3 - API 2350 and 4 - Overfill Prevention

Products Solutions Services
API 2350 4th edition- how to apply on your site?
Overfill protection for storage tanks in petroleum facilities

Aboveground storage tanks
Only a safe plant is

economical
Slide 1 07/19/2016 Ngo – Consult AG Sales Support

API2350 - how to apply on your site?
Definition
• In recent years, accidents caused by tank overfilling, have resulted in loss of

life and the loss of millions of dollars in damages to facilities worldwide.
• Although the loss in assets and the costs for compensation are high,
companies struggle mainly with damage to image: thus the emphasis on
reliability, safety and accident prevention has never been greater than today.
• An Overfill Prevention System is a facility to detect, indicate and prevent the

fluid level in storage tanks rising up to a hazardous overflow.
• Because of prescription or best practice, safety relevant tasks such as overfill

prevention are usually covered by systems operating independently of the
process control.
• Today, Safety Integrity Levels (SIL) are often used to achieve a legally binding
level of risk reduction in an easily comprehensible process.

Background
Accidents caused by tank overfilling

Buncefield, UK
• In the early hours of Sunday 11th December 2005, a number of explosions

occurred at Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire.

Buncefield, UK
“Although the failure of the level measurement was apparent, the operating
personnel took no action.”
• TOTAL has been found liable. The judgment leaves the company facing
damages claims of around £700 million.

Cataño oil refinery fire, Puerto Rico
• The fire began with an explosion at 12:23 am on 23th October 2009 at the
Caribbean Petroleum Corporation oil refinery and oil depot in Bayamón,
Puerto Rico and burnt for 2 days

Cataño oil refinery fire, Puerto Rico
Officials in Puerto Rico ordered the evacuation of a whole neighborhood near

San Juan (1,500 people) after the explosion triggered a major fire. The blast
was measured at a strength of a 2.8 magnitude quake.
In 2010, Caribbean Petroleum Corporation filed for bankruptcy. The company

cited debts of $500 million to $1 billion after the incident.

Port of Santos, Brazil
• The fire at Latin America’s largest fuel tank storage facility near the port of
Santos, Brazil burnt for 8 days and cost millions. Eighteen people were
treated for injuries.

But not only…
• Hundreds of tank spills happen every day generating costs of billions

of dollars each year.
• It is estimated that the number of oil spills exceeds 100’000 spills
each year worldwide.
• Statistically an overfill incident occurs after 3,300 filling operations.
A group of 14 tanks with 2 filling operations per tank and month
(=336 filling operations) would have one overfill every 10 years!

API 2350 3rd edition (2005) – independence required !!!
• overfill protection for storage tanks in petroleum facilities
• C.1.2 […]overflow protection systems shall be independent

of any tank gauging device or system. […]
• A.5.3 […] independent level switches must be installed for
single and two-stage level detector systems. [...]
• [… ] Tanks equipped with a high-level detection device that
is independent of any tank gauging equipment. […]

API 2350 4th edition (2012) Categories
Control center
ATG
Category 1
Display
ATG
Receipt
Category 2
Alarm
ATG LAHH Receipt
Category 3 Alarm

Control center
ATG
Category 1
Display
Fully attended
ATG
(min.
Category 2 1h at the start + min. 1h after the
Receipt
Alarm
end + periodically visual check on site)
Be aware: no manual hand dipping during
ATG LAHH
product receipt and until at least 30 Receipt
min
Category 3
after a product receipt! Alarm

Control center
ATG
Category 1 Semi-attended
(min. 30 min at the start +Display
min. 30 min after the end)
ATG
Receipt
Category 2
Alarm
ATG LAHH Receipt
Category 3 Alarm


Control center
ATG
Category 1
Display
Unattended (ATG and independent level alarm high-high
sensor)
ATG
Receipt
Category 2
Alarm
ATG LAHH Receipt
Category 3 Alarm

Typically Category 1 tank only 1 transfer at one time
Category 1 Category 2 Category 3

Typically 1 Multiple tanks Multiple tanks
transfer at one can be filled can be filled
time simultaneously simultaneously

