A system can be defined as a set of interdependent components combined in such a way as to perform a given function under specified conditions. A machine is a tangible and particularly clear-cut example of a system in this sense, but there are other systems, involving men and women on a team or in a workshop or factory, which are far more complex and not so easy to define. Safety suggests the absence of danger or risk of accident or harm. In order to avoid ambiguity, the general concept of an unwanted occurrence will be employed. Absolute safety, in the sense of the impossibility of a more or less unfortunate incident occurring, is not attainable; realistically one must aim for a very low, rather than a zero probability of unwanted occurrences.

A given system may be looked upon as safe or unsafe only with respect to the performance that is actually expected from it. With this in mind, the safety level of a system can be defined as follows: “For any given set of unwanted occurrences, the level of safety (or unsafeness) of a system is determined by the probability of these occurrences taking place over a given period of time”. Examples of unwanted occurrences that would be of interest in the present connection include: multiple fatalities, death of one or several persons, serious injury, slight injury, damage to the environment, harmful effects on living beings, destruction of plants or buildings, and major or limited material or equipment damage.

Purpose of the Safety System Analysis

The object of a system safety analysis is to ascertain the factors which have a bearing on the probability of the unwanted occurrences, to study the way in which these occurrences take place and, ultimately, to develop preventive measures to reduce their probability.

The analytic phase of the problem can be divided into two main aspects:

1. identification and description of the types of dysfunction or maladjustment
2. identification of the sequences of dysfunctions that combine one with another (or with more “normal” occurrences) to lead ultimately to the unwanted occurrence itself, and the assessment of their likelihood.

Once the various dysfunctions and their consequences have been studied, the system safety analysts can direct their attention to preventive measures. Research in this area will be based directly on earlier findings. This investigation of preventive means follows the two main aspects of the system safety analysis.

Methods of Analysis

System safety analysis may be conducted before or after the event (a priori or a posteriori); in both instances, the method used may be either direct or reverse. An a priori analysis takes place before the unwanted occurrence. The analyst takes a certain number of such occurrences and sets out to discover the various stages that may lead up to them. By contrast, an a posteriori analysis is carried out after the unwanted occurrence has taken place. Its purpose is to provide guidance for the future and, specifically, to draw any conclusions that may be useful for any subsequent a priori analyses.

Although it may seem that an a priori analysis would be very much more valuable than an a posteriori analysis, since it precedes the incident, the two are in fact complementary. Which method is used depends on the complexity of the system involved and on what is already known about the subject. In the case of tangible systems such as machines or industrial facilities, previous experience can usually serve in preparing a fairly detailed a priori analysis. However, even then the analysis is not necessarily infallible and is sure to benefit from a subsequent a posteriori analysis based essentially on a study of the incidents that occur in the course of operation. As to more complex systems involving persons, such as work shifts, workshops or factories, a posteriori analysis is even more important. In such cases, past experience is not always sufficient to permit detailed and reliable a priori analysis.

An a posteriori analysis may develop into an a priori analysis as the analyst goes beyond the single process that led up to the incident in question and starts to look into the various occurrences that could reasonably lead to such an incident or similar incidents.

Another way in which an a posteriori analysis can become an a priori analysis is when the emphasis is placed not on the occurrence (whose prevention is the main purpose of the current analysis) but on less serious incidents. These incidents, such as technical hitches, material damage and potential or minor accidents, of relatively little significance in themselves, can be identified as warning signs of more serious occurrences. In such cases, although carried out after the occurrence of minor incidents, the analysis will be an a priori analysis as regards more serious occurrences that have not yet taken place.

There are two possible methods of studying the mechanism or logic behind the sequence of two or more events:

1. The direct, or inductive, method starts with the causes in order to predict their effects.
2. The reverse, or deductive, method looks at the effects and works backwards to the causes.

Figure 1 is a diagram of a control circuit requiring two buttons (B₁ and B₂) to be pressed simultaneously in order to activate the relay coil (R) and start the machine. This example may be used to illustrate, in practical terms, the direct and reverse methods used in system safety analysis.

