API 2350 Levels of Concern Explained
Levels of concern are how API 2350 turns a single tank height into a staged response, and getting the staging wrong is how overfills happen despite instrumentation. This page explains the level concept and how tank categorization changes the required layers of protection, for the engineer setting up or reviewing a tank's alarm strategy. It focuses on the response logic rather than a specific device.
API 2350 Levels of Concern in one line: In API 2350, levels of concern are graduated tank-level thresholds that each trigger a defined response with a known time margin. As product rises, the tank passes through escalating levels - a high alarm to warn, then higher trips demanding action - so response is staged rather than dependent on one last-ditch cutoff. How many independent layers a tank needs depends on its assigned category.
Why Staged Levels Beat a Single Trip
A single high-high cutoff gives an operator no warning and no margin - it either fires in time or it does not. Levels of concern replace that all-or-nothing point with a ladder: a warning level to plan the stop, then higher levels demanding progressively more decisive action, ending at a critical level that assumes the earlier layers failed.
The value is time. Each level below the top buys minutes to slow or stop the transfer under human control before automation has to intervene. That is why levels are set from a response-time budget - valve closure and line drain-down included - working down from a safe fill level, not from the tank's physical capacity.
How Tank Category Sets the Layers
API 2350 categorizes tanks by how much automated protection stands between the operator and an overfill - from tanks where a person manages the level manually, up to tanks with fully automatic overfill prevention. The category drives how many independent detection layers the program requires and how automated the final trip must be.
The higher categories lean on an independent high-level alarm and often an automatic high-high level shutdown that closes valves without waiting for a human. Lower categories put more of the burden on procedure and attended transfers. Categorizing a tank correctly is therefore the decision that sets its whole protection scheme.
The Level Ladder in Practice
A workable way to lay out the levels for a review is a simple ladder from the top of the tank down. The exact heights are site-specific and set from your response-time analysis; the structure is general.
| Level | Intent |
|---|---|
| Maximum working / critical high | Last defense - automatic trip assumes upstream layers failed |
| High-high level | Independent alarm and, per category, automatic action |
| High level of concern | Operator must act now to stop the transfer |
| Alert / planning level | Begin the controlled stop; confirm receiving capacity |
Common Misconceptions
One misconception is that more levels always mean more safety. Poorly spaced levels either bunch up so tightly there is no time between them, or spread so wide the top level fires with no margin. The spacing must reflect real response times, not round numbers on the gauge.
Another is that the inventory alarm and the overfill levels are the same thing. Inventory alarms watch normal operating range; levels of concern are the overfill-specific ladder above it, ideally driven by independent detection. Conflating them is how a gauging fault quietly removes overfill protection.
Frequently Asked Questions
How many levels of concern does API 2350 require?
The standard defines a ladder of escalating levels rather than a fixed count, and how many independent layers a specific tank needs depends on its assigned category. Higher-risk categories require more independent detection and more automated final action.
What is the difference between a level of concern and a tank category?
A level of concern is a height threshold with a defined response. A category classifies the tank by how much automated protection it has, which then dictates how many independent levels and how much automation the program requires.
Should the highest level of concern be automatic?
For the higher categories the critical level typically drives an automatic shutdown that closes valves without waiting for an operator, since it assumes the human-response layers already failed. Lower categories may rely on attended transfer and manual action.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.