlthoughAPI2350requiresamanagementsystemforoverfillpreventionandprotection,itdoesnotspecifyhowtodeveloporimplementone.Organizationstypicallyrelyuponmanagementsystemsthathavebeendevelopedasaresultofseriousincidentsinthepast.Thesemanagementsystemsarerelativelycommonamonglargeandmidsizeorganizations.Theseorganizationshavelearnedtousethesesystemstosystematicallyreduce,controlandmanageincidentsaswellastoimproveotheraspectsoftheirbusinesses.Inordertobeeffective,thesesystemsmustbeintegratedintothe“corporateculture”andmustbefitforpurpose.Eventhesimplestofsuchsystemsrequirelotsoftime,energyandresourcesandmustbeactivelysupportedbytheverytopleveloftheorganization.Withouttopmanagementactivesupportandpromotion,thereisnohopeforaworkingmanagementsystem.
Itisrecommendedthatorganizationswhichdonotuseanyformofsafetymanagementsystemconsiderdevelopmentandimplementationofabasic,fitforpurposesafetymanagementsystem.ThentheyensurethatthesafetymanagementsystemincorporatestherelevantprinciplesfromAPI2350.Thisrecommendationisespeciallyimportantforthosecompaniesthataregrowingorthosethatareacquiringothercompaniesintheirgrowthcycle.Anyacquisitionispotentiallyhighriskuntilallofitsmanagementsystemsaswellasitsequipmentsystemsandoperationsareintegrated.
Risk assessmentAPI2350requirestheuseofariskassessmentsystem.Eachtankunderthisstandardmusthaveariskassessmentperformedtodeterminewhetherriskreductionisrequired.Riskassessmentisameansofcombiningtheconsequenceandlikelihoodofanoverfillorotheraccidents,usuallyfortwopurposes.First,acommonscaleorrankingmethodologyneedstobeappliedtothemanydifferentpossibleaccidentsorlossscenariosthatafacilityisexposedto.Forexample,theriskofarogueemployeeattemptingtosabotageafacilityisdifferentthantheriskofatankoverfill.Withoutriskassessmentthereisnorationalwaytounderstandwhichscenariomaybeworse.Second,sinceresourcesarealwaysscarce,riskassessment,throughtheriskmanagementprocess,allowsacompanytocompareandprioritizetheserisksforthepurposeofallocationofbudgetsandresourcestomitigatetheminsuchawaythatthemostseriousrisksaremitigatedfirst.
Unfortunately,API2350requiresthatthetankowner/operatoruseariskassessmentsystemtoaddressrisk,butdoesnotprovideanyinformationorguidanceonhowtodeveloporusesuchasystem.Whilethismayseemstrange,itistheonlywaythatageneralindustrystandardcanbewrittenforageneralpopulationofhighlyvariablefacilitiesandtankowners,eachwithdifferingperceptionsofriskthreatsanddifferingcorporatevalueschemes.
AgoodstartingpointforriskassessmentresourcescanbefoundinIEC61511-3Part3:“Guidanceforthedeterminationoftherequiredsafetyintegritylevels–informative”andIEC/ISO31010“RiskManagement–RiskAssessmentTechniques.”
10
OverviewTheprimaryenablingmechanismthatallowsadoptionofAPI2350istopmanagementendorsementandsupportforthesafetymanagementsystem(OPP).Thismeansthatformalprocessesforalloftheelementscoveredin“ManagementSystems”(seebelow)willbedocumented,created,revisedandformallysetintomotionusingaformalcorporateprogramstructure.
ImplementationofAPI2350
Management Systems
Specific Elements of the Management Systems for Overfill Prevention
• Formalwrittenoperatingproceduresandpracticesincludingsafetyproceduresand
emergencyresponseprocedures
• Trainedandqualifiedoperatingpersonnel
• Functionalequipmentsystems,testedandmaintainedbyqualifiedpersonnel
• Scheduledinspectionandmaintenanceprogramsforoverfillinstrumentationand
equipment
• Systemstoaddressbothnormalandabnormaloperatingconditions
• Amanagementofchange(MOC)processwhichincludespersonnelandequipment
changes
• Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents,
• Asystemtosharelessonslearned
• Afollow-upsystemtoaddressanyneededmitigationofcircumstancesleadingtonear
missesorincidents
• CommunicationsystemsprotocolswithintheOwner/Operatororganizationandbetween
theTransporterandtheOwner/Operatorthataredesignedtofunctionunderabnormalas
wellasnormalconditions
Benefits of Management Systems
• Safetyandenvironmentalprotection
• Optimizationoftheworkplaceandoperatingpractices
• Inspection,testing,andmaintenance
• Equipmentandsystemselectionandinstallation
• Safeworkpractices,emergencyproceduresandtraining
• Managementofchangeprogramsrelativetotankoverfillprotection
• Inclusionofcurrenttechnologyandpracticesrelatedtoprocesscontrolandautomated
safetyinstrumentedsystems
11
Figure1(seebelow)-“ConceptualManagementPlanforImplementationofAPI2350”-givestheoverallconceptassociatedwithimplementationofAPI2350.Afirststepissettingupaprocessfordatamanagementassociatedwiththetankoverfillprotectionprogram.Theexistingtankconfigurationmustbeunderstood.Thetankconfigurationisthetypeofinstrumentationthatthetankhas,itsLOCs,alarmandgaugingsystemsandtheoperatingparametersincludinganyrelevantinformationtotheOPP.Thismeansthatallrelevantdataforeachtankneedstobecollectedandaprocessforkeepingituptodateestablished.“RiskConsiderationsforRiskAnalysis”(seepage12)examinessomeoftheinformationconsiderationsneededtoestablishrisk.Thedatabase(1)(2)involvesalltankswithinscopetobeincludedinthetankoverfillprotectionprogram.
Figure 1: Conceptual Management Plan for Implementation of API 2350 (Note:Diagramshowsconceptuallyhowonemayapproachmanagingtheprocessofbringingapopulationofexistingandproposednewtanksforexistingfacilitiesintocompliancewiththe4theditionofAPI2350)
Thedatawillprovideinformationaboutoperatingparameters,tankspecificinformationandanyotherinformationrelevanttoestablishingcompliancewiththestandard.Whilesometankconfigurationsmayhaveacceptableresidualriskothersmaynot.Itisonlyafterariskassessmentprocess(3)isappliedtoeachtankthattheacceptableconfigurationcanbeestablished.Eachtankoverfillsystemwillthenbeclassified(4)aseithercompliantornon-compliantwithAPI2350.Inotherwords,theriskiseitheracceptableorunacceptable.
Theclassificationresultsintheabilitytodoagapassessmentplan(5)whichwillshowwhatchangesareneededtobringthetanksto/withinacceptableriskandintocompliancewithAPI2350.Oncethescaleofchangesneededtobringthetanksystemintocomplianceisunderstood,ariskmanagementprocess(6)canbeusedtoprioritizerisksandtodeterminehowmuchfundingisrequiredtoclosethegapandmakealltankscompliant.
Data ManagementProcess and Tank Database
1)2)
Risk AssessmentProcess
3)
API 2350 CompliantConfiguration(acceptable configuation)
4)
Gap Assessment5)
Modified Tank Systemsand Configuration withAcceptable Risks Compliant with API 2350
8)
Risk ManagementProcess
6)
Establish OperatingParameters and Tank Data:
• Tank Category• LOCs• Alarms• Alerts• Response Time• Attendance• AOPS if applicable• Logic solvers• Final elements• Tank details• Risk data
Project Executionfor Gap Closure
7)
Existing Tank System Configuation (all tanks)
START
FINISH
Schedule for Project Execution
12
Risk Considerations for Risk Analysis
Probability or Likelihood Factors• Frequency,rateanddurationoffilling• Systemsusedtoproperlymeasureandsizereceiptstotanks• Accuratetankcalibration(bothstrappingandverifiedCriticalHigh)• Systemsusedtomonitorreceipts• Extentofmonitoring/supervisionofmanualandautomatictankgauging• ImpactofcomplexityandoperatingenvironmentontheabilityofOperating
Personneltoexecuteoverfillpreventiontasks – Fillingmultipletankssimultaneously – Switchingtanksduringreceipt.
Consequence Factors – Impact of Hazardous Material Release on Vulnerable Exposures Hazard characteristics of material (product) in tank volatility, flammability, dispersion, VCE potential• Numberofpeopleonsitewhomightbeaffectedbyatankoverflowing• Numberofpeopleoffsitewhomightbeaffectedbyatankoverflowing• Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite• Possibilityofimpacttonearbysensitiveenvironmentalreceptors• Physicalandchemicalpropertiesofproductreleasedduringoverflowing• Maximumpotentialoverfillflowratesandduration
Oncetheriskmanagementprocess(6)iscompleted,theprojectengineeringandexecutionphases(7)forimplementationofchangescanbegin.Closingthegapwilltakesometimeanditisafundamentalprincipleofriskmanagementthattheworstrisksshouldbereducedfirst.Thegapclosureplanshouldbebuiltwiththisprincipleinmind.Ultimately,theprocessaimstokeeptheowner/operatorcomplianttoregulations(8).
Theprocessabovewillalsoaddressproposednewtanksthatareaddedtothesystem.Theymustbeevaluatedtothesamecriteriaandrunthroughtheprocess,butunlikeexistingtankstheywillnormallybebuilttobecompliantduringconstruction.
Theprojectexecutionphaseshould,ofcourse,usetheManagementofChange(MOC)processesandinteractwiththedatamanagementsystemtoensurethatinformationinthetankdatabaseisupdatedwhenchangesaremade.Moredetailonthesestepsfollows.
13
InitializationPartofthedatamanagementprocessisthedeterminationofwhatAPI2350callsoperatingparameters.Tankowners/operatorswhoadoptAPI2350mustestablishorvalidatethetankoperatingparameters.Theseincludeknowledgeaboutthetankcategories,LevelsofConcern(LOCs),alarms,alerts,AutomaticOverfillPreventionSystem(AOPS)(ifapplicable),andattendancetype.
