Only a safe plant is economical

Products Solutions Services API 2350 4 th edition- how to apply on your site? Overfill protection for storage tanks in petroleum facilities Aboveground storage tanks Only a safe plant is economical Slide 1 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Definition In recent years, accidents caused by tank overfilling, have resulted in loss of life and the loss of millions of dollars in damages to facilities worldwide. Although the loss in assets and the costs for compensation are high, companies struggle mainly with damage to image: thus the emphasis on reliability, safety and accident prevention has never been greater than today. An Overfill Prevention System is a facility to detect, indicate and prevent the fluid level in storage tanks rising up to a hazardous overflow. Because of prescription or best practice, safety relevant tasks such as overfill prevention are usually covered by systems operating independently of the process control. Today, Safety Integrity Levels (SIL) are often used to achieve a legally binding level of risk reduction in an easily comprehensible process. Slide 2 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Background Accidents caused by tank overfilling Slide 3 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Buncefield, UK In the early hours of Sunday 11 th December 2005, a number of explosions occurred at Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire. Slide 4 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Buncefield, UK Although the failure of the level measurement was apparent, the operating personnel took no action. TOTAL has been found liable. The judgment leaves the company facing damages claims of around 700 million. Slide 5 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Cataño oil refinery fire, Puerto Rico The fire began with an explosion at 12:23 am on 23 th October 2009 at the Caribbean Petroleum Corporation oil refinery and oil depot in Bayamón, Puerto Rico and burnt for 2 days Slide 6 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Cataño oil refinery fire, Puerto Rico Officials in Puerto Rico ordered the evacuation of a whole neighborhood near San Juan (1,500 people) after the explosion triggered a major fire. The blast was measured at a strength of a 2.8 magnitude quake. In 2010, Caribbean Petroleum Corporation filed for bankruptcy. The company cited debts of $500 million to $1 billion after the incident. Slide 7 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Port of Santos, Brazil The fire at Latin America s largest fuel tank storage facility near the port of Santos, Brazil burnt for 8 days and cost millions. Eighteen people were treated for injuries. Slide 8 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? But not only Hundreds of tank spills happen every day generating costs of billions of dollars each year. It is estimated that the number of oil spills exceeds 100 000 spills each year worldwide. Statistically an overfill incident occurs after 3,300 filling operations. A group of 14 tanks with 2 filling operations per tank and month (=336 filling operations) would have one overfill every 10 years! Slide 9 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 3rd edition (2005) independence required!!! overfill protection for storage tanks in petroleum facilities C.1.2 [ ]overflow protection systems shall be independent of any tank gauging device or system. [ ] A.5.3 [ ] independent level switches must be installed for single and two-stage level detector systems. [...] [ ] Tanks equipped with a high-level detection device that is independent of any tank gauging equipment. [ ] Slide 10 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 4 th edition (2012) Categories Category 1 Display ATG Control center Category 2 ATG Receipt Alarm Category 3 ATG LAHH Receipt Alarm Slide 11 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 4 th edition (2012) Categories Category 1 Display ATG Control center ATG Receipt (min. 1h at the start + min. 1h after the Alarm Category 2 ATG LAHH Receipt product receipt and until at least 30 min Alarm Category 3 Fully attended end + periodically visual check on site) Be aware: no manual hand dipping during after a product receipt! Slide 12 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 4 th edition (2012) Categories Category 1 ATG Semi-attended Control center (min. 30 min at the start + Display min. 30 min after the end) Category 2 ATG Receipt Alarm Category 3 ATG LAHH Receipt Alarm Slide 13 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 4 th edition (2012) Categories Control center ATG Category 1 Display Unattended (ATG and independent level alarm high-high sensor) Category 2 ATG Receipt Alarm Category 3 ATG LAHH Receipt Alarm Slide 14 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Typically Category 1 tank only 1 transfer at one time Category 1 Category 2 Category 3 Typically 1 transfer at one time Multiple tanks can be filled simultaneously Multiple tanks can be filled simultaneously Slide 15 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 4 th edition (2012) Categories Category 1 Display ATG Control center Category 2 ATG Receipt Alarm Category 3 ATG LAHH Receipt Alarm Slide 16 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Definition of AOPS and MOPS AOPS: An overfill prevention system not requiring the intervention of operating personnel to function MOPS: Manual overfill prevention system that depends on the interaction of operating personnel to terminate the receipt. A person physically turning a valve or pushing a button that remotely closes a valve or turns off a pump are both manual operations. In MOPS, the alerts and alarms provide the operating personnel with information only. AOPS can be added to all three categories Slide 17 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? If necessary, add