Journal of Loss Prevention in the Process Industries 25 (2012) 329e335

Contents lists available at SciVerse ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

A hazards assessment methodology for large liquid hydrocarbon fuel tanks

C.D. Argyropoulos a,1, M.N. Christolis a, Z. Nivolianitou b, *, N.C. Markatos a
a
CFD Unit, School of Chemical Engineering, National Technical University of Athens, 9 Iroon Polytechniou Str., Zografou Campus, Athens 15780, Greece
b
Institute of Nuclear Technology-Radiation Protection, National Centre for Scientic Research Demokritos, Ag. Paraskevi 15310, Greece

a r t i c l e i n f o a b s t r a c t

Article history: This paper presents a systematic hazards identication methodology for liquid hydrocarbon fuel storage
Received 22 July 2011 tanks, by applying a checklist technique on the accident causes and the relevant protection measures, in
Received in revised form the framework of the SEVESO Directive series. A forum discussion with Greek industrial safety experts
5 December 2011
has been also organised by the authors in order to locate any lack of the methodology. Results are
Accepted 7 December 2011
presented and discussed, and it is concluded that the present hazards assessment methodology helps to
identify the major contributors to risk, to improve safety measures and to assist the analysis in these
Keywords:
aspects.
Hazards assessment
Storage tanks
2011 Elsevier Ltd. All rights reserved.
Tank res
Vapour cloud explosion
Seveso II

1. Introduction Vautard et al., 2007) towards the investigation and explanation of

A hydrocarbon tank re is a relatively rare accident that may
lead, however, to unexpected consequences for the installation, the
environment and the health of workers and neighbours. Para-
phrasing the text by Kletz (2009) we could say that progress in
industrial safety is one accident at a time. Indeed, signicant tank re
accidents have happened recently, such as the December 11th, 2005
Bunceeld Oil Storage Depots (B.O.S.D) disaster (Bunceeld
Investigation Board, 2008; Herbert, 2010) and the massive tank
re of October 23rd, 2009 at the Caribbean Petroleum Rening (U.S.
Chemical Safety Board, 2009). These accidents demonstrate not only
the large-scale of destruction in the surroundings, together with the
implication of potential environmental issues, but also the necessity
to prevent similar accidents (Pitblado, 2010). Chang and Lin (2006)
have made an extensive study, collecting reference and information
through appropriate literature, with the aim to perform a statistical
analysis of accident occurrence in storage tanks. Intensive research
has also been undertaken by many groups of scientists and engi-
neers (Argyropoulos, Christolis, Nivolianitou, Markatos, 2008a,
2008b; Argyropoulos, Sideris, Christolis, Nivolianitou, & Markatos,
2010; Ghoniem, Zhang, Knio, Baum, & Rehm, 1993; McGrattan,
Baum, & Rehm, 1996; Markatos, Christolis, & Argyropoulos, 2009;
* Corresponding author. Tel.: 302106503744; fax: 302106545496.
E-mail address: zoe@ipta.demokritos.gr (Z. Nivolianitou).
1
Present address: Department of Chemical Engineering and Chemical Tech-
nology, Imperial College London, London, SW7 2AZ, UK.
the physical characteristics of the phenomena involved in large
hydrocarbon tank res. These investigations are related with the
estimation of plume dispersion and height elevation, ground-level
concentrations of the toxic pollutants, such as smoke, sulphur
dioxide (SO2), carbon monoxide (CO), polyaromatic hydrocarbons
(PAHs), and volatile compounds (VOCs), together with the charac-
terization of risks zones by comparing the ground-level concen-
trations with existing safety thresholds.
A standard methodology followed for the Safety Analysis in
petrochemical installations is the Quantitative Risk Analysis (QRA)
(Papazoglou, Nivolianitou, Aneziris, & Christou, 1992), preceded in
most cases by the so-called Qualitative Risk Analysis, which has
certain advantages and disadvantages with respect to the rst
according to Knegtering and Pasman (2009).
The Qualitative approach uses well known types of analysis,
such as the Checklist (Giannini, Monti, Ansaldi, & Bragatto, 2006;
Lees, 1996), the Failure Mode and Effect Analysis (FMEA) (NRC,
1983) and the Hazard and Operability analysis (HAZOP) (Lawley,
1974). Checklist is the simplest tool of hazard identication in
a chemical installation passing on hard-won experience; indeed it
is impossible to envisage high standards in hazard control unless
this experience is effectively utilised.
Additionally, quantitative methods attempt to specify the safety
level or the associated risk level of a system or an installation. A
variety of these methods already exist, such as the approaches of
Mond (Lewis, 1974) and Dow (1981) indices and the well-established
methods of Fault Tree (FTA) and Event Tree Analysis (ETA) (NRC,

0950-4230/$ e see front matter 2011 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2011.12.003
330 C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335
1983). The above list could be lengthened with risk assessment
methodologies tailor-made for offshore process facilities in seismic
areas (Fabbrocino, Iervolino, Orlando, & Salzano, 2005), for large-
scale oil export terminals (Shebeko et al., 2007), for re manage-
ment systems (Crippa et al., 2009) and for estimating the domino
effect in petrochemical industries (Kourniotis, Kiranoudis, &
Markatos, 2000). However, what is lacking, in our opinion, is a dedi-
cated hazards assessment methodology for liquid hydrocarbon fuel
storage tanks that could help both in the evaluation of the relative
safety studies and in the safe operation of these installations.
