API 2350 for tanks: overfill prevention and risk management

Overfilling does not begin when the product spills over. It starts earlier, when the level is not measured with sufficient accuracy, when the tank’s available capacity is miscalculated, or when the operational response is delayed. At that point, API 2350 transitions from being a reference document to becoming a safety tool applied to tank operations.

At terminals and tank farms, this standard is now a fundamental guide for preventing overfilling, reducing risks, and improving operational control. Its value lies in integrating tank measurement, alarms, inventory, and decision-making within a single management framework.

API maintains that the 5th edition of API 2350 (Overfill Prevention for Storage Tanks in Petroleum Facilities) reinforces the emphasis on alarm response times, prevention programs, and management systems. This adjustment explains why the standard remains relevant in storage and transfer operations.

API 2350 and overfill prevention in tanks

The API 2350 standard for tanks establishes minimum requirements for overfill prevention in petroleum facilities with above-ground atmospheric tanks. Its scope includes marketing, refining, pipeline, terminal, and other similar facilities that receive petroleum liquids.

In the standard, prevention focuses on the filling operation, available capacity, response time, and actions taken upon an alarm. The standard requires defining the quantity to be transferred, the tank’s calibrated available capacity, those responsible for the operation, the applicable response time, and the actions required to complete the filling within established limits.

This approach gained greater importance following the Buncefield incident in 2005, when the overfilling of a tank revealed failures in management, supervision, the information available to personnel, and the control of the filling process. Since then, the industry has understood that the problem was not limited to instrumentation; it also involved procedures, change management, data quality, and actual response capability.

Where the standard applies and where it does not

The 5th edition of the guide clearly summarizes the scope of API 2350. The standard is intended for storage tanks associated with marketing, refining, pipelines, and terminals that contain Class I or Class II petroleum liquids. It also recommends its use for Class III petroleum liquids.

API 2350 does not apply to several specific cases. These include:

• Subsurface storage tanks.
• Above-ground tanks of 1,320 gallons (5,000 liters) or less.
• Above-ground tanks that comply with PEI 600.
• Process tanks or similar vessels.
• Tanks containing non-petroleum liquids. 

The guidance also excludes LPG and LNG storage tanks, service stations, and loading/delivery operations from wheeled vehicles, such as tanker trucks or tank cars.

How API 2350 structures overfill prevention

The guideline organizes implementation through a verifiable framework divided into five categories: management system (OPP), risk assessment system, operating parameters, procedures, and equipment systems.

In practice, compliance verification is conducted on a tank-by-tank basis through four steps:

1. Management system (OPP): Requires documented operational and safety procedures, qualified personnel, equipment inspection programs, and formal communication protocols between owners, operators, and carriers to ensure the traceability of each event.
2. Risk Assessment: A technical process aimed at determining whether the tank’s current configuration and its protection systems are sufficient or whether the system requires additional risk mitigation measures based on operational criticality.
3. Tank and Operations: Requires precise verification of instrumentation, prevention categories, alarms, response levels, and the tank’s actual available capacity, always relying on verifiable operational parameters and procedures prior to product entry.
4. Compliance Summary: This consists of the final validation that integrates administrative processes, technical data on the tank, and the protection systems in place, allowing certification that the facility meets the minimum regulatory requirements for safe operation.

What API 2350 requires in the field

In the field, the standard requires defining and maintaining the operating parameters for each tank; this includes category, levels of concern (LOC), alarms, alerts, response time, level of assistance, and, where applicable, an AOPS (Automatic Overfill Prevention System). 

The API 2350 alert levels form part of the team’s operational framework.

• Critical High (CH): Corresponds to the level at which overflow or damage may occur
• High-High (HH): This is the alarm level required by the standard
• Maximum Working Level (MW): This is the highest level to which the tank may routinely be filled. 

If the facility has an AOPS, its activation level must be set at HH or above that point.

The guide adds that the vertical distance between the HH and MW must correspond to the response time calculated for plant operations. This ensures that the tank configuration, filling operations, and alarm response are aligned with actual operating conditions.

Categories, alarms, and response time

In API 2350, response time (RT) is the period required to safely complete an entry. This value must be established for each tank and forms part of the operating parameters along with MW, HH, CH, system category, and level of assistance. When the tank-specific RT has not been calculated, the standard uses default minimum times: Category 0: 60 minutes, Category 1: 45 minutes, Category 2: 30 minutes, Category 3: 15 minutes.