Control center
ATG
Category 1
Display
ATG
Receipt
Category 2
Alarm
ATG LAHH Receipt
Category 3 Alarm

Definition of AOPS and MOPS
• AOPS: An overfill prevention system not requiring the intervention of

operating personnel to function
• MOPS: Manual overfill prevention system that depends on the

interaction of operating personnel to terminate the receipt. A person
physically turning a valve or pushing a button that remotely closes a
valve or turns off a pump are both manual operations. In MOPS, the
alerts and alarms provide the operating personnel with information
only.
AOPS can be added to all three categories

If necessary, add AOPS on all categories
Control center
ATG
Category 1 AOPS
Display
Logic Solver
ATG Receipt
Alarm
Category 2
AOPS
Logic Solver
ATG LAHH Receipt
Alarm
Category 3 AOPS
Logic Solver

Overfill prevention is best achieved by use of AOPS
Section 4.1.1. of API2350

• Prevention of tank overfills is best achieved by:
• A) Awareness of available tank capacity and inventory;
• B) Careful monitoring and control of product movement;
• C) Use of reliable instrumentation, sensors and systems; and
• D) use of automatic overfill prevention systems (AOPS) where deemed
appropriate by a risk assessment and risk-based analysis.

API 2350 (2012) independence of AOPS from the ATG
• AOPS: to use automated overfill prevention system (instrument,

sensor, logic solvers and final element) you should follow Annex A
(existing site).
• Annex A is clearly requesting independence from the ATG.
• Annex A states, that sensors with self testing diagnostic features
are preferred.

API 2350 4th edition (2012): Annex A, which is normative
Annex A provides good practices for implementation of an automated

overfill prevention system (AOPS) for existing tank systems.
Annex A.3 Independence

The term “independent” means that the AOPS shall be separate from
any device or method used to measure, calculate or monitor tank
receipts.
The independent AOPS shall be designed and installed such that no
fault in the ATG gauging and monitoring system is capable of causing a
fault in the AOPS.
Annex A.4.2 Sensors

Sensors with self testing diagnostic features are preferred for all AOPS
tank level detection applications

Competition: 2 in 1 feature?
• Competitor claims to have two redundant electronic boards in one

radar/device, but they are still using the same/one antenna.
• This is not allowed by API2350 for an AOPS
• What happens, if moisture/water is in the electronic compartment

or having water built-up in the antenna?
• What happens, if the radar beam is not reflected (e.g. liquid is
boiling, obstacles in the radar beam)?
• What happens, if cables breaks?

High-High tank response time
• The high-high tank response time is the period of time required to

terminate the receipt of flow to a tank in response to reaching the
high-high tank level in order not to reach the critical high level.
Minimum High-High Tank (HH) Level Response Time

(if not calculated)
Category Time in Minutes
1 45
2 30
3 15

Different maximum working levels due to different
minimum level response time (if not calculated)

CH CH CH
HH
MW
Best tank capacity utilization

with AOPS

Best capacity utilization with AOPS system.

CH CH CH
AOPS=HH
MW

API2350 relation to IEC 61511
AOPS for new sites: follow ANSI/ISA 84.00.01-2004 (IEC 61511

modified)
1. Generic standard 2. Application standard
Valid for all relevant sectors Implementation for Process industries
Safety
IEC 61508 Regulations IEC 61511
ISA 84
Supplier and System

manufacturers integrator/
Operator/User
Common Target - Plant Safety!

Layers of protection
Plant emergency response Emergency response

layer
Mitigation
Embankment Passive protection layer
Relief valve, rupture disk, F+G Active protection layer

system
Safety instrumented system Emergency Isolated protection layer
Shutdown Trip level alarm
Alarm & operator intervention “Wild” Process control layer

Prevention
process
Basic process control system or Normal Process control layer
DCS process
Plant and process design Inherent safe plant
design

Overfill prevention process (OPP) in API2350 4th Edition
• Overfill prevention process (OPP) consists of …

• A) management system
• B) risk assessment system
• C) defining operational parameters
• D) requirements for procedures
• E) equipment systems

Wireless communication is not allowed
• Annex A.3
• “Correct operation of the AOPS shall not require communications to or
from any location remote from the facility where the AOPS has been
installed. AOPS shall not rely on wireless communication to initiate
diversion or termination of receipt.”

