1. HAZARDS AP 2015
Title: Leave it to the tank supplier – A common mind-set error
Ref: 50
Author: Alan Munn CEnv CEng FIChemE
Theme: Mind-set and behaviour and Lesson learnt from past incidents/accidents
Key Words: Process Safety, Oil and Gas, Management of Change, Static, Lightning, Vessels, Tanks
Contact details: MMI Engineering Sdn Bhd
B-3A-01, Block B East; PJ8, No.23 Jalan Barat, Seksyen 8, 46050, Petaling Jaya. Malaysia.
Tel: +60 (0) 3 7494 0533
E-mail: amunn@mmiengineering.com
Abstract
Hazardous chemicals such as flammable liquids have been stored in tanks for many years and yet fires or
explosions in or around tanks are still relatively common. The basic technologies of aboveground storage
tanks have not changed significantly for many years and yet these incidents keep happening, showing that we
are not applying the lessons from past incidents. Following Buncefield the emphasis has understandably been
on managing the level in storage tanks and preventing over filling. However, a brief review of worldwide news
reports reveals that incidents due to static discharges, lightning strikes and poor maintenance practices
continue to happen regularly.
The author contends that the primary reason for the failure to apply the lessons from previous incidents are a
casual approach to tank design and an over-reliance on vendor support (i.e. the “Vendor knows best mind-
set”) Tanks are seen as commodities and, relative to process issues, there is little motivation amongst
Engineers to become deeply involved in the detail of tank design. Apart from the basic selection criteria for
different tank types and for sizing, tanks are often built with minimal process engineering input. The tendency
to defer to vendor engineering often results in the Tank Owners actual desired operating plans and
procedures not communicated to the vendor and not being incorporated into the design. Modifications to
existing tanks are a particular challenge where design errors are all too often missed the tendency to not
assign sufficient engineering resources or attention to the design.
The Author has been involved with many incident investigations and HAZOPs on tanks and is aware of many
common design errors on new tanks and management of change issues associated with modifications to
tanks and the re-use of tanks in different services. Several examples from the authors’ personal experiences
will be presented including lightning protection, static generation, vents and flame arrestors and converting a
refinery tank farm to a terminal type operation.

2. Leave it to the tank supplier – A common mind-set error
Introduction
Hazardous chemicals such as flammable liquids have been stored in tanks for many years and yet fires or
explosions in or around tanks are still relatively common. A brief review of worldwide news reports reveals that
incidents continue to happen regularly.
Following Buncefield the emphasis has understandably been on managing the level in storage tanks,
preventing over filling and ensuring the integrity of secondary and tertiary containment systems. This focus,
whilst undoubtedly important, does not tackle the whole picture as there are many additional reasons for tank
failures, fires and explosions.
The basic technologies of above-ground storage tanks have not changed significantly for many years and yet
these incidents keep happening, showing that we are not applying the lessons from past incidents. The author
contends that the primary reason for the failure to apply the lessons from previous incidents are a casual
approach to tank design and an over-reliance on vendor support (i.e. the “Vendor knows best mind-set”)
Tanks are seen as commodities and, relative to process issues, there is little motivation amongst Engineers to
become deeply involved in the detail of tank design..
Apart from the basic selection criteria for different tank types and for sizing, tanks are often built with minimal
process engineering input. They are often built and maintained according to a lowest cost mind-set from a
preferred or cheapest vendor with little discussion about the pros and cons of different features and fittings
and without a clear understanding of how the tank will be operated, i.e. without a proper specification.
The author has been involved with several incident investigations and HAZOPs on tanks and is aware of
many common design errors on new tanks and management of change issues associated with modifications
to tanks and the re-use of tanks in different services. Modifications to existing tanks are a particular challenge
where design errors are all too often missed due the failure to assign adequate engineering resources and
attention to the design.
Several examples from the author’s personal experiences are included to highlight potential problem areas
that affect the safety of tanks. This list is not exhaustive, but is just an example of some of the more
interesting problems that the author has come across. Some common myths or misunderstandings are also
discussed.