The guide also specifies at least three levels of concern (LOC). In this scheme, the vertical distance between the HH alarm and the maximum working level (MW) must ensure that the operator has this time available to act. The technical categorization is defined as follows.

• Category 0: Manual tank measurement; fully assisted and locally monitored facility. 
• Category 1: Assisted operation with local reading. Category 2: Level and alarm transmission to control center (alarm dependent on the ATG).
• Category 2: Level and alarm transmission to control center (alarm dependent on the ATG). 
• Category 3: Same as Category 2, but with an independent alarm (recommended configuration).

Within this four-category framework, Category 3 corresponds to the configuration with ATG and an independent alarm. If an AOPS is used, it must be independent of the BPCS (Basic Process Control System). For new installations, the guide refers to IEC 61511 (Functional safety – Safety instrumented systems for the process industry sector).

Tank gauging and inventory control

Tank gauging (an automatic measurement system) provides the technical foundation for preventing overfilling, controls inventory, and plays a direct role in determining available calibrated capacity and continuously verifying operating parameters.

Best practice requires that the level indicated by the system must strictly align with the calibration table and with the warning levels (MW, HH, and CH) defined for each specific tank.

The system’s reliability enables secure planning; therefore, the standard directly links measurement to the pre-receipt procedure: before initiating any transfer, it is mandatory to compare the volume to be received against the tank’s available calibrated capacity. This validation, based on current measurement and calibration data, constitutes a fundamental operational safeguard within the management system.

The following video complements this point by demonstrating how the modernization of measurement systems enhances data reliability, ensures transfer traceability, and optimizes integration with existing infrastructure—key factors for tank integrity.

API 2350 and API 653 for in service tanks

The relationship with API 653 is practical: When a tank in service is modified, API 2350 must be applied to verify whether the changes affect overfill prevention in tanks through a Management of Change (MOC) process; it is also essential to confirm that the measurement configuration, levels of concern (LOC), alarms, and response time remain valid for the tank’s actual condition.

The guide identifies the following situations as requiring review under MOC:

• New tank or construction of a new bottom.
• Replacement of seals on floating roofs.
• Installation of domes or fixed roofs.
• Recalibration and replacement of measurement equipment.
• Change in product or variation in flow rate.
• Changes in response time due to personnel, operation, or equipment

These changes may alter the technical basis used to define the MW, HH, CH, capacity table, and available tank capacity; therefore, for a tank in service, it must be evaluated whether the capacity table remains valid, whether the alarm system retains the required configuration, and whether the incoming quantity continues to be compared against the available calibrated capacity. This intersection between the physical condition and the protection logic is what ensures compliance with the standard

How to reduce the actual risk of overfilling

To mitigate the risk of overfilling, the standard establishes a comprehensive strategy that treats measurement, protection, and operation as a single management system. Reducing the actual risk requires controlling three critical areas:

• Data quality (Measurement): This is the technical foundation of safety. Without a reliable level, updated parameters, and a current calibration table, the tank’s available capacity ceases to be a technical value and becomes a mere dangerous estimate.
• Protection Strategy: The High-High (HH) alarm must be mandatorily linked to a defined response time (RT). Depending on the tank category, the system must ensure physical independence between the measurement (ATG), the alarm, and the automatic system (AOPS).
• Operational management: This includes documented pre-entry procedures, clear communication among parties, trained personnel, and periodic equipment testing.

In the field, overfilling is prevented when each entry is compared against the available calibrated capacity, ensuring that inventory, alarms, and the tank’s actual condition always operate under the same operational logic and are validated through Management of Change (MOC) processes.

Conclusions

The API 2350 standard transforms overfill prevention in tanks from a theoretical concept into a practical capability based on verifiable criteria. Technical compliance with this standard requires a rigorous sequence of steps: a management system, risk assessment, and validation of critical parameters such as LOCs and response time (RT).

For tanks in service, it is essential to keep the calibrated available capacity up to date and to apply Management of Change (MOC) processes in response to physical or process variations. Only by recording these factors can safety cease to depend on estimates and instead be based on a solid and reliable technical foundation.

References

1. https://www.api.org/searchresults#q=api%202350&sort=relevancy
2. Complete Guide to the 5th Edition of API 2350. Emerson. https://www.emerson.com/documents/automation/guide-gu%EDa-completa-sobre-la-edici%F3n-5-%AA-de-la-api-2350-es-es-7835264.pdf

Frequently Asked Questions (FAQs)