The purpose of the present study is to describe a systematic
hazards identication methodology together with good practices
for liquid hydrocarbon fuel storage tank operation. The proposed
methodology has been conceived and implemented in a pilot study
for a liquid hydrocarbon tank farm in Greece, liable to this analysis
by the SEVESO Directives (European Council, 1982, 1997) of
European Legislation on behalf of the Greek Ministry of Develop-
ment. The implementation of the SEVESO Directives across the EU
since 1983 has created a signicant fund of experience and,
moreover, has highlighted the areas that need support during this
implementation (Christou, Papadakis, & Amendola, 2005). One of
them is the existence of relatively simple and widely accepted tools
among practitioners that constitute a common understanding basis
both in the elaboration and in the assessment of a SEVESO study. In
addition, a forum discussion has been organised by the authors of
the proposed methodology with experienced safety engineers from
the Greek petrochemical industries with the aim to improve and
correct any lacks of the methodology.
In the remainder of this paper one can nd: in Section 2 the
description of the various types of storage tanks together with their
possible accident types; in Section 3, a description of the proposed
hazards assessment methodology; in Section 4 the discussions with
Greek experts; and in Section 5 the presentation of the results and
a general discussion on the methodology proposed.
2. Accidents in storage tanks
2.1. Main types of storage tanks
Large liquid storage tanks are used in the petroleum and
chemical industries for the storing of both raw material and
intermediate or nished products in conned areas that are nor-
mally separated from the rest of the installation. Information for
important safety parameters are provided in detail by Lees (1996).
The types of tanks for storing combustible or ammable liquid
hydrocarbon fuel are classied in three main types by the Institu-
tion of Chemical Engineers (IChemE, 2008) (Fig. 1):
1. Fixed or cone roof tanks.
2. Open top oating roof tank (simple pontoon or double deck).
3. Fixed roof tanks with internal oating roof.
Fig. 1. Types of tanks for fuel storage.
A xed or cone roof tank is made of a vertical cylinder side and
a xed cone-shaped roof that is welded to each other. According to
API standards (API, 2001) this type of tank is designed with a weak
seam at joint, where the roof and sides become one to cope with an
internal explosion. Therefore, the roof separates from the tank
without the containment and any resulting re is proliferated only
on the surface of the fuel. This type of tank usually contains black
heavy products, such as fuel-oils, asphalt (bitumen) and vacuum or
atmospheric residue. Hence, the use of insulation, steam or coil
heating in these types of tanks is necessary for keeping of the
content in a liquid state.
An open top oating roof tank is made of a vertical, cylindrical
above ground shell similar to the conical roof tank. However,
instead of a conical roof it has a pontoon type roof, characterized
by the ability of the roof to rise and fall on the stored-fuel
surface, in order to prevent the large volumes emittance of
fuel-vapours. Moreover, there is a rim seal that covers the space
between the oating roof and the tank shell, in the form of
a rubber tube lled with kerosene, where most frequently a re
may start.
An internal oating roof storage tank is a combination of the
above two types of tanks, as the tank consists of a conical roof with
the addition of the internal oating roof or pan that oats directly
on the fuel surface. Furthermore, internal oaters have the capa-
bility to decrease the potential of ignition and to prevent the
initiation of tank res.
The second and third categories of tanks are used for volatile
liquid hydrocarbons such as crude oil and white light products
(jet, diesel and gasoline). Moreover, important parameters for the
above types of tanks are the existence of bunds with the appro-
priate volume capacity and the correct safety distance between
them and the installations, in order to prevent the dissemination of
the oil-leakage to the surrounding installations with a major
probability of ignition.
2.2. Tank re accidents scenarios
Potential re scenarios that can be developed in a tank accident
are presented in LASTFIRE (2001) (Fig. 2):
1. Rim seal re
2. Spill on roof re
3. Full surface re
4. Bund or Dyke re
5. Pontoon explosion
6. Boilover
The most severe are the full surface re and boilover.
More details on the above scenarios are presented in the study
of Crippa et al. (2009). According to the data of LASTFIRE project
(2001) the most common tank accident is the rim seal re and the
 C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335
Fig. 2. Potential tank re scenarios.
prevalent failure cause of accident is the lightning. The study of
Chang and Lin (2006) conrms the lightning as the most frequent
cause of tank accident, while re and explosion constitute the 85%
of total cases of tank accidents.
