Author: Joel L. Andreani, P.E., Senior Vice President of Consulting Engineering, Principle Engineer I
Recent events that involved tank overfills at terminals and resulted in major fires have brought increased scrutiny to the issue of tank overfill. Two of the more infamous incidents occurred in Buncefield in the UK and at the Caribbean Petroleum Corporation (CAPECO) in Puerto Rico.
In the Buncefield incident (December 2005), a petrol tank was being filled when one gauge stuck and an independent high-level system was inoperable. Eventually, the tank overfilled and spilled large quantities of petrol, resulting in a vapor cloud which ignited, causing a massive explosion and a fire that lasted five days. Containment was inadequate and it also failed, resulting in pollutants leaking from the dike, flowing off site, and entering the groundwater.
In the CAPECO incident (October 2009), a five-million-gallon aboveground storage tank (AST) offloading gasoline from a tanker ship was overfilled, and the product flowed into the secondary containments, resulting again in a vapor cloud which ignited. The blast and resulting fires lasted almost three days and damaged more than one-third of the 48 tanks on site and affected neighboring structures, along with soils, nearby wetlands, and navigable waterways. A neighboring military facility suffered more than $5 million in damage.
Investigations followed, and reports by various organizations such as the Control of Major Accidents Hazards (COMAH) Competent Authority in the UK (2011) and the U.S. Chemical Safety Board (CSB) (2015) produced key findings and recommendations that have led to improved standards regarding overfill: Overfill Prevention for Atmospheric Storage Tanks in Petroleum Facilities (ANSI/API 2350) and the UK Health & Safety Executive (HSE) Safety and Environmental Standards for Fuel Storage Sites. Regulatory pressure also followed from groups such as the Department of Transportation (DOT) and the Pipeline and Hazardous Materials Safety Administration (PHSMA).
E2G | The Equity Engineering Group, Inc. has developed best Engineering Practices (EPs), risk assessment tools, and consulting services to assist our clients in the evaluation and improvement of their existing tank overfill prevention systems (OPSs). In this article, we will review the latest (fifth) edition of ANSI/API 2350 and overfill risk assessments and E2G’s offerings.
API 2350 Fifth Edition
In their 2015 report, the CSB concluded:
Despite past incidents in the US and internationally, the response of US industry, trade associations, professional associations, and standard-setting organizations has been inadequate to prevent similar incidents in the US.
In particular, the CSB pointed to inadequacies in NFPA 30 and ANSI/API 2350 stating:
NFPA 30 only requires one layer of protection on storage tanks, at minimum consistent gauging without requirement for an independent or redundant level alarm or an automatic overfill prevention system.
ANSI/API 2350 only requires an automatic overfill prevention system for remotely operated facilities and does not offer substantial guidance on conducting a risk assessment that considers the complexity of site operations, the type of flammable and combustible liquids stored at the facility or proximity to nearby communities when considering the necessary safeguards to protect the public. In addition, there is a lack of one comprehensive industry standard to address tank terminal operations, including tank filling operations and overfill prevention.
Inadequacies in regulations (EPA, OSHA, etc.) and in the International Code Council (ICC) regarding overfill preventions were also noted in the CSB report.
In response to increased scrutiny on tank overfill prevention, ANSI/API 2350 underwent a significant review and update resulting in the publication of the fifth edition in late 2020. API 2350 became a “standard” (ANSI/API 2350) with the fourth edition while prior versions (pre-2005 through the third edition) were recommended practices (RPs). Generally, RPs have less acceptance in the regulatory world. In terms of regulatory response, DOT/PHMSA has recognized the fifth edition of ANSI/API 2350. Additional regulatory response may be forthcoming.
ANSI/API 2350 scope includes ASTs associated with refining, marketing, pipelines, and terminals that contain NFPA Class I and Class II liquids, with a few exceptions. Sites that have tanks other than, or including, DOT/PHSMA regulated tanks may decide to apply many of the same principles found in the Standard to all their storage tanks as a best practice.
