41-188.2 Overfill Prevention

RECOFO MMR A ENPI DARP TIO23 NS50LEVEL INSTRUMENTSFOR TANK OVERFILL PREVENTIONS P E C I A L A P P L I C AT I O N S E R I E S

Tank Overfill Prevention: Recommended Practice for Level ControlExternal Floating RoofTank overfill incidents in recent yearshave resulted in loss of life and billionsof dollars in damages to petroleum facilities worldwide. One of the worst incidents — the overflow of a gasolinestorage tank at Buncefield Oil Depot(U.K.) — has been traced to the failureof level control to maintain containmentof the flammable liquid. More commonare minor spills that cause significantenvironmental impact and result in millions of dollars in clean-up fees and environmental agency fines.In the wake of this incident, the American Petroleum Institute’s (API) Recommended Practice (RP) 2350, the mostwidely accepted guideline for overfillprevention of petroleum storage tanks,has been revised. The fourth editionwas published in May 2012 and combined the prescriptive standards of RP2350 with the functional safety standards of Safety Instrumented Systems(SIS) as described in IEC 61511.Vital to these new requirements is theapplication of level instrumentation asone part of a comprehensive OverfillPrevention Process (OPP).API RP 2350: Key PointsAPPLICABILITY: Above ground storagetanks (ASTs) with capacities greater than1320 gallons (5000 L) that store Class I,II or III flammable or combustible liquids,and that receive liquids from mainlinepipelines or marine vessels.MANAGEMENT SYSTEM: API RP 2350recommends a management systemfocused on overfill prevention. Thissystem should include documentedprocedures for normal and abnormalconditions including safety, emergencyresponse, trained and competentpersonnel, properly maintained andtested OPS, management of changeprocess and incident reporting andinvestigation.INDEPENDENCE: A key feature ofAPI RP 2350 is that the sensors andalarms used for HH tank level or anypart of the AOPS may not be used forroutine tank filling operations. In addition,the HH level sensor on Category 3 tanksmust be independent from all other levelsensors.REQUIRED ALARMS: High-High Alarm(Category 2 and 3) and optionalDiagnostic Alarm (Category 3).EQUIPMENT: Overfill Prevention System(OPS) typically includes an alarm signalsystem and allied support systems—shutdown or diversion valves, communications, sensors, and logic solvers. AnOPS should be on an uninterruptiblepower supply. Use of wireless communication is prohibited by API 2350.REDUNDANCY: A common strategy forcritical level detection is redundancy ofthe sensors. Ideally, redundant sensorswill be of disparate technologies to avoidmultiple failures due to applicationconcerns.PROOF TESTING: All OPS equipmentrequired to terminate receipt must betested annually. The HH sensor andalarm must be tested semi-annually.Method of proof testing must stimulatean overfill situation as closely as possible, but may not require filling the tankabove the maximum working level. Possible methods are manual testing, pushbutton testing, self-diagnostics ordevising a wet probe testing.FLOATING ROOF SENSORS: A sensorused on a floating roof tank must detectthe roof as well as the liquid should itcover the roof.2magnetrol

Tank Categories & Recommended InstrumentationAPI 2350 categorizes storage tanks by the extent to which personnel are in attendance during receiving operations.The overfill prevention methodology is based upon the tank catagory.ATG with High-High Alarm(Automatic Tank Gauge)IndependentHigh-High AlarmControl RoomATG(AutomaticTank Gauge)ControlRoomCategory 1Fully AttendedCategory 2Semi-AttendedCategory 3Unattended Personnel must always be on site duringthe receipt of product, must monitor thereceipt continuously during the first andlast hours, and must verify receipt eachhour. Personnel must be present during theinitial and final 30 minutes of the receipt.The transporter must assist in monitoringthe high-high alarm. Personnel are not required to be presentduring receiving operations but are remotely located at a control center. Thetransporter must monitor both the leveland high-high alarm. Level instrumentation is not required butmay be used. Output will be local only.Alarms may be point or continuous leveldevices. Tanks must be equipped with an Automatic Tank Gauge System (ATGS) thatincludes a high-high alarm and has atransmittable output signal. A single sensor may be used for both level and highhigh alarm. If a separate sensor is usedfor high-high level it may be point or continuous. Tanks must be equipped with an ATGSconsisting of a level sensor and independent high-high sensor. The output of bothinstruments must be transmitted to a control center in “real time”. The level sensorwill be continuous. The high-high level sensor may be continuous or point. Sensorswith self-diagnostics are preferred. The control center has the ability to terminate receipt. The control center has the ability to terminate receipt. In addition, the HH sensormust automatically terminate flow to thetank or alert the transporter to terminatereceipt. Failure of the ATGS must, also,automatically terminate flow. Termination of receipt is done manuallyby site personnel or by the transporter asinstructed by site personnel. Tanks where operator distraction or complex receipt is possible shall not be classified as Category 1.3magnetrol

