Tank overlls are a major concern to the petroleum industry. The best case
scenario is that you have to clean it up. The worst case scenario involves
going out of business, and ending up in court. As a response to this, the
industry has worked jointly to create the API Standard 2350: “Overll
Protection for Storage Tanks in Petroleum Facilities”. This standard is
a description of the minimum requirements required to comply with
modern best practices in this specic application. Obviously the main
purpose is to prevent overlls, but another common result of applying this
standard is increased operational efciency and higher tank utilization.
API 2350 was created by the industry for the industry with contributions from a wide range of
industry representatives including: tank owners and operators, transporters, manufacturers, and
safety experts. This together with the fact that it singles out a specic application (non-pressurized
above ground large petroleum storage tanks) and a specic use-case (overll prevention) make this
standard unique. It does not compete with other more generic safety standards, but is intended as
compliment them. Using Safety Instrumented Systems (SIS) designed in accordance with IEC61511
is one example of how to fulll some of the requirements in API 2350.
The industry adoption rate to this standard is expected to be very high because of its obvious
benets, combined with the world’s ever-increasing need for more safety. The question for a tank
owner or operator is whether they can afford not to implement API 2350. Because of the standard’s
generic nature, it is expected to also be applicable to nearby tanks outside the standard’s specic
scope, containing, for example, chemicals or Class 31 petroleum liquids.
Tank operations are similar across the world, and many companies operate in a multinational
environment. API 2350, despite the reference to ‘America’, has been written from an international
perspective. Thus, it is intended to be equally valid and applicable worldwide.
This guide will provide the basic elements needed for a petroleum tank owner/operator to apply the
API 2350 to new or existing tank facilities with minimal effort and maximal gains. You should read it
because this new standard is expected to become a game-changer within overll prevention, and by
reading your company can also reap the benets that come from applying the latest best practices.
The standard itself is available for a small fee from API’s web site (www.api.org).
1
NFPA National Fire Protection Association. Class 1 liquids have flash points below 100°F . Class 2 liquids have flash points at or above 100°F and
below 140°F. Class 3 liquids have flash points above 140°F.
3
Purpose
The target audience for this guide are owners and operators of fuel distribution terminals, reneries,
chemical plants and any other facilities which receive petroleum or chemical products into storage.
Anyone responsible for safe operations at fuel marketing, distribution terminals, reneries, oil
handling, or pipeline companies should take advantage of the state of art in tank overll prevention
that will be discussed in this guide. While the scope of API 2350 applies to the lling of petroleumbased products associated with marketing, rening, pipeline and terminal facilities, its principles
may be applied to any tank operation where there is a risk of overlling the tank.
Most applications under API 2350 involve atmospheric or slightly pressurized tanks, but the
principles of API 2350 can be used for higher pressure storage as well. The scope of API 2350 applies
to overll protection for NFPA2 Class 1 and Class 2 liquids and is also recommended for compliance
regarding Class 3 liquids. The “Scope of API 2350” (see below) presents a more detailed breakdown.
For ammable liquids classied by re codes (Class 1 liquids) API 2350 can mitigate the likelihood
of spilling these hazardous products and the likely resulting facility re. Since spills of non-volatile
organic liquids such as lube oils or heavy asphaltic products are often considered an environmental
hazard, overlls of these products are also addressed by the API 2350 standard.
Scope of API 2350
API 2350 applies to petroleum storage tanks associated with marketing, rening,
pipeline, terminals and similar facilities containing Class I or Class II petroleum liquids.
API 2350 recommends including Class III liquids.
API 2350 does not apply to:
• Underground storage tanks
• Above ground tanks of 1320 US gallons (5000 liters) or less
• Above ground tanks which comply with PEI 600
• Tanks (process tanks or similar ow through tanks) that are integral to a process.
• Tanks containing non-petroleum liquids
• Tanks storing LPG and LNG
• Tanks at Service Stations
• Loading or delivery from wheeled vehicles (such as tank trucks or railroad tank cars)
PEI RP 600 Recommended Practices for Overll Prevention regarding Shop-Fabricated
Above Ground Tanks for overll protection where applicable for above ground tanks
falling outside the scope of API 2350.
