at SciVerse ScienceDirect

Journal of Loss Prevention in the Process Industries 25 (2012) 329e335

Contents lists available

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier .com/locate/ j lp

A hazards assessment methodology for large liquid hydrocarbon fuel tanks

C.D. Argyropoulos a,1, M.N. Christolis a, Z. Nivolianitou b,*, N.C. Markatos a

aCFD Unit, School of Chemical Engineering, National Technical University of Athens, 9 Iroon Polytechniou Str., Zografou Campus, Athens 15780, Greeceb Institute of Nuclear Technology-Radiation Protection, National Centre for Scientific Research “Demokritos”, Ag. Paraskevi 15310, Greece

a r t i c l e i n f o

Article history:Received 22 July 2011Received in revised form5 December 2011Accepted 7 December 2011

Keywords:Hazards assessmentStorage tanksTank firesVapour cloud explosionSeveso II

* Corresponding author. Tel.: þ302106503744; fax:E-mail address: zoe@ipta.demokritos.gr (Z. Nivolia

1 Present address: Department of Chemical Enginnology, Imperial College London, London, SW7 2AZ, U

0950-4230/$ e see front matter � 2011 Elsevier Ltd.doi:10.1016/j.jlp.2011.12.003

a b s t r a c t

This paper presents a systematic hazards identification methodology for liquid hydrocarbon fuel storagetanks, by applying a checklist technique on the accident causes and the relevant protection measures, inthe framework of the SEVESO Directive series. A forum discussion with Greek industrial safety expertshas been also organised by the authors in order to locate any lack of the methodology. Results arepresented and discussed, and it is concluded that the present hazards assessment methodology helps toidentify the major contributors to risk, to improve safety measures and to assist the analysis in theseaspects.

� 2011 Elsevier Ltd. All rights reserved.

1. Introduction

A hydrocarbon tank fire is a relatively rare accident that maylead, however, to unexpected consequences for the installation, theenvironment and the health of workers and neighbours. Para-phrasing the text by Kletz (2009) we could say that “progress inindustrial safety is one accident at a time”. Indeed, significant tankfireaccidents have happened recently, such as the December 11th, 2005Buncefield Oil Storage Depots (B.O.S.D) disaster (BuncefieldInvestigation Board, 2008; Herbert, 2010) and the massive tankfire of October 23rd, 2009 at the Caribbean Petroleum Refining (U.S.Chemical Safety Board, 2009). These accidents demonstratenotonlythe large-scale of destruction in the surroundings, togetherwith theimplication of potential environmental issues, but also the necessityto prevent similar accidents (Pitblado, 2010). Chang and Lin (2006)havemade an extensive study, collecting reference and informationthrough appropriate literature, with the aim to perform a statisticalanalysis of accident occurrence in storage tanks. Intensive researchhas also been undertaken by many groups of scientists and engi-neers (Argyropoulos, Christolis, Nivolianitou, Markatos, 2008a,2008b; Argyropoulos, Sideris, Christolis, Nivolianitou, & Markatos,2010; Ghoniem, Zhang, Knio, Baum, & Rehm, 1993; McGrattan,Baum, & Rehm, 1996; Markatos, Christolis, & Argyropoulos, 2009;

þ302106545496.nitou).eering and Chemical Tech-K.

All rights reserved.

Vautard et al., 2007) towards the investigation and explanation ofthe physical characteristics of the phenomena involved in largehydrocarbon tank fires. These investigations are related with theestimation of plume dispersion and height elevation, ground-levelconcentrations of the toxic pollutants, such as smoke, sulphurdioxide (SO2), carbon monoxide (CO), polyaromatic hydrocarbons(PAHs), and volatile compounds (VOCs), together with the charac-terization of risks zones by comparing the ground-level concen-trations with existing safety thresholds.

A standard methodology followed for the Safety Analysis inpetrochemical installations is the Quantitative Risk Analysis (QRA)(Papazoglou, Nivolianitou, Aneziris, & Christou, 1992), preceded inmost cases by the so-called Qualitative Risk Analysis, which hascertain advantages and disadvantages with respect to the firstaccording to Knegtering and Pasman (2009).

The Qualitative approach uses well known types of analysis,such as the Checklist (Giannini, Monti, Ansaldi, & Bragatto, 2006;Lees, 1996), the Failure Mode and Effect Analysis (FMEA) (NRC,1983) and the Hazard and Operability analysis (HAZOP) (Lawley,1974). Checklist is the simplest tool of hazard identification ina chemical installation passing on hard-won experience; indeed itis impossible to envisage high standards in hazard control unlessthis experience is effectively utilised.