However, it is important to mention that sometimes a full
surface re can escalate to a boilover (IChemE, 2008; Koseki,
Natsuma, Iwata, Takahashi, Hirano, 2003), even though it is
accounted as a very rare incident. According to literature large
boilovers have been recorded in Yokkaichi (Japan, 1955), Pernin
(Netherlands, 1968), Findlay (Ohio, USA, 1975), Tacoa (Venezuela,
1982), Milford Haven (U.K., 1983), Thessalonica (Greece, 1986), Port
Edouard Herriot (France, 1987) and Skikda (Algeria, 2005) as
described in LASTFIRE (2001) and by Persson and Lonnermark
(2004). However, the progress of safety science has almost elimi-
nated the possibility of a boilover, but still there will be a hazard for
it with potential precursor signs described in LASTFIRE (2001) and
by Shaluf and Abdullah (2011).
2.3. Vapour cloud explosion
The Bunceeld accident (Bunceeld Investigation Board, 2008)
has shed new light in tank re accidents according to Herbert
(2010). New phenomena, such as the explosion in a typically non-
conned space, have to be considered as plausible alternatives
now (Johnson, 2010). The oil and gas industry has for a number of
years been aware of the potential for ame acceleration and over-
pressure generation owing to obstacles in gas clouds, caused by
leaks of ammable substances. To a large extent the obstacles were
mainly considered to be equipment, piping or other structures
typically found in many installations, but the Bunceeld explosion
showed that also for land based open space installations there is
a potential for ame acceleration in regions of vegetation (trees,
bushes), which most likely led to the severe explosion in this
accident (Bakke, Wingerden, Hoorelbeke, & Brewerton, 2010). In
fact the investigation of explosion accidents in the vicinity of liquid
hydrocarbon storage tanks led to signicant conclusions
(Knegtering and Pasman (2009), such as a) the explosion always
follows a leakage of gasoline, b) tank overlling is the major cause,
c) the cloud ignition happens in nearby sites (50e300 m away from
leakage point), d) the delay of the ignition ranges from 20 to 90 min
from leakage onset, e) almost windless conditions prevail before
the accident, and f) there is signicant recurrence of this type of
331
accident (though not as destructive), almost every 5 years around
the world. All these make obvious that an explosion accident after
the release of a hydrocarbon vapour cloud, as a result of tank
overlling (Bunceeld type of accident), has a signicant occur-
rence probability and needs to be further investigated, especially in
non-properly safeguarded commercial tank farms.
3. Hazards identication methodology for liquid hydrocarbon
fuel storage tanks
3.1. General steps
A liquid hydrocarbon fuel storage tank farm is a particular type
of a chemical installation, in which the hazard stems mainly from
the big potential for re. A hazards analysis should comprise all the
general items, such as described by Santos-Reyes and Beard (2008):
- Description of the local area, including a general map.
- Sufcient knowledge of the hydrogeological, hydrographical
and meteorological data of the area together with any pro-
tected environmental zones.
- Sufcient meteorological data with heavy snow and heavy rain
frequencies.
- List of the hazardous installations in the surroundings.
- Ground plan of the plant and/or tank farm together with
process ow diagrams.
- Description of production processes for every location of the
plant.
- Characteristics of chemical substances according to SEVESO
II (Implementation in the Greek Legislation, Ministerial
Decree 12044/2007), together with declaration of the stored
hazardous substances accompanied by Material Safety Data
Sheets (MSDS).
3.2. Proposed methodology for tank inspection
Before going into a full-blown quantitative analysis, this work
proposes a screening methodology that can, quite easily, lead to the
identication of the areas where a re can start as a result of
a hazardous substance release. The methodology is based on the
philosophy of the checklist, which has been mentioned in Section 1.
332 C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335
Indeed, the present checklist is based on a catalogue of causes that
could lead to the failure of the tank, together with a list of
preventive and/or protection measures that can avert the occur-
rence of an accident in a storage tank. These two lists derive from
past experience of tank operation and maintenance, and are to be
considered as prerequisite conditions to avoid problems in safety. If
an installation satises these criteria, then the accident potential is
very low without banning risk totally. If Time and resources are
available, a full-blown Quantitative Risk Analysis can be performed
on the installation. Additionally, this methodology can be a tool in
the hands governmental agencies, as the former can aid in the
checking of the safety analysis elaborated by the plant owner.
3.2.1. Failure causes of tank accidents
The most common initiating events or failure causes for xed/
cone and oating roof tanks are grouped in the general headings
presented in Table 1 and can be detailed as follows:
1) Operational errors: These comprise a) tank overlling, owing to
a failure of level metering systems or human error in the
loading procedure; b) fuel release because of drain valves left
open accidentally; c) Vent valve left closed during loading or
unloading in xed roof tanks; d) oil leaks owing to operators
errors; e) import of a product with high inlet temperature; and
f) drainage ducts to retention basin being obstructed. Causes
(a), (b), (d) and (f) lead to leakage of fuel in the retention bund
and creation of an airevapour mixture that can be easily
ignited on the occasion of an ignition source, leading to a pool
re even in the whole bund area. Cause (c) leads to tank
buckling, owing to underpressure in it, and subsequent tank
failure and fuel release, while cause (e) leads to temperature
increase in the tank and possible release of fuel vapour.