Figure 1. Two-button control circuit

Direct method

In the direct method, the analyst begins by (1) listing faults, dysfunctions and maladjustments, (2) studying their effects and (3) determining whether or not those effects are a threat to safety. In the case of figure 1, the following faults may occur:

• a break in the wire between 2 and 2´

• unintentional contact at C₁ (or C₂) as a result of mechanical blocking

• accidental closing of B₁ (or B₂)

• short circuit between 1 and 1´.

The analyst can then deduce the consequences of these faults, and the findings can be set out in tabular form (table 1).

Table 1. Possible dysfunctions of a two-button control circuit and their consequences

* Occurrence with a direct influence on the reliability of the system
** Occurrence responsible for a serious reduction in the safety level of the system
*** Dangerous occurrence to be avoided

See text and figure 1.

In table 1 consequences which are dangerous or liable to seriously reduce the safety level of the system can be designated by conventional signs such as ***.

Note: In table 1 a break in the wire between 2 and 2´ (shown in figure 1) results in an occurrence that is not considered dangerous. It has no direct effect on the safety of the system; however, the probability of such an incident occurring has a direct bearing on the reliability of the system.

The direct method is particularly appropriate for simulation. Figure 2 shows an analog simulator designed for studying the safety of press-control circuits. The simulation of the control circuit makes it possible to verify that, so long as there is no fault, the circuit is actually capable of ensuring the required function without infringing the safety criteria. In addition, the simulator can allow the analyst to introduce faults in the various components of the circuit, observe their consequences and thus distinguish those circuits that are properly designed (with few or no dangerous faults) from those which are poorly designed. This type of safety analysis may also be performed using a computer.

Figure 2. Simulator for the study of press-control circuits

Reverse method

In the reverse method, the analyst works backwards from the undesirable occurrence, incident or accident, towards the various previous events to determine which may be capable of resulting in the occurrences to be avoided. In figure 1, the ultimate occurrence to be avoided would be the unintentional starting of the machine.

• The starting of the machine may be caused by an uncontrolled activation of the relay coil (R).

• The activation of the coil may, in turn, result from a short circuit between 1 and 1´ or from an unintentional and simultaneous closing of switches C₁ and C₂.

• Unintentional closing of C₁ may be the consequence of a mechanical blocking of C₁ or of the accidental pressing of B₁. Similar reasoning applies to C₂.

The findings of this analysis can be represented in a diagram which resembles a tree (for this reason the reverse method is known as “fault tree analysis”), such as depicted in figure 3.

Figure 3. Possible chain of events

The diagram follows logical operations, the most important of which are the “OR” and “AND” operations. The “OR” operation signifies that [X₁] will occur if either [A] or [B] (or both) take place. The “AND” operation signifies that before [X₂] can occur, both [C] and [D] must have taken place (see figure 4).

Figure 4. Representation of two logical operations

The reverse method is very often used in a priori analysis of tangible systems, especially in the chemical, aeronautical, space and nuclear industries. It has also been found extremely useful as a method to investigate industrial accidents.

Although they are very different, the direct and reverse methods are complementary. The direct method is based on a set of faults or dysfunctions, and the value of such an analysis therefore largely depends on the relevance of the various dysfunctions taken into account at the start. Seen in this light, the reverse method seems to be more systematic. Given knowledge of what types of accidents or incidents may happen, the analyst can in theory apply this method to work back towards all the dysfunctions or combinations of dysfunctions capable of bringing them about. However, because all the dangerous behaviours of a system are not necessarily known in advance, they can be discovered by the direct method, applied by simulation, for example. Once these have been discovered, the hazards can be analysed in greater detail by the reverse method.

Problems of System Safety Analysis

The analytical methods described above are not just mechanical processes which need only to be applied automatically in order to reach useful conclusions for improving system safety. On the contrary, analysts encounter a number of problems in the course of their work, and the usefulness of their analyses will depend largely on how they set about solving them. Some of the typical problems that may arise are described below.

