only a safe plant is economical - endress+hauser products solutions services api 2350 4th edition-...

07/19/2016

Products Solutions Services

API 2350 4th edition- how to apply on your site?

Overfill protection for storage tanks in petroleum facilitiesAboveground storage tanks

Only a safe plant is

economical

Slide 1 Ngo – Consult AG Sales Support

07/19/2016

Definition

• In recent years, accidents caused by tank overfilling, have resulted in loss of life and the loss of millions of dollars in damages to facilities worldwide.

• Although the loss in assets and the costs for compensation are high, companies struggle mainly with damage to image: thus the emphasis on reliability, safety and accident prevention has never been greater than today.

• An Overfill Prevention System is a facility to detect, indicate and prevent the fluid level in storage tanks rising up to a hazardous overflow.

• Because of prescription or best practice, safety relevant tasks such as overfill prevention are usually covered by systems operating independently of the process control.

• Today, Safety Integrity Levels (SIL) are often used to achieve a legally binding level of risk reduction in an easily comprehensible process.

API2350 - how to apply on your site?


07/19/2016

Background

Accidents caused by tank overfilling



07/19/2016

Buncefield, UK


• In the early hours of Sunday 11th December 2005, a number of explosions occurred at Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire.


07/19/2016

Buncefield, UK


“Although the failure of the level measurement was apparent, the operatingpersonnel took no action.”

• TOTAL has been found liable. The judgment leaves the company facing damages claims of around £700 million.


07/19/2016

Cataño oil refinery fire, Puerto Rico


• The fire began with an explosion at 12:23 am on 23th October 2009 at the Caribbean Petroleum Corporation oil refinery and oil depot in Bayamón, Puerto Rico and burnt for 2 days


07/19/2016

Cataño oil refinery fire, Puerto Rico


Officials in Puerto Rico ordered the evacuation of a whole neighborhood near San Juan (1,500 people) after the explosion triggered a major fire. The blast was measured at a strength of a 2.8 magnitude quake.

In 2010, Caribbean Petroleum Corporation filed for bankruptcy. The company cited debts of $500 million to $1 billion after the incident.


07/19/2016

Port of Santos, Brazil


• The fire at Latin America’s largest fuel tank storage facility near the port of Santos, Brazil burnt for 8 days and cost millions. Eighteen people were treated for injuries.


07/19/2016

But not only…

• Hundreds of tank spills happen every day generating costs of billions of dollars each year.

• It is estimated that the number of oil spills exceeds 100’000 spills each year worldwide.

• Statistically an overfill incident occurs after 3,300 filling operations.A group of 14 tanks with 2 filling operations per tank and month (=336 filling operations) would have one overfill every 10 years!



07/19/2016


API 2350 3rd edition (2005) – independence required !!!

• overfill protection for storage tanks in petroleum facilities

• C.1.2 […]overflow protection systems shall be independent of any tank gauging device or system. […]

• A.5.3 […] independent level switches must be installed for single and two-stage level detector systems. [...]

• [… ] Tanks equipped with a high-level detection device that is independent of any tank gauging equipment. […]


07/19/2016


API 2350 4th edition (2012) Categories

ATG

Display

ATG

Alarm

Control center

LAHH

Alarm

ATG Receipt

Category 1

Category 2

Category 3

Receipt


07/19/2016

Receipt



ATG

Display

ATG

Alarm

Control center

LAHH

Alarm

ATG Receipt

Category 1

Category 2

Category 3

Fully attended(min. 1h at the start + min. 1h after the end + periodically visual check on site)

Be aware: no manual hand dipping during product receipt and until at least 30 min

after a product receipt!


07/19/2016



ATG

Display

ATG

Alarm

Control center

LAHH

Alarm

ATG Receipt

Category 1

Category 2

Category 3

Receipt

Semi-attended (min. 30 min at the start + min. 30 min after the end)


07/19/2016

Receipt



ATG

Display

ATG

Alarm

Control center

LAHH

Alarm

ATG Receipt

Category 1

Category 2

Category 3

Unattended (ATG and independent level alarm high-high sensor)


07/19/2016


Typically Category 1 tank only 1 transfer at one time

Category 1 Category 2 Category 3Typically 1 transfer at one time

Multiple tanks can be filled simultaneously

Multiple tanks can be filled simultaneously


07/19/2016



ATG

Display

ATG

Alarm

Control center

LAHH

Alarm

ATG Receipt

Category 1

Category 2

Category 3

Receipt


07/19/2016


Definition of AOPS and MOPS

• AOPS: An overfill prevention system not requiring the intervention of operating personnel to function

• MOPS: Manual overfill prevention system that depends on the interaction of operating personnel to terminate the receipt. A person physically turning a valve or pushing a button that remotely closes a valve or turns off a pump are both manual operations. In MOPS, the alerts and alarms provide the operating personnel with information only.

AOPS can be added to all three categories


07/19/2016


If necessary, add AOPS on all categories

ATG

Display

ATGAlarm

Control center

LAHHAlarm

ATG Receipt

Category 1

Category 2

Category 3

AOPS

Receipt

Logic Solver

Logic Solver

AOPS

Logic SolverAOPS


07/19/2016


Overfill prevention is best achieved by use of AOPS

Section 4.1.1. of API2350• Prevention of tank overfills is best achieved by:

• A) Awareness of available tank capacity and inventory;• B) Careful monitoring and control of product movement;• C) Use of reliable instrumentation, sensors and systems; and• D) use of automatic overfill prevention systems (AOPS) where deemed

appropriate by a risk assessment and risk-based analysis.


07/19/2016

API 2350 (2012) independence of AOPS from the ATG

• AOPS: to use automated overfill prevention system (instrument, sensor, logic solvers and final element) you should follow Annex A (existing site).• Annex A is clearly requesting independence from the ATG.• Annex A states, that sensors with self testing diagnostic features

are preferred.



07/19/2016

API 2350 4th edition (2012): Annex A, which is normative

Annex A provides good practices for implementation of an automated overfill prevention system (AOPS) for existing tank systems.

Annex A.3 IndependenceThe term “independent” means that the AOPS shall be separate from any device or method used to measure, calculate or monitor tank receipts.The independent AOPS shall be designed and installed such that no fault in the ATG gauging and monitoring system is capable of causing a fault in the AOPS.

Annex A.4.2 SensorsSensors with self testing diagnostic features are preferred for all AOPS tank level detection applications



07/19/2016


Competition: 2 in 1 feature?

• Competitor claims to have two redundant electronic boards in one radar/device, but they are still using the same/one antenna.

• This is not allowed by API2350 for an AOPS

• What happens, if moisture/water is in the electronic compartment or having water built-up in the antenna?

• What happens, if the radar beam is not reflected (e.g. liquid is boiling, obstacles in the radar beam)?

• What happens, if cables breaks?


07/19/2016


High-High tank response time

• The high-high tank response time is the period of time required to terminate the receipt of flow to a tank in response to reaching the high-high tank level in order not to reach the critical high level.

Minimum High-High Tank (HH) Level Response Time (if not calculated)

Category Time in Minutes1 452 303 15


07/19/2016


Different maximum working levels due to differentminimum level response time (if not calculated)

CH CH CH

HHMW

Category 1 Category 2 Category 3

Best tank capacity utilization with AOPS


07/19/2016


Best capacity utilization with AOPS system.

CH CH CHAOPS=HHMW

Category 1 Category 2 Category 3


07/19/2016

API2350 relation to IEC 61511

AOPS for new sites: follow ANSI/ISA 84.00.01-2004 (IEC 61511 modified)


Common Target - Plant Safety!

Supplier and manufacturers

System integrator/

Operator/User

SafetyRegulations

2. Application standard Implementation for Process industries

1. Generic standardValid for all relevant sectors

IEC 61508 IEC 61511ISA 84


07/19/2016


Layers of protection

Plant emergency response Emergency response layer

Embankment Passive protection layer

Relief valve, rupture disk, F+G system

Active protection layer

Safety instrumented system EmergencyShutdown

Isolated protection layerTrip level alarm

Alarm & operator intervention “Wild” process

Process control layer

Basic process control system or DCS

Normal process

Process control layer

Plant and process design Inherent safe plant design

Miti

gatio

nPr

even

tion


07/19/2016


Overfill prevention process (OPP) in API2350 4th Edition

• Overfill prevention process (OPP) consists of …• A) management system• B) risk assessment system• C) defining operational parameters• D) requirements for procedures• E) equipment systems


07/19/2016


Wireless communication is not allowed

• Annex A.3• “Correct operation of the AOPS shall not require communications to or

from any location remote from the facility where the AOPS has been installed. AOPS shall not rely on wireless communication to initiate diversion or termination of receipt.”


07/19/2016


Key points of API 2350 4th Edition 2012:

• Above ground storage tanks• Introduction of Tank Category 1, 2, 3• Differences between AOPS and MOPS• Independence of AOPS• AOPS for new sites

• follow ANSI/ISA 84.00.01-2004 (IEC 61511 modified)• Overfill Prevention Process• Proof testing• A HHLA sensor on a floating roof tank have to detect the oil, even if it

is above floating roof.• No wireless communication for AOPS


07/19/2016

Where can you get the complete standard API2350?

The standard itself is available for about 120 USD from the website of API (www.api.org)



07/19/2016

Fixed roof solutions


Proof testing

• Push buttonactivated test generator

• High proof test coverage

• By proof test simulation

• Proof test coverage depends on inspection depth

MountingFunctional Safety

TuningFork

Radar

Side Top

Top adjustable

Top

• IEC 61508 design• Proven in use• Suitable for SIL 2 / 3 • Discrete output (relays)

or 4..20 mA output

• Proven in use• Suitable for SIL 2/3 • Internal redundancy (EOP)• Analogue output (4-20 mA)• Switching in safety

system or RMA422


07/19/2016

(External) floating roof failure scenarios


Damaged deck

• May lead to lost and deflected echo depending on deck position

• Fails Safe

• No Failure

Lost deck

• May lead to some switch point deviation (up to 100 mm)

• No failure

• No failure

Snow cover

• May lead to lost echo• Fails Safe

• No Failure

Free space Radar

TuningFork


04/06/2016


Overfill Prevention System: SOP600

Launch Presentation

Slide 1 PCPS / AE / MWO

04/06/2016

↙

Introduction

A safe and reliable solution to prevent hazardous overflow in tanks

Overfill Preventions System SOP600


04/06/2016

↙

Industry Effects – A New Focus on Standards

• Buncefield Report Recommendations on the design and operation of fuel storage sites” Major Incident Investigation Board (MIIB)

• American Petroleum Institute’s (API) Recommended Practice RP2350 “Overfill Protection for Storage Tanks in Petroleum Facilities”

• Standard IEC 61511: “Functional safety - Safety instrumented systems for the process industry sector”



04/06/2016

↙

Industry Effects – Buncefield Report






04/06/2016

↙

Industry Effects – API 2350 Overfill Protection






04/06/2016

↙

Industry Effects – IEC 61511 Functional safety



04/06/2016

↙

WHG ; API2350 and IEC61511


WHG

IEC61511

API2350


04/06/2016

↙

General Safety Instrumented System (SIS)


Process

Sensor

Logic solver

Actuator

Process Interface Process Interface

Communication Communication

Safety Instrumented System according to SILx


04/06/2016

↙

General principle: Overfill Prevention System SOP600



04/06/2016

↙

Key system features

• Scalable from 1 to 16 tanks per system• Certified according IEC 61511 up to SIL3 by • Compliant to API 2350 • For automated and manually operated systems• Failsafe High-High Level Alarm detection • Optional High Level Warning detection• Integrated automated proof test procedure• Proof test report printout ability• Uninterruptible power supply for 30 minutes autarkic operation• Detailed warning and alarm messages• Independent signalization of warnings and alarms



04/06/2016

↙

Main benefits

• Automated proof test guarantees that the safety instrumented system functions perfectly. Proof-testing of 16 tanks takes less than 5 minutes.

• Completely independent Safety Instrumented System satisfies the highest safety standards (according IEC 61508/IEC 61511) and complies to API 2350

• With the Automated Overfill Prevention System the tank capacity can be increased without major mechanical upgrades.

• The actuators for emergency shut-down (ESD) can be included in the overall safety data calculation.



04/06/2016

↙

Covering all regulations



04/06/2016

↙

Sensors and instrumentation


The selection of sensor and transmitter determines the achievable safety level:

Suitable for SIL2 complaint overfill prevention system:

• Liquiphant FTL5x or FTL7x with FEL57 and NivotesterFTL325P*

Suitable for SIL3 complaint overfill prevention system:

• Liquiphant FTL8x with FEL85 and Nivotester FTL825*

• Proof-test can be made for 12 years without the need to fill up to the Liquiphant fork.

* Nivotesters are included in SOP600!


04/06/2016

↙

SOP600


• The cabinet size and layout is dependent on the specific project


04/06/2016

↙

User interface


• The two inch character message display enables the operator to read latest status information from other side of the room.

• It shows the latest status message, but with smart prioritization a new warning, for example, will not overwrite an unacknowledged alarm.

• The operator panel with 10 inch touch display is the main user interface for operation of the system.


04/06/2016

↙

Control cabinet signalization


• Horn for warning indication.• Orange light for warning indication.• Green light for overall status good indication.

• Siren for alarm indication.• Red flashing light for new alarm indication.• Red light for acknowledged alarm indication.


04/06/2016

↙

Power management

• The system provides a redundant and uninterruptable power supply.

• The UPS battery provides power for 30 minutes operation of the complete system including sensors.

• To ensure the lifetime of the UPS battery, the temperature in the cabinet is measured with a Thermophant.

• The status of the power supplies, the UPS and the temperature are monitored.



04/06/2016

↙

External field signalization (SIL approved)

• External alarm: flashing light• The flashing light is monitored by an optical sensor

• External alarm: siren• Protect your ears! The siren sounds with 105dB at a

distance of 1 meter!• The siren is monitored by an acoustic sensor



04/06/2016

↙

Safety shut-down relay (ESD for AOPS)

• For each tank, there is a 2-channel relay output for the failsafe shut-off of pumps and valves.

• In the event of a tank related safety alarm, the related safety relay output opens.

• The safety relay requires a manual reset command.

• The status of the safety relay is monitored.



04/06/2016

↙

Emergency shut-down valves

• We can recommend appropriate ESD valves.

• Their safety data can be incorporated into a project specific safety certificate.


• Pneumatically or hydraulically actuated• Ball valve or butterfly valve


04/06/2016

↙

User interface

Detailed warning and alarm messages support the operator



04/06/2016

↙

User interface – Overview pageMessage bar shows warning and alarm messages, changes color dependent on status.


The state bar displays the current active user and the time remaining until next required proof test.

Tank field, shows tank name (user editable) and changes color dependent on status

The button bar contains the navigation and action buttons. Buttons are visible/not visible depending on the access rights of the user.


04/06/2016

↙

Documentation

The following documents are within the scope of supply for an Overfill Prevention System:

• Wiring Diagram incl.- cabinet layout- part list

• Operating Instructions• Functional Safety Manual• Safety Certificates• Test Reports (optional)• Safety System Specification• Data Sheets



04/06/2016

↙

Functional safety certificate



04/06/2016

↙

Additional support

Additionally the following support can be offered:

• Factory Acceptance Tests (FAT)• Commissioning support • Site Acceptance Tests (SAT) • Safety certification• Training• Maintenance contracts• Service level agreement • Customized life-cycle management



04/06/2016

↙

Time & Efficiency Example: Proof Test

Conventional Proof Test

• Proof Test with dismounting the sensor and testing it outside of the tank or even with rising the tank level is not only time consuming but also a potential source of failures.

• In average customers spend 4 man hours per tank with conventional proof testing methods.

Remote, Automated Proof Test

• The remote automated proof test is done in 5 minutes for 16 tanks.

> This saves more than 60 hours for 16 tanks.



04/06/2016

↙

Costs & Economy Example: Increased tank capacity

Tank capacity and flow rates:• Tank capacity: 1’500m3 with 10 m diameter • Inlet Flow rate: 90 m3/h • Volume per cm height : 0.7854m3/cm• Filling rate: 1.5 m3/min

Compare category 2 tank with automated overfill prevention :• The maximum working height is 57.3 cm below the critical height for a

category 2 tank with a response time of 30 minutes (minimum).

• With an automated overfill prevention system the response time is less than 1 minute this results in the maximum working height of 1.9cm below the critical height (minimum 3 inch =7.62cm).

• The tank capacity could be increased by 57.296cm - 7.62cm = 49.676cm => 39 m3 => 2.6%



04/06/2016

↙

Automated overfill prevention system



04/06/2016

↙

CSB safety video on 2009 CAPECO explosion



04/06/2016

↙

What is process safety and what does that imply?



04/06/2016

↙

Simply explained – Plant safety



04/06/2016

↙

Endress Hauser Functional Safety Process Measurement



04/06/2016

↙

References

I know that quality is an important asset that I can use to set standards



04/06/2016

↙

Installation examples – Overfill Prevention cabinet



04/06/2016

↙

Overall status is good…



04/06/2016

↙

The safety sensor and the separate tank-gauging system



04/06/2016

↙

Flexibility in design - liquid bulk storage

Installation ecamples:Liquiphant SIL2/3

• Always the first solution.• Independent High Level Alarms • Best technology available

Internal floating roofs and external decks require installation of stilling wells or side mounted chambers



04/06/2016


Overfill Prevention System SOP 600

Thank you very much.


only a safe plant is economical - endress+hauser products solutions services api 2350 4th edition-...

Documents