Performing a storage tank risk assessment

Figure 1. Facility fire caused by an overflowing storage tank could result in hazardous conditions. Courtesy of Endress+Hauser

What makes a tank overfill uniquely hazardous is that it can generate a deadly vapor cloud, which can flow out far past secondary containment, resulting in a detonation and hazardous conditions for nearby communities. One example that had a major influence on API 2350 is the Buncefield fire in 2005. It led to the current emphasis on overfill prevention in petroleum storage tanks.

It’s important to note at this point that API 2350 is not a regulation that plant owners must conform to, but is instead a recommended standard. But organizations that adopt the processes described in API 2350 will benefit from control of hazards — resulting in reduced exposure to risk, incidents and accidents — and lower insurance premiums and operating expenses.

The new practices urged by API can also improve normal operation and efficiency. Improved operations are the result of specific, clear and actionable procedures that are understandable and accessible to operations personnel. Removing uncertainty at facilities creates less variation in operations, creating an improved process. Efficiency may improve because implementing API 2350 often results in an expansion of usable tank space.

Primary points covered by API 2350 

API 2350 contains a series of recommended practices and procedures, including:

• Implement an overfill prevention process (OPP).
• Apply preventive maintenance practices to overfill prevention system and equipment.
• Develop written procedures for operating under normal, abnormal, startup and shutdown conditions — as well as communications between the supply and receiving companies.
• Define initializing operating parameters for each tank. This covers equipment categories, levels of concern, response times and alarm procedures.
• Implement and maintain a risk assessment system.

Space does not permit a detailed analysis of every provision of API 2350. Conforming to API 2350 does require a detailed risk assessment of storage tanks and comparison to the standard’s recommendations. The following is an example of a high-level risk assessment.

Risk assessment and management

Reducing the risk of an overfill is the main objective of API 2350. Risk assessment is knowing a company’s level of risk, and risk management is acting to reduce it. 

Risk assessment determines the likelihood and consequence of harmful events, but simply knowing the risk level does not help unless those risks can be reduced to an acceptable level, which requires risk management. Proper application of this methodology reduces risk by recommending corrective actions.

Effective risk management assumes that the risk assessment uses a valid approach that is timely, effective, auditable, explainable and practical. To be effective, it is essential to formulate an assessment strategy that ranks and prioritizes risks. 

API 2350 specifically states that a risk assessment must be implemented and maintained, but it does not specify how to do this because risk assessment methods and techniques often vary for each plant or facility. 

Different levels of risk are associated with each tank because the filling rates are different, sensors have differing reliability and other factors that can influence the tanks (see Figure 2). The likelihood of an overfill event requires tank-specific information such as filling rate, installed instrumentation and other data. 

Figure 2. API 2350 defines a properly instrumented and engineered tank. This tank, for example, has an independent overfill protection system, a high-high point level switch and an emergency shutdown valve. Courtesy of Endress+Hauser

There are many ways to perform risk assessments, and each has its pros and cons. Moreover, each company must develop individualized styles and methodologies for executing risk assessments. The risk assessment procedures described in the following section are from the updated Endress+Hauser Risk Analysis Tool. This tool supports and aids an organization’s dual objectives of compliance with best industry practices and the most effective elimination of risk.

Performing a risk assessment

The risk analysis process incorporates the results of data collection, organization, analysis and assessment. For example, specific tank information such as filling rate, previous spills/near misses, operator reliability, implementation of automatic overfill prevention system (AOPS) and gauging system reliability can be compiled and included in the analyzer’s database. In addition to data on size and frequency of events, the severity of various failure modes is also included. For example, the severity of an overfill or spill event may be influenced by the filling rate, the hazard associated with the liquid, proximity to town/city, containment capabilities and early awareness.

The first step is to appoint a team of engineers and operators from the tank farm or an outside agency to perform the risk assessment. This person or team will survey every tank in the plant and assign a risk factor to each one. 

The risk factors are arbitrary. Table 1 shows one potential scenario of numbers, but they can be anything that is meaningful to the plant.

Table 1. Numeric rankings of various factors that can lead to a potential overfill

With the risk factors in mind, the person or team evaluates each tank according to this procedure. The Risk Analysis Tool is separated into three pages: operations grading sheet, likelihood grading sheet and consequence factors grading sheet.

The ideal tank would be outfitted with instrumentation similar to that shown in Figure 2. The assessment person or team may want to designate this condition as ideal and assign risk factors if any instrumentation is missing. At a minimum, a tank should have a high-high limit switch (see Figure 3).

Figure 3. Every tank should have a high-high limit switch, such as this one. Courtesy of Endress+Hauser

Step 1: A tank group is determined — possibly the oldest group of tanks. Each tank is then reviewed for its parameters, operational procedures, emergency response, operator training and all relevant factors influencing risk (such as proximity to town) prior to operating the Risk Analysis Tool. 

Step 2: A grading sheet is provided to grade or score six areas of concern regarding operations. As each of the six areas receives a grade, each grade is also weighted based on the influence or importance of each area. The higher the operational quality score, the less likely it is that a risk event will result from operational failures; the severity is expected to be less, too. If operators are well-trained, have clear procedures, have prepared an emergency response plan, test their level-gauging equipment and independent alarms and carefully plan receipts, then the facility will on-average respond better to risk initiators.

Step 3: The second sheet pertains to both the likelihood and consequence factors related to an overfill event. The likelihood factors are dependent on tank parameters such as the filling rate, flammability of liquid stored, calibration measures and tank category. These graded values are also weighted based on influence and importance.

Step 4: The consequence factors are next. They are dependent on corporate values such as preventing flammability, protecting public perception, environmental protection and the severity due to tank flow rate. The consequence factors are then multiplied by a weight value. 

Step 5: Once each likelihood and consequence factor has been graded by personnel or a tank surveyor, a final score is produced. Obtaining this score is the goal of using the Risk Analysis Tool. If the risk score is high, then there is a high likelihood and severity for a risk event. The tanks with the largest risk scores pose the largest threat to a facility, and these are the tanks that should be addressed first.

Step 6: A summary ranking sheet is created from the various risk factors (see Figure 4). Once each tank is submitted into the ranking sheet, the result will be a bar graph of the risk score for each tank included in the risk analysis. The tanks with the highest risk scores have the highest bars. These high-risk tanks are the most dangerous and most likely tanks to experience an overfill or spill.

Figure 4. Summary bar chart of risk factors for each tank. The tanks on the left have the highest risk of an overspill. Courtesy of Endress+Hauser

The final outputs of this risk analysis spreadsheet are visual and quantitative representations of the risk associated with each tank within the survey. This information empowers companies to allocate funds for preventing risky events in the most effective way possible. Visit endressdirect.us/api for an API 2350 guidebook.

Dean Mallon is the national marketing manager for level products at Endress+Hauser. Previously, he was a regional level product business manager and a rep owner/partner. He serves on various industry committees, including the API 2350 4th and 5th edition working group.