2
NFPA National Fire Protection Association. Class 1 liquids have flash points below 100°F . Class 2 liquids have flash points at or above 100°F and
below 140°F. Class 3 liquids have flash points above 140°F.
4
Fifth generation of API 2350
The API 23503 standard applies to lling tanks with petroleum-based products for the purpose
of preventing overlls. The current edition of API 2350 builds on best practices from both the
petroleum industry and from other industries and applies them directly to tank overll protection.
A key and inuential event that shaped later editions of API 2350 was the Bunceeld conagration
arising from a petroleum tank overll at the Hertfordshire Oil Storage Terminal (HOSL) near
Heathrow Airport. On December 11th 2005, the re engulfed 20 tanks resulting in the total
destruction of the terminal and nearby facilities. This re was the worst in Europe since World War II.
The Bunceeld incident was also one of the most intensely studied tank overll events of all time.
Fortunately, the lessons learned from this incident have been captured by the United Kingdom’s
HSE4 in reports5 covering this incident.
API 2350 represents today’s minimum best practices so tank owners and operators can now
prepare for what will undoubtedly be the benchmark for generally recognized good practice in the
petroleum storage business.
Learning from past experiences
The following quote from the United Kingdom’s Health Safety Executive Bunceeld investigation
shows unsurprisingly, that faults in management systems are a key root cause of tank overll
incidents.
“Management systems in place at HOSL relating to tank lling were both decient and
not properly followed, despite the fact that the systems were independently audited. Pressures
on staff had been increasing before the incident. The site was fed by three pipelines, two of which
control room staff had little control over in terms of ow rates and timing of receipt. This meant
that staff did not have sufcient information easily available to them to manage precisely the
storage of incoming fuel. Throughput had increased at the site. This put more pressure on site
management and staff and further degraded their ability to monitor the receipt and storage of
fuel. The pressure on staff was made worse by a lack of engineering support from Head Ofce.”
Unfortunately, the scenarios described above leading to this incident are all too common. But
fortunately, the API Committee developing the new API 2350, fully integrated the lessons learned
from Bunceeld as well as other incidents and combined them with the best practices for tank lling
operations from every sector of the petroleum industry.
The API committee is a consensus-based standards development organization and the current
edition of API 2350 ensures a worldwide perspective on tank overll protection. The worldwide
best practices from different; countries, regulatory agencies, and companies have been studied and
compiled into the API 2350 standard.
3
O verfill Protec tion for Sto rage Tanks in Petroleum Facili ties, ANSI/API St andard 2350-2012, Fif th Edition, September 2020
4
HSE Healt h Safety E xecutive is a governmental safety agency in the United K ingdom responsible for public and wor ker health an d safety
Clearly, the prevention of overlls is a signicant and obvious benet to tank owners/operators.
All tank owners/operators know that protection of the public and workers health and safety, the
environment, and assets are important. But what may not be so obvious to them is that the benets
that can result by applying the latest thinking related to tank overlls. The new management system
practices encouraged by API 2350 may actually improve the normal day-to-day operations and
efciency for a facility.
Tank overlls are relatively rare events so why are these rare events of concern? The reason is that
the consequences of overlls can exceed most, if not all other potential scenarios at a petroleum
facility. While rare, serious incidents usually yield risks to the tank owners/operators that are
deemed unacceptable. The fact that there may be property damages, injuries or even fatalities
is only the beginning of the accident scenario. Liabilities of various kinds can go on for pages as a
review of the Bunceeld incident reports shows. In some cases being forced out of business is the
end result as in the case of Caribbean Petroleum in the Puerto Rico (October 23, 2009) incident.
