The importance of tank overfill protection

Owners and operators of tanks and wells should make overfill prevention a priority. Obviously, the hazards associated with an overfill vary greatly depending on the product, but any overfill costs money and resources to clean up, especially when surrounding equipment is at risk of damage.

If a tank or well contains hazardous liquids, such as wastewater, chemicals, or petroleum products, then tank overfill prevention is required. The health and safety of employees and the community at large is at risk, not to mention that hazardous spills have many expenses, usually including big fines.

Proper instrumentation and control systems are important, but they alone are not enough. Safety must be a culture woven into the underlying fabric of the corporation. Achieving a culture of safety isn’t easy — it has to start with management and include a well-thought-out methodology.

The American Petroleum Institute has formed such a methodology with the publishing of the newest edition to API 2350. Taking a few pages from this standard can help in implementing an effective tank overfill prevention program.

The blast that rocked an entire industry

While API 2350 has been around since the 1980s, the newest version, edition 4, was not published until last year. Edition 4 was created in response to recent tank overfill disasters in the petroleum industry—the most notable of which was the Buncefield incident.

On Dec. 11, 2005 at about 6 a.m., a massive explosion, originating from an oil storage terminal, rocked the town of Hemel Hempstead, a municipality located outside of London. All of the windows in nearby buildings were blown out, and there were later reports claiming that the blast could be heard in France, Belgium, and the Netherlands. The event measured a 2.4 on the Richter scale, and news agencies described the incident as the biggest explosion in peacetime Europe. Luckily, there were no deaths because the office buildings in the vicinity were mostly empty. However, 43 people were injured, and two seriously.

The explosion took place at one of the tanks at the Hertfordshire Oil Storage Terminal. This initial blast subsequently led to smaller explosions and ultimately resulted in a major fire. It took over two days for crews to put it out.  In all, 20 storage tanks were destroyed.

Soon after the incident, a government investigation reported that the explosion was caused by an overfilling of tank 912 at the Buncefield depot. This overfilling led to a rapid formation of a vapor cloud that was eventually ignited by an unknown source. Investigators concluded that faults in the management system for tank filling were to blame. More specifically, terminal operators had little control over flowrates and timing of receipts, which meant they did not have sufficient information available to them to manage the incoming fuel properly. The companies responsible for the depot were fined millions of pounds.

A different approach to eliminating overfills

Events like the Buncefield incident and others show the importance of tank overfill protection. In fact, the Buncefield explosion, in part, provoked the publication of API 2350 Edition 4.

API 2350 outlines the minimum requirements needed to comply with the latest best practices to prevent tank overfills in petroleum facilities.
Some might ask, "Why should I care if I don’t have a large oil tank?"

It is the approach that API 2350 Edition 4 takes that makes it relevant to any operator of tanks that are at risk of an overfill.

Instead of a standard of strict specifications, like UL or CSA certifications, Edition 4 incorporates a methodology that is comparable to continuous improvement operation standards like Six Sigma. The standard stresses the importance of supporting your tank overfill prevention efforts with a culture of safety and adherence to proper tank management protocol.

Management system

Management systems help organizations reach their objectives through defined processes and activities. They are the written instructions that must be followed by the individuals in an organization. Many companies use management systems to comply with regulations, meet environmental standards, and reduce accidents.
Some common examples of these management systems include Six Sigma and the ISO 9000 family of standards.

The management system now required by API 2350 is referred to as an overfill prevention process (OPP) and includes the following components:

• Formal risk assessment
• Formal written operating procedures and practices including safety and emergency response procedures
• Trained and qualified personnel
• Functional equipment
• Scheduled inspection and maintenance programs for instrumentation
• Systems to address both normal and abnormal conditions
• Management of change process
• A system to deal with overfill near misses and incidents
• A system to share lessons learned

The purpose here is to ensure that management systems are formally integrated into the core of the company’s operations. The investigation into the Buncefield incident specifically referenced that the management systems in place "relating to tank filling were both deficient and not properly followed."

Again, the key to ensuring that the OPP in place is followed is to make it part of the culture of the company or organization. Accomplishing this requires top management play the primary role in endorsing and supporting an OPP. Phil E. Myers, Committee Chairman for API 2350 says it best: "In order to be effective, these systems must be integrated into the ‘corporate culture’ and must be fit for purpose. Even the simplest of such systems require lots of time, energy and resources and must be actively supported by the very top level of the organization. Without top management active support and promotion, there is no hope for a working management system."

What’s in the standard?

To be compliant with the API 2350 standard, certain criteria must be satisfied in order to prove that the risk of overfill has been reduced to an acceptable level.
API 2350 now requires the performance of a risk assessment for each tank by evaluating the likelihood and consequences of an overflow. This enables an organization to prioritize and allocate resources appropriately.

To aid in this effort, the standard requires that each tank be categorized into three groups. This classification process makes it easier to evaluate the existing tank gauging configuration on each tank.

The following is a general overview for each of the categories. While the standard does not state which category is best, it can be presumed that the higher the category, the more reliable the tank gauging system is.

Category 1: In this configuration, all operations are performed manually by a local operator. Basically, this means that an actual person has to be next to the tank to shut the valve during a receipt in order to prevent an overflow. Also, there are no transmittable alarms or equipment to annunciate alarms. So, while there may be tank level gauging equipment installed, it is entirely up to the operator to know when a high level has been reached.

Category 2: In the second category, the tank is equipped with sensors and alarms to notify personnel of a high level. This way operators don’t have to be right by the tank to know if there is a risk of overfill. Furthermore, shutting off the valve no longer requires an operator to be there right next to the tank. Since the sensors and alarms can transmit level information, an operator may be able to cancel a receipt by closing the valve remotely from a control room.

Category 3: The only difference between the second and third categories is that a Category 3 tank is equipped with an independent high-level alarm. This category is theoretically more reliable since it has a backup sensor in case the primary one fails. Just like Category 2, the operator may cancel a receipt from a remote location or locally.

Automatic Overfill Prevention System (AOPS): This final category is separate from the first three categories. The AOPS is never intended to be used on its own, but in addition to one of the other configurations (usually Category 2 or 3). Sometimes AOPS is referred to as Category 4. The advantage to AOPS is that it is capable of executing a shutoff without human intervention.