Safety standard updates aim to strengthen overfill prevention

Author : Johan Sandberg, Emerson

03 January 2023

Failure to prevent overfills in tanks containing hazardous materials can have disastrous consequences. In the worst cases, this can include injuries and even fatalities, as well as catastrophic and costly damage to assets and their surrounding environment. One of the key global safety standards that aims to safeguard against disasters by helping to prevent overfills is API 2350 from the American Petroleum Institute.

Image: Shutterstock

(Click here to view article in digital edition)

API 2350, which was created by a broad range of petroleum industry representatives, is aimed at the owners and operators of refineries, fuel distribution terminals, chemical plants and other facilities where petroleum or chemical products are received into storage. It applies to storage tanks that are above ground; have a capacity of more than 5000 litres (1320 gallons); store class I or II petroleum liquids; and receive liquids from mainline pipelines or marine vessels. The standard is also recommended for compliance regarding class III petroleum liquids.

API 2350 is intended to complement other fundamental safety standards, such as IEC 61511 from the International Electrotechnical Commission, rather than compete with them. Although API 2350 was created in the US, many of its recommendations and guidelines are regarded as generally accepted good engineering practice, and its principles can be applied to any tank operation where there is a risk of an overfill. This has led to it being adopted worldwide and also in applications outside its specific scope, including storage tanks in the chemical industry.

How API 2350 has evolved

The first edition of API 2350 was published in 1987 and the scope of the standard has since been significantly expanded to ensure that it conveys the most up-to-date best practices for tank filling operations. The fifth and most recent edition includes a number of updates aimed at resolving some issues, clarifying certain aspects that were regarded as being open to interpretation, and making the standard more user-friendly, to encourage more successful implementation. Its key areas of focus include management systems, risk assessment systems, defining operational parameters, and procedure requirements supporting overfill prevention, including for automated overfill prevention systems (AOPS).

Management systems

The fifth edition of API 2350 formalises the overfill prevention process (OPP) that must be applied to tank filling operations. The OPP focuses on both the people and equipment required to maintain an optimally tuned system for high performance without overfills. Including the OPP in API 2350 is significant because it means the standard is no longer just referring to the design, operation and maintenance of management systems, but also how organisations should run the processes and procedures associated with tank filling operations.

The updated standard now requires the development and implementation of a safety management system that clearly outlines elements including operating procedures, tank data, alarm setpoints and calibration data. However, it does not provide prescriptive guidance on how this should be achieved, with the onus instead being on organisations to determine what would work best at their site. It is important to state that a lot of time, effort and resources must be spent on even the simplest safety management system. For it to be effective, it must be integrated into an organisation’s corporate culture and actively supported by management and executives.

Image (left): The fifth edition of API 2350 stipulates that category 3 tanks should be equipped with at least one independent overfill alarm in addition to an automatic tank gauge.

Performing risk assessments

API 2350 requires a risk assessment to be performed on all tanks to determine whether risk reduction measures need to be implemented. Such assessments are an essential part of modern overfill prevention strategies because they identify hazards and risks, create awareness of the potential cost of an incident, and determine which layers of protection should be implemented and how they should be designed and managed.

The standard does not prescribe exactly how organisations should perform risk assessments at their facilities, but the fifth edition does provide guidance via three new very informative annexes. These are: Annexe E – An overview of risk assessment techniques; Annexe F – Considerations at the transporter/owner interface (transfers); and Annexe G – categorisations of tanks for risk assessments. This update includes the introduction of a category 0 classification, for tanks with manual hand gauging only. Organisations may choose to use this method of categorisation for risk assessment, which elevates the annexe to become a ‘normative’ requirement as part of the fifth edition.

Tank operating parameters

Organisations adopting API 2350 are required to establish or validate certain tank operating parameters. In the fifth edition, Annexe D provides a detailed approach to determining these parameters, thereby helping organisations to comply with the standard. It outlines several levels of concern (LOC), which are liquid level positions set by an organisation for alerts, alarms and other AOPS functions. Defining these positions correctly for each tank at a facility is a critical aspect of overfill prevention, as it enables potential problems to be identified and action taken before an incident happens.