AOPS on all categories ATG Control center Category 1 Display AOPS Logic Solver Category 2 ATG AOPS Receipt Alarm Logic Solver ATG LAHH Receipt Category 3 AOPS Alarm Logic Solver Slide 18 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Overfill prevention is best achieved by use of AOPS Section 4.1.1. of API2350 Prevention of tank overfills is best achieved by: A) Awareness of available tank capacity and inventory; B) Careful monitoring and control of product movement; C) Use of reliable instrumentation, sensors and systems; and D) use of automatic overfill prevention systems (AOPS) where deemed appropriate by a risk assessment and risk-based analysis. Slide 19 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 (2012) independence of AOPS from the ATG AOPS: to use automated overfill prevention system (instrument, sensor, logic solvers and final element) you should follow Annex A (existing site). Annex A is clearly requesting independence from the ATG. Annex A states, that sensors with self testing diagnostic features are preferred. Slide 20 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API 2350 4 th edition (2012): Annex A, which is normative Annex A provides good practices for implementation of an automated overfill prevention system (AOPS) for existing tank systems. Annex A.3 Independence The term independent means that the AOPS shall be separate from any device or method used to measure, calculate or monitor tank receipts. The independent AOPS shall be designed and installed such that no fault in the ATG gauging and monitoring system is capable of causing a fault in the AOPS. Annex A.4.2 Sensors Sensors with self testing diagnostic features are preferred for all AOPS tank level detection applications Slide 21 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Competition: 2 in 1 feature? Competitor claims to have two redundant electronic boards in one radar/device, but they are still using the same/one antenna. This is not allowed by API2350 for an AOPS What happens, if moisture/water is in the electronic compartment or having water built-up in the antenna? What happens, if the radar beam is not reflected (e.g. liquid is boiling, obstacles in the radar beam)? What happens, if cables breaks? Slide 22 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? High-High tank response time The high-high tank response time is the period of time required to terminate the receipt of flow to a tank in response to reaching the high-high tank level in order not to reach the critical high level. Minimum High-High Tank (HH) Level Response Time (if not calculated) Category 1 45 2 30 3 15 Time in Minutes Slide 23 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Different maximum working levels due to different minimum level response time (if not calculated) Category 1 Category 2 Category 3 CH CH CH HH MW Best tank capacity utilization with AOPS Slide 24 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Best capacity utilization with AOPS system. Category 1 Category 2 Category 3 CH CH CH AOPS=HH MW Slide 25 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? API2350 relation to IEC 61511 AOPS for new sites: follow ANSI/ISA 84.00.01-2004 (IEC 61511 modified) 1. Generic standard Valid for all relevant sectors 2. Application standard Implementation for Process industries IEC 61508 Safety Regulations IEC 61511 ISA 84 Supplier and manufacturers System integrator/ Operator/User Common Target - Plant Safety! Slide 26 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Layers of protection Mitigation Plant emergency response Embankment Relief valve, rupture disk, F+G system Emergency response layer Passive protection layer Active protection layer Safety instrumented system Emergency Shutdown Isolated protection layer Trip level alarm Prevention Alarm & operator intervention Basic process control system or DCS Plant and process design Wild process Normal process Process control layer Process control layer Inherent safe plant design Slide 27 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Overfill prevention process (OPP) in API2350 4 th Edition Overfill prevention process (OPP) consists of A) management system B) risk assessment system C) defining operational parameters D) requirements for procedures E) equipment systems Slide 28 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Wireless communication is not allowed Annex A.3 Correct operation of the AOPS shall not require communications to or from any location remote from the facility where the AOPS has been installed. AOPS shall not rely on wireless communication to initiate diversion or termination of receipt. Slide 29 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Key points of API 2350 4 th Edition 2012: Above ground storage tanks Introduction of Tank Category 1, 2, 3 Differences between AOPS and MOPS Independence of AOPS AOPS for new sites follow ANSI/ISA 84.00.01-2004 (IEC 61511 modified) Overfill Prevention Process Proof testing A HHLA sensor on a floating roof tank have to detect the oil, even if it is above floating roof. No wireless communication for AOPS Slide 30 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Where can you get the complete standard API2350? The standard itself is available for about 120 USD from the website of API (www.api.org) Slide 31 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? Fixed roof solutions Functional Safety Proof testing Mounting Tuning Fork IEC 61508 design Proven in use Suitable for SIL 2 / 3 Discrete output (relays) or 4..20 ma output Push button activated test generator High proof test coverage Side Top adjustable Top Radar Proven in use By proof test Suitable for SIL 2/3 Internal redundancy (EOP) simulation Analogue output (4-20 ma) Proof test Switching in safety coverage system or RMA422 depends on inspection depth Top Slide 32 07/19/2016 Ngo Consult AG Sales Support