2) Equipment/Instrument failure: In this category have been
noticed a) the sinking of oating roof resulting in the bursting
of a re that may comprise the entire upper surface of the tank;
b) the level indicator failure that can lead to tank overlling
(see above); c) the discharge valve failure and d) a rusted vent
valve that does not open, with consequences described above.
3) Lightning is a major accident initiator, owing to: a) poor
grounding of the tank preventing the full absorbing of a direct
strike; b) ammable liquid or rim seal leaks that develop the
lightning strike into to a re; and c) a direct strike of tank wall
that may lead to its failure and subsequent fuel leakage.
Table 1
Immediate causes of accidents.
1. Operational errors 4. Static electricity
Tank overlling Rubber seal cutting
Drain valves left open accidentally Poor grounding
Vent closed during loading/unloading Fluid transfer
Oil leaks due to operators errors Improper sampling procedures
High inlet temperature
Drainage ducts to retention basin obstructed
2. Equipment/instrument failure 5. Maintenance errors
Floating roof sunk Welding/cutting
Level indicator Non explosion-proof motor and tools used
Discharge valve rupture Circuit shortcut
Rusted vent valve does not open Transformer spark
Poor grounding of soldering equipment
Poor maintenance of equipment both normal and blast proof
3. Lightning 6. Tank crack/rupture
Poor grounding Poor soldering
Rim seal leaks Shell distortion/buckling
Flammable liquid leak from seal rim Corrosion
Direct hit
4) Static electricity caused by: a) rubber seal cutting of oating roof
may create a spark that almost certainly leads to tank roof res;
b) poor grounding of xed roof tanks may lead to its channel-
ling to tank shell, causing of vapour ignition; c) uid transfer
(mainly white products) during tank lling can lead to the
creation of a spark, especially when the loading rate is high
because of undersized lines; d) improper sampling procedures
(e.g. not proper shoes, gloves or VHF apparatuses) produces
also sparks.
5) Maintenance errors may lead to the occurrence of accidents,
namely: a) welding/cutting operations producing uncovered
sparks, b) use of non explosion-proof motor and tools, c) circuit
shortcuts, d) transformer sparks e) poor grounding of soldering
equipment and f) improper maintenance of equipment both
normal and blast proof.
6) Tank rupture/crack is another cause of accident caused by: a)
poor soldering, b) shell distortion/buckling (see also above) and
c) roof or shell corrosion and ground subsidence.
7) Piping rupture/crack can be noticed through: a) valve or pump
leaking, b) ammable liquid leak of gasket, c) piping material
failure, d) contractor bungling, and e) pipe failure because of
liquid expansion. All of these causes result in smaller or bigger
liquid outow, possible ignition and creation of a pool re.
8) Miscellaneous comprise: a) earthquakes, b) extreme weather
phenomena, c) vehicles impacting on piping, d) adjacent open
ames or remains of smoking, e) escalation from another unit
(domino effect), f) previous accident caused by energy/fuel
transportation lines and g) sabotage or arson (intentional
damage).
9) Supporting safety systems failures refer to the: a) electric power
system, b) insufcient tank cooling, which could lead to total
tank demolition, c) water supply system for re extinguishing,
and d) freezing of water in pipes of the reghting system.
3.2.2. Preventive and protection measures
For all the above mentioned causes there are certain protective
measures aimed at limiting or preventing their occurrence and are
presented in Table 2 while analysed in the following:
1) Tank design should: a) follow the international standards, such
as those of the American Petroleum Institute (API, 1998), the
American Society of Mechanical Engineers (ASME, 1999) and
7. Piping rupture/leak
Valve leaking
Flammable liquid leak from a gasket
Piping failure
Pump leak
Cut accidentally
Failure owing to liquid expansion
8. Miscellaneous
Earthquake
Extreme weather
Vehicle impact on piping
Open ames/smoking ame
Escalation from another unit (domino)
Accident caused by energy/fuel transportation lines
Arson (intentional damage)
9. Safety supporting systems
Electric power loss
Insufcient tank cooling
Fireghting water loss
Fireghting water in piping freezing
 C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335 333

Table 2
Protective measures.

1. Design 3. Equipment 5. Miscellaneous

Following engineering standards Following engineering standards Safeguarding
and regulations
Modication of tank top design Handling static electricity during tank loading Electrical supply of tanks added to critical utilities
to prevent overlling
Site inspection Lightning protection system No smoking/good house keeping
Safe distance High-integrity automatic operating overlling Protection against extreme weather phenomena
prevention system
Dikes, bunds Arrangements to ensure that the receiving agent Protection from vehicle bumping
has ultimate control of tank lling.