Understanding the system to be studied and its operating conditions

The fundamental problems in any system safety analysis are the definition of the system to be studied, its limitations and the conditions under which it is supposed to operate throughout its existence.

If the analyst takes into account a subsystem that is too limited, the result may be the adoption of a series of random preventive measures (a situation in which everything is geared to preventing certain particular types of occurrence, while equally serious hazards are ignored or underestimated). If, on the other hand, the system considered is too comprehensive or general in relation to a given problem, it may result in excessive vagueness of concept and responsibilities, and the analysis may not lead to the adoption of appropriate preventive measures.

A typical example which illustrates the problem of defining the system to be studied is the safety of industrial machines or plant. In this kind of situation, the analyst may be tempted to consider only the actual equipment, overlooking the fact that it has to be operated or controlled by one or more persons. Simplification of this kind is sometimes valid. However, what has to be analysed is not just the machine subsystem but the entire worker-plus-machine system in the various stages of the life of the equipment (including, for example, transport and handling, assembly, testing and adjusting, normal operation, maintenance, disassembly and, in some cases, destruction). At each stage the machine is part of a specific system whose purpose and modes of functioning and malfunctioning are totally different from those of the system at other stages. It must therefore be designed and manufactured in such a way as to permit the performance of the required function under good safety conditions at each of the stages.

More generally, as regards safety studies in firms, there are several system levels: the machine, workstation, shift, department, factory and the firm as a whole. Depending on which system level is being considered, the possible types of dysfunction—and the relevant preventive measures—are quite different. A good prevention policy must make allowance for the dysfunctions that may occur at various levels.

The operating conditions of the system may be defined in terms of the way in which the system is supposed to function, and the environmental conditions to which it may be subject. This definition must be realistic enough to allow for the actual conditions in which the system is likely to operate. A system that is very safe only in a very restricted operating range may not be so safe if the user is unable to keep within the theoretical operating range prescribed. A safe system must thus be robust enough to withstand reasonable variations in the conditions in which it functions, and must tolerate certain simple but foreseeable errors on the part of the operators.

System modelling

It is often necessary to develop a model in order to analyse the safety of a system. This may raise certain problems which are worth examining.

For a concise and relatively simple system such as a conventional machine, the model is almost directly derivable from the descriptions of the material components and their functions (motors, transmission, etc.) and the way in which these components are interrelated. The number of possible component failure modes is similarly limited.

Modern machines such as computers and robots, which contain complex components like microprocessors and electronic circuits with very large-scale integration, pose a special problem. This problem has not been fully resolved in terms either of modelling or of predicting the different possible failure modes, because there are so many elementary transistors in each chip and because of the use of diverse kinds of software.

When the system to be analysed is a human organization, an interesting problem encountered in modelling lies in the choice and definition of certain non-material or not fully material components. A particular workstation may be represented, for example, by a system comprising workers, software, tasks, machines, materials and environment. (The “task” component may prove difficult to define, for it is not the prescribed task that counts but the task as it is actually performed).

When modelling human organizations, the analyst may opt to break down the system under consideration into an information subsystem and one or more action subsystems. Analysis of failures at different stages of the information subsystem (information acquisition, transmission, processing and use) can be highly instructive.

Problems associated with multiple levels of analysis

Problems associated with multiple levels of analysis often develop because starting from an unwanted occurrence, the analyst may work back towards incidents that are more and more remote in time. Depending on the level of analysis considered, the nature of the dysfunctions that occur varies; the same applies to the preventive measures. It is important to be able to decide at what level analysis should be stopped and at what level preventive action should be taken. An example is the simple case of an accident resulting from a mechanical failure caused by the repeated utilization of a machine under abnormal conditions. This may have been caused by a lack of operator training or from poor organization of work. Depending on the level of analysis considered, the preventive action required may be the replacement of the machine by another machine capable of withstanding more severe conditions of use, the use of the machine only under normal conditions, changes in personnel training, or a reorganization of work.