Relationship with the Vendor / Tank Supplier
A healthy relationship with the tank supplier or vendor is one of the key methods to ensuring a safe tank
design. The vendors are experts in tank design and construction and can provide a great deal of good advice
and this should be used as much as possible. However, for various reasons this wealth of expertise is not
properly utilised.
Tanks and their associated fittings are seen as commodities and there is little interest amongst many
engineers to understand or get involved in the detail of the design. As a result, they rely too much on the
vendor to make key decisions; this is what I term the “vendor knows best mind-set”. At the same time, there is
not enough engineering teamwork with the vendor, clear communication of design and operational
expectations and requirements, and review to ensure that these requirements have been correctly
incorporated into the tank design. This problem with the vendor knows best mind-set is not unique to tanks,
but is common for many equipment types.
The vendors are experts in tank design and construction, but they are rarely experts in tank operation. This is
why they require the detailed specification for the tank; this tells them how the operating company is intending
to operate the tank. Everyone therefore relies on the technical standards in use by the company, but these are
not often updated with new information or local operational experience or changed procedures, are
incomplete or are out-of-date and may leave many aspects of the tank design to choice rather than being
prescriptive. Successful application of poorly detailed standards requires even further attention by
experienced engineers rather than deferral to the vendor or more junior engineer staff.
In most cases the procurement policy of operating companies or EPC contractors is that three or more
vendors have to be approached for prices. The vendors are commercial entities; they want the business and
understand that their prices must be competitive. It is understandable then, that if the specification is
incomplete or poorly done, the vender will supply the lowest cost fittings or components that meet the
specification. If the tank is being designed by an EPC contractor, then there is an added complication and
more barriers to communication between the operator and the vendor. Especially in the case of fixed price
Page 2 of 7

3. Leave it to the tank supplier – A common mind-set error
jobs, it is understandable that the cheapest option sometimes gets selected, which may have significant safety
implications.
This lowest first cost approach is often visible when it concerns maintenance aspects and the provision of
access ladders and platforms etc., but is often hidden when it concerns design details that affect safety.
These are often far more subtle as can be seen in some of the case studies discussed below.
I have come across examples where a vendor has questioned some of the details in the specification and
been told by the client to just supply the cheapest, with no consideration given to the technical or even safety
concerns raised by the vendor.
Case Studies
Several examples from the author’s personal experiences are included to highlight potential problem areas
that affect the safety of tanks. This list is not exhaustive, but is just an example of some of the more
interesting problems that the author has encountered.
Case Study 1 – Blast Hatches on Fixed Roof Tanks on a Terminal
In this case study, the terminal operator had misunderstood the purpose and design basis of the so called
“blast hatches” to be fitted on to the new tanks. These hatches are incorrectly named “blast hatches” since
they do not protect the tank from an internal explosion or blast. These hatches, which are typically man-hole
sized and fitted with a counter weight system, are designed to relieve against overpressure due to
vaporisation from thermal input from a fire on adjacent tanks or in the surrounding bund. These hatches are
not big enough to protect against an internal explosion.
The normal method of providing pressure relief against an internal explosion is to provide a weak joint
between the roof and the shell, often termed a frangible joint. This is designed to fail in an explosion, the roof
remains attached to the tank and the liquid typically remains in the tank as the floor / wall weld should remain
intact.
The engineers in the operating company had taken the name “blast hatch” at face value and had changed
their tank specification documents to eliminate frangible joints on their tanks and only to provide these blast
hatches. They were considering retrofitting this requirement to their existing tanks as well as new tanks. They
had even changed their operator training materials to explain (incorrectly) how the blast hatches worked and
why they no longer needed frangible joints.
Case Study 2 – Inlet Distributor Design and Static Generation in both Fixed and Floating Roof Tanks
on a terminal
In this case study, the terminal operator was building several new tanks to increase capacity. The terminal
handled a range of hydrocarbon products including finished gasoline, kerosene and diesel as well as various
blend components. The engineers were well aware of the hazards of static generation and the requirement to
limit inlet velocities into the tanks especially during the initial stages of filling a tank from empty. Various codes
and standards discuss this issue and, depending on the situation, the tank inlet velocities were typically limited
to 1 m/s when nearly empty or 7m/s when the inlet was submerged.