CategoriesAlltanksmustbecategorizedaccordingtoAPI2350asshowninFigure2(seebelow)-“DefinitionofOverfillProtectionSystemCategories”.Thecategoriesareameansofgroupingallofthemanydifferentpossibletankoverfillgaugingconfigurationsintothreebroadconfigurationcategories.Whilethestandardsaysnothingaboutwhichcategoryis“better”westatethatgivenallthingsequal,thehigherthecategorynumberthemorereliableisthegaugingandalarmsystem.
OperatingParameters
Figure 2: Definition of Overfill Protection System Categories
• Local and/or remote Manual Operations• Tank levels given by ATG• Transmittable levels and alarming• Independent Level Alarm High High (LAHH)• Overfill protection dependant on manual intervention by local and/or remote Operator
• Automatic Overfill Prevention System
• Local and/or remote Manual Operations• Tank levels may be read using ATG or sensor(s) located on tankwith ability to transmit a signal and/or annuniciate alarm(s)• May use dependent alarm• Overfill protection dependant on manual intervention by local and/or remote Operator or automated, dependent, shutdown
• Local Manual Operations• Taking receipts depends on using hand gauging or ATG• Does not have transmittable alarms or any mechanism to annunciate alarms• Overfill protection dependant on manual intervention by local Operator
LAHH
Category I System Category II System
Category III System AOPS System
LAH
ATG
LAHH
ATGATG
LAHH LSH
Logic Solver
LAH
ATG
14
Category ICategory1systemsareessentiallymanualsystemssuchasmeasurementofthelevelby“sticking”,insertionofatapeorrodwhichindicatesthelevelofoilonit.WhileanAutomaticTankGauging(ATG)maybeatthetankandusedforlevelmeasurement,ithasnocapabilitytotransmitlevelsignalssoallinformationaboutlevelislocalizedtothetank.Thiscategoryshouldonlybeusedwhentherisksarelow(noClass1liquids),thereceiptoperationisinfrequent,therateoflevelriseisslowandwheretheoperationissosimplethatanoperatorhasvirtuallynochanceofmakingamistake.Category1systemsmayonlybeusedforafullyattendedoperation.
Category 2Category2systemshavetheabilitytotransmitlevelandalarminformationtoacentralizedorremotecontrolcenter.ButthealarmisdependentsothatanATGfailurecancausetotallossofinformationaboutthetanklevelsaswellasthealarms.Category2systemshavenoredundancyandsoshouldonlybeusedifthefailurerateoftheATGandlevelsystemisextremelylow(i.e.thebestpossibletechnologyavailable).Category2ispermittedonlyforattendedandsemi-attendedfacilities.WhilemosttankfacilitiesarefittedwithCategory2systems,mostarealsofittedwithunreliableautomatictankgaugesmakingtheseparticularlyvulnerabletoanoverfillevent.
Category 3Category3systemsarelikeCategory2systemsbutarecharacterizedbyhavinganindependentalarm.TheindependentalarmensuresthatanATGfailurewillnotcauseafailureofthealarmfunction.Category3systemsareconsideredthebestavailableconfigurationandtechnologyfortankfillingoperationsandalarmsystems.Theymaybeusedatafacilitywhichisattended,semi-attendedorunattended.
Automatic Overfill Prevention System (AOPS) NotethatAOPSisasystemwhichisindependentoftheBasicProcessControlSystem(BPCS).TheAOPSinFigure2(page17)canbecombinedwithanyofthecategories,however,inmostcases,itwouldmakesensetocombineitwitheitheraCategory2or3overfillpreventionsystem.SometimesAOPSisalsocalled“Category4”.
Other ConfigurationsAPI2350makesabroadclassificationofsystemsbutcannotcoverallcases.Forexample,sometankowners/operatorsuse2ATGsinsteadofasingleATGandpoint-levelalarm.TheseconfigurationsshouldbeconsideredCategory3sincethisconfigurationisusedinthesamewayasaCategory3system.However,itismorerobustbecauseoftheextralevelinformationavailable.Forexample,adualATGsystemcannotonlyalarmatHHbutonavariationbetweenthetwoATGsprovidinganotherdimensionofreliability.
API2350cannotcoveralldifferentcasesandinthosecasesthestandardcouldneverthelessbeusedasaguide.Alternatesolutionsthanthosethatarerecommendedinthisguidecanbeapprovediftheyarebetterandmoresafethatwhatissuggestedinthestandard.
Levels of Concern (LOCs)LOCsaretheoreticallevels.Thatis,theydonothavetohaveequipmentassociatedwiththem.Theyarejustliquidlevelpositionsthatarerecordedintheoperatorsdocumentationsuchasinstraptables,inthecontrolroomdisplaysorprocedures.
15
Critical HighForexample,letusstartwiththehighestLOC.ThisistheliquidlevelatwhichanoverflowordamagecanoccuranditiscalledtheCriticalHigh(CH).SeeFigure3above.Notethatthereisnoequipmentrelatedtotankgaugingplacedatthislevel.
High HighMovingdowntothenextLOCwehaveHighHigh(HH).Thisisthealarmforhighlevel.ItisalsotheonlyalarmrequiredbyAPI2350.Currently,mostoperatorsusebothaHighandHighHighalarm.API2350nowrequiresonlyonealarm.An“alert”maybeusedinsteadoftheHighalarmifdesired.
Havingsaidthis,onespecificreasontostickwiththeoldermethodoftwoalarmsmaybeduetotheunreliabilityofthealarmsensors.Iftheyarenothighlyreliable,thenthesecondsensorgivestheoperatora“secondchance”bystillalarmingeventhoughoneofthesensorshasfailed.
Figure 3: API 2350 Tank Levels of Concern (LOCs) – Category 2 and 3 Configurations
ThisimprovedreliabilitywasintroducedintothetankbusinessinpreviouseditionsofAPI2350aswellastheNFPA630FireCodewhichusedtheconceptofredundancyofsensorsystems.
6 NationalFireProtectionAssociation30FlammableandCombustibleLiquids
16
However,usingthehighlyreliablesensorsthatareonthemarkettoday,asinglehighreliabilityalarmcanbebetterthantwounreliablealarmsandsoonlyonealarmisneededandrequired.Thedecisiontotakeadvantageoftheone-alarmrequirementshouldbebasedonmanyfactors,butperhaps,mostimportantly,onaformalmanagementofchangeforthetankoverfillsystems.
Maximum Working (MW) Level Movingdownagain,theMWlevelmayormaynothaveanylevelsensors.Analertmaybeusedatthisleveliftheoperatorchooses.
Automated Overfill Protection System (AOPS) Level IfanAOPSisappliedthenitwillbesetatorabovetheHH.ThelevelatwhichtheAOPSissetiscalledtheAOPSlevel.
Updating and Management of Change (MOC)AccordingtotheOPPtheLOCsmustbeperiodicallyreviewedandupdated.AnMOCshallbeusedwheneverchangessuchasthoselistedin“SomeManagementofChange(MOC)Triggers”(seebelow)occur.
Some Management of Change (MOC) Triggers
Tank Modifications That Trigger MOC• Newtank• Changeinfloatingrooftankseals• Installationofgeodesicdomesorotherkindsoffixedroofs(e.g.whenexternal
floatingrooftanksreceiveretrofitcovers).• Newinternalorexternalfloatingroof• Sideventchanges• Shellextensions• Newtankbottom• Additionofancillaryequipmentsuchasfoamchambers• Recalibrationorre-strappingofthetank• Changeoftankgaugingequipment• Additionofagaugetubewithdatumorchangeindatum/strikeplate
Operating Changes Trigger MOC• Changeinproduct• Changeinincomingoroutgoinglines• Changeinflowrates,• Changeinserviceifitimpactsstructuralintegrity(corrosion,temporaryrepairs,etc.)• Changeinoperations,suchas:paralleltank,floatingorhighsuction,continuousmixer
operation• Changeinresponsetimeresultingfromstaffing,operationorequipmentchanges
17
AttendanceTanksfacilitiesaregroupedaccordingtowhetherassignedpersonnelareonthepremisescontinuouslyduringtheentirereceiptoperation(fullyattended),onthepremisesjustduringthebeginningandendingofthereceipt(semi-attended)ornotpresentduringanypartofthereceipt(unattended).Thetankowner/operatormustensurethatthefacilityoperationisconsistentwiththisdefinitionsothatthecorrectcategoryoftankdescribednextcanbeassignedtotheseattendancelevels.Table1(seebelow)-“MonitoringProductReceipt”-presentsattendancerequirementsformonitoringreceipts.
Table 1: Monitoring Product Receipt
Categories vs Attendance Level
Category1Facilities
MustBeAttended
Continuouslyduringfirst
hourofreceipt
Everyhourduringreceipt
Continuouslyduringthe
lasthourofreceipt
Category2Facilities
IfSemi-Attended
Emergencyconditions
(equipmentmalfunctionor
powerfailure)mayrequire
operationasaCategory1
facility(see4.5.3.6)
Continuouslyduringthefirst
30minutesofreceipt
Hourlynotapplicable
Continuouslyduringthelast
30minutesofreceipt
Category3Facilities
IfUnattended
Emergencyconditions
(equipmentmalfunctionor
powerfailure)mayrequire
operationasaCategory1
facility(see4.5.3.6)
Nolocalmonitoring
requirements.For
unattendedfacilities,
continuousmonitoring
duringreceiptbythe
operator,transporter,orby
computer.
Seeabove
Seeabove
Response TimeResponsetimeisthetimenecessaryfortheoperator,undermostoperatingconditions,toterminateareceiptafteraHHalarminitiates.Theresponsetimeshouldbecarefullydocumentedandestablishedforeachtank.Manyoperatorswillchoosetouseasetfixedtime,suchas15minutestoterminatethereceiptsincethissimplifiestheoperatingprocedures.However,untiltheresponsetimeisformallyestablishedAPI2350requiresverylongresponsetimesasseeninTable2(seepage18)-“DefaultMinimumHigh-HighResponseTime”.Becauseofthisitisclearthatcomputingandauditingtheactualresponsetimewillpayoffinthelongrun,anditisalsoarequirement.