Additionally, quantitative methods attempt to specify the safetylevel or the associated risk level of a system or an installation. Avariety of these methods already exist, such as the approaches ofMond (Lewis,1974) andDow (1981) indices and thewell-establishedmethods of Fault Tree (FTA) and Event Tree Analysis (ETA) (NRC,

C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335330

1983). The above list could be lengthened with risk assessmentmethodologies tailor-made for offshore process facilities in seismicareas (Fabbrocino, Iervolino, Orlando, & Salzano, 2005), for large-scale oil export terminals (Shebeko et al., 2007), for fire manage-ment systems (Crippa et al., 2009) and for estimating the dominoeffect in petrochemical industries (Kourniotis, Kiranoudis, &Markatos, 2000). However, what is lacking, in our opinion, is a dedi-cated hazards assessment methodology for liquid hydrocarbon fuelstorage tanks that could help both in the evaluation of the relativesafety studies and in the safe operation of these installations.

The purpose of the present study is to describe a systematichazards identification methodology together with good practicesfor liquid hydrocarbon fuel storage tank operation. The proposedmethodology has been conceived and implemented in a pilot studyfor a liquid hydrocarbon tank farm in Greece, liable to this analysisby the “SEVESO” Directives (European Council, 1982, 1997) ofEuropean Legislation on behalf of the Greek Ministry of Develop-ment. The implementation of the SEVESO Directives across the EUsince 1983 has created a significant “fund” of experience and,moreover, has highlighted the areas that need support during thisimplementation (Christou, Papadakis, & Amendola, 2005). One ofthem is the existence of relatively simple and widely accepted toolsamong practitioners that constitute a common understanding basisboth in the elaboration and in the assessment of a SEVESO study. Inaddition, a forum discussion has been organised by the authors ofthe proposedmethodology with experienced safety engineers fromthe Greek petrochemical industries with the aim to improve andcorrect any lacks of the methodology.

In the remainder of this paper one can find: in Section 2 thedescription of the various types of storage tanks together with theirpossible accident types; in Section 3, a description of the proposedhazards assessmentmethodology; in Section 4 the discussions withGreek experts; and in Section 5 the presentation of the results anda general discussion on the methodology proposed.

2. Accidents in storage tanks

2.1. Main types of storage tanks

Large liquid storage tanks are used in the petroleum andchemical industries for the storing of both raw material andintermediate or finished products in confined areas that are nor-mally separated from the rest of the installation. Information forimportant safety parameters are provided in detail by Lees (1996).The types of tanks for storing combustible or flammable liquidhydrocarbon fuel are classified in three main types by the Institu-tion of Chemical Engineers (IChemE, 2008) (Fig. 1):

1. Fixed or cone roof tanks.2. Open top floating roof tank (simple pontoon or double deck).3. Fixed roof tanks with internal floating roof.

Fig. 1. Types of tanks

A fixed or cone roof tank is made of a vertical cylinder side anda fixed cone-shaped roof that is welded to each other. According toAPI standards (API, 2001) this type of tank is designed with a weakseam at joint, where the roof and sides become one to cope with aninternal explosion. Therefore, the roof separates from the tankwithout the containment and any resulting fire is proliferated onlyon the surface of the fuel. This type of tank usually contains “black”heavy products, such as fuel-oils, asphalt (bitumen) and vacuum oratmospheric residue. Hence, the use of insulation, steam or coilheating in these types of tanks is necessary for keeping of thecontent in a liquid state.

An open top floating roof tank is made of a vertical, cylindricalabove ground shell similar to the conical roof tank. However,instead of a conical roof it has a pontoon type roof, characterizedby the ability of the roof to rise and fall on the stored-fuelsurface, in order to prevent the large volumes emittance offuel-vapours. Moreover, there is a rim seal that covers the spacebetween the floating roof and the tank shell, in the form ofa rubber tube filled with kerosene, where most frequently a firemay start.

An internal floating roof storage tank is a combination of theabove two types of tanks, as the tank consists of a conical roof withthe addition of the internal floating roof or pan that floats directlyon the fuel surface. Furthermore, internal floaters have the capa-bility to decrease the potential of ignition and to prevent theinitiation of tank fires.

The second and third categories of tanks are used for volatileliquid hydrocarbons such as crude oil and “white” light products(jet, diesel and gasoline). Moreover, important parameters for theabove types of tanks are the existence of bunds with the appro-priate volume capacity and the correct safety distance betweenthem and the installations, in order to prevent the dissemination ofthe oil-leakage to the surrounding installations with a majorprobability of ignition.

2.2. Tank fire accidents scenarios

Potential fire scenarios that can be developed in a tank accidentare presented in LASTFIRE (2001) (Fig. 2):

1. Rim seal fire2. Spill on roof fire3. Full surface fire4. Bund or Dyke fire5. Pontoon explosion6. Boilover

The most severe are the full surface fire and boilover.More details on the above scenarios are presented in the study

of Crippa et al. (2009). According to the data of LASTFIRE project(2001) themost common tank accident is the “rim seal fire” and the

for fuel storage.

Fig. 2. Potential tank fire scenarios.

C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335 331

prevalent failure cause of accident is the “lightning”. The study ofChang and Lin (2006) confirms the lightning as the most frequentcause of tank accident, while fire and explosion constitute the 85%of total cases of tank accidents.