Dening tank capacity Remotely operated and re-safe shut-off valves Protection of piping from mechanical stress
Protection against uid expansion in piping Protection from DOMINO effects
Temperature monitoring Protection from areal electric power lines
Proper labelling and trafc signing
2. Maintenance 4. Safety supporting systems Appropriate management of oily waste
Routine inspection Fire detection and alarm system Appropriate management of reghting water
Periodic proof testing of overll Fireghting network Appropriate management of rain water
prevention system/
Corrosion resistance Foam supply and production system Good house keeping
(5S e Sort, Straighten, Shine, Standardize, Sustain)
Preventive checking of venting Tank cooling system
equipment
Use proper equipment Spare reghting water tank/diesel driven pump
Use explosion-proof tools Anti-frost protection
Maintenance of both normal Connection of gas detection with the overlling
and blast proof equipment prevention system.
Hot work permit CCTV equipment
Checking of successful work completion Emergency response plan

the National Fire Protection Association (NFPA, 1993) covering
also material selection, fabrication, installation, inspection,
repair and safe management; b) cover modication of tank top
to prevent overlling and allow re-routing of the uid back to
the tank; c) include site inspection to reveal soil quality, seis-
micity etc.; d) respect safe distances or let adopt additional
protection measures; and e) dene tank capacity before
loading onset, so as to avoid overlling logistically.
2) Maintenance ought to cover: a) good policy regarding routine
inspections; b) periodic proof testing of overll prevention
system with high level alarms, metering devices, trip systems
and the alike; c) preventive checking of venting equipment
together with drains; d) using of equipment (e.g. valves) and
explosion-proof tools in conformity with international stan-
dards or directives (ATEX, European Council, 1994) along with
their dedicated maintenance scheme; f) managing of the hot
works permit system for both internal personnel and
contractors; and e) checking of successful work completion in
order to prevent contractors sloppiness.
3) Equipment should: a) conform to all standards and regulations;
b) comprise a lighting protection system (e.g. a lightning rod in
a nearby hill); c) accommodate special precautions for tank
overlling, through multiple systems (e.g. level switch high-
ehigh plus a radar level meter); d) ensure that the receiving
agent has ultimate control of tank lling during loading; e)
contain remotely operated and re-safe shut-off valves; and f)
have protection against uid expansion in piping together with
mechanical stress, corrosion, vibration, excess temperature and
static electricity avoidance (e.g. diffusers in the uid inlet).
4) Safety supporting systems must guarantee the uninterrupted
supply of main utilities to the tank farm, such as electric power,
instrument air, electronic and alarm signals and many others.
These systems comprise: a) re detection (linear) and noti-
cation (alarm system) on every tank capable of transmitting
signals such as a warning of a re incident in the control room.
Moreover, re alarms should be installed in the surrounding
areas of the tanks, for immediate response of the re-ghters
personnel in the event of a re; b) a reghting network that
comprises all the pipe lines, cooling of tanks, pumps and water
supply (tanks and dikes with water) in case of a re incident;
the former is designed to provide continuous ow and pressure
of water for a specic period of time, which depends on the size
of the installations. Portable re extinguishers are also part of
this network, as they should be placed at the tank entrance
platform and its containment areas passages; c) a foam supply
and production system for a large tank re (diameter > 40 m)
accomplished with water monitors, water pumping appliances,
foam monitors, foam pumping appliances, foam concentrate
tankers or containers, large diameter/capacity re hoses and
water supplies (see also in IChemE, 2008); d) a tank cooling
system mounted on every tank with important mechanical
equipment in order to prevent its exposure to an adjacent re;
e) spare diesel driven pumps and reghting water tank; f)
anti-frost protection system for the prevention of piping
frosting in the reghting network; g) connection of the gas
detection system with the overlling prevention system, with
gas detectors positioned in strategic positions; h) CCTV
equipment to give direct view of what is happening in the close
neighbourhood of the tank so that the control room operator
can have a warning of abnormal situations; and i) a detailed
emergency response plan together, with the strict use of
Personal Protective Equipment (PPE), and a good knowledge of
the MSDS, which are the cornerstones of every successful
mitigation and reaction effort
5) Miscellaneous general precautions include various measures
such as: a) safeguarding, in the sense of safety fencing of the
facility area; site inspection; safety control and attending of the
visitors; high security level of power facility, b) electrical
supply of tanks added to critical utilities, c) no smoking near
the tanks, d) protection against extreme weather phenomena,
e) protection of tank from vehicle bumping, f) protection of
piping from mechanical stress, g) protection from DOMINO
effects from adjacent installations, h) protection from areal
electric power lines, i) proper labelling and trafc signing, j)
appropriate management of oily waste, k) appropriate
management of reghting water, l) appropriate management
334 C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335
of rain water, and m) good house keeping in general through
the application of the 5S principle (Sort, Straighten, Shine,
Standardize, Sustain) in the design and operation.