18
Table 2: Default Minimum High-High (HH) Response Time
TimeallocatedforoperationstoterminateareceiptpriortoreachingeitherAOPSifitexistsorcritical
high(CH).
Minimum High-High Tank (HH) Response Time (if not calculated)
Category
1
2
3
Time in Minutes
45
30
15
Thesevaluesmaybereducedonlyiftheactualresponsetimesarevalidated.
19
ProceduresOverfillPreventionSystem(OPS)isusuallyassociatedtotheequipment,butequallyimportantisthatitisoperatedproperlyaccordingtotheprocedures.That’swhyalargeportionofAPI2350focusesontheseprocedures,e.g.proof-testingwhichisdescribedbelow.
EquipmentSignificantprogressinthedesignandreliabilityoftankgaugingandalarmsystemshasbeenmadeinrecentyears.However,API2350doesnotgetintowhichequipmentortechnologyshouldbeused.
Proof TestingTheimportanceofprooftestingcannotbeoveremphasized.Whensystemssuchastankalerts,alarmsorAOPSfailthefailuresareforthemostpartunrevealed.Forexample,supposeanoperatordependsonasensorlocatedatHHtothealarmincasethereisafailuretoterminatethereceipt.Ifthisalarmisfailedthentherewillmostlikelybeanoverfill.Thistypeoffailureisreferredtoasadangerous,undetectedfailureifthepurposeofthealarmsystemisforsafety.WhilegreatadvanceshavebeenmadeforselfdiagnosticelectronicsensorsandATGS,whichmonitormanyifnotmostofthefailuremodesandoutputadiagnosticalarminsuchcases,howevernosystemhasa100%probabilityofdiagnosingsystemfaults.Theonlywaytopositivelyfindallpotentialdangerousundetectedfaultsistoprooftesttheentireloopfromthesensortothefinaloutput(sensor,logicsolver,andfinalelementorvalve).ItisrecommendedthatprooftestingrequirementsasspecifiedforAOPSbeappliedtoallalarmsaswell.
API2350requiresallcomponentsinvolvedtoterminateareceipttobeproof-testedatleastannually,unlessotherwisesupportedbyatechnicaljustification(i.e.aprobabilityoffailureondemandcalculation).Point-levelsensorsshallbeevaluatedsemi-annually.TestingofhandgaugesshallcomplywiththerequirementsinAPIManualOfPetroleumMeasurementStandards(MPMS)Ch.3.1A,andcontinuouslevelgaugesshallalsocomplywithAPIMPMSCh.3.1B.
EquipmentandOperations
20
General considerationsAlthoughcurrentlyAutomatedOverfillPreventionSystems(AOPS)isinfrequentlyfoundincurrenttankfillingoperations,theywillbecomeanimportanttoolinthetoolboxofoverfillprevention.Intheworldofsafetyinstrumentedsystems,specificindustrystandardshavebeendevelopedwhichapplytoelectricaland/orelectronicand/orprogrammableelectronicdevicestocontroldangerousprocesses.Thesestandardscoverpossiblehazardscausedbyfailureofthesafetyfunctionsbythesafety-relatedsystems.Thesestandardsrepresentthebestpossiblemethodologiestoensurethatsafetysystemsoperateasintended.Thesesafetyinstrumentedsystemsareappliedtorailwaysignalingsystems,remotemonitoringandoperationofprocessplants,emergencyshutdownsystems,burnermanagementsystemsandmanymore.Bytheirveryconstruct,whencombinedwithnormaloperatingsystemsandbasicprocesscontrolsystems,theycanachievealevelorriskreductionthatcannotbeachievedwithoutthem.Sowhythehesitancytousethem?
Onekeyreasonisthatiftheyareimproperlydesignedapipelinecanberupturedbyclosingoffaflowingtankreceiptdeliveringfromapipeline.Inordertodothiswithoutsignificantproblems,thevalveclosuretimemustbesufficientsothatthereisnopossibilityofalinerupture.Asignificantamountofdatacollectionandengineeringanalysisisrequiredtopreventtheriskofapipelinerupture.Onmarinereceipts,thetemporaryhosesthatconnectshiptoterminalcandisengageorruptureduetohydraulictransientsandaspilloverwaterisgenerallymoreseriousthanaspillintheterminal.GreatcaremustbeexercisedwhenapplyingAOPStoanymarineorpipelineoperation.
ThinkingaboutAOPSasakindofinsurancepolicyisuseful.TheAOPSshouldneverbeusedifoperationsaresufficientlygoodthatnooverfillsoccur.Butifnot,theAOPSwillkickinandbringthetankfillingprocesstoasafestate,basicallypayingoutthepremiumforthesesystems.Thingsarecomplicatedbythefactthatthepipelinedeliverycompanyisaseparatebusinessentityfromtheterminal,sothequestionbecomes“Wheredoyouwanttheincidenttooccur?”.Theterminaloperatormostlikelydoesnotwantaspillonhispropertyandlikewisethepipelineoperatorwouldratherhavethespillintheterminalthansomewhereoffsiteinthepipeline.SeriousdiscussionandnegotiationisrequiredbyboththepipelineoperatorandtheterminaloperatortodetermineifandhowanAOPSwillbeusedandacarefulagreementnegotiatedthatmaximizesthebenefitstoallparties.WhileuseofAOPScanreducerisk,itcanalsoincreaseitifnotproperlyappliedanddesignedmeaningthatalloftherequirementsofIEC61511aretotallycompliedwith.
AutomatedOverfillPreventionSystem
21
Two options for AOPS (existing and new tank systems)TherearetwooptionsforinstallingAOPSontankoverfillsystems.WhenthefacilitiesareexistingthenAppendixAofAPI2350isrequiredasaminimum.TheappendixisacompilationofbestpracticesthatshouldachieveariskreductioncomparabletoSIL1(safetyintegritylevel1perIEC61511)orariskreductionfactorof10to100.ThisoptionwasincludedbecauseitissimplynotpracticaltoattempttoapplyIEC61511tooldertankfacilities.
22
Fornewfacilities,theuseofIEC61511isrequired.ArequiredminimumSafetyIntegrityLevel(SIL)hashowevernotbeenspecified,althoughthereweremembersinthecommitteeadvocatingforthistobedone.ItislikelythatfuturerevisionsofthisstandardwillcomewitharequirementforminimumSIL2,anditisthereforewisetousethisforguidancewhendesigningnewAOPS.
AdoptingthenewAPI2350isasignificantchallengeandrequiressomeeffort.Butthepayoffcanbeworththeeffortbecausemanyoftheprocessessuchastheuseofsafetymanagementsystemsandriskassessmentarealreadyacceptedbytheindustryasthemostefficientandappropriatewaytodealwithrisk.Thedatacollectioneffortisimportantbecauseitisthefirststeptoassessingtheoverallsystemriskthatthetankfillingoperationsposeinyourfacilities.
Inaddition,oncedataaboutthesystemiscollected,thehighriskfacilitiescanbeidentifiedandriskreductionstarted.Forexample,asimplerequirementistoensurethatalltankalarmsaretestedandthatthealarmresponseismandatedtobeactionableasrequiredbyAPI2350.Thiswillsignificantlyreducerisksassociatedwithoverfill.Asimplesurveycanbeusedtostartidentifyingwhatkindsofequipmentthatisinplace.
Butbeyondtheselowhangingfruitsthereareresourcesandcoststhatmustbeallocatedtotheworthycauseofeliminatingoverfillsfromyourportfoliooftankfacilities.Theyarejusttooseriousathreattoignore.
Manytankoverfillincidentsresultedfromfaultyinstrumentation.Inaddition,whenthealarmshavebeenworking,itisnotuncommonthatoperatorsdidnotbelievethealarmsbecauseofpastproblemswiththeinstrumentationsystems.Ineithercase,overfillsresulted.Today,thehigh-tech,self-diagnosticequipmentavailablehasoutstandingreliability.Itisworthconsideringamigrationprocesswherethehighestrisktankfacilitiesaresystematicallyupgradedtothebestoverfillpreventionequipment.