However, it is important to mention that sometimes a fullsurface fire can escalate to a boilover (IChemE, 2008; Koseki,Natsuma, Iwata, Takahashi, Hirano, 2003), even though it isaccounted as a very rare incident. According to literature largeboilovers have been recorded in Yokkaichi (Japan, 1955), Pernin(Netherlands, 1968), Findlay (Ohio, USA, 1975), Tacoa (Venezuela,1982), Milford Haven (U.K., 1983), Thessalonica (Greece, 1986), PortEdouard Herriot (France, 1987) and Skikda (Algeria, 2005) asdescribed in LASTFIRE (2001) and by Persson and Lonnermark(2004). However, the progress of safety science has almost elimi-nated the possibility of a boilover, but still there will be a hazard forit with potential precursor signs described in LASTFIRE (2001) andby Shaluf and Abdullah (2011).

2.3. Vapour cloud explosion

The Buncefield accident (Buncefield Investigation Board, 2008)has shed new light in tank fire accidents according to Herbert(2010). New phenomena, such as the explosion in a typically non-confined space, have to be considered as plausible alternativesnow (Johnson, 2010). The oil and gas industry has for a number ofyears been aware of the potential for flame acceleration and over-pressure generation owing to obstacles in gas clouds, caused byleaks of flammable substances. To a large extent the obstacles weremainly considered to be equipment, piping or other structurestypically found in many installations, but the Buncefield explosionshowed that also for land based open space installations there isa potential for flame acceleration in regions of vegetation (trees,bushes), which most likely led to the severe explosion in thisaccident (Bakke, Wingerden, Hoorelbeke, & Brewerton, 2010). Infact the investigation of explosion accidents in the vicinity of liquidhydrocarbon storage tanks led to significant conclusions(Knegtering and Pasman (2009), such as a) the explosion alwaysfollows a leakage of gasoline, b) tank overfilling is the major cause,c) the cloud ignition happens in nearby sites (50e300 m away fromleakage point), d) the delay of the ignition ranges from 20 to 90minfrom leakage onset, e) almost windless conditions prevail beforethe accident, and f) there is significant recurrence of this type of

accident (though not as destructive), almost every 5 years aroundthe world. All these make obvious that an explosion accident afterthe release of a hydrocarbon vapour cloud, as a result of tankoverfilling (Buncefield type of accident), has a significant occur-rence probability and needs to be further investigated, especially innon-properly safeguarded commercial tank farms.

3. Hazards identification methodology for liquid hydrocarbonfuel storage tanks

3.1. General steps

A liquid hydrocarbon fuel storage tank farm is a particular typeof a chemical installation, in which the hazard stems mainly fromthe big potential for fire. A hazards analysis should comprise all thegeneral items, such as described by Santos-Reyes and Beard (2008):

- Description of the local area, including a general map.- Sufficient knowledge of the hydrogeological, hydrographical

and meteorological data of the area together with any pro-tected environmental zones.

- Sufficient meteorological data with heavy snow and heavy rainfrequencies.

- List of the hazardous installations in the surroundings.- Ground plan of the plant and/or tank farm together with

process flow diagrams.- Description of production processes for every location of the

plant.- Characteristics of chemical substances according to “SEVESO

II” (Implementation in the Greek Legislation, MinisterialDecree 12044/2007), together with declaration of the storedhazardous substances accompanied by Material Safety DataSheets (MSDS).

3.2. Proposed methodology for tank inspection

Before going into a full-blown quantitative analysis, this workproposes a screening methodology that can, quite easily, lead to theidentification of the areas where a fire can start as a result ofa hazardous substance release. The methodology is based on thephilosophy of the checklist, which has beenmentioned in Section 1.

C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335332

Indeed, the present checklist is based on a catalogue of causes thatcould lead to the failure of the tank, together with a list ofpreventive and/or protection measures that can avert the occur-rence of an accident in a storage tank. These two lists derive frompast experience of tank operation and maintenance, and are to beconsidered as prerequisite conditions to avoid problems in safety. Ifan installation satisfies these criteria, then the accident potential isvery low without banning risk totally. If Time and resources areavailable, a full-blown Quantitative Risk Analysis can be performedon the installation. Additionally, this methodology can be a tool inthe hands governmental agencies, as the former can aid in thechecking of the safety analysis elaborated by the plant owner.

3.2.1. Failure causes of tank accidentsThe most common initiating events or failure causes for fixed/

cone and floating roof tanks are grouped in the general headingspresented in Table 1 and can be detailed as follows:

1) Operational errors: These comprise a) tank overfilling, owing toa failure of level metering systems or human error in theloading procedure; b) fuel release because of drain valves leftopen accidentally; c) Vent valve left closed during loading orunloading in fixed roof tanks; d) oil leaks owing to operatorserrors; e) import of a product with high inlet temperature; andf) drainage ducts to retention basin being obstructed. Causes(a), (b), (d) and (f) lead to leakage of fuel in the retention bundand creation of an airevapour mixture that can be easilyignited on the occasion of an ignition source, leading to a poolfire even in the whole bund area. Cause (c) leads to tankbuckling, owing to underpressure in it, and subsequent tankfailure and fuel release, while cause (e) leads to temperatureincrease in the tank and possible release of fuel vapour.

