TODAY'S petroleum distribution operations, whether pipelines or terminal facilities, need to ensure that protection is given to human health and the environment. It's essential to prevent tank overfills at above-ground atmospheric storage tanks because overfills and the resulting consequences — potential volitization and groundwater-soil contamination — pose a significant risk to the safety of workers, surrounding communities, and the environment itself.
Overfill incidents demonstrate the need, and urgency, for Tank Overfill Protection (TOP) measures to be evaluated and, as determined, undertaken, according to Michael E Erickson, senior consultant for the Antea Group. He spoke during the International Liquid Terminals Association's 31st Annual International Operating Conference June 6-8 in Houston, Texas.
“There are benefits in any comprehensive approach to a major program,” he said. “Some of you may be saying, ‘I don't have large facilities. I don't have large numbers. We're not an integrated international oil or energy concern.' I would contend that in my experience, principles of how you approach programs large or small are synergistic and apply to both large and small. Arguably some would say that in smaller terminals in the smaller business side, some of the greater risk can result. In today's world, extraordinary attention is brought to industry failures. There are benefits in implementing programs and developing them in a comprehensive way.
“Being an old Army officer, I learned very quickly that troops, the workers in the field, are going to embrace what a leader espouses. It's important to have management's vision clearly articulated. It's important to drive an organization's commitment to strengthen accountability, not only for the employee in field, but at the management level as well. All too often, programs are birthed and launched like a child, but from then on the parenting fails. So it's important to identify systemic gaps.
“The question is then, ‘What's the benefit?' I would contend that enhanced operation, risk reduction, and improved safety should be among the objectives.”
In “A Comprehensive Approach to Tank Overfill Protection Philosophy, Vision, Objectives, Program Structure & Execution,” Erickson described a real-time, ongoing project involving a US pipeline organization with over 800 A/G atmospheric storage tanks (Class I-III) and over 90 terminals and pipeline locations. The program is currently undergoing its first year of compliance and assurance evaluation.
“Some of you may not be owners of large-scale Fortune 500 terminals,” Erickson said. “The important takeaway is the principles and methodology. It's relevant to all types of terminal and pipeline operations.”
He said this company had strong leadership and vision at the top, and listed this vision: “Committed to the highest-quality practices in overfill protection and safe operations … will continually improve effectiveness.”
He said upgrading and buying new gauges is important and necessary, but that's not the driver of success.
“That's not going to make an effective tank overfill protection plan work,” he said. “It's what you do in the programmatic aspect.”
That aspect addresses various program features: policy development, standards and procedures, roles and responsibilities, program management functions, and various content features of the overfill policy to be implemented. Another key aspect deals specifically with overfill equipment, to include equipment identification and related engineering, procurement, and construction (installation) activities, as well as any necessary electrical and instrumentation upgrades at a facility. The programmatic aspect, in a proactive and preventative sense, is deemed the most protective regarding tank overfill events.
Vision and philosophy
Erickson said an effective tank overfill program should be proactive and reflect management's vision, philosophy, and long-term commitment to achieve uniform protection standards and practices. The program should be reasonably comprehensive in scope, requiring development of key program parameters to ensure successful development and implementation. Such parameters necessarily include: objectives to be accomplished; specific content features to be developed; new or revised definitions and terminology to be fully understood; operating requirements and practices to be defined and followed; appropriate organizational training required; engineering, procurement, and installation requirements (for identified overfill protection equipment) to be established; and long-term commitment to compliance and assurance evaluations.
A conceptual model for tank overfill protection program should seek to address or incorporate the following: development of a tank overfill philosophy, to include vision and objectives; program management structure and protocols to achieve integration across the various stakeholders and full program implementation; and a survey of existing facilities to establish a database of overfill input parameters (level settings, alarms, etc).