For additional information:• IntheAppendixyouwillfindaAPI2350-compliancechecklistandsomeexamples
ofdifferentAPI2350-compliantequipmentsolutions• Downloadthestandardfromwww.api.org• Visitwww.rosemount-tg.com/safety• ContactyourlocalEmersonrepresentative
SummaryandConclusions
I
AppendixA. EquipmentSolutions:Sortedbytechnicalsolution
B. EquipmentSolutions:Sortedbytanktype
C. API2350ComplianceChecklist
D. FrequentlyAskedQuestions
E. AbouttheAuthors
Chapter explanations Abbreviations:MOPS: Manual Overfill Prevention System, API 2350 Category 3 AOPS: Automatic Overfill Prevention System, API 2350 Category 3 (sometimes called category 4)
Ranking system:This example shows a solutions that has ranked in the following way:
Reliability: 4/20Installation: 8/20Proof-testing: 4/20Approvals: 4/20Independence: 20/20
Total score: 40/100
Mechanical level switch
Float and tape level measurement
Reliability
Installation
Proof-testing Approvals
Independence
II
A.EquipmentSolutions:Sortedbytechnicalsolution
Point-Level Solution: 2100 + 5900S
Example: Fixed Roof tank
SIL 2
HiHi
Hi
MWL
Connection toTankMaster(optional)
Rosemount2100 LevelSwitch
SafetyInstrumentedSystem (SIS)
TankMaster InventoryManagement Software
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Automatic Tank Gauging (ATG)Automatic Overfill Prevention System (AOPS)
Rosemount5900S RadarLevel Gauge
Rosemount2240S withMultiple PointTemperature
Rosemount 2460System Hub
Rosemount 2410Tank Hub
Rosemount 2230Graphical Field
Display
SIL 2RelaySignal
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 64/100
III
Wireless Point Level Solution: 2160 + 5900S
Example: Fixed Roof tank
Connection toTankMaster
(optional)
IndependentAlarm Panel
1400 SmartWireless Gateway
Rosemount2160 WirelessLevel Switch
WirelessSignal
HiHi
Hi
MWL
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Automatic Tank Gauging (ATG)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
TankMaster InventoryManagement Software
Manual Overfill Prevention System (MOPS)
Rosemount5900S RadarLevel Gauge
Rosemount2240S withMultiple PointTemperature
Rosemount 2230Graphical Field
Display
PLC /Scada /
RTU /Safety
System
High-High Alarm
IndependentAlarm Panel
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 56/100
IV
Point-Level Solution: DS21D + 5900S
Example: Floating Roof tank
Connection toTankMaster(optional)
High-High Alarm
IndependentAlarm Panel
Mobrey DS21DFloating RoofAlarm Switch
Automatic Tank Gauging (ATG)
ArrayAntenna
with Hatch
Rosemount5900S RadarLevel Gauge
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
TankMaster InventoryManagement Software
Rosemount 2230Graphical Field
Display
Manual Overfill Prevention System (MOPS)
Rosemount2240S withMultiple PointTemperature
DiscreteSignal
HiHi
Hi
MWL
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 52/100
V
2-wire Pulse Radar Solution: 5400 + 5900S
Example: Fixed Roof tank
SIL 2
Connection toTankMaster(optional)
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Automatic Tank Gauging (ATG)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
Automatic Overfill Prevention System (AOPS)
SafetyInstrumentedSystem (SIS)
Rosemount 5400Radar LevelTransmitter(Pulse)
TankMaster InventoryManagement Software
Rosemount 2230Graphical Field
Display
Rosemount5900S RadarLevel Gauge(FMCW)
Rosemount2240S withMultiple PointTemperature
SIL 24-20 mAAnalogSignal
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 72/100
VI
2-wire Guided Wave Radar Solution: 5300 + 5900S
Example: Bullet tank
Automatic Tank Gauging (ATG)
Rosemount644 withSingle PointTemperature
Rosemount5900S RadarLevel Gaugewith PressureTransmitter(FMCW)Safety
InstrumentedSystem (SIS)
Automatic Overfill Prevention System (AOPS)
SIL 24-20 mAAnalogSignal
Rosemount 2410Tank Hub
Rosemount 2230Graphical Field
Display
Connection toTankMaster(optional)
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Rosemount 2460System Hub
TankMaster InventoryManagement Software
VerificationPin
Rosemount 5300Guided WaveRadar LevelTransmitter
SIL
2
SIL 2
Also applicable for:
Fixed Roof
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 76/100
VII
Wireless Guided Wave Radar Solution: 3308 + 5900S
Example: Bullet tank
Automatic Tank Gauging (ATG)
Connection toTankMaster
(optional)
1400 SmartWireless Gateway
WirelessSignal
Rosemount3308 WirelessGuided WaveRadar LevelTransmitter
Rosemount5900S RadarLevel Gaugewith PressureTransmitter
Rosemount 2410Tank Hub
Rosemount 2230Graphical Field
Display
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Rosemount 2460System Hub
TankMaster InventoryManagement Software
VerificationPin
Manual Overfill Prevention System (MOPS)
PLC /Scada /
RTU /Safety
System
High-High Alarm
IndependentAlarm Panel
Also applicable for:
Fixed Roof
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 64/100
VIII
SIL 2SIL 3
FMCW Radar Solution: 5900C + 5900S
Example: Sphere tank
SIL 2
Automatic Tank Gauging (ATG)
Rosemount 644with Single PointTemperature
Rosemount 644with Single PointTemperature
SIL 2Discrete
Signal
Rosemount 2410Tank Hub
VerificationPin
Rosemount5900C RadarLevel Gauge
with PressureTransmitter
Rosemount5900S RadarLevel Gaugewith PressureTransmitter
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Connection toTankMaster
(optional)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
Rosemount 2460System Hub
SafetyInstrumentedSystem (SIS)
TankMasterInventory Management Software
Automatic Overfill Prevention System (AOPS)
Rosemount 2230Graphical Field
Display
SIL 2 SIL 2
SIL 2SIL
2
Also applicable for:
Bullet Fixed Roof Floating Roof(Pipe)
Floating Roof (Roof-plate)
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 80/100
IX
SIL 2SIL 3
SIL 2
FMCW Radar Solution: 5900S + 5900S
Example: Floating Roof tank
SIL 2
SIL 3
SIL 2
SIL 3
Also applicable for:
Bullet Sphere Fixed Roof Floating Roof (Roof-plate)
SIL 2
SIL 3
SIL 2 / SIL 3Discrete
Signal
Rosemount 2410Tank Hub
Automatic Tank Gauging (ATG)
ArrayAntenna
with Hatch
Rosemount5900S RadarLevel Gauge
Rosemount5900S RadarLevel Gauge
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Connection toTankMaster
(optional)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
Rosemount 2460System Hub
SafetyInstrumentedSystem (SIS)
TankMaster InventoryManagement Software
Automatic Overfill Prevention System (AOPS)
Rosemount 2230Graphical Field
Display
Rosemount2240S withMultiple PointTemperature
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 92/100
X
2-in-1 Solution: 5900S 2-in-1
Example: Floating Roof tank
Rosemount5900S 2-in-1Radar Level
Gauge
Leve
l
SIL 2
Ove
rfill
SIL 2Discrete
Signal
Rosemount 2410Tank Hub
Automatic Tank Gauging (ATG)
SafetyInstrumentedSystem (SIS)
Automatic Overfill Prevention System (AOPS)
Rosemount 2410Tank Hub
Rosemount 2230Graphical Field
Display
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Connection toTankMaster
(optional)
Rosemount 2460System Hub
Rosemount 2460System Hub
TankMaster InventoryManagement Software
Rosemount2240S withMultiple PointTemperature
SIL 2
Leve
l
Ove
rfill
SIL 2
Leve
l
Ove
rfill
SIL 2
Leve
l
Ove
rfill
Also applicable for:
Bullet Sphere Fixed Roof
SIL 2
Reliability
Installation
Proof-testing Approvals
Independence
Total score: 88/100
XI
Fixed Roof Tank Solutions
SIL 3
SIL 3
SIL 3
Delta VSIS
SIL-PAC(Fisher DVC +
Bettis Actuator)FisherValve
Connection toTankMaster(optional)
Rosemount5900S RadarLevel Gauge
High-High Alarm
IndependentAlarm Panel
1400 SmartWireless Gateway
SmartWireless
THUM™ Adapter
Rosemount 2410Tank Hub
TankMaster InventoryManagement Software
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Automatic Tank Gauging (ATG)Automatic Overfill Prevention System (AOPS)
Rosemount5900S RadarLevel Gauge
Rosemount2240S withMultiple PointTemperature
Rosemount 2410Tank Hub
Rosemount 2460System Hub
Rosemount 2230Graphical Field
Display
B.EquipmentSolutions:Sortedbytanktype
SIL 2SIL 2
SIL 3
SIL 2
Leve
l
Ove
rfill
SIL 2
Point-level (2100) Wireless Point-level (2160) 2-wire Pulse Radar (5400) 2-wire Guided Wave Radar (5300)
Wireless Guided Wave Radar (3308) FMCW Radar (5900C) FMCW Radar (5900S) FMCW Radar 2-in-1
SIL 2
SIL 2
XII
Floating Roof Tank Solutions
SIL 3
SIL 3
Rosemount5900S 2-in-1Radar Level
Gauge
Leve
l
SIL 2
Over
fill
Automatic Tank Gauging (ATG)Automatic Overfill Prevention System (AOPS)
Rosemount 2230Graphical Field
Display
Rosemount2240S withMultiple PointTemperature
Delta VSIS
SIL-PAC(Fisher DVC +
Bettis Actuator)FisherValve
Connection toTankMaster(optional)
High-High Alarm
IndependentAlarm Panel
1400 SmartWireless Gateway
SmartWireless
THUM™ Adapter
Rosemount 2410Tank Hub
TankMaster InventoryManagement Software
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
SIL 2
SIL 2
SIL 2
SIL 3
Point-level (DS21D) FMCW Radar (5900C) FMCW Radar (5900C) FMCW Radar (5900S) (Pipe) (Roof Plate) (Pipe)
SIL 2SIL 3
Leve
l
SIL 2
Ove
rfill
FMCW Radar (5900S) FMCW Radar 2-in-1 (Roof Plate)
XIII
SIL 2
Leve
l
Ove
rfill
Bullet Tank Solutions
2-wire Guided Wave Radar (5300) Wireless Guided Wave Radar (3308) FMCW Radar (5900C)
FMCW Radar (5900S) FMCW Radar 2-in-1
SIL 2
SIL 2
SIL 3
SIL
2
SIL 3
SIL 3
Rosemount644 withSingle PointTemperature
Rosemount5900S RadarLevel Gaugewith PressureTransmitter
Rosemount5900S RadarLevel Gaugewith PressureTransmitter
Delta VSIS
SIL-PAC(Fisher DVC +
Bettis Actuator)FisherValve
Connection toTankMaster(optional)
High-High Alarm
IndependentAlarm Panel
1400 SmartWireless Gateway
Smart Wireless THUM™ Adapter
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Automatic Tank Gauging (ATG)Automatic Overfill Prevention System (AOPS)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
Rosemount 2230Graphical Field
Display
VerificationPin
Rosemount 2410Tank Hub
TankMaster InventoryManagement Software
SIL 3
XIV
FMCW Radar (5900C) FMCW Radar (5900S) FMCW Radar 2-in-1
SIL 2
Leve
l
Ove
rfill
SIL 2
VerificationPin
Rosemount 644with Single PointTemperature
Rosemount 644with Single PointTemperature
Rosemount5900S RadarLevel Gauge
with PressureTransmitter
Rosemount5900S RadarLevel Gaugewith PressureTransmitter
Delta VSIS
SIL-PAC(Fisher DVC +
Bettis Actuator)
FisherValve
Connection toTankMaster(optional)
High-High Alarm
IndependentAlarm Panel
1400 SmartWireless Gateway
Smart Wireless THUM™ Adapter
Includes Visual & Audible Level Alert High and Level Alarm High-High (optional)
Automatic Tank Gauging (ATG)Automatic Overfill Prevention System (AOPS)
Rosemount 2410Tank Hub
Rosemount 2460System Hub
Rosemount 2230Graphical Field
Display
Rosemount 2410Tank Hub
TankMaster InventoryManagement Software
SIL 3
SIL 3
SIL 3
Sphere Tank Solutions
FMCW Radar (5900C) FMCW Radar (5900S) FMCW Radar 2-in-1
C.API2350Edition4ComplianceChecklist
Introduction Thischecklistprovidesatoolforverificationofcompliancewiththenewstandardforoverfillprevention:API2350,Edition4,May2012.Itcanalsohelpyoutobetterunderstandtherequirementsandrecommendedpracticesthatcomprisethenewstandard.Thechecklistisintendedtobeappliedonatankbytankbasis.Duplicatethechecklistforusagewithmultipletanks(e.g.forassessmentofanentiretankfarm).Thechecklistisorganizedintofourconsecutivesteps(seefigureB1):
Step 1: Management System
Step 2: Risk Assessment
Step 3: Tank & Operations
Step 4: Compliance Summary
Eachstepisbrieflydescribedbelow.Additionalinformationcanbefoundin”TheCompleteGuidetoAPI2350”availableathttp://www.api-2350.com.Foracompletelistofallrequirements,werefertothestandarditself.YoucanobtaintheAPI2350standardathttp://publications.api.org.