3.3. Checklist for tank safety assessment
The above analysis led the study team to the development of
a prototype checklist that can detect all of the above issues and be
a valuable tool in the hands of all safety practitioners, both analysts
and installation owners. This list has the form of Tables 1 & 2 having
additional space for Evaluation and Comments regarding the
awareness of failure causes and the implementation of protection
measures by tank farm owners. These remarks are lled out by the
person who performs the tank inspection. More specically, in
column Evaluation the inspector must complete each cell of the
table with the appropriate letter (A, B, C or X), each letter referring
to a specic situation observed by the inspector always according to
the proposed methodology and ndings. The explanation of each
letter is as follows: A: Full description (the safety study describes
the specic failure cause or protective measure with full details), B:
Insufcient description (the safety study does not describe the
specic failure cause or protective measure with the appropriate
detail), C: Inefcient (the safety study does not include or there is
inefcient description of the specic failure cause or protective
measure), and X: Inapplicable (the specic failure cause or
protective measure is inapplicable to this installation). The
Comments column contains any comment of the inspector that is
important to be referred for the specic failure cause or protective
measure.
4. Discussion of methodology
In order to verify the soundness of the methodology, the
development team has presented it to a group of Greek safety
experts coming from big reneries and from commercial tank farm
sites and has discussed with them the methodology highlights so as
to elicit their opinion considered of high importance. Group
discussions have been organised with the operation and safety
experts at each site (2e3 persons), where the study team presented
in a structured manner the items of both Tables 1 & 2 trying to
cause the reaction of the experts and register their opinion/
suggestions on them. Each group discussion lasted for one and
a half to 2 h, while the experts had the possibility to send back their
remarks in writing. The discussion results together with the elab-
oration of the experts written assessment led to the ordering of
specied failure causes and proposed measures, on the basis of
their signicance in the current practice in the visited installations.
As most of these companies are directly afliated to multinational
ones (Shell, Esso) or operate under the international state of the art,
the study team reckons that the results of this discussion are
applicable outside Greece as well. It has been veried that some
installation owners are very much aligned, in most safety issues,
with the after Bunceeld international practice. Additionally, the
discussion with the experts has approved in general the ndings of
the literature and gave rise to some additional remarks-
suggestions, as in the following.
a) All expert practitioners place great importance to an integrated
automatic system for overlling protection; namely, independent
automatic Level Switch HigheHigh & Level Switch LoweLow
systems with no explicit reference to the use of emergency
shut-off valves.
b) The protection against lightning is considered vital, so the exis-
tence of a very effective grounding system (reaching the
aquifer) is deemed indispensable for every separate tank, in
combination with lightning conductors positioned at sufcient
height and distance from the tank farm.
c) A rim seal re is considered as the most frequent re cause for
oating roof tanks containing petrol, crude oil and kerosene, as
the rst one burns out quickly, while the last two produce
signicant thermal load while burning.
d) Venting devices placed on the top of xed roof tanks should be
regularly checked, as they may be easily blocked, because of
a variety of reasons, such as the intrusion of birds.
e) The systematic maintenance of blast proof equipment is under-
lined, so that its blast proong quality is preserved.
f) The (easy to happen) sinking of the oating roof must be avoided
through regular maintenance of the pontoons and the rim seal
and drainage system integrity checking.
g) A Boilover accident is quite improbable to happen in a renery,
given the constant monitoring of the operations and the timely
water removal from the tank, should an accident be initiated. It
is not that unlike, though, to happen in a non-properly safe-
guarded commercial tank farm.
h) Extreme weather phenomena, such as an abrupt and heavy
precipitation, can cause ooding of the drains for oily residuals
resulting in the spreading of hydrocarbons to the environment.
i) High inlet temperature of the fuel is not considered a probable
accident cause.
However, experts had split opinions about some points that
need to be taken into consideration in the future, so as to ensure
globally the safety of the hydrocarbons storage tanks, such as:
a) The necessity for dike walls, bottom or joints safeguarding. Only
one expert has mentioned that a possible prevention measure
should be to prohibit the entrance of non-specically desig-
nated vehicles in the bund area, so as to avoid any bumping on
the tank wall.
b) The reservation about the Vapour cloud explosion scenario, and
whether such a scenario should be considered as a standard in
similar safety studies, as it is clearly recommended by the
Bunceeld accident investigation Committee.
c) The controversy about mounting a cooling system on a storage
tank: few of them supported very strongly the opinion that the
installation of a cooling system on the tanks is indispensable,
while the others did not consider it as a prerequisite, given that
it is not foreseen by the Greek law. On the contrary experts
stressed the necessity to protect the reghting foam layer
from the cooling water used for the side part of the tank, as
penetration of this layer by the fuel gas phase will result in
foam loosing its masking effect.
d) The underestimation of a re detection system on the top of
a storage tank or within the boundaries of the retention bund,
as such systems are frequently falsely triggered so that their
effectiveness is soon devaluated.
e) The minor attention on the systematic collection and pro-
cessing of the reghting waste water, (not even during practice
drills) constituting a severe threat to the environment.
f) The non-existence of specic safety measures, like an obligatory
cooling system, in the cases that the tank farms have been built
prior to the actually existing regulations (NFPA, 2002), which
prescribes the minimum in between distances among storage
tanks.