Key points of API 2350 4th Edition 2012:
• Above ground storage tanks

• Introduction of Tank Category 1, 2, 3
• Differences between AOPS and MOPS
• Independence of AOPS
• AOPS for new sites
• follow ANSI/ISA 84.00.01-2004 (IEC 61511 modified)
• Overfill Prevention Process
• Proof testing
• A HHLA sensor on a floating roof tank have to detect the oil, even if it
is above floating roof.
• No wireless communication for AOPS

Where can you get the complete standard API2350?
The standard itself is available for about 120 USD from the website of
API (www.api.org)

Fixed roof solutions

Functional Safety Proof testing Mounting
• IEC 61508 design • Push button

Top
• Proven in use activated test adjustable
• Suitable for SIL 2 / 3 generator
• Discrete output (relays)
Tuning • High proof test Side Top
or 4..20 mA output
Fork coverage
• Proven in use • By proof test

• Suitable for SIL 2/3 Top
• Internal redundancy (EOP) simulation
Radar
• Analogue output (4-20 mA)• Proof test
• Switching in safety coverage
system or RMA422 depends on
inspection depth

(External) floating roof failure scenarios

Snow cover Damaged deck Lost deck
• May lead to lost echo • May lead to lost and • May lead to some
Free deflected echo switch point
• Fails Safe
space deviation (up to
depending on deck
Radar 100 mm)
position • No failure
• Fails Safe
• No Failure • No failure
• No Failure
Tuning
Fork

Overfill Prevention System: SOP600
Launch Presentation
Slide 1 04/06/2016 PCPS / AE / MWO

Overfill Preventions System SOP600
Introduction
A safe and reliable solution to prevent hazardous overflow in tanks
↙
Industry Effects – A New Focus on Standards

• Buncefield Report Recommendations
on the design and operation of fuel
storage sites” Major Incident
Investigation Board (MIIB)
• American Petroleum Institute’s (API)

Recommended Practice RP2350
“Overfill Protection for Storage
Tanks in Petroleum Facilities”
• Standard IEC 61511: “Functional

safety - Safety instrumented
systems for the process industry
sector”
↙
Industry Effects – Buncefield Report



sector”
↙
Industry Effects – Buncefield Report
↙
Industry Effects – API 2350 Overfill Protection



sector”
↙
Industry Effects – IEC 61511 Functional safety
↙
Industry Effects – IEC 61511 Functional safety



sector”
↙
WHG ; API2350 and IEC61511
IEC61511
WHG
API2350
↙
General Safety Instrumented System (SIS)
Safety Instrumented System according to SILx
Logic solver
Communication Communication
Sensor Actuator
Process Interface Process Interface
Process
↙
General principle: Overfill Prevention System SOP600
↙
Key system features
• Scalable from 1 to 16 tanks per system

• Certified according IEC 61511 up to SIL3 by
• Compliant to API 2350
• For automated and manually operated systems
• Failsafe High-High Level Alarm detection
• Optional High Level Warning detection
• Integrated automated proof test procedure
• Proof test report printout ability
• Uninterruptible power supply for 30 minutes autarkic operation
• Detailed warning and alarm messages
• Independent signalization of warnings and alarms
↙
Main benefits
• Automated proof test guarantees that the safety instrumented

system functions perfectly. Proof-testing of 16 tanks takes less than
5 minutes.
• Completely independent Safety Instrumented System satisfies the

highest safety standards (according IEC 61508/IEC 61511) and
complies to API 2350
• With the Automated Overfill Prevention System the tank capacity can
be increased without major mechanical upgrades.
• The actuators for emergency shut-down (ESD) can be included in the

overall safety data calculation.
↙
Covering all regulations
↙
Sensors and instrumentation
The selection of sensor and transmitter determines

the achievable safety level:
Suitable for SIL2 complaint overfill prevention system:
• Liquiphant FTL5x or FTL7x with FEL57 and Nivotester
FTL325P*
Suitable for SIL3 complaint overfill prevention system:

• Liquiphant FTL8x with FEL85 and Nivotester FTL825*
• Proof-test can be made for 12 years without the need to

fill up to the Liquiphant fork.
* Nivotesters are included in SOP600!