Other benefits
In addition to reducing liabilities, there are benets impacting overall facility operational efciency
and reliability as mentioned above. Operational improvements in general may result from:
• Simplied and claried response to alarms
• More usable tank capacity (explained later)
• Generalized understanding and use of the Management of Change (MOC) process
• Operator training and qualication
• Inspection, maintenance and testing
• Procedures for normal and abnormal conditions
• Lessons learned used to evolve better operational, maintenance and facility practices
6
Major components of API 2350
The key elements of API 2350 may be considered to comprise the following elements:
• Management System (Overll Prevention Process or OPP)
• Risk Assessment system
• Operating Parameters
– Levels of Concern (LOCs) and Alarms
– Categories
– Response time
– Attendance
• Procedures
• Equipment Systems
The rst two elements are major additions that were absent in previous editions. API 2350 denes
the Management System to be the Overll Prevention Process (OPP). In other words, when you read
or hear the term OPP, just think of the management system concept.
Next, Operating Parameters was a term coined to designate the tank specic data required to use
the standard. These include the Levels of Concern (LOCs) value of important liquid levels such as
Critical High (CH), High High Tank (HH) and Maximum Working Level (MW). Also included are the
Categories of overll protection systems which are designated by the type and conguration of
equipment being used for overll protection. Another operating parameter are the Response Time
(RT) and Attendance. All of these operating parameters are discussed in detail later. They should be
thought of as the data about tank facilities required to use API 2350 efciently.
Finally, the adoption of guidance applicable to Safety Instrumented Systems which can automate
the termination of a receipt in the event that the HH LOC is exceeded. Such systems are sometimes
called “automated safety shutdown systems” or “safety instrumented systems”, but in API 2350
these are called “Automated Overll Protection Systems (AOPS)”.
Management systems
A Management System allows an organization to manage its processes or activities so that its
products or services meet the objectives and terms set. The objectives can vary from; satisfying the
customer’s quality requirements, complying with regulations, or to meet environmental objectives
and management systems often have multiple objectives. Many companies use management
systems to reduce safety, health and environmental incidents to as low a rate as possible, given the
state of the art for business operations best practices today.
API 2350 lines up with the current industry thinking by requiring the application of the Overll
Prevention Process (OPP). OPP is the people and equipment associated with tank lling operations
to maintain an optimally tuned system for high performance without overlls. The inclusion of OPP
is signicant in that the standard is no longer just talking about how to design, operate and maintain
such systems, but is talking about how the company should run its processes and procedures
associated with tank lling operations.
7
Although API 2350 requires a management system for overll prevention and protection, it does
not specify how to develop or implement one. Organizations typically rely upon management
systems that have been developed as a result of serious incidents in the past. These management
systems are relatively common among large and mid size organizations. These organizations
have learned to use these systems to systematically reduce, control and manage incidents as
well as to improve other aspects of their businesses. In order to be effective, these systems must
be integrated into the “corporate culture” and must be t for purpose. Even the simplest of such
systems require lots of time, energy and resources and must be actively supported by the very top
level of the organization. Without top management active support and promotion, there is no hope
for a working management system.
It is recommended that organizations which do not use any form of safety management system
consider development and implementation of a basic, t for purpose safety management system.
Then they ensure that the safety management system incorporates the relevant principles from API
2350. This recommendation is especially important for those companies that are growing or those
that are acquiring other companies in their growth cycle. Any acquisition is potentially high risk until
all of its management systems as well as its equipment systems and operations are integrated.
Risk assessment
API 2350 requires the use of a risk assessment system. Each tank under this standard must have a
risk assessment performed to determine whether risk reduction is required. Risk assessment is a
means of combining the consequence and likelihood of an overll or other accidents, usually for
two purposes. First, a common scale or ranking methodology needs to be applied to the many
different possible accidents or loss scenarios that a facility is exposed to. For example, the risk
of a rogue employee attempting to sabotage a facility is different than the risk of a tank overll.
Without risk assessment there is no rational way to understand which scenario may be worse.
Second, since resources are always scarce, risk assessment, through the risk management process,
allows a company to compare and prioritize these risks for the purpose of allocation of budgets and
resources to mitigate them in such a way that the most serious risks are mitigated rst.
A good starting point for risk assessment resources can be found in IEC 61511-3 Part 3: “Guidance
for the determination of the required safety integrity levels – informative” and IEC/ISO 31010 “Risk
Management – Risk Assessment Techniques.”