Levels of Concern (LOCs)Critical HighAOPS ActivationHigh-HighMaximum WorkingMinimum WorkingLevels of Concern are calculated product levels in the tank upon which all alarm and alert positions and response times arebased. Careful calculation of LOCs ensures the success of the OPS.LevelExplanationRequired ActionCritical High Level (CH) - RequiredHighest level before tank damage or productoverflowSpill ManagementEmergency ResponseAutomated Overfill Prevention System (AOPS)Activation Level - Required with AOPSMaximum level at which termination can beautomatically initiated without level reaching CHAOPS ActivationHigh-High (HH) - RequiredMaximum level at which termination can beinitiated manually without level reaching CHAlarm & Shutdown ResponsesMaximum Working Level (MW) RequiredHighest level to which tank may be filled during normal operationNoneMinimum Working Level - OptionalLowest tank level permitted during normaloperationNoneResponse TimeTime required from initiation of termination of receipt to prevent next higher alarm from triggering, based upon communication time, personnel response time, system response time, and safety factors.Minimum High-High (HH) Level Response Time (if not calculated)Category 1Category 2Category 3Time in Minutes: 45Time in Minutes: 30Time in Minutes: 154magnetrol

Roof TypesFixed Roof or Floating Roofwith Instrument WellInternal Floating RoofExternal Floating RoofRecommended Equipment: Eclipse Guided Wave RadarTransmitter Pulsar Radar Transmitter Jupiter Magnetostrictive Transmitter(Orion Instruments ) Echotel Model 961/962 UltrasonicSwitch Model A15 Displacer SwitchRecommended Equipment: Pulsar Radar Transmitter Model A15 Displacer SwitchRecommended Equipment: Pulsar Radar Transmitter Model A15 Displacer SwitchEclipse Pulsar Jupiter Echotel A15 Displacer5magnetrol

Recommended Level SwitchesPoint Level SensorsPoint level sensors actuate at one or more discrete levels. These types of instruments may be used as the HH sensor and maybe of a mechanical or electronic technology. Sensors used on floating roof tanks must detect the roof as well as the liquidshould the roof become submerged. Additional point sensors may be used for additional alarms or alerts as determined by theoperator.Single-Point Top MountBuoyancy Displacer SwitchSingle-Point Echotel Model 961Contact Ultrasound SwitchDual-Point Echotel Model 962Contact Ultrasound Switch Furnished with a non-sparking, hollowshell, brass displacer for dual detectionof both floating roof and liquid levels. Continuous diagnostics of sensor, electronics and electrical noise interference.All the advanced features of the 961 singlepoint level switch, plus: DPDT HH level relay and SPDT dedicated diagnostic alarm relay. Dual point switch for two discrete setpoints. Push buttons for manual testing of leveland diagnostic relays. Allows two set points through a singletank connection. Loop current or relay output. SIL 2 suitable; SFF: 91.5%. Proof-er Manual Check easily verifiesoperation without the need to move tanklevel. Automatic reset of proofer. Retrofit kits available to convert yourmodel A15 from floating roof only to dualdetection as required by API RP 2350. Features “Watchdog Timer.” Metal or plastic sensors. SIL 2 suitable with DPDT switch;SFF: 77.7%. SIL 2 suitable; SFF: 91.4%.6magnetrol

Recommended Level TransmittersContinuous Level SensorsContinuous level sensors output an analog-type signal over a specified range of the tank height. Continous sensors may be usedas the level sensor or as the high-high alarm sensor. Additional continous level sensors may be used to monitor additional alarmor alert points as determined by the tank operator.Eclipse 706Guided Wave Radar TransmitterPulsar Pulse Burst Radar TransmitterJupiter Magnetostrictive Transmitter(Orion Instruments ) Low dielectric media capability. Non-contact technology Continuous diagnostics (electronics,sensor and float). Flexible probe to 100 ft. (30 m). True top-of-probe level detection. 5.8/6.3 GHz operating frequency offerssuperior performance in turbulence,foam, and heavy vapors. Quick connect/disconnect probe. Activiates on roof or liquid if roof sinks. SIL 2 suitable; SFF: 93.0%. Quick connect/disconnect probe. Accuracy: 0.015" (0.38 mm). Repeatability: 0.005" (0.13 mm). 33.3 feet (10 meter) span. SIL 2 suitable (Model 26X); SFF: 90.7%. Continuous self diagnostics.7magnetrol