↙
SOP600
• The cabinet size and layout is dependent on the specific project
↙
User interface
• The two inch character message display

enables the operator to read latest
status information from other side of
the room.
• It shows the latest status message, but

with smart prioritization a new
warning, for example, will not
overwrite an unacknowledged alarm.
• The operator panel with 10 inch touch

display is the main user interface for
operation of the system.
↙
Control cabinet signalization
• Horn for warning indication.

• Orange light for warning indication.
• Green light for overall status good indication.
• Siren for alarm indication.

• Red flashing light for new alarm indication.
• Red light for acknowledged alarm indication.
↙
Power management
• The system provides a redundant and

uninterruptable power supply.
• The UPS battery provides power for

30 minutes operation of the complete
system including sensors.
• To ensure the lifetime of the UPS

battery, the temperature in the cabinet
is measured with a Thermophant.
• The status of the power supplies, the

UPS and the temperature are
monitored.
↙
External field signalization (SIL approved)
• External alarm: flashing light

• The flashing light is monitored by an optical sensor
• External alarm: siren

• Protect your ears! The siren sounds with 105dB at a
distance of 1 meter!
• The siren is monitored by an acoustic sensor
↙
Safety shut-down relay (ESD for AOPS)
• For each tank, there is a 2-channel relay output for

the failsafe shut-off of pumps and valves.
• In the event of a tank related safety alarm, the

related safety relay output opens.
• The safety relay requires a manual reset command.
• The status of the safety relay is monitored.
↙
Emergency shut-down valves
• We can recommend appropriate ESD valves.
• Their safety data can be incorporated into a project specific safety

certificate.
• Pneumatically or hydraulically actuated

• Ball valve or butterfly valve
↙
User interface
Detailed warning and alarm messages support the operator
↙
User interface – Overview page

Message bar shows warning and alarm
messages, changes color dependent on status.
Tank field, shows tank name (user editable)

and changes color dependent on status
The state bar displays the current active user

and the time remaining until next required
proof test.
The button bar contains the navigation and

action buttons. Buttons are visible/not visible
depending on the access rights of the user.
↙
Documentation
The following documents are within the scope of supply for an

Overfill Prevention System:
• Wiring Diagram incl.

- cabinet layout
- part list
• Operating Instructions
• Functional Safety Manual
• Safety Certificates
• Test Reports (optional)
• Safety System Specification
• Data Sheets
↙
Functional safety certificate
↙
Additional support
Additionally the following support can be offered:
• Factory Acceptance Tests (FAT)

• Commissioning support
• Site Acceptance Tests (SAT)
• Safety certification
• Training
• Maintenance contracts
• Service level agreement
• Customized life-cycle management
↙
Time & Efficiency Example: Proof Test
Conventional Proof Test
• Proof Test with dismounting the sensor and testing it outside of the tank or
even with rising the tank level is not only time consuming but also a
potential source of failures.
• In average customers spend 4 man hours per tank with conventional proof
testing methods.
Remote, Automated Proof Test
• The remote automated proof test is done in 5 minutes for 16 tanks.
> This saves more than 60 hours for 16 tanks.
↙
Costs & Economy Example: Increased tank capacity
Tank capacity and flow rates:

• Tank capacity: 1’500m3 with 10 m diameter
• Inlet Flow rate: 90 m3/h
• Volume per cm height : 0.7854m3/cm
• Filling rate: 1.5 m3/min
Compare category 2 tank with automated overfill prevention :

• The maximum working height is 57.3 cm below the critical height for a
category 2 tank with a response time of 30 minutes (minimum).
• With an automated overfill prevention system the response time is less than
1 minute this results in the maximum working height of 1.9cm below the
critical height (minimum 3 inch =7.62cm).
• The tank capacity could be increased by 57.296cm - 7.62cm = 49.676cm
=> 39 m3 => 2.6%
↙
Automated overfill prevention system
↙
CSB safety video on 2009 CAPECO explosion
↙
What is process safety and what does that imply?
↙
Simply explained – Plant safety
↙
Endress Hauser Functional Safety Process Measurement
↙
References
I know that quality is an important asset that I can use to set standards
↙
Installation examples – Overfill Prevention cabinet
↙
Overall status is good…
↙
The safety sensor and the separate tank-gauging system
↙
Flexibility in design - liquid bulk storage
Installation ecamples:
Liquiphant SIL2/3
• Always the first solution.
• Independent High Level Alarms
• Best technology available
Internal floating roofs

and external decks
require installation of
stilling wells or side
mounted chambers
↙
Overfill Prevention System SOP 600
Thank you very much.