2) Equipment/Instrument failure: In this category have beennoticed a) the sinking of floating roof resulting in the burstingof a fire that may comprise the entire upper surface of the tank;b) the level indicator failure that can lead to tank overfilling(see above); c) the discharge valve failure and d) a rusted ventvalve that does not open, with consequences described above.

3) Lightning is a major accident initiator, owing to: a) poorgrounding of the tank preventing the full absorbing of a directstrike; b) flammable liquid or rim seal leaks that develop thelightning strike into to a fire; and c) a direct strike of tank wallthat may lead to its failure and subsequent fuel leakage.

Table 1Immediate causes of accidents.

1. Operational errors 4. Static electricity

Tank overfilling Rubber seal cuttingDrain valves left open accidentally Poor groundingVent closed during loading/unloading Fluid transferOil leaks due to operators errors Improper sampling proceduresHigh inlet temperatureDrainage ducts to retention basin obstructed

2. Equipment/instrument failure 5. Maintenance errors

Floating roof sunk Welding/cuttingLevel indicator Non explosion-proof motor and toolDischarge valve rupture Circuit shortcutRusted vent valve does not open Transformer spark

Poor grounding of soldering equipmPoor maintenance of equipment bot

3. Lightning 6. Tank crack/rupture

Poor grounding Poor solderingRim seal leaks Shell distortion/bucklingFlammable liquid leak from seal rim CorrosionDirect hit

4) Static electricity caused by: a) rubber seal cutting of floating roofmay create a spark that almost certainly leads to tank roof fires;b) poor grounding of fixed roof tanks may lead to its channel-ling to tank shell, causing of vapour ignition; c) fluid transfer(mainly white products) during tank filling can lead to thecreation of a spark, especially when the loading rate is highbecause of undersized lines; d) improper sampling procedures(e.g. not proper shoes, gloves or VHF apparatuses) producesalso sparks.

5) Maintenance errors may lead to the occurrence of accidents,namely: a) welding/cutting operations producing uncoveredsparks, b) use of non explosion-proof motor and tools, c) circuitshortcuts, d) transformer sparks e) poor grounding of solderingequipment and f) improper maintenance of equipment bothnormal and blast proof.

6) Tank rupture/crack is another cause of accident caused by: a)poor soldering, b) shell distortion/buckling (see also above) andc) roof or shell corrosion and ground subsidence.

7) Piping rupture/crack can be noticed through: a) valve or pumpleaking, b) flammable liquid leak of gasket, c) piping materialfailure, d) contractor bungling, and e) pipe failure because ofliquid expansion. All of these causes result in smaller or biggerliquid outflow, possible ignition and creation of a pool fire.

8) Miscellaneous comprise: a) earthquakes, b) extreme weatherphenomena, c) vehicles impacting on piping, d) adjacent openflames or remains of smoking, e) escalation from another unit(domino effect), f) previous accident caused by energy/fueltransportation lines and g) sabotage or arson (intentionaldamage).

9) Supporting safety systems failures refer to the: a) electric powersystem, b) insufficient tank cooling, which could lead to totaltank demolition, c) water supply system for fire extinguishing,and d) freezing of water in pipes of the firefighting system.

3.2.2. Preventive and protection measuresFor all the above mentioned causes there are certain protective

measures aimed at limiting or preventing their occurrence and arepresented in Table 2 while analysed in the following:

1) Tank design should: a) follow the international standards, suchas those of the American Petroleum Institute (API, 1998), theAmerican Society of Mechanical Engineers (ASME, 1999) and

7. Piping rupture/leak

Valve leakingFlammable liquid leak from a gasketPiping failurePump leakCut accidentallyFailure owing to liquid expansion

8. Miscellaneous

Earthquakes used Extreme weather

Vehicle impact on pipingOpen flames/smoking flame

ent Escalation from another unit (domino)h normal and blast proof Accident caused by energy/fuel transportation lines

Arson (intentional damage)

9. Safety supporting systems

Electric power lossInsufficient tank coolingFirefighting water lossFirefighting water in piping freezing

Table 2Protective measures.

1. Design 3. Equipment 5. MiscellaneousFollowing engineering standards

and regulationsFollowing engineering standards Safeguarding

Modification of tank top designto prevent overfilling

Handling static electricity during tank loading Electrical supply of tanks added to critical utilities

Site inspection Lightning protection system No smoking/good house keepingSafe distance High-integrity automatic operating overfilling

prevention systemProtection against extreme weather phenomena

Dikes, bunds Arrangements to ensure that the receiving agenthas ultimate control of tank filling.