Program content features: standardized procedures and protocols; standardized definitions and requirements, with a particular emphasis on alarm set-point methodology and minimum response time for critical levels; employee roles and responsibilities to be followed at the business manager, engineering staff, and operations levels; conformance standards and measurement parameters; integration requirements with engineering, inspection, and maintenance; training to be accomplished, at all levels; implementation of program policy requirements, above, using Management of Change procedures, etc.; compliance and assurance to evaluate conformance vs. non-conformances regarding policy implementation, with the goal of achieving continuous improvement and integrating shared learning; overfill equipment and installation evaluations.
He said a tank overfill program should have a clear focus, purpose, and an end state to be achieved. A conceptualized vision statement and set of objectives might include the following vision concept and objectives:
- Consistency
Demonstrate recognized and measurable consistency in tank inventory management practices and tank overfill protection…measured by establishing measurable standards of conformance; identifying non-conformances and corrective actions to be undertaken; and implementing continuous improvement, shared learning's, and best practices
- Efficiency
Achieve optimal product delivery and receipts that ensure no tank overfills….efficiency measured by demonstrated clarity on available tank capacities & equipment status; demonstrated planning prior to product movements; and demonstrated knowledge and responses during inventory and product movements;
- Safety
Improve and enhance safety performance and operational culture by implementing an overfill policy…safety success will be measured by demonstrated leadership and commitment to safety; reduction in OSHA recordables and meeting our safety expectations; and improvement in safety performance evaluations (e.g. field audits).
- Environmental
Reduce or prevent environmental spills by eliminating tank overfills…environmental commitment will be demonstrated through a demonstrated record of no tank overfills; establishment of a culture in which employees understand they are individually accountable for adhering to, and enhancing, our quality program; and ensuring compliance with all applicable regulatory requirements.
- Assurance
Develop a systemized approach for ensuring the delivery of conforming work products and outcomes…assurance will be evidenced by establishing measurable objectives and ensuring compliance with all applicable regulatory requirements.
The program management (PM) structure must be designed to ensure alignment in objectives and achievement of key milestones and deliverables, he said. The various teams must be properly identified to optimize alignment and accountability. Decision-making must be efficient, and issues must be identified early-on, with resolution occurring timely.
The PM structure for a tank overfill protection program consists of key leadership assignments and accountabilities. Within the structure, there are “Focus Teams” that have a specific program area accomplish and a scope of work to execute. Focus Team leaders making recommendations to the program manager and seek input from other team leaders. A “Program Execution Support” serves to facilitate and coordinate the many activities and help resolve the key issues that arise.
The Focus Teams should be integrated in the communications and decision-making processes. The teams must have accountability for their respective areas and yet anticipate common areas of technology and operational overlap. Issues must be resolved timely.
The various steering committee groups represent key stakeholders, across the larger organization, potentially impacted by specific decisions regarding tank overfill implementation (new standards issued throughout the organization); tank capacity impacts (losses or gains) due to new minimum response times to be met; budgetary implications; and risk-management considerations.
Policy provisions
An overarching document should be developed to establish the basic policy regarding tank overfill protection, and should include key objectives, standards, and specific conformance requirements.
“The policy's provisions should apply to all employees of the organization who are directly involved with, impact, or influence storage tank operations, including tank filling, monitoring and measuring, maintenance and reporting,” he said. “The policy should apply to all atmospheric storage tanks that receive pipeline, truck, rail, and marine deliveries (crude or petroleum) controlled or monitored by the organization's personnel, to even include the organization's owned tanks receiving deliveries by other non-organizational operations. Where possible to implement, the requirements should apply to facilities owned by the organization but operated by others, and even those facilities operated by the organization but owned by others.”
A “Primary Response Time” is the amount of time at maximum flow rate between a high-level alarm and a high-high-level alarm. This time shall be used to calculate the high-level alarm set point.
A “Secondary Response Time” is the amount of time at maximum flow rate between a high-high level alarm and the overfill level of the tank. This time shall be used to calculate the high-high level alarm set point.
Alarm set points shall be established based on the amount of a tank's available space required to support the response times determined above and at maximum possible flow-rates. The calculations shall be completed for each tank at a facility and resulting documentation shall be archived and made available to all facility personnel.