8
Implementation
of API 2350
Overview
The primary enabling mechanism that allows adoption of API 2350 is top management endorsement
and support for the safety management system (OPP). This means that formal processes for all of the
elements covered in “Management Systems” (see below) will be documented, created, revised and
formally set into motion using a formal corporate program structure.
Management Systems
Specic Elements of the Management Systems for Overll Prevention
• Formal written operating procedures and practices including safety procedures and
emergency response procedures
• Trained and qualied operating personnel
• Functional equipment systems, tested and maintained by qualied personnel
• Scheduled inspection and maintenance programs for overll instrumentation and
equipment
• Systems to address both normal and abnormal operating conditions
• A management of change (MOC) process which includes personnel and equipment
changes
• A system to identify, investigate, and communicate overll near misses and incidents,
• A system to share lessons learned
• A follow-up system to address any needed mitigation of circumstances leading to near
misses or incidents
• Communication systems protocols within the Owner/Operator organization and between
the Transporter and the Owner/Operator that are designed to function under abnormal as
well as normal conditions
Benets of Management Systems
• Safety and environmental protection
• Optimization of the workplace and operating practices
• Inspection, testing, and maintenance
• Equipment and system selection and installation
• Safe work practices, emergency procedures and training
• Management of change programs relative to tank overll protection
• Inclusion of current technology and practices related to process control and automated
safety instrumented systems
9
Figure 1 (see below) - “Conceptual Management Plan for Implementation of API 2350” - gives the
Data Management
Process and Tank
Database
1)
2)
Risk Assessment
Process
3)
API 2350 Compliant
Configuration
(acceptable configuation)
4)
Gap Assessment5)
Modified Tank Systems
and Configuration with
Acceptable Risks
Compliant with API 2350
8)
Risk Management
Process
6)
Establish Operating
Parameters and Tank Data:
• Tank Category
• LOCs
• Alarms
• Alerts
• Response Time
• Attendance
• AOPS if applicable
• Logic solvers
• Final elements
• Tank details
• Risk data
Project Execution
for Gap Closure
7)
Existing Tank System
Configuation (all tanks)
START
FINISH
Schedulefor Project Execution
overall concept associated with implementation of API 2350. A rst step is setting up a process
for data management associated with the tank overll protection program. The existing tank
conguration must be understood. The tank conguration is the type of instrumentation that the
tank has, its LOCs, alarm and gauging systems and the operating parameters including any relevant
information to the OPP. This means that all relevant data for each tank needs to be collected and
a process for keeping it up to date established. “Risk Considerations for Risk Analysis” (see page
12) examines some of the information considerations needed to establish risk. The database (1)(2)
involves all tanks within scope to be included in the tank overll protection program.
The data will provide information about operating parameters, tank specic information and
any other information relevant to establishing compliance with the standard. While some tank
congurations may have acceptable residual risk others may not. It is only after a risk assessment
process (3) is applied to each tank that the acceptable conguration can be established. Each tank
overll system will then be classied (4) as either compliant or non-compliant with API 2350. In other
10
words, the risk is either acceptable or unacceptable.
The classication results in the ability to do a gap assessment plan (5) which will show what changes
are needed to bring the tanks to/within acceptable risk and into compliance with API 2350.
Once the scale of changes needed to bring the tank system into compliance is understood, a risk
management process (6) can be used to prioritize risks and to determine how much funding is
required to close the gap and make all tanks compliant.
Figure 1: Conceptual Management Plan for Implementation of API 2350
(Note: Diagram shows conceptually how one may approach managing the process of bringing
a population of existing and proposed new tanks for existing facilities into compliance with API
2350)
Risk Considerations for Risk Analysis
Probability or Likelihood Factors
• Frequency, rate and duration of lling
• Systems used to properly measure and size receipts to tanks
• Accurate tank calibration (both strapping and veried Critical High)
• Systems used to monitor receipts
• Extent of monitoring / supervision of manual and automatic tank gauging
• Impact of complexity and operating environment on the ability of Operating
Personnel to execute overll prevention tasks
– Filling multiple tanks simultaneously
– Switching tanks during receipt.
