API 2350 is in its 4th edition, and the 5th is scheduled for next year. It is expected to clarify issues that generate interpretation doubts without major changes in procedures.

In API 2350, the levels of concern for the product inside the tank are defined. Are they:

• Maximum operating level - Maximum product level that must be achieved under normal operating conditions;
• Very high level – Demands an alarm, indicating that the reception must be stopped;
• Critical level – It is the most critical level, on the verge of causing an overflow.

The distance between the very high and critical level (h) must be calculated as a function of the action time for blocking the tank, before the product reaches the critical level. This distance should not be less than three inches.

The maximum operational level must be determined below and as close as possible to the very high level so that there is no loss of storage, however, external factors must be taken into account to avoid undue triggering of the very high level alarm, such as thermal expansion, turbulence and earthquakes.

API 2350 presents a method of protection against overflow using an AOPS (Automatic Overfill Prevention System), whose application can reduce the distance between the very high and critical level and, as a consequence, raise the height of the maximum operational level.

API 2350, up to its 3rd edition, recommended good practices for preventing overflow. In its 4th edition, API 2350 ceased to be a recommendation of good practices and became a standard.

In Brazil, API 2350 is a normative reference and is cited as an indispensable document for the application of the ABNT NBR 17505 standard, which specifies the requirements for the storage of combustible and flammable liquids, defined in ABNT NBR 17505-2:2015.

In addition to the ABNT standard, some units of the fire department, in the form of a Technical Instruction, which aims to establish the minimum requirements necessary for the preparation of a project and dimensioning of the fire safety measures required for production, storage, handling facilities and distribution of combustible and flammable liquids, signal the consultation to API 2350 regarding the means of preventing overfilling.

What is the impact for adequacy to API 2350?

When we deal with the subject, one of the first questions that the operation team asks is: to adapt to API 2350 will it be necessary to reduce the operational level of the tanks? And the answer is: it depends. The category to be applied for adequacy of API 2350 will depend on the existing instrumentation, operational procedures, process risk analysis, probability of failure on demand of instrumented systems, among other factors.

Once the category is defined, the terminal can decide to use a higher category, raising the maximum operational level of the tank, since the response time required for blocking the tank, in case of a very high alarm, will be reduced.

The opposite may also occur, and the maximum operating level must be reduced if the terminal is operating the tank in a category that is not compatible with the real response time for blocking the tank.

If the tank block response time is not calculated, API 2350 determines the minimum times by category as follows:

Category I – 45 minutes

• Local operation:
  • Continuously assisted operation in the first hour of product receipt;
  • Assisted operation every hour during product receipt;
  • Continuously assisted operation in the last hour of product receipt;
• It has no mechanism for announcing alarms;
• Overfill protection relies on manual operator intervention on site;
• It can only be used in situations where the process is simple, with a slow rate of leveling up.

Category II – 30 minutes

• Local and/or remote manual operation;
• The tank level can be read using automatic measurement or a sensor located in the tank capable of transmitting a signal and/or alarm;
• Can use dependent alarm;
• Semi-assisted operation:
  • Assisted operation in the first 30 minutes of receiving the product;
  • Assisted operation in the last 30 minutes of product receipt.
• Overfill protection dependent on manual operator intervention on site or remote.

Category III – 15 minutes

• Local and/or remote manual operation;
• Tank level provided by automatic measurement;
• Very high level and alarm information is also transmitted to the control room so that the operation can be stopped manually;
• It has a very high level switch and alarm, exclusive for overflow prevention;
• Overfill protection dependent on manual intervention by local or remote operator.

AOPS

The AOPS (Automatic Overfill Prevention Systems) is intended for use on tanks classified in any of the three categories. The advantage of AOPS is the ability to perform receiving interruption through a final element, for example the tank inlet valve, without human intervention. AOPS is composed of 3 components: sensor element, logic solver and final element. The high-high level sensor must initiate a safety function in the logic solver, which will trigger the closing of the final element, ie the tank inlet valve, thus stopping the rise of the tank level.

It is important to highlight that this closing of the valve must have its time calculated to avoid breaking the inlet connected to the product dispatcher.

According to Bolonkin (2008), pipelines are, in general, the most economical way to transport large amounts of oil or natural gas over land. Compared to railways, this modal has a lower cost per unit and greater capacity. In addition, it works 24/7, except during maintenance. Interruptions that may affect the transportation period, such as weather or traffic, do not affect pipeline operation.

However, a significant disadvantage of using this type of transport is the possibility of leaks that may occur as a result of erosion, corrosion, landslides, acts of vandalism, actions of third parties, among others. Due to the high pressure at which the products are pumped and, depending on the type of substance transported, these leaks can cause serious environmental and socioeconomic damage.

With this in mind, oil and gas transportation companies are continually looking for more sensitive, accurate, repeatable, reliable and robust leak detection systems (SDVs). The American standard API 1149 defines these characteristics as follows:

• Sensitivity: the smallest loss that can be detected (with confidence)
• Accuracy: The accuracy at which the size and location of the leak can be estimated
• Reliability: the confidence that can be attached to any reported loss
• Availability/Robustness: The uptime that can be expected from the SDV under normal conditions; and also the resilience of the SDV to unexpected conditions

There are several technologies for leak detection that have different advantages, disadvantages and levels of complexity. The API 1130 standard classifies these technologies into two types:

• External systems, which depend on specific hardware, instrumentation or sensors to operate, such as optical fiber, acoustic emission detectors, etc.;
• Internal systems, which use existing infrastructure, such as mass or energy balance, RTTM (Real Time Transient Model), statistical analysis, etc.

One system that currently protects more than 11,000 miles of pipeline around the world is the Synergi Pipeline Simulator (SPS), which combines Statefinder and Leakfinder modules. These modules are based on the represented states (variable conditions) of a pipeline system.

For the system to perform as expected, it is necessary to create a hydraulic model of the pipeline, provide real-time measurement data from SCADA, and also provide consistent fluid property data. Thus, through the field data and the fundamental laws of fluid mechanics, the model will track conditions very close to the real pipeline and investigate temporal anomalies between the measured data and the model.

One mechanism that the SPS uses to reconcile differences between measured and modeled head losses are diagnostic flows, which are flows injected or removed from the model to preserve the mass balance when there is a discrepancy. If average diagnostic flows exceed a predefined dynamic threshold, the software will:

• Alarm;
• Define the type of abnormality;
• Define the confidence level of the alarm.

There are 5 alarm statuses: (1) Starting (in case detection has been turned off), (2) Okay (there is no abnormality), (3) Circulation (indicates circulation has occurred), (4) Injection (indicates flow injection) and (5) Leak (indicates leakage). Statuses 3 and 4 normally indicate modeling or instrumentation problems, as they are very unusual events to occur in an operating pipeline.

It is important to note that, as stated in Annex A of API 1130, no CPM (Computational Pipeline Monitoring) methodology or technology is applicable to all pipelines, because each system has an exclusive configuration and operation. Furthermore, detection limits are difficult to quantify due to the unique characteristics presented by each pipeline. Boundaries must be determined and validated, system by system, and perhaps section by section. Pipeline operating conditions (steady state or transient) will influence the minimum size of product loss that can be detected so detection limits for CPMs are not fixed. During transients the detection limits are higher.

Another factor that must be highlighted is that efficiency objectives (sensitivity, accuracy, repeatability, reliability, availability and robustness) are often at odds with each other. For example, high sensitivity in leak detection generally leads to more false alarms and, consequently, lower reliability, so it is essential that tuning is carried out and monitored according to the main relevant points defined by the customer.