3 - API 2350 and 4 - Overfill Prevention

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

3 - API 2350 and 4 - Overfill Prevention

Uploaded by

Copyright:

Available Formats

Products Solutions Services

API 2350 4th edition- how to apply on your site?

Overfill protection for storage tanks in petroleum facilities

Only a safe plant is

Slide 1 07/19/2016 Ngo – Consult AG Sales Support

• In recent years, accidents caused by tank overfilling, have resulted in loss of

• An Overfill Prevention System is a facility to detect, indicate and prevent the

• Because of prescription or best practice, safety relevant tasks such as overfill

Slide 2 07/19/2016 Ngo – Consult AG Sales Support

Accidents caused by tank overfilling

Slide 3 07/19/2016 Ngo – Consult AG Sales Support

• In the early hours of Sunday 11th December 2005, a number of explosions

Slide 4 07/19/2016 Ngo – Consult AG Sales Support

Slide 5 07/19/2016 Ngo – Consult AG Sales Support

Cataño oil refinery fire, Puerto Rico

Slide 6 07/19/2016 Ngo – Consult AG Sales Support

Cataño oil refinery fire, Puerto Rico

Officials in Puerto Rico ordered the evacuation of a whole neighborhood near

In 2010, Caribbean Petroleum Corporation filed for bankruptcy. The company

Slide 7 07/19/2016 Ngo – Consult AG Sales Support

Port of Santos, Brazil

Slide 8 07/19/2016 Ngo – Consult AG Sales Support

But not only…

• Hundreds of tank spills happen every day generating costs of billions

Slide 9 07/19/2016 Ngo – Consult AG Sales Support

API 2350 3rd edition (2005) – independence required !!!

• overfill protection for storage tanks in petroleum facilities

• C.1.2 […]overflow protection systems shall be independent

Slide 10 07/19/2016 Ngo – Consult AG Sales Support

API 2350 4th edition (2012) Categories

ATG LAHH Receipt

Slide 11 07/19/2016 Ngo – Consult AG Sales Support

API 2350 4th edition (2012) Categories

Slide 12 07/19/2016 Ngo – Consult AG Sales Support

API 2350 4th edition (2012) Categories

ATG LAHH Receipt

Slide 13 07/19/2016 Ngo – Consult AG Sales Support

API 2350 4th edition (2012) Categories

ATG LAHH Receipt

Slide 14 07/19/2016 Ngo – Consult AG Sales Support

Typically Category 1 tank only 1 transfer at one time

Category 1 Category 2 Category 3

Slide 15 07/19/2016 Ngo – Consult AG Sales Support

API 2350 4th edition (2012) Categories

ATG LAHH Receipt

Slide 16 07/19/2016 Ngo – Consult AG Sales Support

Definition of AOPS and MOPS

• AOPS: An overfill prevention system not requiring the intervention of

• MOPS: Manual overfill prevention system that depends on the

AOPS can be added to all three categories

Slide 17 07/19/2016 Ngo – Consult AG Sales Support

If necessary, add AOPS on all categories

ATG LAHH Receipt

Slide 18 07/19/2016 Ngo – Consult AG Sales Support

Overfill prevention is best achieved by use of AOPS

Section 4.1.1. of API2350

Slide 19 07/19/2016 Ngo – Consult AG Sales Support

API 2350 (2012) independence of AOPS from the ATG

• AOPS: to use automated overfill prevention system (instrument,

Slide 20 07/19/2016 Ngo – Consult AG Sales Support

API 2350 4th edition (2012): Annex A, which is normative

Annex A provides good practices for implementation of an automated