Protection from vehicle bumping

Defining tank capacity Remotely operated and fire-safe shut-off valves Protection of piping from mechanical stressProtection against fluid expansion in piping Protection from DOMINO effectsTemperature monitoring Protection from areal electric power lines

Proper labelling and traffic signing2. Maintenance 4. Safety supporting systems Appropriate management of oily wasteRoutine inspection Fire detection and alarm system Appropriate management of firefighting waterPeriodic proof testing of overfill

prevention system/Firefighting network Appropriate management of rain water

Corrosion resistance Foam supply and production system Good house keeping(5S e Sort, Straighten, Shine, Standardize, Sustain)

Preventive checking of ventingequipment

Tank cooling system

Use proper equipment Spare firefighting water tank/diesel driven pumpUse explosion-proof tools Anti-frost protectionMaintenance of both normal

and blast proof equipmentConnection of gas detection with the overfillingprevention system.

Hot work permit CCTV equipmentChecking of successful work completion Emergency response plan

C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335 333

the National Fire Protection Association (NFPA, 1993) coveringalso material selection, fabrication, installation, inspection,repair and safe management; b) cover modification of tank topto prevent overfilling and allow re-routing of the fluid back tothe tank; c) include site inspection to reveal soil quality, seis-micity etc.; d) respect safe distances or let adopt additionalprotection measures; and e) define tank capacity beforeloading onset, so as to avoid overfilling logistically.

2) Maintenance ought to cover: a) good policy regarding routineinspections; b) periodic proof testing of overfill preventionsystem with high level alarms, metering devices, trip systemsand the alike; c) preventive checking of venting equipmenttogether with drains; d) using of equipment (e.g. valves) andexplosion-proof tools in conformity with international stan-dards or directives (ATEX, European Council, 1994) along withtheir dedicated maintenance scheme; f) managing of the hotworks permit system for both internal personnel andcontractors; and e) checking of successful work completion inorder to prevent contractors’ sloppiness.

3) Equipment should: a) conform to all standards and regulations;b) comprise a lighting protection system (e.g. a lightning rod ina nearby hill); c) accommodate special precautions for tankoverfilling, through multiple systems (e.g. level switch high-ehigh plus a radar level meter); d) ensure that the receivingagent has ultimate control of tank filling during loading; e)contain remotely operated and fire-safe shut-off valves; and f)have protection against fluid expansion in piping together withmechanical stress, corrosion, vibration, excess temperature andstatic electricity avoidance (e.g. diffusers in the fluid inlet).

4) Safety supporting systems must guarantee the uninterruptedsupply of main utilities to the tank farm, such as electric power,instrument air, electronic and alarm signals and many others.These systems comprise: a) fire detection (linear) and notifi-cation (alarm system) on every tank capable of transmittingsignals such as a warning of a fire incident in the control room.Moreover, fire alarms should be installed in the surroundingareas of the tanks, for immediate response of the fire-fighterspersonnel in the event of a fire; b) a firefighting network that

comprises all the pipe lines, cooling of tanks, pumps and watersupply (tanks and dikes with water) in case of a fire incident;the former is designed to provide continuous flow and pressureof water for a specific period of time, which depends on the sizeof the installations. Portable fire extinguishers are also part ofthis network, as they should be placed at the tank entranceplatform and its containment areas passages; c) a foam supplyand production system for a large tank fire (diameter > 40 m)accomplished with watermonitors, water pumping appliances,foam monitors, foam pumping appliances, foam concentratetankers or containers, large diameter/capacity fire hoses andwater supplies (see also in IChemE, 2008); d) a tank coolingsystem mounted on every tank with important mechanicalequipment in order to prevent its exposure to an adjacent fire;e) spare diesel driven pumps and firefighting water tank; f)anti-frost protection system for the prevention of pipingfrosting in the firefighting network; g) connection of the gasdetection system with the overfilling prevention system, withgas detectors positioned in strategic positions; h) CCTVequipment to give direct view of what is happening in the closeneighbourhood of the tank so that the control room operatorcan have a warning of abnormal situations; and i) a detailedemergency response plan together, with the strict use ofPersonal Protective Equipment (PPE), and a good knowledge ofthe MSDS, which are the cornerstones of every successfulmitigation and reaction effort

5) Miscellaneous general precautions include various measuressuch as: a) safeguarding, in the sense of safety fencing of thefacility area; site inspection; safety control and attending of thevisitors; high security level of power facility, b) electricalsupply of tanks added to critical utilities, c) no smoking nearthe tanks, d) protection against extreme weather phenomena,e) protection of tank from vehicle bumping, f) protection ofpiping from mechanical stress, g) protection from DOMINOeffects from adjacent installations, h) protection from arealelectric power lines, i) proper labelling and traffic signing, j)appropriate management of oily waste, k) appropriatemanagement of firefighting water, l) appropriate management

C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335334

of rain water, and m) good house keeping in general throughthe application of the 5S principle (Sort, Straighten, Shine,Standardize, Sustain) in the design and operation.