5. Conclusions
In the present paper, an exhaustive hazards identication and
good practice methodology for liquid hydrocarbon fuel storage
 C.D. Argyropoulos et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 329e335
tanks have been presented, aimed at being applied in the Risk
Assessment Analysis of any liquid hydrocarbon tank farm; partic-
ularly in the ones liable to the European Legislation of the series of
SEVESO Directives. The methodology gives valuable insight of
potential risks to the installations owners and can result in the
ordering of tank accident sequences according to their risk severity.
The most common initiating events leading to an accident in
a liquid hydrocarbon fuel storage tank together with the preventive
and protection measures to be taken have been listed. The inno-
vative part of the present study is the presentation of the checklist
aimed at helping both safety engineers and safety reviewers to
easily identify the major contributors to risk and detail the analysis
in those aspects.
Several group discussions has been organised by the authors of
the proposed methodology with experienced safety engineers from
the Greek petrochemical industries, with the aim to improve and
correct any lacks in the methodology. This initiative has helped
a lot, as the teams of experts interviewed have signicant knowl-
edge and expertise in the operation of liquid hydrocarbon fuel
storage tanks and know exactly the critical points behind the safe
operation of these installations. Experts believe that this method-
ology can greatly help in quick the assessment of the safe operation
of liquid hydrocarbon fuel storage tanks. The discussion has addi-
tionally shown that issues that do not rank high in experts opinion
must all the same be highlighted and adequately ordered within
the framework of the SEVESO II type of safety analyses. In partic-
ular, the Vapour cloud explosion scenario should be thoroughly
analysed, together with the proposal of additional preventive and/
or protective measures, so as to minimize its probability to occur,
given that the consequences are per denition disastrous.
Moreover, in commercial tank farms, where the safety measures
and the expertise are not comparable to the ones of big reneries,
additional safety management measures should be taken, such as
the in situ observing of tank lling either by an operator or by
a CCTV system.
The authors hope that the proposed methodology will be
benecial for safety engineers, safety report evaluators, safety
inspectors and process companies, which are involved in the
preparation and evaluation of safety studies for liquid hydrocarbon
fuel storage tanks.
Acknowledgements
The authors would like to thank the Greek Ministry of Devel-
opment for the assignment of the safety studies checking and the
Greek safety experts for their knowledge and comments offered to
the methodology improvement.
References
American Petroleum Institute. (1998). Welded steel tanks for oil storage (10th ed.).
Washington, DC: API. Standard 650.
API RP 2021 (R2006). (2001). Management of atmospheric storage tank res (4th ed.).
American Petroleum Institute.
Argyropoulos, C. D., Christolis, M. N., Nivolianitou, Z., & Markatos, N. C. (2008a).
Assessment of acute effects for re-ghters during a fuel-tank re. In
Proceedings of the 4th international conference on prevention of occupational
accident in a changing work environment, WOS 2008, Crete, Greece.
Argyropoulos, C. D., Christolis, M. N., Nivolianitou, Z., & Markatos, N. C. (2008b).
Numerical simulation of the dispersion of toxic pollutants from large tank re.
In M. Papadakis, & B. H. V. Topping (Eds.), Proceedings of the sixth international
conference on engineering computational technology. Stirlingshire, UK: Civil-
Comp Press, Paper 49. http://dx.doi.org/10.4203/ccp.89.49.
Argyropoulos, C. D., Sideris, G. M., Christolis, M. N., Nivolianitou, Z., & Markatos, N. C.
(2010). Modelling pollutants dispersion and plume rise from large hydrocarbon
tank res in neutrally stratied atmosphere. Atmospheric Environment, 44,
803e813.
ASME B96.1 Welded aluminium-alloy storage tanks, Publication date: Jan 1; 1999.
335
Bakke, J. R., Wingerden, K., Hoorelbeke, P., & Brewerton, B. (2010). A study on the
effect of trees on gas explosions. Journal of Loss Prevention in the Process
Industries, 23, 878e884.
Bunceeld Major Incident Investigation Board. (2008). The Bunceeld incident 11
December 2005. Final report.
Chang, J. I., & Lin, C. C. (2006). A study of storage tank accidents. Journal of Loss
Prevention in the Process Industries, 19, 51e59.
Christou, M., Papadakis, G., & Amendola, A. (2005). Guidance on the preparation of
a safety report to meet the requirements of the directive 96/82/EC as amended by
the directive 2003/105/EC 2002 (SEVESO II), EUR 22113 EN.
Crippa, C., Fiorentini, L., Rossini, V., Stefanelli, R., Tafaro, S., & Marchi, M. (2009). Fire
risk management system for safe operation of large atmospheric storage tanks.
Journal of Loss Prevention in the Process Industries, 22, 574e581.
Dow Chemicals. (1981). Fire and explosion index hazard classication guide (6th ed.)..
European Council. (1982). Council directive 82/501/EEC on the major accident
hazards of certain industrial activities (SEVESO I). Ofcial Journal of the European
Communities, Luxembourg.