The effectiveness and scope of a preventive measure depend on the level at which it is introduced. Preventive action in the immediate vicinity of the unwanted occurrence is more likely to have a direct and rapid impact, but its effects may be limited; on the other hand, by working backwards to a reasonable extent in the analysis of events, it should be possible to find types of dysfunction that are common to numerous accidents. Any preventive action taken at this level will be much wider in scope, but its effectiveness may be less direct.

Bearing in mind that there are several levels of analysis, there may also be numerous patterns of preventive action, each of which carries its own share of the work of prevention. This is an extremely important point, and one need only return to the example of the accident presently under consideration to appreciate the fact. Proposing that the machine be replaced by another machine capable of withstanding more severe conditions of use places the onus of prevention on the machine. Deciding that the machine should be used only under normal conditions means placing the onus on the user. In the same way, the onus may be placed on personnel training, organization of work or simultaneously on the machine, the user, the training function and the organization function.

For any given level of analysis, an accident often appears to be the consequence of the combination of several dysfunctions or maladjustments. Depending on whether action is taken on one dysfunction or another, or on several simultaneously, the pattern of preventive action adopted will vary.

Back

Pipelines, marine vessels, tank trucks, rail tank cars and so forth are used to transport crude oils, compressed and liquefied hydrocarbon gases, liquid petroleum products and other chemicals from their point of origin to pipeline terminals, refineries, distributors and consumers.

Crude oils and liquid petroleum products are transported, handled and stored in their natural liquid state. Hydrocarbon gases are transported, handled and stored in both the gaseous and liquid states and must be completely confined in pipelines, tanks, cylinders or other containers prior to use. The most important characteristic of liquefied hydrocarbon gases (LHGs) is that they are stored, handled and shipped as liquids, taking up a relatively small amount of space and then expanding into a gas when used. For example, liquefied natural gas (LNG) is stored at –162°C, and when it is released the difference in storage and atmospheric temperatures causes the liquid to expand and gasify. One gallon (3.8 l) of LNG converts to approximately 2.5 m³ of natural gas at normal temperature and pressure. Because liquefied gas is much more “concentrated” than compressed gas, more useable gas can be transported and provided in the same size container.

Pipelines

It is generally the case that all crude oils, natural gas, liquefied natural gas, liquefied petroleum gas (LPG) and petroleum products flow through pipelines at some time in their migration from the well to a refinery or gas plant, then to a terminal and eventually to the consumer. Aboveground, underwater and underground pipelines, varying in size from several centimetres to a metre or more in diameter, move vast amounts of crude oil, natural gas, LHGs and liquid petroleum products. Pipelines run throughout the world, from the frozen tundra of Alaska and Siberia to the hot deserts of the Middle East, across rivers, lakes, seas, swamps and forests, over and through mountains and under cities and towns. Although the initial construction of pipelines is difficult and expensive, once they are built, properly maintained and operated, they provide one of the safest and most economical means of transporting these products.

The first successful crude-oil pipeline, a 5-cm-diameter wrought iron pipe 9 km long with a capacity of about 800 barrels a day, was opened in Pennsylvania (US) in 1865. Today, crude oil, compressed natural gas and liquid petroleum products are moved long distances through pipelines at speeds from 5.5 to 9 km per hour by large pumps or compressors located along the route of the pipeline at intervals ranging from 90 km to over 270 km. The distance between pumping or compressor stations is determined by the pump capacity, viscosity of the product, size of the pipeline and the type of terrain crossed. Regardless of these factors, pipeline pumping pressures and flow rates are controlled throughout the system to maintain a constant movement of product within the pipeline.

Types of pipelines

The four basic types of pipelines in the oil and gas industry are flow lines, gathering lines, crude trunk pipelines and petroleum product trunk pipelines.

• Flow lines. Flow lines move crude oil or natural gas from producing wells to producing field storage tanks and reservoirs. Flow lines may vary in size from 5 cm in diameter in older, lower-pressure fields with only a few wells, to much larger lines in multi-well, high-pressure fields. Offshore platforms use flow lines to move crude and gas from wells to the platform storage and loading facility. A lease line is a type of flow line which carries all of the oil produced on a single lease to a storage tank.