Consequence Factors – Impact of Hazardous Material Release on Vulnerable
Exposures Hazard characteristics of material (product) in tank volatility,
ammability, dispersion, VCE potential
• Number of people onsite who might be affected by a tank overowing
• Number of people offsite who might be affected by a tank overowing
• Possibility of a tank overowing resulting in (escalation) of hazardous events onsite
or offsite
• Possibility of impact to nearby sensitive environmental receptors
• Physical and chemical properties of product released during overowing
• Maximum potential overll ow rates and duration
Once the risk management process (6) is completed, the project engineering and execution
phases (7) for implementation of changes can begin. Closing the gap will take some time and it is
a fundamental principle of risk management that the worst risks should be reduced rst. The gap
closure plan should be built with this principle in mind. Ultimately, the process aims to keep the
owner/operator compliant to regulations(8).
The process above will also address proposed new tanks that are added to the system. They must
be evaluated to the same criteria and run through the process, but unlike existing tanks they will
normally be built to be compliant during construction.
The project execution phase should, of course, use the Management of Change (MOC) processes
and interact with the data management system to ensure that information in the tank database is
updated when changes are made. More detail on these steps follows.
11
Operating
Parameters
Initialization
Part of the data management process is the determination of what API 2350 calls operating
parameters. Tank owners/operators who adopt API 2350 must establish or validate the tank
operating parameters. These include knowledge about the tank categories, Levels of Concern
(LOCs), alarms, alerts, Automatic Overll Prevention System (AOPS) (if applicable), and attendance
type.
Categories
All tanks must be categorized according to API 2350 as shown in Figure 2 (see below) - “Denition of
Overll Protection System Categories” . The categories are a means of grouping all of the many different
possible tank overll gauging congurations into three broad conguration categories. While the
standard says nothing about which category is “better” we state that given all things equal, the higher
the category number the more reliable is the gauging and alarm system.
12
Figure 2: Definition of Overfill Protection System Categories
Category 0
Category 0 tanks have no ATG available to monitor level movements during lling. Safety
considerations may prohibit manual gauging during product receipt and 30 minutes after lling is
complete (see API 2003). The only overll prevention in a Category 0 system comes from planning
receipts less than the available volume. Category 0 tanks shall be operated as a locally monitored
facility for receipts, with continuous monitoring during the rst hour of receipt, every hour during
the receipt, and continuously during the last hour of the receipt. For a Category 0 tank there are no
remote monitoring capabilities by the transporter for either alarm or level information.
Category I
Category 1 systems require a local level instrument e.g. level gauge or automatic tank gauge with
a local display or readout. Category 1 systems may only be used for a fully attended operation.
Category 1 should not be used where the operator cannot reasonably be expected to focus fully
on termination of the receipt or may be distracted with other duties or responsibilities. Sites where
distractions can occur are those where there are frequent receipts, or the facility or terminal has
complex operations. Addition of an AOPS and/or upgrade to Category 2 or Category 3 tanks should
be considered where the risk does not meet the owner/operator risk criteria.
Category 2
Category 2 systems have the ability to transmit level and alarm information to a centralized or
remote control center. But the alarm is dependent so that an ATG failure can cause total loss of
information about the tank levels as well as the alarms. Category 2 systems have no redundancy
and so should only be used if the failure rate of the ATG and level system is extremely low (i.e. the
best possible technology available). Category 2 is permitted only for attended and semi-attended
facilities. Category 2 tanks shall be operated as semi-attended or fully attended tanks. At a
minimum, personnel shall be at the facility with tanks at the rst and last 30 minutes of a receipt and
transfer operation (start denoted by the ow of product, last denoted by termination of ow).
Category 3
Category 3 systems are like Category 2 systems but are characterized by having an independent
alarm. Category 3 systems are considered the best available conguration and technology for
tank lling operations and alarm systems. They may be used at a facility which is attended, semiattended or unattended. The independent LAHH instrument (either a point level or continuous level
device) may be connected to a second ATG, the common alarm system, or the SCADA system only if
these other systems are electrically supervised and provide diagnostic alarms to the transporter.