Front-End Loading (FEL) of key overfill information is essential in developing an effective protection program. A survey should be conducted of all applicable tanks to gather key information. Key information is necessary to understand existing overfill conditions.
From this database, determinations could be rendered as to the potential number of tanks and alarm settings not in compliance with the company's minimum response times, as well as additional stakeholder considerations were made transparent.
In addition to this database, risk-evaluation considerations should be undertaken, particularly with respect to establishing equipment prioritization. Such considerations include aged equipment, locations in proximity to sensitive receptors, etc.
In addition to the specific requirements reflected in the policy, there are some special features, which, when completed, add strength to the program, he said.
All tanks must meet minimum response times, based on alarm level settings, at maximum flow rates. If these RTs are not achieved, then the alarms must be adjusted to bring overfill requirements into conformance. However, a formal “waiver” process could be established to grant exceptions.
The waiver process is, in effect, a petitioning process, whereby the tank owner seeks permission to operate at RTs less than the minimums. However, respective managers must justify the waiver petition, based on analyses of relevant business and technical/engineering drivers. Additionally, accompanying each waiver request is a risk management and mitigation plan, in which the following criteria must be demonstrated: increased operational safeguards have been established; technical/engineering safeguards have been engineered and installed; and operational safeguards and enhancements have been undertaken, such as additional communication linkage with suppliers.
An effective policy should identify a common set of terms and concepts to be clearly understood and embraced by personnel. Among the many definitions to be understood and accepted, three deserve emphasis:
- Overfill Level (OFL)
Liquid level when the tank is filled to its maximum capacity, and the lowest level at which any of the following occur: additional product will overfill and spill out of the tank (through foam nozzle, overfill slot, overfill nozzle or top of tank); floating roof component comes into contact with fixed roof component (seal touches fixed roof structural, floating roof leg touches fixed roof, etc.); maximum allowable stress level is reached in tank shell; secondary seal reaches the top of tank shell on External Floating Roof Tank (EFRT) with primary and secondary seals; and top of primary seal reaches top of shell on EFRT with primary seal only.
- Independent (alarm)
A type of alarm that is free from any control or influence by any other gauge or alarm on the tank. The high-high alarm shall be independent.
- Maximum Flow Rate (MFR)
The highest possible flow rate to a tank, but not including a potential initial spike associated with the very beginning of the receipt. The MFR (in barrels per hour ), is the flow rate used in calculating the minimum response times (RTs) for crude/product deliveries into an atmospheric storage tank, for the purposes of setting the normal (safe) working alert level; high-level alarms; and high-high level alarms. The MFR represents the maximum flow rate conditions under all intended and purposeful operating plans for that tank. The MFR is not the average or typical flow rate, but a flow rate based on recognized and approved operational scenarios. The determination shall include the maximum flow in a particular pipeline and any additional contributions (flow rates) from other pipeline sources, as well as contributions from overfill/relief systems. A new MFR should be determined when the tank service and/or delivery service conditions change.
He said it's important that an effective policy is clear and unconfused regarding roles, responsibilities, and accountabilities.
“An organization might well consider clarity on ‘shall' versus ‘should' statements,” he said. “The organization must provide a clear and consistent tank operating philosophy, requirements, and expectations for operators and tank maintenance and inspection personnel. All personnel must be fully trained and possess a clear understanding of the key terminology and concepts, to include the minimum RTs and corresponding alarm set-point bases; maximum flow rates used to determine any approved waivers; pre-planning calculation bases used to determine available capacities as well as calculations for estimated versus actual tank levels during receipts; and any specific duties, responsibilities, and procedures required to achieve overfill protection conformance.”
Successful overfill protection programs must integrate engineering, inspection, and maintenance activities with overfill practices and operational conditions. He said there should be period inspections (monthly, quarterly, biannual, and annual events for designated equipment). Preventive maintenance and walk-around inspections should occur frequently and constitute hallmarks of a proactive program. Maintenance and inspection records should be documented and readily to operators.