Figure C.1: Checklist step by step overview
Managemenet System (MS)
Amanagementsystemisdefinedastheframeworkofadministrativeprocessesandproceduresusedtoenabletheownerandoperatortofulfillthetasksrequiredtoreduceoverfillstoanacceptablelevel.AmanagementsystemisrequiredforconformancewithAPI2350,butthestandarddoesnotspecifyhowtoimplementsuchasystem.
Thefirststepofthechecklistoutlinesalltheele-mentsrequiredbyAPI2350tobeincludedinamanagementsystem.Yourmanagementsystemmustmeetalloftherequirementsinthechecklisttobecompliantwiththestandard.
Is the tank compliant with API 2350 Edition 4?
Are administrative processes and procedures in compliance with API 2350?
4.ComplianceSummary
Is the risk, associated with tank overfills, acceptable to responsible stakeholders?
2.RiskAssessment
Are tank data and operating parameters in compliance with API 2350?
Sub-Steps: 3a.DataCollection3b.ScopeCheck3c.TankCategorization3d.LOCandResponseTime3e.Equipment
3.Tank&Operations
1.ManagementSystem
XV
Click for printable MS Checklist
Risk Assessment (RA)
Tank & Operations (TO)
API2350requiresariskassessment,associatedwithtankoverfills,tobeconductedandproperlydocumented.Thestandarddoesnothoweverspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletoresponsiblestakeholders.
TheRiskAssessmentChecklist(seepageXVII)isoutlinedaseithermeetingornotmeetingcriteriasetbystakeholders.Stakeholderstakenintoconsiderationareowners,operators,employees,authorities,transportersandpublic.Ifanyofthestakeholdersfindthattheriskisunacceptable,thenriskreductionisrequired.Thismaybeaccomplishedbyachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(e.g.attendance),achangeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.
Theriskassessmentprocessshallbeconductedbypeoplewhoarefamiliarwithtankfacilitiesandoperationsaswellastheriskassessmentprocess.Thechecklistisintendedforonetankonly.Duplicatethechecklistforusagewithmultipletanks.
ThethirdstepconcernstankconfigurationforconformancewithAPI2350.Here,specifictankdataandoperatingparametersarecollectedandcomparedwiththerequirementsinAPI2350.ThisisrequiredforeachtankwithinscopeoftheAPI2350complianceprogram.
TheTank&OperationsChecklist(seepageXIX)isdividedintofivesub-steps.Thefirststepisintendedfortankdatacollectiononly.Thisdataisthenusedinsubsequentstepstoassessthetank´scompliancewithAPI2350.Morespecific,thedatahelpsyoutoanswerquestionssuchas:IsyourtankwithinthescopeofAPI2350?Whatpre-definedcategoryisyourtank?and,Doesyourtankmeettheequipmentrequirementsforselectedcategory?
RESET
API2350alsorequires,asaminimum,threeLevelsofConcern(LOCs)tobeestablished.Eachofthesethreeshallbedefinedinlevel,ullageandvolumeseperately.Theexactvaluesdependonoperatingparameterssuchasfillrateandresponsetime.
Compliance Summary (CS)
ThefinalsectionconstitutesaComplianceSummaryforthespecifictank.TheComplianceSummaryChecklist(seepageXXV)servesasafinalverificationofthistank scompliancewithAPI2350.Yoursummarymustmeetalloftherequirementstobecompliantwiththestandard.
Click for printable TO Checklist
Click for printable RA Checklist
XVI
Itisadvisable,butnotrequired,toinitiatethefollowingactivitiesbeforestartingtheverificationprocess:
• Createanexperiencedassessmentteamwithcompetentpeoplespanningalldisciplinesrequired (e.g.design,operation,maintenance,instrumentation,safety,qualitydepartments)• Setup/Clarifyresponsibilities• Definethescopeandtimelineofthetankcomplianceprogram• Createproceduresformanagingthedataobtainedandcreatedduringthecomplianceprocess• AcquireacopyoftheAPI2350standardathttp://publications.api.org
NotethatAPI2350isastandardofminimumrequirements.Alternateapproachesthatprovideequivalentormorerobustoverfillpreventionareacceptedandrecommendedbythestandarditself.Forexample,Emersonalwaysadvocatestheusageofthehighestcategoryequipment(automatictankgauging+independentoverfillalarm)foralltankswithinthescopeofthisstandard,sincethecostdifferenceisusualllyminimal.
AlsonotethatthischecklistsummarizestherequirementsinAPI2350,anddoesnotnecessarilyreflectEmerson’sview.Ifanydiscrepanciesorunclaritiesoccur,alwaysrefertotheoriginalsource.Theremayalsobeadditionallocalregulation(e.g.country,federal,statelaws)thatmustbetakenintoconsideration.Ultimately,thisistheresponsibilityofthetankfarmowner/operator.
Incaseyouneedassistance,orhaveanysuggestions,pleasecontactyourlocalRosemountTankGaugingrepresentativeormailto:[email protected].
Incasethetankisnon-compliantwithAPI2350,thecollectedinformationcanbeusedtoperformagapassessment,whichshouldbefollowedbyacomplianceproject.ThisprocessisfurtherdescribedinTheCompleteGuidetoAPI2350,wherefigure1(seepage11)providesanoverviewoftheentireverificationandimplementationprocess.
Recommendations
Click for printable CS Checklist
XVII
Your management system shall include (as a minimum)... Is your management system
compliant with requirement?
1. Formaldocumentedoperatingproceduresandpractices,includingsafetyproce-duresandemergencyresponseprocedures.
Yes No
2. Establishedanddocumentedproceduresforpre-receiptplanning.Theproce-dureshallrequiretheproductquantitytobereceivedtobecomparedtogaugedavailablereceivingtankcapacityaheadoftheactualtransfer.Thisinformationshallberecordedonthetankproducttransferorreceiptrecord(s)andshallbemadeavailabletothetransporter.
Yes No
3. Establishedanddocumentedproceduresforactivitiesduringthereceipt.Thestan-dardrequiresregularlyscheduledcomparisonsofproductlevelsduringreceipts.
Yes No
4. Documentedprocedureforpostreceiptactivities(e.g.closevalves). Yes No
5. Writtenprocedureswhichestablishtheminimumlocalattendancelevelsduringreceipt.1.1
Yes No
6. PoliciesandproceduresshallprohibittheuseofHigh-hightanklevelalarmsandAOPSforroutineoperationorcontroloftankfillingoperations.
Yes No
7. Recordsshowingthatallpersonnelinvolvedintheproducttransferarecompetent1.2andhavereceivedadequatetrainingforthespecifictaskarerequired.
Yes No
8. Functionalequipmentsystems,testedandmaintainedbycompetent1.2personnel. Yes No
9. Drawings,operatinginstructions,inspections,testingandmaintenanceplansshallbeestablishedanddocumentedforthetankgaugingsystem,overfillpreventionsystemandotherequipmentasapplicable.Documentationrelatingtoinspectionandmaintenanceofsystemsshallbemaintainedforaminimumofoneyear.
Yes No
ManagementSystemChecklist
Step 1: Management System (MS) Checklist
Section 4.2 and 4.5http://publications.api.org
Is your MS compliant with API 2350 Ed.4 ?Fill out the following form to check if yourmanagement system is compliant with API2350.Thissheetisintendedforonetankonly.Duplicate the sheet for multiple usage. Foradditional information, see “The CompleteGuidetoAPI2350”.
Tank-farm Facility/Site
Date Revision DataStorageLocation
Issue
1.Name Position 4.Name Position
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
RESET
XVIII
XVIII
RESET
10. Systemsandprocedurestoaddressbothnormalandabnormaloperatingconditions.
Yes No
11. AManagementofChange(MOC)processthatincludespersonnel,equipmentandproceduralchanges.
Yes No
12. Asystemtoidentify,investigate,andcommunicateoverfillnearmissesandincidents.
Yes No
13. Afollow-upsystemtosharelessonslearnedandtoaddressanyneededmitigationofcircumstancesleadingtonearmissesorincidents.
Yes No
14. Documentedcommunicationprotocolswithintheownerandoperatororganiza-tionandbetweenthetransporterandtheownerandoperatorthataredesignedtofunctionunderabnormalaswellasnormalconditions.