3.3. Checklist for tank safety assessment

The above analysis led the study team to the development ofa prototype checklist that can detect all of the above issues and bea valuable tool in the hands of all safety practitioners, both analystsand installation owners. This list has the form of Tables 1 & 2 havingadditional space for ‘Evaluation’ and ‘Comments’ regarding theawareness of failure causes and the implementation of protectionmeasures by tank farm owners. These remarks are filled out by theperson who performs the tank inspection. More specifically, incolumn “Evaluation” the inspector must complete each cell of thetable with the appropriate letter (A, B, C or X), each letter referringto a specific situation observed by the inspector always according tothe proposed methodology and findings. The explanation of eachletter is as follows: A: Full description (the safety study describesthe specific failure cause or protective measure with full details), B:Insufficient description (the safety study does not describe thespecific failure cause or protective measure with the appropriatedetail), C: Inefficient (the safety study does not include or there isinefficient description of the specific failure cause or protectivemeasure), and X: Inapplicable (the specific failure cause orprotective measure is inapplicable to this installation). The“Comments” column contains any comment of the inspector that isimportant to be referred for the specific failure cause or protectivemeasure.

4. Discussion of methodology

In order to verify the soundness of the methodology, thedevelopment team has presented it to a group of Greek safetyexperts coming from big refineries and from commercial tank farmsites and has discussedwith them themethodology highlights so asto elicit their opinion considered of high importance. Groupdiscussions have been organised with the operation and safetyexperts at each site (2e3 persons), where the study team presentedin a structured manner the items of both Tables 1 & 2 trying tocause the reaction of the experts and register their opinion/suggestions on them. Each group discussion lasted for one anda half to 2 h, while the experts had the possibility to send back theirremarks in writing. The discussion results together with the elab-oration of the experts’ written assessment led to the ordering ofspecified failure causes and proposed measures, on the basis oftheir significance in the current practice in the visited installations.As most of these companies are directly affiliated to multinationalones (Shell, Esso) or operate under the international state of the art,the study team reckons that the results of this discussion areapplicable outside Greece as well. It has been verified that someinstallation owners are very much aligned, in most safety issues,with the after Buncefield international practice. Additionally, thediscussion with the experts has approved in general the findings ofthe literature and gave rise to some additional remarks-suggestions, as in the following.

a) All expert practitioners place great importance to an integratedautomatic system for overfilling protection; namely, independentautomatic Level Switch HigheHigh & Level Switch LoweLowsystems with no explicit reference to the use of emergencyshut-off valves.

b) The protection against lightning is considered vital, so the exis-tence of a very effective grounding system (reaching theaquifer) is deemed indispensable for every separate tank, in

combination with lightning conductors positioned at sufficientheight and distance from the tank farm.

c) A rim seal fire is considered as the most frequent fire cause forfloating roof tanks containing petrol, crude oil and kerosene, asthe first one burns out quickly, while the last two producesignificant thermal load while burning.

d) Venting devices placed on the top of fixed roof tanks should beregularly checked, as they may be easily blocked, because ofa variety of reasons, such as the intrusion of birds.

e) The systematic maintenance of blast proof equipment is under-lined, so that its blast proofing quality is preserved.

f) The (easy to happen) sinking of the floating roof must be avoidedthrough regular maintenance of the pontoons and the rim sealand drainage system integrity checking.

g) A Boilover accident is quite improbable to happen in a refinery,given the constant monitoring of the operations and the timelywater removal from the tank, should an accident be initiated. Itis not that unlike, though, to happen in a non-properly safe-guarded commercial tank farm.

h) Extreme weather phenomena, such as an abrupt and heavyprecipitation, can cause flooding of the drains for oily residualsresulting in the spreading of hydrocarbons to the environment.

i) High inlet temperature of the fuel is not considered a probableaccident cause.

However, experts had split opinions about some points thatneed to be taken into consideration in the future, so as to ensureglobally the safety of the hydrocarbons storage tanks, such as:

a) The necessity for dike walls, bottom or joints safeguarding. Onlyone expert has mentioned that a possible prevention measureshould be to prohibit the entrance of non-specifically desig-nated vehicles in the bund area, so as to avoid any bumping onthe tank wall.

b) The reservation about the Vapour cloud explosion scenario, andwhether such a scenario should be considered as a standard insimilar safety studies, as it is clearly recommended by theBuncefield accident investigation Committee.

c) The controversy about mounting a cooling system on a storagetank: few of them supported very strongly the opinion that theinstallation of a cooling system on the tanks is indispensable,while the others did not consider it as a prerequisite, given thatit is not foreseen by the Greek law. On the contrary expertsstressed the necessity to protect the firefighting foam layerfrom the cooling water used for the side part of the tank, aspenetration of this layer by the fuel gas phase will result infoam loosing its masking effect.

d) The underestimation of a fire detection system on the top ofa storage tank or within the boundaries of the retention bund,as such systems are frequently falsely triggered so that theireffectiveness is soon devaluated.

e) The minor attention on the systematic collection and pro-cessing of the firefighting waste water, (not even during practicedrills) constituting a severe threat to the environment.

f) The non-existence of specific safety measures, like an obligatorycooling system, in the cases that the tank farms have been builtprior to the actually existing regulations (NFPA, 2002), whichprescribes the minimum in between distances among storagetanks.