The terminal had been in operation for many years and undergone many projects to increase storage capacity
and throughput. The limitation on inlet velocity into tanks had been identified as a bottle-neck many years ago
and all the tanks had subsequently been fitted with ‘H’ type distributors to quadruple the allowable flow rate. In
other words a tank that was originally fitted with a 14” inlet nozzle was now fitted with four 14” inlet nozzles,
thus allowing four times the flow. The company concerned had changed their tank specification documents to
include ‘H’ type distributors as their preferred design, so the new tanks that were undergoing HAZOP were to
be fitted with these.
The engineers involved had failed to understand the mechanism of charge generation and had incorrectly
assumed that the charge is generated at the inlet nozzle rather than in the pipe leading to it. Reducing the
velocity in the inlet nozzles, but not in the pipe branch to the tank, does not reduce the charge generation
potential.
Page 3 of 7

4. Leave it to the tank supplier – A common mind-set error
This finding had major consequences to the design and operation of the new tanks as well as operation of the
existing tanks. A wide range of equipment modifications had to be performed as well as major changes to
operating procedures and operating limits and additional limitations on which products could be stored in
which tanks.
Case Study 3 – Conversion of a Tank Farm from a Refinery Operation to a Terminal
This example concerns an historical case of inadequate management of change that was identified during a
subsequent HAZOP study. A refinery was shut down and decommissioned many years ago; however the tank
farm remained in place, was sold and converted to a terminal type operation.
The tank farm contained a mix of External Floating Roof (EFR), Internal Floating Roof (IFR) and Fixed Roof
Tanks as is typical at any refinery. An assumption was made, probably unconsciously, that the new operating
mode was not significantly different to the original refinery type operation.
The issue of concern here was the change in operation of the Floating Roof Tanks, although similar issues
existed with the operation of the Fixed Roof Tanks. One of the most hazardous periods of operation for a
floating roof tank is whilst the roof is ‘landed’. The roof is supported by its legs and air is introduced
underneath the roof; flammable mixtures can easily form potentially leading to an explosion.
In a refinery type operation, once the tank is in operation, the legs are put into their operating position and the
tank operates between defined minimum and maximum levels. It is rare for the roof to be landed; typically this
is only done once every 5 or 10 years and sometimes even longer, when the tank is taken out of service for
inspection or maintenance.
In the terminal operating mode, different customers used to store products for defined durations. At the end of
each contract, the tanks had to be completely emptied and as much as possible of the product returned to the
customer; all of the product under the roof had to be removed. This also had to be done as fast as possible;
unlike in a refinery operation where emptying tanks for maintenance was much slower
The result of this change was that instead of landing each tank roof once every 5 or 10 years, each roof was
now landed several times per year. This activity changed the risk profile of the site as this was now the
biggest risk. Operating practices that were suitable for the refinery operation were unacceptable in the new
operating mode, where tighter controls were required. These included better practices for avoidance of static
generation, limitations to personnel access near to the tanks during the landed period and various operational
limits on the use of particular tanks for particular services and storage of low-conductivity diesel stocks in
nitrogen inerted Fixed Roof or IFR tanks. Nitrogen dilutes the flammable vapours so that the vapour space is
below the lower flammability limit, although during fast draw-down large volumes of nitrogen may not be
available and the tank vacuum breaker valve can open which draws in large volumes of air. Provision of an
extensive nitrogen /inert gas system was required.to manage this.
Two other significant problems were also identified as a result of this change; the need to empty out the
transfer lines from the jetty each time a tank was emptied, thus allowing air into the line, which could mix with
the hydrocarbon during the initial filling of the next cycle if not removed. The venting system was totally
inadequate. The second problem was a mechanical issue involving potential fatigue failure of the wall to floor
weld of each tank. Repeated emptying of tanks below about 1m renders a tank liable to this problem if the
weld has not been designed for it.
These unexpected findings had major consequences to the operation of the facility and a wide range of
modifications to hardware and procedures had to be implemented to reduce the risk to ALARP.