Yes No
15. ProceduresforperiodicreviewoftheLevelofConcerns(LOCs).Maxreviewtimeisfiveyears.
Yes No
Ifalloftheanswersareequaltoyes,thenyourmanagementsystemiscompliantwiththere-quirementsinAPI2350Edition4.
IsyourmanagementsystemcompliantwithAPI2350?
Yes No
Note1.1: Category1:Localattendanceon-sitecontinuouslyduringthefirstandlasthourofreceipt,andataminimumhourlyduringthereceipt.Category2: Maybesemi-attended,butrequiresattendancecontinuouslyduringthefirstandlast30minutesofreceipt.Category3:Nolocalmonitoringrequirements.
Note1.2: API2350definesacompetentpersonas“anindividualwhoiscapableandabletoperformtheassigneddutiesasdeterminedbymanagementina specificareaofoperations.”(3.10)
Section 4.2 and 4.5http://publications.api.org
XIX
Step 2: Risk Assessment (RA) Checklist
Is risk, associated to tank overfills, acceptable to responsible stakeholders?API2350requiresariskassessmenttobeconductedandproperlydocu-mented.Thestandarddoeshowevernotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist,andultimatelythattheresidualriskisacceptabletotheowner,operatorandotherresponsiblestakeholders.AccordingtoAPI2350,itistheresponsibilityoftheownerandoperatortoconductariskassessmentcoveringtherisksassociatedwithpotentialtankoverfills.
RiskAssessmentChecklist
Minimum risk requirement Risk acceptable?
1. Theriskassessmenthasbeenconductedandproperlydocumentedforthespecifictank. Yes No
2. Theriskassessment´sresidualriskisacceptable...
2a. totheOWNER. Yes No
2b. totheOPERATOR. Yes No
2c. totheEMPLOYEES. Yes No
2d. totheAUTHORITIES/REGULATION. Yes No
2e. totheTRANSPORTER. Yes No
2f. tothePUBLIC. Yes No
Ifalloftheanswersareequaltoyes,thentheriskassessmentiscompliantwiththerequirementsinAPI2350Edition4.2.1
Istheriskacceptabletoresponsiblestakeholders? Yes No
RESET
Is the RA acceptable to stakeholders?Filloutthefollowingformtocheckiftheriskassessment is compliant with API 2350 re-quirements. This sheet is intended for onetank only. Duplicate the sheet for multipleusage. For additional information, see “TheCompleteGuidetoAPI2350”.
RESET
1.Name Position 4.Name Position
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
Date Revision DataStorageLocation
Issue
Section 4.3http://publications.api.org
Note2.1: Ifthestakeholdersfindthattherisksdonotmeetthegapassessmentcriteria,thenriskreductionisrequired.Thismaybeaccomplished byachangeofoperatingcharacteristic(i.e.receiptflowrates),byachangeofoperatingproceduresandpractices(i.e.attendance),a changeofequipmentsystemsandalarms,additionalautomationofsystemsthroughthetransporterortheinstallationofanAOPS.
Tank-farm Facility/Site
XX
ProbabilityandConsequenceFactors(OptionalSection)
Factor considered in the risk assessment?Probability Factors
A.1 Frequency,rateanddurationoffilling. Yes No
A.2 Systemsusedtoproperlymeasureandsizereceiptstotanks. Yes No
A.3 Accuratetankcalibration(bothstrappingandverifiedCriticalHighlevel. Yes No
A.4 Systemsusedtomonitoringandsupervisionofmanualandautomatictankgauging. Yes No
A.5 Extentofmonitoringandsupervisionofmanualandautomatictankgauging. Yes No
A.6 Impactofcomplexityandoperatingenvironment. Yes No
A.7 Fillingmultipletankssimultaneously. Yes No
A.8 Switchingtanksduringreceipt. Yes No
Factor considered in the risk assessment?Consequence Factors
B.1 Hazardcharacteristicofmaterial(product)intank. Yes No
B.2 Volatility,flammability,dispersion,VCEpotential. Yes No
B.3 Numberofpeopleonsitewhomaybeaffectedbyatankoverflowing. Yes No
B.4 Numberofpeopleoffsitewhomaybeaffectedbyatankoverflowing. Yes No
B.5 Possibilityofatankoverflowingresultingin(escalation)ofhazardouseventsonsiteoroffsite.
Yes No
B.6 Possibilityofimpacttonearbysensitiveenvironmentalreceptors. Yes No
B.7 Physicalandchemicalpropertiesofproductreleasedduringoverflowing. Yes No
B.8 Maximumpotentialoverfillflowratesandduration. Yes No
API2350doesnotspecifyhowtheriskassessmentshouldbeconducted,onlythatitshallexist.Butgenerally,riskisacombinationofconsequencemultipliedbytheprobabilityforaspecificeventorscenariothatresultsinharmordamage.Thereforethestandard(seeAnnexE)recommendsthatatleastthefollowingprobabilityandconsequencefactorsareconsideredintheriskassessment.
RESET
Section 4.3 and Annex Chttp://publications.api.org
XXI
Step 3: Tank & Operations (TO) Checklist
DescriptionofATGLevelMeasurement ATGTagName Technology(e.g.radar)
TankGaugingSystemTypeofappliedTankGaugingSystem?
None/ManualTankGauging(sectionN/A)AutomaticTankGauging(ATG)
Section 4.4http://publications.api.org
Is your TO compliant with API 2350 Ed.4 ?Filloutthefollowingformtodefineandcon-figure your tank according to API 2350. Thissheetisintendedforonetankonly.Duplicatethe sheet for multiple usage. For additionalinformation,see“TheCompleteGuidetoAPI2350”.
RESET
1.Name Position 4.Name Position
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
Figure 1: Overview tank parameters, internal /external floating roof tanks respectively
TypeofLiquidProduct(e.g.crudeoil) Max/MinDensityorSpecificGravity3.1
TankType(e.g.fixedorfloatingroof) TankHeight(TH)/CriticalHigh(CH)3.2
Strapping-tableisuptodate?3.3
EffectiveFloatingRoofThickness(FR)(fromliquidleveltotopsealextension)
Yes No
GeneralTankData
3a. Data Collection
RESET
NotApplicable
OperationalTankDataMaxFillRate MaxWorkingLevel(MW) High-HighLevel(HH) WorstCaseResponseTime(RT)3.4
Note3.1: DensitycaninfluenceCriticalHigh(CH)andEffectiveFloatingRoofThickness(FR).
Note3.2: AccordingtoAPI23503.13:CriticalHigh(CH)isthehighestlevelinthetankthatproductcanreachwithoutdetrimentalimpacts(i.e.productoverflowortankdamage). Foradditionalinformation,seeAPI2350AnnexD.
Note3.3 Max15yearintervalforunchangedtanksaccordingtoAPIManualofPetroleumMeasurementStandards(MPMS)2.2.
Note3.4: ResponseTimeistheperiodoftimerequiredtoterminateareceipt.API23504.4.2.5providesguidanceonhowthiscanbecalculated.Alternatively,thedefault responseratesdefinedbythestandardcanbeused,seesection3e.LevelsofConcern(LOCs)Determination.
Date Revision DataStorageLocation
Issue
Tank-farm Facility/Site
XXII
3b. Scope Check
Is your tank within the scope of API 2350?ThescopeofAPI2350isintendedforabovegroundatmosphericstoragetanksassociatedwithpetroleumfacilitiesincludingrefineries,marketingterminals,bulkplantsandpipelineterminalsthatreceiveClassIorClassIIpetroleumliquids.Useisrecom-mendedforClassIIIpetroleumliquids.3.7
Note3.7: NFPA30-2008definesclassesofliquids.ClassIliquid:aflammableliquidwithaclosedcupflashpointbelow100°F(37.8°C)andareidvaporpressure notexceeding40poundspersquareinchabsolute(2068millimetersofmercury)at100°F(37.8°C).ClassIIliquid:acombustibleliquidwithaclosedcup flashpointatorabove100°F(37.8°C)andbelow140°F(60°C).ClassIIIliquid:aliquidwithflashpointsabove140°F(60°C).
Note3.8: PEI600RecommendedPracticesforOverfillPreventionforShop-fabricatedAbovegroundTanksisavailableathttp://www.pei.org.
RESET
The Tank is...Is your tank compliant
with the statement?
1. Anabovegroundstoragetankof1320USgallons(5000liters)ormore. Yes No
2. ContainingClassIorClassIIpetroleumliquids(optional:ClassIIIpetroleumliquids).3.7 Yes No
Is your tank compliant with the statement?The Tank is NOT...
3. Apressurevessel. Yes No
4. Shop-fabricatedorcompliantwithPEI6003.8. Yes No
5. Locatedataservicestation. Yes No
6. Filledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars). Yes No
8. StoringLPGorLNG. Yes No
If all of the answers are equal to yes, thenthetankiswithinthescopeofAPI2350Edi-tion4.
IsyourtankwithinthescopeofAPI2350? Yes No
ScopeofAPI2350
IndependentOverfillPreventionSystemTypeofappliedOverfillPreventionSystem?
ManualOverfillPreventionSystem(MOPS)3.5
AutomaticOverfillPreventionSystem(AOPS)3.6
None(sectionN/A)
TypeofLevelAlarmHigh-HighSensor Actuator:AlarmSignalSystem OperationalExperience(e.g.replacements,alarms,etc.)
TypeofLogicSolver Actuator:FinalElement
Documentedproof-testprocedureexists?
Proof-testInterval MostRecentProof-testResultandDate
(months)Yes No
RESET
Section 1.1http://publications.api.org
Note3.5: Anoverfillpreventionsystemrequiringoperatingpersonnelactiontofunction(API23503.29).
Note3.6: Anoverfillpreventionsystemnotrequiringtheinterventionofoperatingpersonnelactiontofunction(API23503.6).
Datacommunicationtolocalorremotecontrolexists?
OperationalExperience(e.g.replacements,alarms,etc.)
Documentedverificationtestprocedureexists?