5. Conclusions

In the present paper, an exhaustive hazards identification andgood practice methodology for liquid hydrocarbon fuel storage

C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335 335

tanks have been presented, aimed at being applied in the RiskAssessment Analysis of any liquid hydrocarbon tank farm; partic-ularly in the ones liable to the European Legislation of the series of“SEVESO” Directives. The methodology gives valuable insight ofpotential risks to the installations owners and can result in theordering of tank accident sequences according to their risk severity.

The most common initiating events leading to an accident ina liquid hydrocarbon fuel storage tank together with the preventiveand protection measures to be taken have been listed. The inno-vative part of the present study is the presentation of the checklistaimed at helping both safety engineers and safety reviewers toeasily identify the major contributors to risk and detail the analysisin those aspects.

Several group discussions has been organised by the authors ofthe proposedmethodology with experienced safety engineers fromthe Greek petrochemical industries, with the aim to improve andcorrect any lacks in the methodology. This initiative has helpeda lot, as the teams of experts interviewed have significant knowl-edge and expertise in the operation of liquid hydrocarbon fuelstorage tanks and know exactly the critical points behind the safeoperation of these installations. Experts believe that this method-ology can greatly help in quick the assessment of the safe operationof liquid hydrocarbon fuel storage tanks. The discussion has addi-tionally shown that issues that do not rank high in experts’ opinionmust all the same be highlighted and adequately ordered withinthe framework of the SEVESO II type of safety analyses. In partic-ular, the Vapour cloud explosion scenario should be thoroughlyanalysed, together with the proposal of additional preventive and/or protective measures, so as to minimize its probability to occur,given that the consequences are per definition disastrous.

Moreover, in commercial tank farms, where the safety measuresand the expertise are not comparable to the ones of big refineries,additional safety management measures should be taken, such asthe in situ observing of tank filling either by an operator or bya CCTV system.

The authors hope that the proposed methodology will bebeneficial for safety engineers, safety report evaluators, safetyinspectors and process companies, which are involved in thepreparation and evaluation of safety studies for liquid hydrocarbonfuel storage tanks.

Acknowledgements

The authors would like to thank the Greek Ministry of Devel-opment for the assignment of the safety studies checking and theGreek safety experts for their knowledge and comments offered tothe methodology improvement.

References

American Petroleum Institute. (1998). Welded steel tanks for oil storage (10th ed.).Washington, DC: API. Standard 650.

API RP 2021 (R2006). (2001).Management of atmospheric storage tank fires (4th ed.).American Petroleum Institute.

Argyropoulos, C. D., Christolis, M. N., Nivolianitou, Z., & Markatos, N. C. (2008a).Assessment of acute effects for fire-fighters during a fuel-tank fire. InProceedings of the 4th international conference on prevention of occupationalaccident in a changing work environment, WOS 2008, Crete, Greece.

Argyropoulos, C. D., Christolis, M. N., Nivolianitou, Z., & Markatos, N. C. (2008b).Numerical simulation of the dispersion of toxic pollutants from large tank fire.In M. Papadakis, & B. H. V. Topping (Eds.), Proceedings of the sixth internationalconference on engineering computational technology. Stirlingshire, UK: Civil-Comp Press, Paper 49. http://dx.doi.org/10.4203/ccp.89.49.

Argyropoulos, C. D., Sideris, G. M., Christolis, M. N., Nivolianitou, Z., & Markatos, N. C.(2010). Modelling pollutants dispersion and plume rise from large hydrocarbontank fires in neutrally stratified atmosphere. Atmospheric Environment, 44,803e813.

ASME B96.1 Welded aluminium-alloy storage tanks, Publication date: Jan 1; 1999.

Bakke, J. R., Wingerden, K., Hoorelbeke, P., & Brewerton, B. (2010). A study on theeffect of trees on gas explosions. Journal of Loss Prevention in the ProcessIndustries, 23, 878e884.

Buncefield Major Incident Investigation Board. (2008). The Buncefield incident 11December 2005. Final report.

Chang, J. I., & Lin, C. C. (2006). A study of storage tank accidents. Journal of LossPrevention in the Process Industries, 19, 51e59.

Christou, M., Papadakis, G., & Amendola, A. (2005). Guidance on the preparation ofa safety report to meet the requirements of the directive 96/82/EC as amended bythe directive 2003/105/EC 2002 (SEVESO II), EUR 22113 EN.

Crippa, C., Fiorentini, L., Rossini, V., Stefanelli, R., Tafaro, S., & Marchi, M. (2009). Firerisk management system for safe operation of large atmospheric storage tanks.Journal of Loss Prevention in the Process Industries, 22, 574e581.

Dow Chemicals. (1981). Fire and explosion index hazard classification guide (6th ed.)..European Council. (1982). Council directive 82/501/EEC on the major accident

hazards of certain industrial activities (SEVESO I). Official Journal of the EuropeanCommunities, Luxembourg.