All individuals (managers to operators) should be trained on the basic “programmatic” aspects and concepts of an overfill program. This level of training would normally include the philosophy, vision, objectives, and all key definitions and content items.
“Personnel must be trained and possess a clear understanding of terminology and concepts, especially to include minimum RTs, maximum flow rates, and pre-planning calculation bases used to determine available capacities as well as calculations for estimated versus actual tank levels during receipts,” he said. “Training may be structured according to need and various levels to fit roles and responsibilities. For example, whereas all personnel should take basic programmatic training, specific equipment operators should undergo training on radar ATGs, and such.
“Implementation of the programmatic aspects of an overfill policy should be implemented in a way that ensures successful implementation and strengthens accountability throughout an organization. An MOC process will normally be administered as set forth by the organization. However, experience shows that additional and/or concurrent steps are useful and may even prove more effective in achieving implementation. Such measures include coaching sessions; town-hall meetings, dial-in conference calls with question-and-answer sessions; road-show presentations, and more.”
Conformance standards
Tracking performance metrics regarding overfills is essential, he said. The following metrics will provide sufficient evidence that adherence to the overfill policy is occurring appropriately:
- An absence of high-, high-high and low-level alarm activations will demonstrate that overfill planning as established by the policy requirements is taking place.
- Appropriate level (local/regional) management should require periodic confirmation that the sum of all tank alarm activations for the reporting period does not exceed one event. Evidence that any high-high alarm activation has occurred shall be investigated.
- All unintended high-high alarm activations shall be considered a serious “near miss” and require a Root Cause Investigation (RCI) along with timely implementation of RCI recommendations. Independent confirmation of timely and effective corrective action implementation regarding compliance and assurance findings on overfill non-conformances.
“The policy must be dynamic and living - not a one-time event to be placed on a shelf or embedded on a library server,” he said. “An effective overfill protection policy should provide, proactively, a mandated provision for compliance and assurance. A compliance and assurance program should be established to provide for identification of shared learning's and continuous improvement opportunities, either through internal and/or independent means. Periodic internal auditing will be conducted at local facilities, with non-conformances noted, and shared learning's and continuous improvement opportunities reported throughout the organization. Integration must be widespread, designed to encompass the key elements of policy, data, training, equipment, and compliance and assurance.”
The equipment and installation aspect to the overfill program largely focuses on new ATGs and alarms, but may also include necessary instrumentation and electrical upgrades on both the tanks as well at the facilities. A comprehensive program does not necessitate wholesale purchases of new equipment. In fact, he said, use of existing equipment is deemed appropriate, when properly demonstrated with acceptance criteria.
Equipment evaluations should consider: technical evaluations (new vs. existing); total cost of ownership; organizational and facility impacts; electrical and instrumentation upgrades; stakeholder needs; and regulatory drivers.
A strong overfill program must recognize the diversity that inherently exists. This extends to facilities (existing non-ATG sites, crude versus product tankage, and new sites/tanks to be built); monitoring methods employed (fully automated versus manual), manning and resource levels (manned or unmanned); and varying gauges and alarms (radar, magnetostrictive, servo, tape, and float gauges, and varying alarm types, to include mechanical switches, electronic-capacitance devices, etc).
“Protecting human health and the environment are essential requirements in today's workplace,” he said. “The design and implementation of a tank overfill protection program offers potential benefits for the petroleum industry, specifically in the environmental, human health, community welfare, and safety performance areas. Regardless of the number of atmospheric tanks at a location, there are common attributes of a comprehensive overfill protection program that can be applied.
“The programmatic aspects of an overfull program are deemed the most protective regarding tank overfill, in that they are proactive in nature and represent prevention at numerous levels. It is essential that for an overfill protection program to be successful, there must be clarity and transparency in all of its programmatic features, to include a well-written and management supported policy; uniform standards and procedures; roles and responsibilities; and an effective program management function.
“An overfill prevention program cannot be a one-time event — it must be characterized by a compliance and assurance program and commitment to continuously improve and strive for excellence. Management must have a passion for this long-term commitment.”