VerificationInterval MostRecentVerificationResultandTestDate
(months)
RESET
Yes No
Yes No
XXIII
3d. Equipment Requirements
TankEquipmentRequirements
Category 3
Yes(requirement)
Yes(requirement)
LiquidlevelandindependentLAHHistransmittedtocontrolcenter
Category 2
Yes(requirement)
Notrequired
Liquidlevelistrans-mittedtocontrolcenter
Category 1
Notrequired
Notrequired
Nodatacommuni-cationwithcontrolcenterrequired
ATG-System
Independent LAHH Sensor
Availability of measured level data
Tankfulfillsrequirementsforselectedcategory?(Yes,ifallboxesarecheckedforselectedcategory)
Yes No
Does your tank meet the equipment requirements?Thewaythetankisoperated,orequallyitscategory,determinestheminimumrequirementsfortheoverfillpreventionsystem.Givenallthingsequal,ahighercategoryoverfillpreventionsystem(e.g.category3)issaferthanalowercategorysystem(e.g.2).Ahighercategorysystemalsoallowsformoreefficienttankoperationswithlesspersonnelandhighertankutilization.Ahighercategoryoverfillpreventionsystemthanrequiredcanbeusedsinceitisastandardofminimumrequirements.Selectthepreferredtankcategorybelow,andevaluateifyourtankfullfillstheminiumrequirements.Exampleofequipmentsolutionscanbefoundin“TheCompleteGuidetoAPI2350”,AppendixA.
3c. Tank Categorization
Which API 2350 pre-defined category does your tank belong to?API2350requireseachtanktobecategorizedaccordingtohowitisoperated.Mostmodernfacilitiesareoperatedremotelyfromacontrolcenterandwillthereforefallundertankcategory3.
Category 1 Category 2 Category 3
Attendance
Cat.1:Fullyattendedfacility(locallymonitored)
Cat.2:Semi-attendedfacility(locallyandremotelymoni-tored)
Cat.3:Unattendedfacility(remotelymonitored)
Monitoring
Cat.1:Continuouslyduringfirstandlasthourofreceiptandonceeveryhourduringreceipt
Cat.2:Continuouslyduringthefirstandlast30minutesofreceipt
Cat.3:Monitoredfromlocalorremotecontrolcenter
Operator
Cat.1:Fullfocusononereceiptatatime,andnotdistractedbyotherduties.
Cat.2:Focusonmultipletanks/receiptssimultaneously,oroperatormaybedistractedbyotherduties
Cat.3:Samerequirementasincategory2
Tankiscategorizedas..?(equalsthehighestcatgoryselectedabove) Category1 Category2 Category3
TankCategorization
RESET
RESETSection 4.4 and 4.5http://publications.api.org
XXIV
TheATGsystemisoneofthemostcriticalcomponentstopreventoverfillsfromoccurring.Thisisrecog-nizedinAPI2350,andthereforethestandardrequiressoundengineeringprinciplestobeappliedalsotothispartofthefacility.Thissectionismandatoryforcategory2and3tanks,andoptionalforcategory1.
Automatic Tank Gauging (ATG) System - applies to category 2 and 3
TankequippedwithATGsystem?
ATG system conforms to the following principlesIs your ATG system compliant
with the statement?
1. TheATGsystemisdesignedandconfiguredtoinitiateadistinctvisualandaudiblealarmincasetheliquidsurfacereachestheHighhighLevelAlarm(LAHH)point.
Yes No
2. Written maintenance and verification plans, encompassing all components in the tankgauging system,shallexist.Testingofcontinous-levelsensorsshallcomplywiththere-quirementsinAPIManualofPetroleumMeasurement3.1Bandthemanufacturer’sinstruc-tions.
Yes No
3. Tankandfacilityshallallowformanualshutdownincaseoffailure(e.g.equipmentorcablefailures,powerloss).
Yes No
Ifallof theanswersareequal toyes, thentheATGsystemiscompliantwiththerequirementsinAPI2350Edition4.
IsyourATGsystemcompliantwithAPI2350?
Yes No
AutomaticTankGauingSystem
RESET
Yes No(sectionN/A)
Section 4.4 and 4.5http://publications.api.org
Independent overfill prevention system conforms to the following principlesIs your independent OPS
compliant with the principle?
1. TheequipmentusedintheOPsystemshallnotbeapartoftheATGsystem Yes No
2. AdistinctvisualandaudiblealarmthatisnotapartoftheATGsystem Yes No
3. Documentedproof-testingproceduresandmaintenanceplanshallexistforallcompo-nentsintheoverfillpreventionsystem:-High-HighLevelAlarmSensor-Alarmpanel-LogicSolver(e.g.PLC)-Valves-Communicationsequipment
Yes No
4. TheProof-testingmethodsshall:-beincompliancewiththemanufacturers’instructions-donotput(orleave)thetankinanunsafeoperatingmode(e.g.itisnotrecommendedtofillthetankaboveitsminimumworkinglevel)-forcontinuouslevelsensors:complywiththerequirementsinAPIMPMS3.1B
Yes No
IndependentOverfillPreventionSystem
Independent Overfill Prevention System (OPS) - applies to category 3
AnindependentOverfillPreventionSystem(OPS)isrequiredforalltanksoperatedascategory3,whichisthemajorityoftanksoperatingtoday.Traditionally,electro-mechanicalpoint-levelsensorshavebeenusedastheHigh-HighLevelAlarm(LAHH)Sensor.Theusageof“continuous”typeleveltechnologyisrap-idlybecomingthedesiredchoicetoreplace“point”typeswitches;theobviousadvantageisthe‘online’levelmeasurementwhichcanbecomparedwiththeATGforproof-testing.
Tankequippedwithindependentoverfillpreventionsystem?
Yes No(sectionN/A)
XXV
Section 4.4http://publications.api.org
AutomaticOverfillPreventionSystem:GenericRequirements
AOP system conforms to the following principlesIs your AOPS compliant
with the principle?
Existing Facilities ConformtoAnnexAinAPI2350orIEC61511 Yes No
New facilities ConformwithrequirementsinIEC61511orANSI/ISA84.00.01-2004 Yes No
Wireless AOPSdoesnotdependonWirelesscommunication3.9 Yes No
Safe state Allequipmentshallbedesignedtomovetheprocessintoasafestateintheeventofapowerlossordevicefailure.
Yes No
Automatic Overfill Prevention System (AOPS) - if used
AutomaticOverfillPreventionSystems(AOPS)areoptional.Butifoneisbeingem-ployed,thenitisrequiredtoconformtotheminimumrequirementsbelow.
RESET
TankequippedwithAOPS?
Yes No(sectionN/A)
Note3.9: WirelesscommunicationisacceptableforanythingbutAOPS.AnAOPScannotdependsolelyonwireless,butitcanbeusedasredundant communication(e.g.deviceconfiguration).
RESET
CHLevelset-point:expressedasLevel CHLevelset-point:expressedasVolume CHLevelset-point:expressedasUllage
MinimumRequirement CHLeveliscompliantwiththeminimumrequirement?
Highestlevelintankthatproductcanreachwithoutinitiatingoverflowortankdamage.Ifapplicable,thethicknessofthefloatingroofshallbetakenintoconsideration. Yes No
CriticalHighLevel
3e. Levels of Concern (LOCs) Determination
ThestandardrequiresataminimumthefollowingthreeLOCstobedefined:CriticalHighLevel(CH),High-HighLevel(HH)andMaximumWorkingLevel(MW).EachLevelofConcernshallbedefinedinlevel,ullageandvolume.UsageofHi-Alertsisoptional.FigureC.2outlinestheLOCs.
5. Resultfromproof-testingshallbeproperlydocumentedandthetestintervalismaxi-mum-Point-levelSensor(ifexist):6months-Allothercomponentsintheoverfillpreventionsystem:12months
Yes No
6. High-HighLevelAlarmSensorshallbeabletoalsomeasureliquidproductontopofthefloatingroof(ifapplicable)
Yes No
If all of the answers are equal to yes, then theIOP system is compliant with the principles inAPI2350Edition4.
IsyourindependentOPScompliantwithAPI2350?
Yes No
RESET
AOPSLevelset-point:expressedasLevel AOPSLevelset-point:expressedasVolume AOPSLevelset-point:expressedasUllage
MinimumRequirement AOPSLeveliscompliantwiththemin.requirement?
Level/VolumeequivalenttodistancefromCHtocalculatedAOPSresponsetimeatmaxflowrate.Distance(btw.CHlevelandAOPSlevel)shallnotbelessthanthree(3)inches.
Yes No
AutomaticOverfillPreventionSystem:Set-point
RESET
XXVI
Level Required action for specified level Requirement fulfilled?
CriricalHigh(CH) Anemergencymanagementresponseshallbeinitiated.Procedureshallbedocumented
Yes No
HighHigh(HH) Alarmgeneratedanddocumentedproceduresrequiringoperatorstoinitiateimmediatetermination• Category1:Alarmoptional• Category2:AlarmgeneratedbyATG-system.• Category3:RedundantAlarmsgeneratedbyATGandIOPS
Yes No
ActionRequirements
Are actions and procedures documented?API2350requiresdocumentedactionsincasetheliquidproductsurfacereachesCriticalHigh(CH)orHigh-High(HH).
RESET
HHset-point:Level HHset-point:Volume HHset-point:Ullage
MinimumRequirement
Ataminimum,verticaldistancebetweenCHandHHcorre-spondstothefollowingresponsetime(atmaxflowrate)3.10:• Category1=45minutes• Category2=30minutes• Category3=15minutesThree(3)inchminimumlevelforallcategories.
HHiscompliantwiththeminimumrequirement?
HighHighLevel
Figure B.2: Overview Levels of Concern (LOCs)
Yes No
RESETNote3.10: Thesearethedefaultresponsetimesforeachcategory. Alternatively,thetankspecificresponsetimecanbeused.
MWLevelset-point:expressedasLevel MWLevelset-point:expressedasVolume MWLevelset-point:expressedasUllage
MinimumRequirement MWLevelcompliantwithmin.requirement?