Image (right): Digital technology available in modern level measurement devices enables proof-testing to now be conducted remotely from the comfort of the control room, thereby increasing worker safety.

The highest of these LOC is the critical high, which is the liquid level at which an overflow can occur if it is exceeded. This is followed by the high-high alarm, for when the level is approaching critical high. High-high is the only alarm required by API 2350, and the AOPS level will be set at or above this point. After this comes the maximum working level, which is the highest level to which a tank can normally be filled. An alert may be used at this level if desired.

The fifth edition of API 2350 requires default minimum response times – in other words, the time required to detect a LOC, trigger an alarm and terminate receipt. These response times vary depending on the category of tank concerned. A liquid level safety margin of no less than 75 millimetres (3 inches) between two LOC – for example, the critical high and the high-high – is also necessary. A further requirement of the fifth edition is that all LOC must be periodically reviewed and updated, in accordance with the OPP. Any changes to LOC should undergo a management of change process, which is part of the overfill management system.

The use of wireless technology

The goal of API 2350 is to make overfill prevention a priority for tank owners and operators, yet it recognises that many facilities lack wiring infrastructure and therefore the high cost of installing wired devices can act as an economic barrier. Although wireless technology is widely deployed for measurement applications in process plants, its use in safety instrumented systems (SIS) is not permitted. However, the fifth edition of the standard points to the use of modern, digital wireless networks as an acceptable means of deploying non-SIS overfill protection layers, if the wireless topology and protocols follow the standards set forth in the Industry Standard Architecture (ISA) technical report ISA-TR84.00.08. This change enables organisations to implement wireless solutions for these applications.

Proof-testing requirements

A large proportion of API 2350 is devoted to procedures that ensure the correct ongoing operation of the equipment or technology used in overfill prevention. This includes proof-testing sensors and systems in the overfill prevention safety loop. The importance of proof-testing cannot be over-emphasised. When tank alerts, alarms or AOPS fail, these failures are for the most part unrevealed and are referred to as dangerous undetected failures. The self-diagnostic functionality available within modern level sensors and automatic tank gauging systems enables the monitoring of many of the failure modes and the output of a diagnostic alarm in such cases. However, no system has a 100% probability of diagnosing system faults, so the only way to ensure that you find all potential dangerous undetected failures is to proof-test the entire safety loop. It is recommended that the proof-testing requirements specified for AOPS are also applied to all alarms.

Johan Sandberg, Emerson

The fifth edition of API 2350 requires all components involved in terminating a receipt to be proof-tested at least annually, unless otherwise supported by a technical justification, such as a probability of failure on demand calculation. Annexe C of the standard discusses various types of sensors, with differing testing procedures associated to each type. In addition, annexe H provides informative considerations when deciding on a proof-testing regime.

Operational benefits

It can be a significant challenge for organisations to adopt and implement processes and procedures according to API 2350. However, it can also help to bring about significant benefits, not just in increasing safety by preventing overfills, but also in day-to-day operations. Operational benefits may result from simplified and clarified alarm responses, increased tank utilisation, improved operator training and qualification, better procedures for both normal and abnormal conditions, and enhanced inspection, maintenance and testing practices.

Complete guide to API 2350 fifth edition

API 2350 fifth edition can be purchased in full from the API website. To support those who would prefer an overview of the standard, Emerson has produced ‘The Complete Guide to API 2350, Fifth Ed.’. The guide, which can be downloaded free of charge at www.Emerson.com/API2350Guide, details the purpose and scope of the standard, its latest revisions, and the benefits of its adoption and implementation.

About the author:

Johan Sandberg is a Senior Business Development Manager for Rosemount tank gauging at Emerson and is based in Gothenburg, Sweden. During his career with Emerson, Johan has gained vast experience in the field of instrumentation, radar-based tank gauging and overfill prevention solutions for the refining and tank storage industries.