European Council. (1994). Council directive 94/9/EC on equipment and protectivesystems intended for use in potentially explosive atmospheres (ATEX). OfficialJournal of the European Communities, Luxembourg.

European Council. (1997). Council Directive 96/82/EC on the major accident hazardsof certain industrial activities (SEVESO II). Official Journal of the EuropeanCommunities, Luxembourg.

Fabbrocino, G., Iervolino, I., Orlando, F., & Salzano, E. (2005). Quantitative riskanalysis of oil storage facilities in seismic areas. Journal of Hazardous Materials,A123, 61e69.

Giannini, F.M.,Monti,M. S., Ansaldi, S. P., &Bragatto, P. (2006). P.L.M., to supporthazardidentification in chemical plant design. InD. Brissaud, et al. (Eds.), Innovation in lifecycle engineering and sustainable development (pp. 349e362). Springer.

Ghoniem, A. F., Zhang, X., Knio, O., Baum, H. R., & Rehm, R. G. (1993). Dispersion anddeposition of smoke plumes generated in massive fires. Journal of HazardousMaterials, 33, 275e293.

Herbert, I. (2010). The UK Buncefield incident e the view from a UK risk assessmentengineer. Journal of Loss Prevention in the Process Industries, 23, 913e920.

IChem, E. (2008). BP process safety series, liquid hydrocarbon tank fires: Preventionand response (4th ed.).. U.K.

Johnson, D. M. (2010). The potential for vapour cloud explosions e lessons from theBuncefield accident. Journal of Loss Prevention in the Process Industries, 23,921e927.

Kletz, T. A. (2009). Accident reports may not tell us everything we need to know.Journal of Loss Prevention in the Process Industries, 22, 753.

Knegtering, B., & Pasman, H. J. (2009). Safety of the process industries in the 21stcentury: a changing need of process safety management for a changingindustry. Journal of Loss Prevention in the Process Industries, 22, 162e168.

Koseki, H., Natsuma, Y., Iwata, Y., Takahashi, T., & Hirano, T. (2003). A study on large-scale boilover using crude oil containing emulsified water. Fire Safety Journal,39, 143e155.

Kourniotis, S. P., Kiranoudis, C. T., & Markatos, N. C. (2000). Statistical analysis ofdomino chemical accidents. Journal of Hazardous Materials, 71, 239e252.

LASTFIRE. (2001). Large atmospheric storage tank fires. Resource ProtectionInternational.

Lawley, G. (1974). Operability studies and hazards analysis, loss prevention. CEP.Lees, F. P. (1996). Loss prevention in the process industries (2nd ed.). Oxford, U.K:

Butterworth.Lewis, D. J. (1974). The Mond fire, explosions and toxicity index, applied plant lay-out

and spacing, loss prevention symposium. CEP.Markatos, N. C., Christolis, M., & Argyropoulos, C. (2009). Mathematical modeling of

toxic pollutants dispersion from large tank fires and assessment of acute effectsfor fire fighters. International Journal of Heat and Mass Transfer, 52, 4021e4030.

McGrattan, K. B., Baum, H. R., & Rehm, R. G. (1996). Numerical simulation of smokeplumes from large oil fires. Atmospheric Environment, 30, 4125e4136.

NFPA 11. (2002). National fire protection association standard: Standard for low-,medium-, and high-expansion foam.

NFPA 30. (1993). National fire protection association standard: Flammable andcombustible liquids code.

Nuclear Regulatory Commission. (1983). USA, PRA procedure guide, NUREG/CR-2815.Papazoglou, I. A., Nivolianitou, Z., Aneziris, O., & Christou, M. (1992). Probabilistic

safety analysis in chemical installations. Journal of Loss Prevention in the ProcessIndustries, 5, 181e191.

Persson, H., & Lonnermark, A. (2004). Tank fires. SP Swedish National Testing andResearch Institute. SP Report 2004:14, Boras, Sweden.

Pitblado, R. (2010). Global process industry initiatives to reduce major accidenthazards. Journal of Loss Prevention in the Process Industries, 24, 57e62.

Santos-Reyes, J., & Beard, A. N. (2008). A systemic approach to managing safety.Journal of Loss Prevention in the Process Industries, 21, 15e28.

Shaluf, I. M., & Abdullah, S. A. (2011). Floating roof storage tank boilover. Journal ofLoss Prevention in the Process Industries, 24, 1e7.

Shebeko, Y. N., Bolodian, I. A., Molchanov, V. P., Deshevih, Y. I., Gordienko, D. M.,Smolin, I. M., et al. (2007). Fire and exploS200sion risk assessment for large-scaleoil export terminal. Journal of Loss Prevention in the Process Industries, 20, 651e658.

U.S. Chemical Safety Board. (2009). Cited at December, 5, 2011, available at http://www.csb.gov/investigations/detail.aspx?SID¼87.

Vautard, R., Ciaisa, P., Fisher, R., Lowry, D., Breon, F. M., Vogel, F., et al. (2007). Thedispersion of the Buncefield oil fire plume. Atmospheric Environment, 41,9506e9517.