European Council. (1994). Council directive 94/9/EC on equipment and protective
systems intended for use in potentially explosive atmospheres (ATEX). Ofcial
Journal of the European Communities, Luxembourg.
European Council. (1997). Council Directive 96/82/EC on the major accident hazards
of certain industrial activities (SEVESO II). Ofcial Journal of the European
Communities, Luxembourg.
Fabbrocino, G., Iervolino, I., Orlando, F., & Salzano, E. (2005). Quantitative risk
analysis of oil storage facilities in seismic areas. Journal of Hazardous Materials,
A123, 61e69.
Giannini, F. M., Monti, M. S., Ansaldi, S. P., & Bragatto, P. (2006). P.L.M., to support hazard
identication in chemical plant design. In D. Brissaud, et al. (Eds.), Innovation in life
cycle engineering and sustainable development (pp. 349e362). Springer.
Ghoniem, A. F., Zhang, X., Knio, O., Baum, H. R., & Rehm, R. G. (1993). Dispersion and
deposition of smoke plumes generated in massive res. Journal of Hazardous
Materials, 33, 275e293.
Herbert, I. (2010). The UK Bunceeld incident e the view from a UK risk assessment
engineer. Journal of Loss Prevention in the Process Industries, 23, 913e920.
IChem, E. (2008). BP process safety series, liquid hydrocarbon tank res: Prevention
and response (4th ed.).. U.K.
Johnson, D. M. (2010). The potential for vapour cloud explosions e lessons from the
Bunceeld accident. Journal of Loss Prevention in the Process Industries, 23,
921e927.
Kletz, T. A. (2009). Accident reports may not tell us everything we need to know.
Journal of Loss Prevention in the Process Industries, 22, 753.
Knegtering, B., & Pasman, H. J. (2009). Safety of the process industries in the 21st
century: a changing need of process safety management for a changing
industry. Journal of Loss Prevention in the Process Industries, 22, 162e168.
Koseki, H., Natsuma, Y., Iwata, Y., Takahashi, T., & Hirano, T. (2003). A study on large-
scale boilover using crude oil containing emulsied water. Fire Safety Journal,
39, 143e155.
Kourniotis, S. P., Kiranoudis, C. T., & Markatos, N. C. (2000). Statistical analysis of
domino chemical accidents. Journal of Hazardous Materials, 71, 239e252.
LASTFIRE. (2001). Large atmospheric storage tank res. Resource Protection
International.
Lawley, G. (1974). Operability studies and hazards analysis, loss prevention. CEP.
Lees, F. P. (1996). Loss prevention in the process industries (2nd ed.). Oxford, U.K:
Butterworth.
Lewis, D. J. (1974). The Mond re, explosions and toxicity index, applied plant lay-out
and spacing, loss prevention symposium. CEP.
Markatos, N. C., Christolis, M., & Argyropoulos, C. (2009). Mathematical modeling of
toxic pollutants dispersion from large tank res and assessment of acute effects
for re ghters. International Journal of Heat and Mass Transfer, 52, 4021e4030.
McGrattan, K. B., Baum, H. R., & Rehm, R. G. (1996). Numerical simulation of smoke
plumes from large oil res. Atmospheric Environment, 30, 4125e4136.
NFPA 11. (2002). National re protection association standard: Standard for low-,
medium-, and high-expansion foam.
NFPA 30. (1993). National re protection association standard: Flammable and
combustible liquids code.
Nuclear Regulatory Commission. (1983). USA, PRA procedure guide, NUREG/CR-2815.
Papazoglou, I. A., Nivolianitou, Z., Aneziris, O., & Christou, M. (1992). Probabilistic
safety analysis in chemical installations. Journal of Loss Prevention in the Process
Industries, 5, 181e191.
Persson, H., & Lonnermark, A. (2004). Tank res. SP Swedish National Testing and
Research Institute. SP Report 2004:14, Boras, Sweden.
Pitblado, R. (2010). Global process industry initiatives to reduce major accident
hazards. Journal of Loss Prevention in the Process Industries, 24, 57e62.
Santos-Reyes, J., & Beard, A. N. (2008). A systemic approach to managing safety.
Journal of Loss Prevention in the Process Industries, 21, 15e28.
Shaluf, I. M., & Abdullah, S. A. (2011). Floating roof storage tank boilover. Journal of
Loss Prevention in the Process Industries, 24, 1e7.
Shebeko, Y. N., Bolodian, I. A., Molchanov, V. P., Deshevih, Y. I., Gordienko, D. M.,
Smolin, I. M., et al. (2007). Fire and exploS200sion risk assessment for large-scale
oil export terminal. Journal of Loss Prevention in the Process Industries, 20, 651e658.
U.S. Chemical Safety Board. (2009). Cited at December, 5, 2011, available at http://
www.csb.gov/investigations/detail.aspx?SID87.
Vautard, R., Ciaisa, P., Fisher, R., Lowry, D., Breon, F. M., Vogel, F., et al. (2007). The
dispersion of the Bunceeld oil re plume. Atmospheric Environment, 41,
9506e9517.