AtaminimumverticaldistancebetweenHHandMWcorrespondstocalculatedfacilityoperationsresponsetime3.11. Yes No
MaxWorkingLevel
RESETNote3.11: Responsetimeistheperiodoftimerequiredtoterminateareceipt.
Section 4.4http://publications.api.org
Level Description Action and Alarm/Alert Requirements
The level at which damage or overflow occurs
A spill management emergency response shall be initiated. Procedure shall be documented. Alarm is required.
The level at which termination of product receipt triggers
Critical High (CH)
Max. Working (MW)
AOPS Level
High-High Tank (HH) The action alarm level to enable termination of product receipt
The highest level to which the tank may routinely be filled
Level only applies if AOPS is used. Alarm is optional.
Action response required. Procedures shall be documented. Alarm is required for Cat. 2 and 3.
Alert is recommended but not required.
Note: High tank level is not required
XXVII
Step 4: Compliance Summary (CS) Checklist
Is tank compliant with API 2350?Filloutthefollowingformtoverifyifthetankis compliant with API 2350. This sheet is in-tendedforonetankonly.Duplicatethesheetformultipleusage.Foradditionalinformation,see“TheCompleteGuidetoAPI2350”.
RESET
1.Name Position 4.Name Position
2.Name Position 5.Name Position
3.Name Position 6.Name Position
AssessmentTeam
Tank-farm Facility/Site
Date Revision DataStorageLocation
Issue
ComplianceSummaryChecklist
1. ManagementSystemoftankincludesallelementspresentedinSection1,MSCheck-list?
Yes No
2. Ariskassessmenthasbeenconductedandproperlydocumented,andtheassessment´sresidualriskisacceptabletoresponsiblestakeholders?
Yes No
3. DatacollectionandtankconfigurationhasbeenconductedinaccordancewithSection3,TOChecklist?
Yes No
3a. Datarequiredfortheassessmentoftankhasbeenproperlycollected? Yes No
3b. ThetankiswithinthescopeofAPI2350? Yes No
3c. ThetankhasbeencategorizedinaccordancewithAPI2350? Yes No
Ifyes,thespecifictankiscategorizedas: Cat.1 Cat.2 Cat.3
3d. Thetankfulfillstheequipmentrequirementsforselectedcategory? Yes No
ATGSystemcompliantwithAPI2350? N/a Yes No
IOPSystemcompliantwithAPI2350? N/a Yes No
3e. LevelsofConcern(CH,HHandMW)havebeenestablishedinaccordancewithAPI2350?
Yes No
Ifalloftheanswersareequaltoyes,thenthetankiscompliantwithAPI2350Edi-tion4.
IstankcompliantwithAPI2350Edition4? Yes No
RESET
XXVIII
XXIX
C.FrequentlyAskedQuestions
Who should care about API 2350?Thepurposeofthestandardistocoverminimumoverfill(anddamage)preventionpracticesforabovegroundstoragetanksinpetroleumfacilities,includingrefineries,marketingterminals,bulkplants,andpipelineterminalsthatreceiveflammableandcombustibleliquids.Thestandardassistsowner/operatorsandoperatingpersonnelinthepreventionoftankoverfillsbyimplementationofacomprehensiveoverfillpreventionprocess(OPP).Thegoalistoreceiveproductintotheintendedstoragetankwithoutoverfillorlossofcontainment.Anybodyinvolvedinthisprocessbenefitsfromunderstandingandapplyingthisstandard,rangingfromtankowner/operators,operatingandmaintenancepersonnel,transporters,engineering,safetystaff,suppliers,andgovernmentofficials,justtomentionafew.
What’s the scope of API 2350?API2350isintendedforstoragetanksassociatedwithmarketing,refining,pipelineandterminalscontainingClassIorClassIIpetroleumliquids.UseofthestandardisrecommendedforClassIIIpetroleumliquids.API2350doesnotapplyto:• undergroundstoragetanks;• abovegroundtanksof1320USgallons(5000liters)orless;• abovegroundtankswhichcomplywithPEI600;• pressurevessels;• tankscontainingnon-petroleumliquids;• tanksstoringLPGandLNG;• tanksatservicestations;• tanksfilledexclusivelyfromwheeledvehicles(i.e.tanktrucksorrailroadtankcars);and• tankscoveredbyOSHA29CFR1910.119andEPA40CFR68orsimilarregulations.
Why should API 2350 be used and not some other safety standard?API2350isasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Itwascreatedbytheindustryfortheindustry.Awidespectrumofindustryrepresentativesparticipatedinitscreation:tankownersandoperators,transporters,manufacturers,andsafetyexperts,justtomentionafew.Itisacompilationoftheminimumrequirementsrequiredtocomplywithmodernbestpracticesinthisspecificapplication.Obviouslythemainpurposeistopreventoverfills,butanothercommonresultofapplyingthisstandardisincreasedoperationalefficiencyandhighertankutilization.Anditdoesnotcompetewithothermoregenericsafetystandards,butinsteadactsasacomplement.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingsomeoftherequirementsinAPI2350.
XXX
Is API 2350 required by any law?API2350isastandardcreatedbytheindustrycommunity,andnotalegaldocument.However,inmanycasestheapplicablelawsrequiretheoperationtobecompliantwithrecognizedindustrybestpractices.Often,APIpublicationsareusedasthebenchmark,therebyindirectlyreferencingtoAPI2350incaseoftankoverfills.ItishoweverimportanttorecognizethatAPI2350doesnotsupersedeanylocal,stateorfederallawsandregulations,whichalwaysmustbetakenintoconsideration.
What’s the difference between API 2350 and 61508/61511?IEC61508/615011aregenericsafetystandardsdescribingtheuseofsafetyinstrumentedsystems(SIS).API2350ontheotherhandisasafetystandardforaspecificuse-case(overfillprevention)inaspecificapplication(non-pressurizedabovegroundlargepetroleumstoragetanks).Thesetwostandardsdonotcompetewitheachother,butinsteadactascomplements,withmanysimilarities.UsingSafetyInstrumentedSystems(SIS)designedinaccordancewithIEC61511isforexampleonewayoffulfillingmanyoftherequirementsinAPI2350.
Is API 2350 applicable outside the US?Tankoperationsaresimilaracrosstheworld,andmanycompaniesoperateinamultinationalenvironment.API2350,despitethereferenceto‘America’,hasbeenwrittenfromaninternationalperspective.Itisintendedtobeequallyvalidandapplicableworldwide.
Where can I get API 2350?Thestandardcanbedownloadedfromwww.api.orgforasmallfee.
What does API 2350 say about Wireless communication?AccordingtoAPI2350,theuseofwirelesscommunicationisacceptable,exceptforonespecificuse-case:“AOPSshallnotrelyonwirelesscommunicationtoinitiatediversionorterminationofreceipt”(AnnexA).InAOPS,wiredandwirelesscommunicationcanhoweverbeusedsimultaneously,ifthewirelesslinkisusedfordeviceanddiagnosticsmonitoring,andnottoinitiatediversionorterminationofreceipt.
XXXI
D.AbouttheAuthors
Phil E. Myers, API 2350 Committee Chairman
PhilE.MyershaschairednumeroustaskgroupsfortheAmericanPetroleumInstitute,includingAPI2350.Currently,heisthedirectorofPEMYConsulting.HehasalsoworkedatChevronCorporationwherehewasamechanicalintegrityspecialistfortanks,pipingandpressurevesselsspecializinginsafetyandrisk.MyersholdsaBScinChemicalEngineeringfromUCBerkeleyandanMScinTheoreticalandAppliedStatisticsfromCaliforniaStateUniversity.
Carl-Johan Roos, Emerson Safety Expert
Carl-Johan“CJ”Rooshasover10yearsofglobalexperiencefromvarioustechnicalandmanagerialpositionsintheprocess-andtankgaugingindustry.BesidesAPI2350hehasactivelyparticipatedinnumerousproductspecificIEC61508-CertificationsandsitespecificIEC61511-relatedprojects,besideshisusualworkasbusinessdevelopmentmanageratEmerson’sProcessLeveldivisionwhereheoftenaddressesnationaloverfillpreventionregulationsuchasTÜV/DIBtWHGinGermany.RooshasaMScinElectricalandComputerEngineeringfromGeorgiaTechandChalmersUniversity,andaMBAfromtheUniversityofGothenburg.
Global Headquarters and Europe Regional OfficeTank GaugingEmerson Process ManagementBox150(Visitingaddress:Layoutvägen1)SE-43523Mö[email protected]
North America Regional OfficeTank GaugingEmerson Process Management6005RogerdaleRoadMailStopNC136Houston,TX77072,[email protected]
Latin America Regional OfficeEmerson Process Management1300ConcordTerrace,Suite400Sunrise,Florida,33323,[email protected]
Asia Pacific Regional OfficeEmerson Process Management Asia Pacific Pte Ltd1PandanCrescentSingapore128461+6567778211+6567770947Specialist-OneLevel.RTM-AP@emerson.com
Middle East and Africa Regional OfficeTank GaugingEmerson Process ManagementP.O.Box20048ManamaBahrain+97317226610+97317227771rtgmea.sales@emerson.com
StandardTermsandConditionsofSalecanbefoundat:www.Emerson.com/en-us/pages/Terms-of-Use.aspxTheEmersonlogoisatrademarkandservicemarkofEmersonElectricCo.TankMaster,TankRadar,RosemountandRosemountlogotypearetrademarksofEmersonProcessManagement.Allothermarksarethepropertyoftheirrespectiveowners.©2015EmersonProcessManagement.Allrightsreserved.
The Complete Guide to API 2350 00821-0100-5100,RevCA November2015
EmersonProcess.com/Rosemount
Linkedin.com/company/Emerson-Process-Management
Twitter.com/Rosemount_News
Facebook.com/Rosemount
Youtube.com/user/RosemountMeasurement
Google.com/+RosemountMeasurement