In the fifth edition, some of the main changes included:
- Expansion of requirements in the body of the Standard, including the addition of a Category “0”
- The revision of Annex E on Risk Assessment to be more robust
- The addition of annexes on Transporter/Owner/Operator Interface (Annex F), Tank Categories (Annex G), and Proof Testing (Annex H)
- The change in status of Annex A on Automated Overfill Prevention Systems (AOPS) from Informative to Normative
These revisions addressed many of the issues reported by the CSB, specifically in terms of requirements for minimum response time, attendance, instrumentation, alarm systems, and monitoring. The new Category “0,” added to the previous three categories, covers tanks manually or hand gauged.
ANSI/API 2350 Risk Assessments
As mentioned, the CSB concluded that:
ANSI/API 2350…does not offer substantial guidance on conducting a risk assessment that considers the complexity of site operations.
The substantial revision of Annex E of ANSI/API 2350 addressed this criticism. The expanded content in Annex E focuses on the components and procedures that might be used in a risk assessment and provides references to industry-accepted risk analysis techniques.
Risk assessments generally involve the evaluation of likelihood (probability) of failure and consequence of failure. These are combined to determine a risk magnitude, as follows:
Risk = Probability × Consequence
Risk assessments can range from qualitative to quantitative, with the term semi-quantitative often used for a process somewhere between the two ends of this range. Frequently, results of a risk assessment of many assets are displayed on a risk matrix. An example from ANSI/API 2350 is shown in Figure 2.
Note: The lower left green area identified as “Higher Risk” is a typographical error in ANSI/API 2350. This should read “Low Risk” or “Lower Risk.”
E2G recommends that a qualitative or semi-quantitative procedure be used first to screen a larger population of tanks to determine those highest risk tanks that require a more rigorous risk assessment, or a deeper dive.
The basic risk assessment process has three steps (Figure 3). The first step may also include this initial screening or prioritization before a more detailed risk assessment.
After determination of risk, the analyst would compare the risk of each tank against some acceptable risk level (target) and ultimately determine the need for risk reduction involving such things as increased attendance, revised procedures, additional or upgraded hardware (and software), upgraded secondary (and tertiary) containment, etc.
Qualitative Risk Assessments
In many cases, E2G will utilize a qualitative risk analysis to screen or prioritize large tank populations for additional risk assessments. A qualitative assessment uses a team of experts whose make judgements (subjective) on the various factors that affect risk, such as:
- Frequency of fill
- Rate of fill
- Complexity of operations
- Management systems
- Monitoring methods
- Safeguards
- Emergency response
E2G has developed a qualitative overfill risk tool that we use to do this initial risk screening (Figure 4).
In Figure 4, Tank 3293, as part of a large tank population, is considered a medium-risk tank. However, if there were higher-risk tanks in the population, these tanks would be prioritized higher than Tank 3293 for additional risk evaluation or risk reduction.
Semi-Quantitative and Quantitative Risk Assessments
One disadvantage of a qualitative risk assessment is consistency or repeatability. Additionally, the expertise of the team involved in the qualitative assessment is key in the performance of a qualitative risk assessment. A more consistent approach to risk assessment is a quantitative or semi-quantitative approach. E2G has developed a semi-quantitative tool that we can also use to perform initial screening or prioritization of tank risk. This procedure uses similar considerations to those identified for the qualitative process but provides more quantitative ranking of the tanks in a large population.
When Tank 3293, and the remaining tank population, are evaluated using this semi-quantitative procedure, it results in a numeric or more quantitative ranking of risk. The semi-quantitative risk “score” for Tank 3293 is 78 (Figure 5). In a small sample of a tank population, the scores for four tanks are also shown in Figure 5. These scores range from -91 (Low Risk) to 110 (High Risk). In this sample, Tank 3294 would certainly be identified for further risk assessment or risk reduction. It is likely that Tank 3293, with a medium-high score, would also be evaluated further.