API2350 - how to apply on your site? (External) floating roof failure scenarios Snow cover Damaged deck Lost deck Free space Radar May lead to lost echo Fails Safe May lead to lost and deflected echo depending on deck position Fails Safe May lead to some switch point deviation (up to 100 mm) No failure No Failure No Failure No failure Tuning Fork Slide 33 07/19/2016 Ngo Consult AG Sales Support

Products Solutions Services Overfill Prevention System: SOP600 Launch Presentation Slide 1

Introduction A safe and reliable solution to prevent hazardous overflow in tanks Slide 2

Industry Effects A New Focus on Standards Buncefield Report Recommendations on the design and operation of fuel storage sites Major Incident Investigation Board (MIIB) American Petroleum Institute s (API) Recommended Practice RP2350 Overfill Protection for Storage Tanks in Petroleum Facilities Standard IEC 61511: Functional safety - Safety instrumented systems for the process industry sector Slide 12

Industry Effects Buncefield Report Buncefield Report Recommendations on the design and operation of fuel storage sites Major Incident Investigation Board (MIIB) American Petroleum Institute s (API) Recommended Practice RP2350 Overfill Protection for Storage Tanks in Petroleum Facilities Standard IEC 61511: Functional safety - Safety instrumented systems for the process industry sector Slide 13

Industry Effects Buncefield Report Slide 14

Industry Effects API 2350 Overfill Protection Buncefield Report Recommendations on the design and operation of fuel storage sites Major Incident Investigation Board (MIIB) American Petroleum Institute s (API) Recommended Practice RP2350 Overfill Protection for Storage Tanks in Petroleum Facilities Standard IEC 61511: Functional safety - Safety instrumented systems for the process industry sector Slide 15

Industry Effects IEC 61511 Functional safety Slide 18

Industry Effects IEC 61511 Functional safety Buncefield Report Recommendations on the design and operation of fuel storage sites Major Incident Investigation Board (MIIB) American Petroleum Institute s (API) Recommended Practice RP2350 Overfill Protection for Storage Tanks in Petroleum Facilities Standard IEC 61511: Functional safety - Safety instrumented systems for the process industry sector Slide 19

WHG ; API2350 and IEC61511 IEC61511 WHG API2350 Slide 20

General Safety Instrumented System (SIS) Safety Instrumented System according to SILx Logic solver Communication Communication Sensor Actuator Process Interface Process Interface Process Slide 27

General principle: Overfill Prevention System SOP600 Slide 29

Key system features Scalable from 1 to 16 tanks per system Certified according IEC 61511 up to SIL3 by Compliant to API 2350 For automated and manually operated systems Failsafe High-High Level Alarm detection Optional High Level Warning detection Integrated automated proof test procedure Proof test report printout ability Uninterruptible power supply for 30 minutes autarkic operation Detailed warning and alarm messages Independent signalization of warnings and alarms Slide 30

Main benefits Automated proof test guarantees that the safety instrumented system functions perfectly. Proof-testing of 16 tanks takes less than 5 minutes. Completely independent Safety Instrumented System satisfies the highest safety standards (according IEC 61508/IEC 61511) and complies to API 2350 With the Automated Overfill Prevention System the tank capacity can be increased without major mechanical upgrades. The actuators for emergency shut-down (ESD) can be included in the overall safety data calculation. Slide 32

Covering all regulations Slide 34

Sensors and instrumentation The selection of sensor and transmitter determines the achievable safety level: Suitable for SIL2 complaint overfill prevention system: Liquiphant FTL5x or FTL7x with FEL57 and Nivotester FTL325P* Suitable for SIL3 complaint overfill prevention system: Liquiphant FTL8x with FEL85 and Nivotester FTL825* Proof-test can be made for 12 years without the need to fill up to the Liquiphant fork. * Nivotesters are included in SOP600! Slide 35