In the current economic climate, a number of refineries are facing possible closure and conversion to terminal
type operation is being considered. This change is not as easy as it first appears to be and each tank needs a
thorough management of change design review and HAZOP for the proposed new terminal service, operating
conditions and stored liquid.
Case Study 4 – Contamination of Fuel Oil with Low Flash Point Material
This is a common problem on refineries that I have come across several times. The bottoms product from the
catalytic cracker fractionator is a fuel oil blend component. It is typically routed to a fixed roof tank where
catalyst fines are allowed to settle out. From there it is blended into the fuel oil pool.
A fixed roof tank is used as the rundown temperature should be below the flash point, the temperature at
which enough vapours may be present to form a flammable mixture. The bottoms product is stripped in the
Page 4 of 7

5. Leave it to the tank supplier – A common mind-set error
bottom of the fractionator to ensure this. However, in practice the tower operation varies significantly, often
outside of the design parameters and light material often contaminates the bottoms product. In addition the
rundown temperature varies considerably and is often higher than planned.
At one refinery, a review of historical data showed that the flash point of the product in the tank was
unacceptably low most of the time. This led to some interesting discussions including the classic “it’s been like
this for 30 years and it’s never blown up yet” argument, a typical example of normalisation of deviance.
Eventually, as it was not possible to eliminate all of the control variations, a nitrogen blanketing system was
installed to resolve the problem. Tests showed that contamination was only a problem in the first tank; it was
not significant in the blending tanks.
A similar problem often exists with propane contamination of the product from a propane de-asphalting unit.
Case Study 5 – Product on the roof of an Internal Floating Roof Tank
One unintended consequence of using an IFR tank rather than an EFR tank is that the operators are less
likely to be aware of product escaping onto the roof, although this depends on the remoteness of the tank and
the degree of operator vigilance. In some cases, unless the product smells strongly, it may not be seen on the
roof for weeks or even months. Even when product on the roof is found, the situation may not be taken as
seriously as it would be for an EFR tank as it is out of sight and out of mind.
IFR tanks are often used to store similar products to those typically stored in EFR tanks; that is products with
a relatively high vapour pressure like gasoline. An occasional problem with all floating roof tanks is getting
product onto the roof; this can happen for a variety of reasons in both EFR and IFR tanks although some roof
designs are less prone to this than others.
Although there are exceptions, the design basis for most IFR tanks is that the space above the floating roof
operates in the lean region with concentrations of flammable vapour below the lower flammable limit. Large
vents are provided to ensure this. Even so, the ventilation above the roof in an IFR Tank is not as good as for
an EFR tank and it is easier for a flammable mixture to form and to be maintained. In essence, operating in
this way is similar to handling gasoline in a fixed roof tank, something that would normally be considered
unacceptable without special precautions.
The vents and fittings on the tank will probably not be designed for this situation and the area classification
around them will be too low for this scenario and operating practices and procedures may not be as strict as
for a Fixed Roof tank, thus increasing the probability of ignition. As the tank is free venting, an ignition may
flash back into the tank leading to an internal explosion.
Case Study 6 – Effectiveness of Lightning Protection Systems
This example involves the lessons learned following a lightning strike that destroyed an EFR tank and all the
gasoline stored in it. One evening there was an unusually violent electrical storm and the tank was struck by
lightning; soon after a fire was visible above the lip of the tank and investigation showed a significant area of
the roof to be on fire. The fire eventually spread over the full tank and despite several attempts it was
impossible to extinguish; eventually it burnt out.
Subsequent investigations showed that several of the roof pontoons had exploded; indicating that leakage
had taken place, probably due to corrosion; and several of the pontoon chambers contained a flammable
mixture which had exploded when ignited by the lightning strike.
The tank was fitted with a normal lightning protection system including shunts between the roof and the tank
and cable connections from the roof, via the ladder, to the shell. Following the fire it was impossible to
determine what condition these had been in, but there was no reason to believe that they had been in
particularly poor condition.