In terms of further risk evaluation, more rigorous quantitative risk calculations, Layer of Protection Analysis (LOPA), or other methods could be used. The method in API 353 Managing Systems Integrity of Terminal and Tank Facilities looks at the probability in terms of a generic or base frequency of occurrence (overfills per year). In API 353, this generic probability of overfill is:
10-4 events per AST fill / year / AST
The total API 353 probability of tank overfills is this generic event rate factored by four additional modifiers (MF). These include Quality of Management Systems (MFQuality), Level Gauging MFLevel Gauging), Automated Shutdown (MFAuto Shut), and Attendance (MFAttend), or the total probability is:
10-4 per fill × No. Fills × MFQuality × MFLevel Gauging × MFAuto Shut × MFAttend
The range of each factor is shown below:
These factors can reduce the generic overfill rate by as much as a factor of 0.0045 or increase the rate by as much as a factor of 8.0.
From a consequence, API 353 provides some insight into the various consequences of a tank release (leak, spill, overfill). API 581 Risk-based Inspection Methodology provides a more in-depth look at consequences of tank and other fixed equipment asset releases. Some of these main consequence considerations are:
- Volume spilled (rate x duration)
- Properties of the product (flammability, hydraulic conductivity, etc.)
- Properties of the surrounding soil (related to permeability)
- Secondary (and tertiary) containment
- Proximity to other assets
- Proximity to population
- Proximity of surface water
Figure 6 (Figure 6.1 from API 581 Part 3) is often used to represent the potential areas affected by a tank release. Certainly, the paths shown for some of the release scenarios (to Subsurface Soil #4 or Ground Water #5) are intended to represent scenarios related to bottom leaks. These would not likely be areas impacted to a great extent by overfills. However, the other release locations shown (the dike and surrounding areas) may be impacted by overfill. Once product is in the dike and surrounding areas, the consequences considered include environmental damage, fires, vapor cloud explosions, and subsequent impacts to personnel and adjacent assets. As the Buncefield and Puerto Rico incidents showed, the effects of a single tank overfill can be far-reaching.
One advantage of using the appropriate aspects of the API 581 tank consequence models is that they have been vetted by a consensus standards committee, have been effectively used on numerous RBI assessments, and use much of the same data as API 353 and other quantitative or quantitative risk assessments.
ANSI/API 2350 also mentions other types of risk assessment techniques, such as the use of event and fault trees and LOPA. LOPA also provides a consistent basis for evaluating risk. LOPA will help determine if there are sufficient independent protection layers (IPLs) against various hazards scenarios to meet the acceptable risk target. The IPLs in this case must have specificity (functionality), independence, dependability (reliability), and auditability. Advantages of the use of LOPA include that it conforms to industry standards (e.g., ASNI/API 2350), facilitates the analysis of IPLs that address health and safety, and may also be applied to risks associated with equipment (tank) damage and business interruption. As part of our EPs, E2G has developed procedures for LOPA based on our experience.
E2G Tank Consulting Services:
As a result of some of the more recent incidents mentioned, increased scrutiny and regulatory pressure have come to the area of tank overfill prevention. Likely more regulatory pressure is still to come. As is often the case, proactive actions will help owner/operators get out in front of any regulatory pressure, with the end goal of these efforts, and most asset integrity programs, being improved safety, reliability, and environmental/community stewardship. E2G has developed a full-service approach to tank overfill prevention. Our team consists of SMEs in the areas of storage tanks, instruments & controls, and risk assessment. This team has the expertise needed to support clients evaluating their OPS. We have risk screening tools to help clients prioritize the many tanks in their storage facilities for further risk assessment. When more rigorous risk assessments are needed, our expertise in areas such as risk assessment, LOPA, consequence modeling, and storage tanks can provide these deeper-dive assessments. We have developed and performed deep-dive mechanical integrity (MI) gap assessments to evaluate all MI processes at tank facilities. We have also performed numerous tank RBI assessments and numerous tank fitness-for-service assessments.
E2G stands ready to assist clients looking to evaluate their tank facilities to improve the safety and reliability of these storage facilities for years to come.
For more information on our Tank Overfill Prevention services and other tank consulting services, please contact Joel Andreani by submitting the form below:
