Def - Tank Overfill Protection v3.0 - February 2015 PDF

Tank Overfill Protection
Standard
Global Operations
February 2015
This document is for Vopak internal use only and should not be distributed outside Vopak.
Tank Overfill Protection I Version 3.0 I February 2015

Property of Vopak – Confidential 1 © Vopak 2015
Document title Tank Overfill Protection
Document Number 0102-020-08-001
Document Type Standard
Status Endorsed by Global Operations Leadership Team
Date February 2015
Version 3.0
Project name Vopak Standards
Owner Royal Vopak – Global Operations
Confidentiality and Distribution
Vopak Global Operations Standards contain confidential information regarding Vopak and its relevant
subsidiaries and have been prepared with a view to inform and instruct Vopak employees. For that
reason none of these Standards - whether in original or copies, including but not limited to any
medium including paper or electronic formats like file copies, word documents, pdf files, on electronic
storage devices or by email - is to be shown, given or loaned to any third party, including external
companies and persons not directly employed by Vopak. No exceptions are permitted without the
written authorisation of the Director Global Operations.
This document has only been made available to Vopak employees who have agreed to return it to
Vopak immediately upon first request, together with any copies and any other information that was
provided. Persons who are not employed by Vopak and who have nevertheless received this
document must be aware that it is likely they have received it in breach of a confidentiality obligation.
Such persons may not rely on, use, duplicate or disclose any information contained in this document
and should forthwith return it, together with any copies if any, to Vopak.
This copy is not controlled, for the latest revision check on Vopak Intranet.
February 2015 3.0 Updated risk matrix and updated options

March 2014 2.1 Figure page 15 added (was missing in PDF file on QoL)
June 2013 2.0 Endorsed by GOLT
June 2013 2.0 Updated version / Checked against API 2350-Endorsed by GOLT
September 2008 1.0 Endorsed by Operational Excellence Leadership Team
Date: Version: Description:

TABLE OF CONTENT
Page
1 INTRODUCTION 5
1.1 Scope 5
1.2 Related standards 5
1.3 Roles and responsibilities 6
2 OVERFILL PROTECTION PROCESS 8

2.1 Management system 8
2.2 Risk assessment 8
2.3 Definition of operating parameters 8
2.4 Operating procedures 9
2.5 Equipment specifications 9
3 PROCESS 10
4 RISK ASSESSMENT 11
4.1 Scenarios 11
4.2 Risk matrix 11
4.3 SIL assessment 13
5 DEFINITION OF OPERATING PARAMETERS 14

5.1 Levels of Concern 14
5.2 Response time between fill levels: 18
5.3 Determining response times 18
6 MANAGEMENT SYSTEM 20
6.1 Global Standards 20
6.2 Procedures for operation 20
6.3 LOC review 21
6.4 Personnel performance and training 22
6.5 Testing, inspection and maintenance 22
7 EQUIPMENT SPECIFICATIONS 23
8 EQUIPMENT REQUIREMENTS 27
8.1 Introduction 27
8.2 System Design 27
8.3 Emergency Shut Down 27
8.4 Valve actuator selection 28
8.5 Closure Times of Valves 29
8.6 Automatic Tank Gauging System (ATG) 30
8.7 Stilling Well 30
8.8 Level Switches for Independent Overfill Alarm or Trip 31
8.9 Positioning of Switch 32
8.10 Wireless systems 32
8.11 Proof testing 32
8.12 Maintenance 32

9 DEFINITIONS 33
APPENDIX 1 – TANK OVERFILL RISK MATRIX 37
APPENDIX 2 – TANK ALARM LEVEL CALCULATION 39
APPENDIX 3 - RESPONSE TIME CALCULATIONS T1 AND T2 40
APPENDIX 4 – GAUGING PRINCIPLE SELECTION MATRIX 42

1 Introduction
Overfills are relatively rare events. However the consequences of overfills can exceed most, if not all
potential scenarios at a terminal.
Vopak has established a standard for the provision of an overfill protection process which is set out in
this documents and which includes:
• Requirements for integrity organization;

• Type of equipment to be used;
• How to establish the set points for high level alarms and trip systems;
• System testing and maintenance requirement.
There are a large number of abbreviations and definitions used in this document. These are described
and explained in the section at the end of the document.
The main update version 2.1 for this standard was:

• The previous version is checked following the learnings from Buncefield with development of the
new API 2350 guideline (version 2012) and updated accordingly.
• The risk matrix is updated.
This updates for versions 2.2 are:

• Re-evaluation and simplification of the risk matrix;
• More options for level 1 and 2 overfill protection designs;
• Additional information potential events and risks;
• For level 3 overfill protection design, it is allowed to have the timing of the two last Level of
Concerns simultaneously, leading to potential higher filling levels.
• Updated calculation sheet.
• Update of appendix 4, Gauging principle
The starting point for this standard is that every tank is equipped with a tank dedicated tank overfill
system, i.e. a type of tank gauging (.g. tank gauging in some cases with level switch) and one (or
more) bottom valves(s) to stop the flow per tank. Any deviations from this starting point need to be
approved via the Vopak waiver process by the terminal / division.
1.1 Scope
This standard is applicable for all above ground atmospheric storage tanks.
Out of scope are:

• Cryogenic tanks;
• Pressure vessels;
• Water and waste water tanks.
Although the philosophy of this standard can be applied for these types of storage tanks.
1.2 Related standards
For a minimum the following Vopak standards are related;


• Vopak Maintenance and Inspection of Critical Equipment (Part 2: Tank Overfill Protection Systems)
standard;
• Vopak Fundamental+ standard;
• Vopak Control of Work standard;
• Vopak Incident Reporting & investigation;
• Vopak Commissioning standard;
• Vopak Defeat of Safety Critical Equipment standard;
• Vopak Major Hazard Risk Assessment standard;
• Vopak Risk Based Maintenance management standard, including risk graphs;
• Vopak Incident Reporting and Investigation standard;
• Vopak Management of Training standard;
• Vopak Emergency Planning standard;
• Vopak Product Movement Management (PMM) standard;
• Vopak Static Electricity standard.
Vopak documents:
• RF BB0 Life Cycle SIS expert document, doc no 32016-P-06-0001
Related international standards are:

• ANSI/API 2350 “Overfill Protection for Storage Tanks in Petroleum Facilities”, version 2012;
• IEC 61511 “Functional safety - Safety instrumented systems for the process industry sector” (SIL
Standard)
• Buncefield incident report.
1.3 Roles and responsibilities
The roles and responsibilities for the implementation of this standard are the following.
The Terminal manager responsibilities include:

• Ensuring that critical equipment nominated for inspection is made available through liaison with all
appropriate departments and customers.
• Communicating the progress of installation and other relevant information to these departments,
customers and other appropriate Vopak management personnel.
• Commission the Overfill Protection Process;
• Ensuring reassessment of this Overfill Protection Process after every change in stored product and
physical change in tank, transfer pump, transfer line and infrastructure;
• Periodical reviewing of Overfill Protection Process and its settings;
• Ensuring that competent people are available and that they are effectively carrying out the
requirements of this standard;
• Determining and documenting of the alarm and control liquid levels for all tanks. These levels are
called the Levels of Concerns (LOC);
• Monitoring, auditing of Overfill Protection Program is completed, recorded and any corrective
actions following this review;
• Monitoring any out of service safety critical equipment on a routine basis;
• Approving response times for overfill systems;
• Approve testing frequencies for overfill systems;
The Operational Manager responsibilities include:

• Ensuring that the equipment is operated safely by competent operational personnel and according
to supplier requirements and procedures;

• Ensure training for operational personnel;
The Maintenance manager responsibilities include:

• Ensuring maintenance and inspection is done according to Maintenance and inspection of Critical
Equipment part1 and part 2 – Tank Overfill Protection System;
• Ensure competent maintenance personnel are employed for tasks to be completed;
• Ensure training for maintenance personnel;
• Maintenance, updating and implementing of Overfill Protection Process documentation.
Engineer responsibilities include:

• Correct design to meet specific requirements in this standard;
• Correct documentation of the design, commissioning and hand over;
• Correct implementation of design and infrastructure;
• Training material is available for operations.

2 Overfill Protection Process
The Overfill Protection System is last line of defense for the Overfill Protection Process. It is important
to ensure that the whole process is correctly implemented. This standard provides the different steps
and requires systems to ensure an effective Overfill Protection Process.
The API 2350 standard is used as basis for this standard.
This standard describes a process, which has the following fundamental components:
1. Management system;
2. Risk assessment;
3. Definition of the operational parameters;
4. Operational procedures;
5. Equipment specifications
2.1 Management system
A properly structured management system provides the controls on all components of the Overfill
Protection Process so that each component is coordinated with other components and is assessed,
managed and kept current as people and equipment change.
The management system is the framework for the administrative processes and procedures used to
enable Vopak to fulfill the tasks to reduce the risk for overfills to an acceptable level.
Details can be found in chapter 3.
2.2 Risk assessment
A risk assessment is a process of analyzing the risk of failure that should contain the following stages:
• Identification of accident scenarios involving failure of the equipment;
• Identification of potential deterioration mechanisms and modes of failure;
• Assessment of the probability of failure from each mechanism/mode;
• Assessment of the consequences resulting from equipment failure;
• Determination of the risk from equipment failure;
• Risk ranking and categorization.
2.3 Definition of operating parameters
Every tank will have it specified liquid levels to set alarms, alerts and set points for the Automatic
Overfill Protection System of the Overfill Protection System. These levels are called Levels of Concern
(LOC).
The Level of Concerns shall be based on amongst others:

• Products to be stored in tank;
• Tank capacity and physical conditions;
• Transfer rate into tank;
• Level of automation;

2.4 Operating procedures
This standard shall be closely linked to Vopak operation procedures. The Overfill Protection Process
shall as a minimum be included in or checked with the following procedures:
• Management systems;
• Risk assessment;
• Operating procedures,
• Personnel performance and training for operating personnel for Overfill Protection System;
• Procedures for testing, inspection and maintenance for Overfill Protection System.
2.5 Equipment specifications
Equipment systems are the physical equipment with which the operating personnel interface to
transfer product, including (but not limited to) tanks, piping, valves, sensors, instrumentation, gauges,
electronic data collection systems, testing devices and communicating systems. All these systems
components (including cable, junction boxes) shall be suitable for the application and environment for
which they are installed and installed in accordance with the components supplier’s specifications,
hazardous area regulations, etc.
Detail can be found in chapter 7 and 8.

3 Process
This standard shall be used to check for gaps with the current Vopak management processes, if there
are gaps these need to be adapted in such a way that the processes do not interfere with a safe
Overfill Protection Process.
The management system for the Overfill Protection Process shall as a minimum include:
• Formal documented operating procedures and practices, including safety procedures and
emergency response procedures;
• Requirement for competent operating personnel;
• Functional equipment systems, tested and maintained by competent personnel;
• Scheduled inspections and maintenance programs for overfill instrumentations and equipment;
• Systems to address both normal and abnormal operating procedures;
• A management of change (MOC) process that includes personnel and equipment changes;
• A system to identify, investigate and communicate overfill near misses, alarms and incidents;
• Communication system protocols within the owner and operator organization and between the
transporter and the owner and operator that are designed to function under abnormal as well as
normal conditions
The MOC system is described in the Vopak Fundamental+ standard.
The activation of the overfill protection system shall be reported as a high potential near miss
according to the Vopak Incident Reporting and Investigation standard.

4 Risk assessment
There are different risk assessment methods suitable.
Vopak prefers the risk matrix to assess the risk as described in section 5.1.
An example is The Netherlands where the PGS29 guideline leaves the used risk assessment method
open and thus Vopak terminal in NL should use the Vopak Risk Matrix for overfill systems.
In some countries the assessment method which needs to be used is prescribed. A much used
method is SIL assessments and / or LOPA studies, which are described in section 4.2. Countries
which require SIL assessments are the UK and India.
If LOPA studies are required, please contact the owner of this standard via Global Operations to
support you with existing LOPA studies.
Please check if local legislation describes a risk assessment method otherwise use the Vopak matrix,
which can be found in section 4.1.
4.1 Scenarios
Typical scenarios leading to tank overfilling split in continuous and non-continuous fed tanks are:
Continuous fed tank

• Forgetting to switch tanks.
During normal operation the tank is fill till the permitted fill level and then we change to another
tank. This switching over often requires manual actions and can be forgotten. This is the main
reason why. Vopak has given continuous fed tanks a higher risk than normal tanks.
Non-continuous fed tanks:

• Wrong line-up. Putting product in the wrong tank, which might be already filled;
• When discharging to a tank, simply forgetting that the tank is filling;
• Miscalculation of the ullage (= available space);
• Higher or increasing flow rate, leading to higher flow rate than the overfill system is designed for;
4.2 Risk matrix
The matrix is based on a risk based approach and can be found in table 1 below.
The risk analysis shall be individually done per tank / product combination.
It is advisable per tank pit to use the Overfill Protection System requirements of the tank with the
highest risk in the whole tank pit, except when this leads to extraordinary cost for the tanks with low
risk.
In this matrix the risk for overfilling is determined based on three criteria:
• Product hazard: flammability and toxicity.
The basis for the categorization is the Global Harmonised System (GHS) by the United Nations.;
• Risk to people, business, environment and reputation. The basis is the Vopak Risk matrix;
• If the tank is continuously fed or not.

The definitions for the movement type and product hazard are detailed in table 1 and in appendix 1.
For all other systems initial proof testing shall be once per year and based on results and a risk
analysis this frequency may be increased or reduced.
Table 1. Risk matrix for overfill protection
The risk analysis is a 2 step process. The Vopak Risk Matrix required to assess the risk for step 2, i.e
the environmental , business, customer and operational risk can be found in the Vopak Incident
Reporting & Investigation standard
1. Product Hazard Classification: Using the criteria above select the hazard classification and
determine the product category (A, B or C)
2. Risk assessment of other consequences: Using the Vopak risk matrix consider the other potential
consequences of a tank overfill (environment, business, customer, operations risk etc.) and
determine if the risk category changes from the product hazard classification.
3. Final selection: Type of overfill protection required is based on the highest category assessed
from steps 1 and 2.
Overfill level 1 (green area in table 1) allows the use of manual gauging. Especially for the tanks with
Overfill Level 1 and manual gauging the environmental and the business risk need to be assessed in
more detail. It is likely that environmental and business risk can lead to a higher overfill system

requirement. Please be aware that the scenarios as described in section 4.1 are more difficult to
detect, when manual gauging is used, and the overall change for overfilling increases.
Example:
Neodols are generally low hazard products on the above matrix based on its flammability and toxic
hazards.
However Neodols are dangerous to the environment (GHS cat 1 Aquatic Hazards) if they are stored in
an impermeable bund then the risk from overfill could remain as low risk but should this be stored in a
permeable bund and there is risk of contamination of soil/water then the category of product could
increase to higher risk, leading to a higher standard of overfill protection system”.
Continuous Pipeline Transfer

Where product is transferred from an off-site source to Vopak tanks on a continuous basis
4.3 SIL assessment
In some countries the global IEC 61508 and the IEC 61511 norms, i.e. Safety Integral Level (SIL)
standard, are mandatory for all Automated Overfill Protection System.
If SIL assessment and installation are required by local or national requirement, please contact your
Divisional Operation and Technology Director or Global Operations for assistance.
For pipeline transfers the risk assessment shall be done jointly with the customer for delivery or receipt
transfers.

5 Definition of operating parameters
To prevent overfilling of a tank operating parameters need to be defined. Vopak requires that different
liquid levels with its appropriate action and or alarm shall be defined. The idea behind these levels is
that every tank has at least one succeeding liquid level alarm between permitted fill level and tank
overfill level. If the risks are higher two levels are defined. The levels shall be defined in such a way
that they provide sufficient response time to stop the overfilling of the tank.
These alarm liquid levels together with the permitted fill level and the overfill level are called Level of
Concerns.
These Levels of Concern (LOC) shall be defined and documented for all tanks in scope of this
standard.
5.1 Levels of Concern
The following LOC’s are used and need to be determined and documented for each individual tank:
• Overfill level;
• (Optional ) Level Switch High (LSH) or Level Alarm High High (LAHH) ;
1
• Level alarm high (LAH);

• Permitted Fill Level.
The Levels of Concern (LOC) shall be established based on:

• Product to be stored in tank;
• Tank capacities and physical conditions
• Rate of product flow into the tank.
For all tanks all Levels of Concerns (LOC)’s shall be determined and documented.
The LOC’s shall be displayed at the Central Control Room and / or locally at all manual gauge
hatches.
These LOC’s can be converted to the following levels as indicated in the API 2350 standard see table
2.
Vopak definition API 2350 definition

Overfill level Critical high (CH)
2
Level Switch High (LSH) Automatic Overfill Prevention System level (AOPS)
Level Alarm High (LAH) High-high level (HH)
Permitted fill level Maximum working level (MW)
No Level of Concern
Level Control High (LCH) (not defined)
Table 2. Vopak vs API2350 definition of Levels of Concerns (LOC)
In figure 1 the different LOC’s are shown.
1
LASH or LAHH are optional and only used in case of higher risk, see table 1 for risk assessment.
2
LSH can be Level Alarm High High (LAHH) for systems of risk level 2 and no actuated valve.

Figure 1. Different Levels of Concern
Overfill Level (or Maximum Capacity):

This is the maximum level of liquid the tank can contain while still avoiding product loss by overflow
or damage to the tank structure. This is set by the physical characteristics of the tank.
This level is described as the point where one of the following points is viable:
• Loss of primary containment occurs;
• Tank would suffer mechanical damage, e.g. product with higher specific density than
where the tank is designed for example sulphuric acid (Specific density of 1.6) in tank with
design of specific density of 1 (i.e. water),
• Damage occurs due to mechanical contact of:
o Floating roof;
o Floating roof seals;
o Floating roof legs;
o Foam dams;

o Or other appurtenances with tank structure;
• Allowable tank stresses shall be exceeded or;
• Another designated overfill level lower than those described above is exceeded, e.g.:
o Temporary maximum levels due to shell repair;
o Where seal rises above the vents or top lip of the tank;
o Below foam pourer injection points...
If the overfill level is reached the required actions are:

• emergency response;
• stop product flow;
Level Switch High (LSH) (or Tank Rated Capacity):

The Level Switch High (LSH) is set at a level below the overfill level and is the set point for the
automatic overfill prevention system (AOPS). This LOC is only applicable for level 3 Overfill
Protection systems, see section 7.
In the previous version of this standard the term tank rated capacity was also used for level switch
high.
The separation between the maximum capacity and Level Switch High is a function of the response
time needed between detecting the level switch high and stopping at the MAXIMUM product flow
rate into the tank before the “overfill” level is reached.
Where tanks are installed with PV valves the maximum filling rate is used to size the Venting
requirement and this should be used for the overfill protection calculation as long as the maximum
liquid velocity is less than 7 m/s in the filling line.
To account for errors in measurement and data the minimum response time T1 between
overfill level and LSH level shall be the biggest of:
• Determined response time T1 (see section 5.2) and add extra time as safety margin.
This safety margin shall be minimum 2 minutes;
• Or response time T1 determined based on minimum distance between overfill level
end LSH of 7.6 centimeters (3 inch) (API 2350 (2012) section 4.4.2.2.2).
The LSH level is not allowed to be exceeded. If the LSH is activated it should be reported
according to the Vopak “Incident Reporting & Investigating” standard.
Product levels reaching Level Switch High (LSH) should be lowered as soon as practical possible
below Permitted Fill Level.
If the level switch high level is reached, the required actions are:
• emergency response;
• stop product flow;
Level Alarm High (LAH):

This is an alarm at a level sufficiently below the level switch high to allow action to shut down the tank
before this level is activated. This alarm level is installed on tanks depending on risk for overfilling.
Product levels reaching Level Alarm High (LAH) should be lowered as soon as practical possible
below Permitted Fill Level.

The level alarm high is not allowed to be exceeded. If the LAH is activated it is to be treated
as a near miss and reported and investigated according to the Vopak “Incident reporting &
Investigating” standard. .
It is allowed for an Automated Overfill Protection System (Level 3 system, see section 7) it is allowed
to position the response time T2 parallel with response time T1 of LSH (Level Switch High).
A minimum safety margin of 2 minutes is required between the activation of LAH and
activation of LSH.
The response time T2 for Level Alarm High shall be determined based on maximum possible flow
3
rate .
If the level alarm high is reached the required action is:

• Activation Overfill Protection System;
• Terminate all flows to tank / stop tank transfer from source.
• Lower level below permitted fill level
Permitted Fill Level:

This is the maximum level to which the tank routinely shall be filled in normal operation. No alarms are
required at this level, but alerts may be established to aid operation.
This is set at a level sufficiently below the LAH set point to avoid alarms due to:
• Thermal product expansion during storage;
• Wave action caused by turbulence, wind
Wave slosh height set at permitted fill level is of concern in geographic areas where seismic activity to
prevent sloshing overflow. Here avoiding alarms during earth quakes is not the goal.
When not calculated exactly, the permitted fill level is set at 1% below the alarm limit of the LAH, in
special cases e.g. heating of tanks it might be necessary to increase this.
It is not permitted to fill the tank above permitted fill level, for example to get the last few
tonnes off a ship.
Any filling above this limit may only be done in non-operational exceptional circumstances, for
example to refloat a suspended cable supported roof after product change.
Where this is the case, the operation shall only be undertaken in line with the Vopak Standard –
Defeat of Safety Critical Equipment.
If the permitted fill level is reached the required action is:

• Stop product transfer.
Level Control High (LCH):

This is the near fill notification, which is positioned at a level sufficiently below the normal fill level to
allow the terminal staff to take action to shut down the tank before the normal fill level is reached.
If the Level Control High is reached the required action shall be determined locally.
3
The fact that T1 and T2 can be positioned simultaneous, takes away the necessity for the option as
mentioned in version 2.1 of this standard to allow the LAH level to be determined based on a reduced
flow rate.

As guidance the Product Movement Standard cites 5 and 15 minute alarms.
5.2 Response time between fill levels:
Different response times are defined. These response times are defined as the maximum allowed time
to safely detect and stop the tank filling process to prevent the actual liquid level to exceed the next
liquid or alarm level. The response times and alerts are indicated in table 3 and figure 1.
Table 3. Response times and the corresponding tank levels

Response time Response time between
T1 (only Level 3) Overfill level and Level Switch High (LSH)
T2 Level Alarm High (LAH) and Level Switch High (LSH)
Alerts
T3 Permitted fill level and Level Alarm High (LAH)
T4 Level Control High (LCH) and Permitted Fill Level
T2 and the optional T1 are response times, which shall be determined with the method
described below.
Response time T3 is installed to prevent unintended activation of overfill alarms, for

instance due to thermal expansion factor.
Some tank gauging systems include the facility for the user (operator) to set alerts (system prompts) to
notify them when a particular level has been reached or exceeded, a typical example is the optional
response time T4.
These alerts are not treated as alarms but should give some different form of fill notifications (or
operational fill alerts) and should be treated as operational events to prevent serious alarms being
mixed in with more normal operating aspects of the facility.
These operational warnings are not discussed further in this document.
5.3 Determining response times
When considering the level to set any tank alarm or trip, it is necessary to determine how long it will
take for the system and / or people to respond to the level alarm and to shut off the inflow to the tank.
Particular care is needed when estimating the likely time for operators to respond to an incident.
Consideration should be given to times for:
a) Detection
b) Diagnosis
c) Response actions.
Detection covers how an operator will become aware that a problem exists. When control rooms are
not continually staffed, the means by which operators are informed about terminal alarms requires
careful consideration.
Diagnosis refers to how an operator will determine what action, if any, is required to respond to the
problem. Relevant factors to think about include training and competence assurance, the availability of

clear operating procedures and other job aids, and level of supervision. The existence of more than
one problem at the same time, or a continuous sounding or a mixture of important and trivial alarms
can make diagnosis more difficult.
Response actions cover how a timely response is carried out. Key aspects here include: the
availability of a reliable means of communicating with other plant operators, the time needed to locate
and operate a control (close a valve, stop a pump), the need to wear PPE, the ease of operating the
control whilst wearing PPE, and how feedback is given to operators that the control has operated
correctly. Occasionally there may be circumstances where operators may hesitate if shutting down an
operation might lead to later criticism.
The response times T1 and T2 are mainly determined by the grade of automation. The higher the
automation grade, i.e. less human interference, the shorter the minimum response time can be.
Vopak recognises three levels of automation:

Manual system
no actuated valves to stop tank from overfilling
Remote actuated system
Remote actuated valve but operator interference is required to close the valve at
alarm levels LAH or LSH.
Automatic actuated system
Automatic actuated valve, which will automatically close without operator interference
when alarm level LAH or LSH is reached
There are several methods to determine the response time for the levels of automation. These
methods are often based on a local regulation. Typical examples can be found in appendix 2.
Response times of less than 10 minutes need to be justified and approved by terminal
management.
A ‘walk-through’ of the physical aspects of the task with operators can provide very useful information
on the minimum time needed to detect and respond to an overfilling incident. However due allowance
needs to be made for additional delays due to uncertainty, hesitation, communications problems. This
will need to be added to the minimum time to produce a realistic estimate of the time to respond.
Where automatic systems are provided to shut a tank inlet valve without any manual intervention, the
actual response time of the system can be used with consideration of pressure surge times, see
section 8.5.
Documentation shall be maintained on a tank to tank basis for each product that establishes the basis
for the LOC settings. This LOC documentation shall be updated whenever there is a change to the
LOC’s.

6 Management system
6.1 Global Standards
Within Vopak there are Global Vopak Standards to manage, operate and maintain terminals. Besides
that there will be local procedures.
The following standards and procedures are related to this standard. To prevent contradiction, a
minimum of the following procedures need to be reviewed and if necessary aligned:
• Vopak standards
o Vopak Fundamentals, especially Management of change and working permit;
o Commissioning;
o Compliance with regulations;
o Emergency planning;
o Risk assessment;
o Maintenance;
o Incident Reporting and investigation;
o Product Movement Management;
o Safety management systems.
• Training of personnel;
• Assessment of personnel;
• There will be many local procedures which need to be reviewed and aligned to this standard.
6.2 Procedures for operation
Vopak prohibits filling the tank over the permitted fill level as routine or using the
Automated Overfill Protection System as an operational control mechanism to stop filling
the tank.
The Overfill Protection standard shall be included in the following operating procedure:
• Planning of receipt;
• Pre-receipt activities;
• Activities during receipt;
• Post receipt activities;
• Documentation for product receipt;
• Filling a tank above Permitted Fill Level;
• Emergency procedure;
• Personnel performance and training for Overfill Protection Process;
• Stock Control standard;
Product movement procedures are described in Vopak Product Movement Management (PMM)
standard.
The procedures shall as a minimum include:

• Instruction for normal operation control and procedures for tank receipts that fill the tank to
permitted fill level;

• Determination and communication of the anticipated final liquid product level shall involve
operations staff. It is NOT permitted to exceed the permitted fill level. This anticipated level
shall be communicated to these involved in and supervising the product transfer;
• Documentation of the different procedure shall be managed by the operation manager.
The pre-receipt activity procedure shall include as a minimum:

• Gauging of the tank prior to product receipt shall confirm that adequate capacity is available to
receive the designated amount of product. Any expected volume increase, e.g. product
temperature rise in the tank, shall be considered when determining the available ullage for
product.
• Recording of the pre-receipt information shall be recorded on the tank product transfer or
receipt record shall be available to the transporter;
• Execution and verification of a proper valve line-up before the product is transferred or
received, shall be in order to ensure that the product is delivered into the designated tank or
tanks. Where piping is connected from the same receiving manifold to different tanks:
o Only the inlet valves for those tanks designated to receive product should be open;
o The inlet valves for all other tanks shall be closed.
The procedures for activities during receipt shall include as a minimum:

• The documented operating procedures shall require regularly scheduled monitoring of product
levels during receipt.
• The documented operating procedures shall require that regularly scheduled comparisons and
recording of the following information will be made based on tank capacity, the flow rate and
the estimated filling time:
o The remaining available tank capacity shall be compared to the remaining volume of
product to be received;
o The expected completion time for the individual tank and the whole cargo will be
estimated and monitored;
• Tanks that are connected to the same product manifold, but that are not scheduled to receive
product shall be monitored to ensure that there is no unintended flow.
The procedures for post transfer shall include as a minimum:

• Procedures to secure tanks.
The emergency procedures shall include as a minimum:

o Emergency procedures in the event that the Overfill Protection System fails due to
mechanical or power failure or abnormal condition, i.e. operating, equipment,
environmental or weather related.
6.3 LOC review
Once established, the LOC’s shall be reviewed periodically (5 years as a maximum) to ensure that
they remain set appropriately for current conditions. In addition triggers for review of LOC settings
include those associated with MOC and changes to the operation of the tank or other aspects for the
Overfill Protection System.
Physical changes warranting LOC review

Conditions that specifically warrant an LOC review and a tank calibration include significant physical
changes to a tank or facility, such as:
• New tank;
• Changes on the tank, e.g. installation steam coil, bottom replacement, shell extensions;

• Change in floating roof seals;
• Installation of geodesic domes or other kind of fixed roofs, e.g. when external floating roof
tanks receive retrofit covers;
• New internal or external floating roof;
• Side vents changes;
• Addition of ancillary equipment, e.g. foam chambers;
• Recalibration or re-strapping of the tank;
• Change of tank gauging equipment;
• Addition of gauge tube with datum or change in datum and strike plate.
Operational changes warranting LOC review

An LOC review shall be conducted according to the Management of Change (MOC) procedure when
there are operational changes from the most recent determination, such as:
• Change in product;
• Change in incoming or outgoing line;
• Change in maximum flow rate;
• Change in service if it impacts structural integrity (corrosion, temporary repairs);
• Change in operations, i.e. parallel tank, floating or high suction, continuous mixer operation;
• Change in response time resulting from staffing, operation or equipment changes.
After review the LOC’s shall be documented and implemented.
6.4 Personnel performance and training
The overfill Protection Process shall be included in the training program for personnel according to
Vopak Management of Training standard.
Operational, technical, maintenance and contractor staff will be deemed and maintained as competent
for the tasks they are meant to execute.
Operational-, technical-, maintenance and contractor staff who participate in product receipt
operations or are involved in design, engineering or maintenance of equipment shall be thoroughly
familiar with the documented procedures, operating-, maintenance and technical instructions. They will
have to attend mandatory training and assessment.
6.5 Testing, inspection and maintenance
Testing, inspection and maintenance of Overfill Protection Systems are described in the Vopak
Maintenance and inspection of Critical Equipment Part 1 and part 2: Tank Overfill Protection System.
For systems initial proof testing shall be once per year, except for the three highest risk options (see
table 1) and based on results and a risk analysis this frequency may be increased or reduced.

7 Equipment specifications
Tanks must be fitted with overfill protection as determined in the risk analyses, see table 1 in section
4.
There are three levels to ensure overfill protection (in increasing order of protection):
Level 1 Overfill system based on tank gauging system or level switch / manual gauging with
manual or remotely operated closing of bottom valve(s) (lowest protection level);
Level 2 Overfill system based on tank gauging system (or level switch (not preferred)) with
automatic closing of bottom valve(s)
Optional, the use of manual or remote actuated valves is allowed. This requires one
additional alarm level;
Level 3 Overfill protection based on tank gauging and independent level switch with automatic
closing of bottom valve(s) (highest protection level).
The typical set up for a level 1 overfill protection with only tank gauging or independent level switch
and remotely operated closing of bottom valve is shown in figure 3 and 4.
The use of manual gauging will lead to longer response times and less usable volume of the tank.
Please note:
That in case manual gauging is chosen the chance on overfilling increases. Please ensure
that the environmental and business are within acceptable range for Vopak, see section 4.
A level 2 overfill protection is shown in figure 5 and 6.

When the tank is not equipped with an actuated valve to stop flow to the tank, an additional alarm level
is required. This leads to a reduction of effective tank volume, because it is still not allowed to fill the
tank beyond the permitted fill level.
For level 3 overfill protection there are two typical, see figure 7 and 8. The system in figure 8 the level
switch and the ATG both act by automatically closing the bottom valve. In figure 7 the level switch is
automatically closing the actuated valve at LSH level, while closing the bottom valve at LAH level still
requires action via the remote controlled actuator.

Figure 3 Level 1 overfill protection (option 1)


Figure 7 Level 3 overfill protection, remote closure of bottom valve at LAH level (option 1)
Figure 8 Level 3 overfill protection, automatic closure of bottom valve at LAH level (option 2)

8 Equipment requirements
8.1 Introduction
This chapter describes the selection of overfill protection equipment for different product groups stored
in Vopak tanks. The selection of suppliers is based on proven technology and customs approval.
Many technical solutions can be selected to protect from overfilling, however the solutions discussed
in this document are proven reliable Vopak Best practices and from a total cost of ownership point of
view are preferred above other solutions and are fastest to implement.
8.2 System Design
Overfill protection valves / actuators and measuring device should be “hard wired” to the controller.
It is not allowed to use a wireless system for the level switch or an ATG, when this is the
single level instrument (Level 1 or 2 protection).
For level 1 and 2 protection systems it is preferred to use an ATG as a level device. If the terminal
decides to install only a level switch or manual gauging on the tank for overfill protection, this will have
the following consequences:
• The response time T2 and T3 need to determine based on manual gauging and will be longer,
see appendix 2. This will lead to loss of effective volume in the tank.
• The personal risks of the operator involved will increase, i.e. climbing stairs and higher chance
of contact with products
For level 3 protection systems, it is allowed to use a wireless ATG for overfill protection, when a hard
wired LSH is used as last line of defense.
Where the signal passes through a programmable device, e.g. (safety) PLC or DCS systems, the
selected equipment shall be selected to be suitable for use in the electrical zone classification where it
will be installed and has the appropriate SIL classification, if SIL rated systems are required.
8.3 Emergency Shut Down
A deviation from the API 2350 standard section A.4.4.1 (API 2350 (2012)) (when allowed by
legislation) is that Vopak allows the use of a single valve for both the emergency signal and normal
operation.
For new applications and upgrades the ESD valve shall guarantee 100% isolation.
The combination ESD valve and Flow Control Valve (FCV) is not preferred and only allowed when
100% isolation is guaranteed. In case of existing FCV / ESD combination based on a written and
documented risk analysis the terminal can decide that with specific procedures and / or additional
alarm levels the FCV / ESD combination leads to acceptable risk and leave the system in operation.
In case of a pneumatic actuator and the valve is used both as an operational valve and a safety valve,
a separate solenoid for the overfill / ESD signal is required, which overrules the second solenoid for
normal operation.

For existing installations with level 1 or 2 overfill protection, see section 7, actuators with a single
solenoid can remain in service for duration of their expected service life, if can be proven by risk
assessment that the residual risk is acceptable
In case of an electrical actuator, which is used for both safety and operational function, a separate
contact for the safety function and a separate contact for the normal operation shall be available.
In both cases (pneumatic or electrical actuator) the safety function shall always overrule the normal
operation. The two contacts and wiring shall be designed in such a way that misconnection is
impossible or clearly visible.
The valves which perform the function of Emergency Shut Down should be of a type that “fail to closed
position” upon loss of control signal or actuating power.
This can be guaranteed by air or hydraulic system, pressing against a spring, and so continuously
pushes a valve open. If this fails, the spring forces the valve to close.
It is recognized that some terminals are already equipped with actuated valves which are not of the
spring close to fail type but are instead of a type that stays at the last set position upon loss of power
or control signal. These valves can remain in service for the duration of their expected service life, if
can be proven by risk assessment that the residual risk is acceptable.
It is also understood that providing of a “fail to closed” valve on very large pipelines may be difficult to
achieve and may introduce additional difficulties when dealing with an emergency, e.g. due to water
surge (water hammer).
In this case it is acceptable that a “fail to last set position“ valve is used if risk analysis shows that the
residual risk is acceptable. The justification for this must be documented and agreed at Division level
via the waiver process.
Justification which relies on cost issues alone is not acceptable unless it can be shown that the
additional costs are grossly disproportionate to the level of increased safety which would be provided.
8.4 Valve actuator selection
Any valve used as a shutdown or emergency isolation valve should be installed in line with normal site
standards including anti-static, fire safe requirements and rated to match the terminal pipe
specifications.
The easiest (lowest capital and operating costs) way to achieve a “fail to closed” actuated valve is to
install single acting spring closed, air driven actuator on to a quarter turn (90°) valve. The spring
ensures that the valve is closed down on loss of air pressure.
An electric solenoid valve controls the supply of air to open and close the valve and will automatically
vent the actuator on loss of power.
If electric motor operated valves are used for this function it will normally be necessary to fit an
uninterruptible fire protected power supply with fire proof cabling to ensure the valves close in the
event of loss of the mains power supply.
A third alternative is the use of a “fail to closed” electric hydraulic actuator.
The different alternatives with their advantages and disadvantages are indicated in the table below.

Table 4. Fail to close actuator options
Options Fail to close Advantages Disadvantages
mechanism
Air driven Spring - Cost effective - More difficult to prevent
actuator water surge
- Only open/close
application
- Not applicable for all
sizes valves and all
types of valves
Electrical UPS and fire - Possibility to throttle - Expensive cabling /
actuator proof cabling the valve UPS
- Water surge design
possible
- All types of valves
Electrical / Spring - Possibility to throttle - Expensive actuator
hydraulic the valve - Only ¼ turn valves
actuator - Water surge design
possible
Either quarter turn ball valves or butterfly valves can be used and the choice to use ball or butterfly
valve is typically at the size 8”. Above 8” triple offset butterfly valves should be used.
Triple offset butterfly valves achieve adequate sealing. In high pressure and high temperature
circumstances double off set butterfly valves cannot guarantee adequate sealing.
Valves shall be equipped with position indicator. Valves shall not have a hand wheel installed.
8.5 Closure Times of Valves
The set levels of the overfill protection system are affected by the speed at which the inlet valve
closes. A very short valve closure time can cause pressure surges (water hammer) in the pipelines,
which for long pipelines and /or high flow rates can be sufficiently large to cause flange gasket failures
or even cause rupture of the pipeline.
Pressure surge is particularly an issue for butterfly valves and ball valves which are commonly used in
tank overfill applications. For butterfly- and ball valves the effective closure takes place over a
relatively short portion of the overall closure time for the valve.
It is less of an issue with gate type valves because the closure rates are generally limited by the
mechanics of the valve itself.
General guidance on minimum closure times for tank filling valves on standard product pipelines with
flow rates below 7 m/s can be found in the table below.

Table 5. Typical minimum valve closure times for different pipe length
Length pipe line Typical minimal valve closure time
Less than 500 m 10 second
500 – 1000 m 20 seconds
1000 – 2000 m 30 seconds
More than 2000 m detailed study to determine the minimum valve closure time
8.6 Automatic Tank Gauging System (ATG)
Only proven technology devices should be employed in level gauges. The type of gauge and supplier
shall be selected from:
• Servo level gauge (Honeywell/Enraf)

• Radar level gauge (Honeywell/Enraf or Rousemount – Emerson/Saab)
The choice of measurement principle to use depends on the mechanical design and setup of the tank
and the product which is to be measured. Please be aware that not all gauges are suitable for all
products, systems should be in place to review this aspect both for initial gauge selection and also
when the product changes in a tank.
Key parameters for the selection of the correct measurement principle of product level in a tank are:
• Measurement limits
o Vapour influence on radar accuracy (with reference to appendix 4: radar product list)
o Requirements to the mechanical installation (with or without stilling well)
o Measuring range
• Functional requirements
o Density profile
o Interface level measurement
• Installation aspects
o Stilling well: reference point for manual verification
o Required mechanical modifications (stilling well, alternatively roof nozzle)
• Cost
o Purchase price of equipment
o Mechanical modifications
o Maintenance cost
For more information see Appendix 4 – Gauging Principle Selection Matrix.
Both Enraf and Saab can a supply list of products that can be measured with the radar principle. See
the respective supplier web sites for the latest updates.
8.7 Stilling Well
Using a Servo ATG or floating roofs requires the use of a stilling well. For free space radar
applications a minimum distance shall be used from the tank shell and the centre of the radar.

8.8 Level Switches for Independent Overfill Alarm or Trip
Based on Vopak Best Practices three systems are selected that should be used for new applications
of AOPS systems with an independent level switch:
•
4
Displacer type liquid level switch (Magnetrol)
• Vibrating fork level switch (Liquiphant, Endress & Hauser)
• Explosion proof Mechanical or Electromagnetic switch
Picture Displacement type liquid Picture Vibrating fork level

level switch (Magnetrol) switch (Liquiphant E&H)
The table below shows field of application of the possible selection of the three different switches:
Table 6. Switches versus tank type

Displacement Vibrating fork Mechanical or
type liquid level level switch Electromagnetic
5
switch (Liquiphant , switch
(Magnetrol) E&H)
EFR √ preferred X (√)
Fixed roof tank, no IFR √ √ preferred X
Fixed roof tank with IFR √ preferred X (√)
X means not allowed
√ means allowed
For tanks with IFR using a Magnetrol is preferred above a Mechanical or Electromagnetic switch
because of reliability of total system.
When using a Magnetrol switch it is strongly recommended to mount the switch on an extended
nozzle or double flanged pipe section, with an inspection door. This way the Magnetrol switch can
physically be tested in the field. This is one of the bigger advantages of this device.
An alternative for the inspection door is the use of a Magnetrol prover, see Magnetrol manual
4
Magnetrol type device should have a displacement weight which would float if liquid is present so
that it still activates if IFR is stuck or has product on top
5
The use of mechanical or electromechanical switch for floating roofs detection is not preferred,
because these devices will not comply with the requirement to detect liquid on top of the roof or when
the roof has sunk, API 2350 (2012) annex C note on page 38.

8.9 Positioning of Switch
For fixed roof tanks a level switch should be mounted in the roof of the tank. This way the switch can
be adjusted in height for different product densities, possibly requiring different set points. For external
floating roofs the switch should be mounted in the guide platform, easily accessible for inspection.
Special care shall be taken to prevent static discharge between the switch and the liquid level, see
Vopak Way static electricity standard.
8.10 Wireless systems
It is not allowed to use a wireless system for the level switch or an ATG, when this is the single level
instrument (Level 1 or 2 protection).
It is only allowed to use a wireless ATG for overfill protection, when a hard wired LSH is used as last
line of defense, i.e. level 3 protection.
8.11 Proof testing
Testing, inspection and maintenance for Overfill Protection Systems are described in the Vopak
Maintenance and inspection of Critical Equipment Part 1 and part 2: Tank Overfill Protection System.
Also reference is made to section 4.5.5 of the API 2350 (2012) code.
Vopak requires the terminal to proof test, maintain and document these tests and maintain it in the
spirit of SIL rated systems.
For systems initial proof testing shall be once per year, except for the three highest risk options (see
table 1) and based on results and a risk analysis this frequency may be increased or reduced.
8.12 Maintenance
The details of the maintenance are described in the Vopak “Maintenance and Inspection of Critical
Equipment part 2 – Tank Overfill Protection System” standard

9 Definitions
Item Definition or Description
AOPS Automatic Overfill Prevention System.
Automatic system consisting of level device, controller and actuated

valve which prevents the tank to overfill.
ATG This is a device which monitors and gives a read-out of the tank
level. The read out indication is at some remote location such as a
Automatic Tank Gauge control room, and is sometimes also available as a read out local to
the tank.
ATGs have a computer type interface which allows then to be used

to control the filling of a tank, and to set alarms at predetermined
limits.
Some gauges or the software system also have the capability to

initiate a control action, such as the closure of an automatic safety
valve.
ESV-A This is a valve fitted with an actuator (automatic valve) which shuts
off the inflow to the tank when a high level is detected.
Emergency Shutdown Valve
Automatic operation Automatic trip systems, which act to shut the inlet valve to the tank,
have a far quicker reaction time than an operator can achieve, and
this can allow the high level detection to be set close to the overfill
level, and so maximize the useable capacity of the tank.
ESV-R This is a valve fitted with an actuator which can be closed by a

person pressing a button or a switch at some remote location such
Emergency Shutdown Valve as control room, to shut off the inflow to the tank.
Remote Operation
The person will take the action to close the valve in response to a
level alarm.
GHS "Globally Harmonized System of Classification and Labelling of

Chemicals (GHS)", addresses classification of chemicals by types
of hazard and proposes harmonized hazard communication
elements, including labels and safety data sheets. The GHS also
provides a basis for harmonization of rules and regulations on
chemicals at national, regional and worldwide level, an important
factor also for trade facilitation.
LAH This is an alarm which is activated by the ATG at a level sufficiently
below the LSH to allow action to shut down the tank before the high
High Level Alarm level device is activated.
These can be configured in two ways.

Type a) The gauge initiates closure of the inlet valve to the tank
In this case the alarm limit can be set at or just below the level trip
sensor (it is good practice not to set the levels at exactly the same
level so that they do not both activate at exactly the same moment).
Type b) Action has to be taken by an operator to close off the inlet

flow.
In this case the level has to be set sufficiently below the LSH that
the operator has sufficient time to take action to stop the flow before
the LSH activates.
The LAH level is not allowed to be exceeded. If the LAH is activated

it is to be treated as a near miss and investigated accordingly.
LAHH This is an additional alarm level for a level 2 overfill protection

system no ATG is installed.
Level Alarm High High
LCH This is a notification which is activated by the ATG at a level
sufficiently below the permitted fill level to allow the terminal staff to
High Control Level take action to shut down before operational filling maximum is
reached.
LOC Levels of Concern
Levels of Concern are all liquid levels in a tank which shall be used
for alarms, notifications and liquid levels which will cause overfill or
damage to the tank.
Industrial Tank A tank which is filled by pipeline from some remote location.
Transfers may be batch or continuous.
LSHA This is a sensor which detects a high level in the tank and which
initiates an alarm.
Level Switch It is not connected to any control system.
High Alarm
LSH This is a safety sensor which detects a high level in the tank and
which initiates an alarm and a control action to close the ESV-A in
Level Switch High sufficient time to prevent overfilling the tank.
This sensor is completely independent of any tank gauge system.
The LSH level is not allowed to be exceeded. If the LSH is activated

it is to be treated as a high potential near miss and investigated
accordingly.
If the LSH has to be taken out of service for any reason this shall be
managed within the Vopak Standard on Defeat of Critical (Safety)
Equipment.
LTG This is a simple mechanical device, often based on a tape attached


to a float in the tank and reels in or out as the level (and so the
Local Tank Gauge float) rises and falls.
Level read out is only local to the tank and there is no level alarm
capability.
Manual Gauging This is the use of a traditional tape and weighted bob to manually
gauge the level in a tank.
A variation is the use of a tape and float to find the ullage level
(unfilled level) in the tank. By subtracting this from the known
overall height of the tank the level of the product in the tank can be
found.
Overfill Level (Maximum This is the maximum level the tank can contain just before it
Capacity overflows or just before damage is caused to the tank structure (for
example due to collision between an internal floating roof and other
structures within the tank, or for some fluids overstressing of the
tank due to hydrostatic loading). This is set by the physical
characteristics of the tank.
Permitted fill level This is the maximum level to which the tank will be filled in normal
operation. This is set at a level below the LAH set point sufficient to
avoid alarms due to product expansion during storage. In the
calculation examples and spreadsheet this is set at 1% below the
alarm limit but may need adjustment on a tank to tank basis
depending on expansion factors.
Pipeline fed tank A tank which is filled by pipeline. Also called industrial tank
Transfers may be batch or continuous.
Tank Rated Capacity The set level for the overfill protection device.
The tank rated capacity is set at a level below the maximum
capacity, to allow time for any action necessary to prevent the
maximum level being reached or exceeded.
The separation between the maximum capacity and the tank rated
capacity is a function of the time needed between detecting the high
level and stopping the flow of product into the tank.
The time to stop the flow needs to take account of what the
operator or automatic equipment has to do, and should include the
time to close the valve. In some cases the valve closure time is
deliberately “long” to prevent damaging pressure surges in
pipelines.

Ullage Available space in a tank

Appendix 1 – Tank overfill risk matrix

Attention: Vopak Risk Matrix must be reviewed (e.g. are consequences effective?)
• Step 1 – Product Hazard Classification: Using the criteria above select the hazard
classification and determine the product category (A, B, C or D)
• Step 2 – Risk assessment of other consequences: Using the Vopak risk matrix consider the
other potential consequences of a tank overfill (environment, business, customer, operations
risk etc.) and determine if the risk category changes from the product hazard classification.
• Final selection: Type of overfill protection required is based on the highest category assessed
from steps 1 and 2.
E.g. Neodols are generally “Cat D” products on the above matrix based on its flammability and
toxic hazards. However Neodols are dangerous to the environment (GHS cat 1 Aquatic Hazards)
if they are stored in an impermeable bund then the risk from overfill could remain as “Cat D” but
should this be stored in a permeable bund and there is risk of contamination of soil/water then
the category of product could increase to “Cat A, B or C”.

Appendix 2 – Tank Alarm Level Calculation
Screen shot of Overfill Calcs version 8.1

Appendix 3 - Response time calculations T1 and T2
The method below is based on the Dutch CPR guideline. The United Kingdom specifies similar times
while in North America it is necessary to demonstrate an “adequate” response time to enable the
operator to take corrective action.
Tanks may have different response times to the different alarm level settings.
These times are represented in the spreadsheet in appendix 1 as T1, T2, T3 and T4.
Note that shorter response times are permitted with automatic systems, and protection systems are
duplicated.
Please note that the time limits set out in the table below must be treated as minimum times unless it
can be demonstrated and justified by terminal based trials that a shorter time can be used.
Table 7. Times based upon information in the major hazard assessment codes produced by the
Dutch Authorities. (Reference CPR18)
6 7 8
Type of system Manual Remote Automatic
Action Time (minutes)
High Level detected 0.5 0.5 0.5
Alarm sounds 0.5 0.5 0.5
(Does not count in
overall response as at
the same time a
closing signal is sent
to valve)
Validate the alarm 7 7 0
Travel to the valve closure 15 .5 0
position and initiate
closure
Closing signal reaches 0 .5 .5
valve
Close Valve 7 1 1
Total 30 minutes 10 minutes 2 minutes
These times are similar to times proposed in other regulatory areas.
For example:
In United Kingdom, where operator action is needed, times less than 20 minutes need detailed
justification. The API 2310 indicates that response times less than 10 minutes shall be justified by
human factor analysis
6
Manual means no actuated valves to stop tank from overfilling.
7
Remote means actuated valves, which can be controlled from a central control room, but the action
still requires operator interference.
8
Automatic means actuated valves, when the level is reached the actuated valve closes automatically
without operator interference.


Appendix 4 – Gauging Principle Selection Matrix
Notes:
• The accuracy of radars has been increased dramatically the last years, so in most application
radars are preferred over servos gauges due to the higher reliability, more robust design and
lower maintenance cost
• Check on vapour effects of radars.
• In some very specific cases the required legal accuracy and if this cannot be achieved by
radar. Please check legal accuracy against accuracy of radar.
Application Gauging Remarks

Principle
Preferred Alternative
Products
Heavy oil Products Radar Servo New Tanks – always radar unless excluded
Products included on radar by product.
approved list For existing tanks consider product and
extent of any tank modification required.
Waxy, or polymerizing products Radar Servo Servo will require high maintenance
activity.
Light oil products with high Radar Servo Radar cannot be selected for some
vapour influence on radar products due to radar beam scattering or
refraction within the vapour space.
Chemical tanks – dedicated Radar Servo Provided that there is no vapour issue.
Chemical tanks – multi-user Radar Servo Gives the widest range of product
application for custody transfer.
Tanks / Applications
Tanks under pressure Radar / Servo Choice in support with supplier.
Tanks with internal floating roof Servo Radar is not an option in this circumstance.
but no stilling well
Tanks with internal floating roof Radar
with stilling well
Fixed roof tanks, with or without Radar Servo
stilling well
Additional function requirements For example density, water bottom.
Measurement of density profile Servo Useful for blended product to demonstrate
full mixing.
Water interface detection Servo Radar Standard feature on many servo gauges,
relies on density difference.
Radar requires separate interface probe.
Installation aspects
If suitable nozzle available Radar Servo Costs for overall modification of tank, fitting
of stilling well, new nozzles, operational
availability of tank – all influence the final
decision.


Def - Tank Overfill Protection v3.0 - February 2015 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Def - Tank Overfill Protection v3.0 - February 2015 PDF

Uploaded by

Copyright:

Available Formats

Tank Overfill Protection

Tank Overfill Protection I Version 3.0 I February 2015

Confidentiality and Distribution

February 2015 3.0 Updated risk matrix and updated options

Tank Overfill Protection I Version 3.0 I February 2015

2 OVERFILL PROTECTION PROCESS 8

5 DEFINITION OF OPERATING PARAMETERS 14

Tank Overfill Protection I Version 3.0 I February 2015

APPENDIX 1 – TANK OVERFILL RISK MATRIX 37

APPENDIX 2 – TANK ALARM LEVEL CALCULATION 39

APPENDIX 3 - RESPONSE TIME CALCULATIONS T1 AND T2 40

APPENDIX 4 – GAUGING PRINCIPLE SELECTION MATRIX 42

Tank Overfill Protection I Version 3.0 I February 2015

• Requirements for integrity organization;

The main update version 2.1 for this standard was:

This updates for versions 2.2 are:

Out of scope are:

1.2 Related standards

For a minimum the following Vopak standards are related;

Tank Overfill Protection I Version 3.0 I February 2015

Related international standards are:

1.3 Roles and responsibilities

The Terminal manager responsibilities include:

The Operational Manager responsibilities include:

Tank Overfill Protection I Version 3.0 I February 2015

The Maintenance manager responsibilities include:

Engineer responsibilities include:

Tank Overfill Protection I Version 3.0 I February 2015

The API 2350 standard is used as basis for this standard.

2.1 Management system

Details can be found in chapter 3.

2.2 Risk assessment

Details can be found in chapter 4.

2.3 Definition of operating parameters

The Level of Concerns shall be based on amongst others:

Tank Overfill Protection I Version 3.0 I February 2015

2.4 Operating procedures

Details can be found in chapter 6.

2.5 Equipment specifications

Detail can be found in chapter 7 and 8.

Tank Overfill Protection I Version 3.0 I February 2015

The MOC system is described in the Vopak Fundamental+ standard.

Tank Overfill Protection I Version 3.0 I February 2015

Continuous fed tank

Non-continuous fed tanks:

4.2 Risk matrix

Tank Overfill Protection I Version 3.0 I February 2015

Table 1. Risk matrix for overfill protection

Tank Overfill Protection I Version 3.0 I February 2015

Continuous Pipeline Transfer

4.3 SIL assessment

Tank Overfill Protection I Version 3.0 I February 2015

5.1 Levels of Concern

• Level alarm high (LAH);

The Levels of Concern (LOC) shall be established based on:

Vopak definition API 2350 definition

In figure 1 the different LOC’s are shown.

Tank Overfill Protection I Version 3.0 I February 2015

Overfill Level (or Maximum Capacity):

Tank Overfill Protection I Version 3.0 I February 2015

If the overfill level is reached the required actions are:

Level Switch High (LSH) (or Tank Rated Capacity):

Level Alarm High (LAH):