The point of discussing this example is that disbelief was expressed then and still regularly is; that a lightning
strike could ignite a tank fitted with a lightning protection system. These systems, even if properly maintained
and tested are never 100% effective.
Following this incident I have learnt to visualise a lightning strike on a tank as follows, like water flowing
through rapids. Most of the flow goes down the main flow channels, but some goes via the more difficult side
branches. The main channel corresponds to the lighting protection route; down the shell, along the cables and
Page 5 of 7

6. Leave it to the tank supplier – A common mind-set error
across the shunts etc. Some however, takes routes with more resistance; across rusty corrosion patches and
the tiny gaps between the steel plates such as will be present in the pontoons where the side plates are only
joined with fillet welds. These types of gaps will always be present as long as tanks are fabricated to current
methods.
As a result, one should assume that lightning will always cause an ignition and the only way to properly
protect the tank is to ensure that no flammable mixtures are present; this means regular inspections of the
pontoon chambers for leaks and checking of the conditions of the roof seals etc. The pontoons should be both
liquid and gas tight; and during construction and maintenance this should be tested. Besides allowing vapour
ingress in the first place, this limits the size of any explosion to a single chamber. I am aware of at least one
oil company that only has a requirement in its standards for liquid tightness; but there is no requirement for
gas tightness, the welds along the top joint of each plate do not have to be full length welds.
Case Study 7 – Drains and Bunds: Unintentional Connections
This next example is not about the tank itself, but involves a bund that had been upgraded and improved
following the Buncefield incident. It shows the importance of applying a questioning or challenging mind-set, of
field visits and the axiom “if it looks wrong it probably is”. Because the project did not involve the process or
mechanical integrity, it had been left to a civil contractor to manage who had little knowledge of the refinery or
refinery processes. The details have been changed substantially to provide anonymity, but the situation
described below is similar to what happened.
The refinery tank farm was built on a slope with the tanks grouped into common bunds at different levels. The
tanks included external floating roof tanks, fixed roof tanks and LPG spheres. This is a common arrangement.
In this case a storm water drain ran down the slope and the tank farm had been built over it. This was a
legacy of the piecemeal development of the tank farm which had been expanded over many years. There was
a small spring up the hill so there was always a significant flow through the drain.
Following Buncefield, the refinery had reviewed the integrity of all of its bunds and had upgraded many of
them. The storm drain had been identified as a potential problem and had been routed via a new above–
ground concrete pipe. This had been fitted with an access chamber and manway at the inlet and outlet of
each bund. There were no fire seals and a penstock (valve) had been fitted at the outlet of the lower bund.
This was left open but could be closed if the water was contaminated.
A schematic is shown in figure 1
Figure 1 – Storm drain through a tank farm
The access chambers and manway were at a lower elevation than the bunds and were supposed to be fitted
with concrete covers with vent pipes and removable manway covers, however these had not been fitted to
some. As a result there was an easy mechanism for liquid or vapour to pass from one bund into the next or
out of the bunds altogether and into the pond or down the slope onto open ground; a major breach of bund
containment. If the penstock was closed then the lower bund could easily flood or the water would spill out of
the bottom manway – whichever was the lowest. Even if the concrete covers and manway covers had been in
place, there would easily be adequate head available to lift them and push them aside as a 200mm slab does
not require a great head of water to move it.
Page 6 of 7

7. Leave it to the tank supplier – A common mind-set error
Conclusions
Tank related incidents and fires happen regularly. One of the reasons for this is that tanks are seen as
commodities and management and Owners must step in and assign priority to tank design in terms of the
assignment of adequate engineering resources to the design or operation; rarely is adequate expertise
applied to the design and there is generally a failure to apply the lessons from previous incidents.
Even when this lack of experience is recognised, key decisions are often left to the vendor or contractor who
is often under significant pressure to supply the lowest cost design that meets the client’s standards. It is very
rare that the vendor’s expertise is leveraged and their advice sort for improving the operation and safety of the
tanks.
The case studies in this paper are presented in the hope that some of the lessons learnt will be incorporated
into future designs and thus reduce the risk of tank incidents.
Page 7 of 7