SOP600 The cabinet size and layout is dependent on the specific project Slide 36

User interface The two inch character message display enables the operator to read latest status information from other side of the room. It shows the latest status message, but with smart prioritization a new warning, for example, will not overwrite an unacknowledged alarm. The operator panel with 10 inch touch display is the main user interface for operation of the system. Slide 37

Control cabinet signalization Horn for warning indication. Orange light for warning indication. Green light for overall status good indication. Siren for alarm indication. Red flashing light for new alarm indication. Red light for acknowledged alarm indication. Slide 38

Power management The system provides a redundant and uninterruptable power supply. The UPS battery provides power for 30 minutes operation of the complete system including sensors. To ensure the lifetime of the UPS battery, the temperature in the cabinet is measured with a Thermophant. The status of the power supplies, the UPS and the temperature are monitored. Slide 39

External field signalization (SIL approved) External alarm: flashing light The flashing light is monitored by an optical sensor External alarm: siren Protect your ears! The siren sounds with 105dB at a distance of 1 meter! The siren is monitored by an acoustic sensor Slide 40

Safety shut-down relay (ESD for AOPS) For each tank, there is a 2-channel relay output for the failsafe shut-off of pumps and valves. In the event of a tank related safety alarm, the related safety relay output opens. The safety relay requires a manual reset command. The status of the safety relay is monitored. Slide 41

Emergency shut-down valves We can recommend appropriate ESD valves. Their safety data can be incorporated into a project specific safety certificate. Pneumatically or hydraulically actuated Ball valve or butterfly valve Slide 42

User interface Detailed warning and alarm messages support the operator Slide 43

User interface Overview page Message bar shows warning and alarm messages, changes color dependent on status. Tank field, shows tank name (user editable) and changes color dependent on status The state bar displays the current active user and the time remaining until next required proof test. The button bar contains the navigation and action buttons. Buttons are visible/not visible depending on the access rights of the user. Slide 45

Documentation The following documents are within the scope of supply for an Overfill Prevention System: Wiring Diagram incl. - cabinet layout -part list Operating Instructions Functional Safety Manual Safety Certificates Test Reports (optional) Safety System Specification Data Sheets Slide 46

Functional safety certificate Slide 47

Additional support Additionally the following support can be offered: Factory Acceptance Tests (FAT) Commissioning support Site Acceptance Tests (SAT) Safety certification Training Maintenance contracts Service level agreement Customized life-cycle management Slide 50

Time & Efficiency Example: Proof Test Conventional Proof Test Proof Test with dismounting the sensor and testing it outside of the tank or even with rising the tank level is not only time consuming but also a potential source of failures. In average customers spend 4 man hours per tank with conventional proof testing methods. Remote, Automated Proof Test The remote automated proof test is done in 5 minutes for 16 tanks. > This saves more than 60 hours for 16 tanks. Slide 55

Costs & Economy Example: Increased tank capacity Tank capacity and flow rates: Tank capacity: 1 500m3 with 10 m diameter Inlet Flow rate: 90 m3/h Volume per cm height : 0.7854m 3 /cm Filling rate: 1.5 m 3 /min Compare category 2 tank with automated overfill prevention : The maximum working height is 57.3 cm below the critical height for a category 2 tank with a response time of 30 minutes (minimum). With an automated overfill prevention system the response time is less than 1 minute this results in the maximum working height of 1.9cm below the critical height (minimum 3 inch =7.62cm). The tank capacity could be increased by 57.296cm - 7.62cm = 49.676cm => 39 m3 => 2.6% Slide 56

Automated overfill prevention system Slide 60

CSB safety video on 2009 CAPECO explosion Slide 61

What is process safety and what does that imply? Slide 62

Simply explained Plant safety Slide 63

Endress Hauser Functional Safety Process Measurement Slide 64

References I know that quality is an important asset that I can use to set standards Slide 65

Installation examples Overfill Prevention cabinet Slide 66

Overall status is good Slide 67

The safety sensor and the separate tank-gauging system Slide 68

Flexibility in design - liquid bulk storage Installation ecamples: Liquiphant SIL2/3 Always the first solution. Independent High Level Alarms Best technology available Internal floating roofs and external decks require installation of stilling wells or side mounted chambers Slide 69

Products Solutions Services Overfill Prevention System SOP 600 Thank you very much. Slide 70