Automatic Overfill Prevention System (AOPS)
Note that AOPS is a system which is independent of the Basic Process Control System (BPCS). The
AOPS in Figure 2 (page 17) can be combined with any of the categories, however, in most cases, it
would make sense to combine it with either a Category 2 or 3 overll prevention system.
Other Configurations
API 2350 makes a broad classication of systems but cannot cover all cases. For example, some tank
owners/operators use 2 ATGs instead of a single ATG and point-level alarm. These congurations
should be considered Category 3 since this conguration is used in the same way as a Category 3
system. However, it is more robust because of the extra level information available. For example,
13
Figure 3: API 2350 Tank Levels of Concern (LOCs) – Category 2 and 3 Configurations
a dual ATG system cannot only alarm at HH but on a variation between the two ATGs providing
another dimension of reliability.
API 2350 cannot cover all different cases and in those cases the standard could nevertheless be used
as a guide. Alternate solutions than those that are recommended in this guide can be approved if
they are better and more safe that what is suggested in the standard.
Levels of Concern (LOCs)
LOCs are theoretical levels. That is, they do not have to have equipment associated with them. They
are just liquid level positions that are recorded in the operators documentation such as in strap
tables, in the control room displays or procedures.
Critical High
For example, let us start with the highest LOC. This is the liquid level at which an overow or damage
can occur and it is called the Critical High (CH). See Figure 3 above. Note that there is no equipment
related to tank gauging placed at this level.
14
6
National Fire Protection Association 30 Flammable and Combustible Liquids
High High
Moving down to the next LOC we have High High (HH). This is the alarm for high level. It is also the
only alarm required by API 2350. Currently, most operators use both a High and High High alarm.
API 2350 requires only one alarm. An “alert” may be used instead of the High alarm if desired.
Having said this, one specic reason to stick with the earlier method of two alarms may be due to
the unreliability of the alarm sensors. If they are not highly reliable, then the second sensor gives the
operator a “second chance” by still alarming even though one of the sensors has failed.
This improved reliability was introduced into the tank business in previous editions of API 2350 as
well as the NFPA6 30 Fire Code which used the concept of redundancy of sensor systems.
However, using the highly reliable sensors that are on the market today, a single high reliability
alarm can be better than two unreliable alarms and so only one alarm is needed and required. The
decision to take advantage of the one-alarm requirement should be based on many factors, but
perhaps, most importantly, on a formal management of change for the tank overll systems.
Maximum Working (MW) Level
Moving down again, the MW level may or may not have any level sensors. An alert may be used at
this level if the operator chooses.
Automated Overfill Protection System (AOPS) Level
If an AOPS is applied then it will be set at or above the HH. The level at which the AOPS is set is called
the AOPS level.
Updating and Management of Change (MOC)
According to the OPP the LOCs must be periodically reviewed and updated. An MOC shall be used
whenever changes such as those listed in “Some Management of Change (MOC) Triggers” (see
below) occur.
Some Management of Change (MOC) Triggers
Tank Modications That Trigger MOC
• New tank
• Change in oating roof tank seals
• Installation of geodesic domes or other kinds of xed roofs (e.g. when external oating roof
tanks receive retrot covers).
• New internal or external oating roof
• Side vent changes
• Shell extensions
• New tank bottom
• Addition of ancillary equipment such as foam chambers
• Recalibration or re-strapping of the tank
• Change of tank gauging equipment
• Addition of a gauge tube with datum or change in datum/strike plate
15
Operating Changes Trigger MOC
• Change in product
• Change in incoming or outgoing lines
• Change in ow rates,
• Change in service if it impacts structural integrity (corrosion, temporary repairs, etc.)
• Change in operations, such as: parallel tank, oating or high suction, continuous mixer
operation
• Change in response time resulting from stafng, operation or equipment changes
Attendance
Tanks facilities are grouped according to whether assigned personnel are on the premises
continuously during the entire receipt operation (fully attended), on the premises just during the
beginning and ending of the receipt (semi-attended) or not present during any part of the receipt
(unattended). The tank owner/operator must ensure that the facility operation is consistent with this
denition so that the correct category of tank described next can be assigned to these attendance
levels. Table 1 (see below) - “Monitoring Product Receipt” - presents attendance requirements for