• Gathering and feeder lines. Gathering lines collect oil and gas from several locations for delivery to central accumulating points, such as from field crude oil tanks and gas plants to marine docks. Feeder lines collect oil and gas from several locations for delivery direct into trunk lines, such as moving crude oil from offshore platforms to onshore crude trunk pipelines. Gathering lines and feeder lines are typically larger in diameter than flow lines.

• Crude trunk pipelines. Natural gas and crude oil are moved long distances from producing areas or marine docks to refineries and from refineries to storage and distribution facilities by 1- to 3-m- or larger-diameter trunk pipelines.

• Petroleum product trunk pipelines. These pipelines move liquid petroleum products such as gasoline and fuel oil from refineries to terminals, and from marine and pipeline terminals to distribution terminals. Product pipelines may also distribute products from terminals to bulk plants and consumer storage facilities, and occasionally from refineries direct to consumers. Product pipelines are used to move LPG from refineries to distributor storage facilities or large industrial users.

Regulations and standards

Pipelines are constructed and operated to meet safety and environmental standards established by regulatory agencies and industry associations. Within the United States, the Department of Transportation (DOT) regulates the operation of pipelines, the Environmental Protection Agency (EPA) regulates spills and releases, the Occupational Safety and Health Administration (OSHA) promulgates standards covering worker health and safety, and the Interstate Commerce Commission (ICC) regulates common carrier pipelines. A number of industry organizations, such as the American Petroleum Institute and the American Gas Association, also publish recommended practices covering pipeline operations.

Pipeline construction

Pipeline routes are planned using topographic maps developed from aerial photogrammetric surveys, followed by actual ground surveying. After planning the route, obtaining right-of-way and permission to proceed, base camps are established and a means of access for construction equipment is required. Pipelines can be constructed working from one end to another or simultaneously in sections which are then connected.

The first step in laying pipeline is to construct a 15- to 30-m-wide service road along the planned route to provide a stable base for the pipe-laying and pipe-joining equipment and for underground pipeline excavation and backfill equipment. The pipe sections are laid on the ground alongside the service road. The ends of the pipe are cleaned, the pipe is bent horizontally or vertically, as necessary, and the sections are held in position by chocks above the ground and joined by multi-pass electrical arc-welding. The welds are checked visually and then with gamma radiation to assure that no defects are present. Each connected section is then coated with liquid soap and air-pressure tested to detect leaks.

The pipeline is cleaned, primed and coated with a hot, tar-like material to prevent corrosion and wrapped in an outer layer of heavy paper, mineral wool or plastic. If the pipe is to be buried, the bottom of the trench is prepared with a sand or gravel bed. The pipe may be weighed down by short, concrete sleeves to prevent its lifting out of the trench from groundwater pressure. After the underground pipeline is placed in the trench, the trench is backfilled and the surface of the ground returned to normal appearance. After coating and wrapping, aboveground piping is lifted up onto prepared stanchions or casements, which may have various design features such as anti-earthquake shock absorption. Pipelines may be insulated or have heat trace capabilities to keep products at desired temperatures throughout transport. All pipeline sections are hydrostatically tested prior to entering gas or liquid hydrocarbon service.

Pipeline operations

Pipelines may be either privately owned and operated, carrying only the owner’s products, or they may be common carriers, required to carry any company’s products provided that the pipeline’s product requirements and tariffs are met. The three major pipeline operations are pipeline control, pumping or compressor stations and delivery terminals. Storage, cleaning, communication and shipment are also important functions.

• Pipeline control. Regardless of the product being transported, the size and length of the pipeline or the terrain, pipeline pumping stations, pressures and flow rates are completely controlled in order to ensure appropriate flow rates and continuous operations. Typically an operator and computer control the pumps, valves, regulators and compressors throughout the pipeline system from a central location.

• Oil pumping and gas compressor stations. Crude oil and petroleum products pumping stations and gas compressor stations are located at wellheads and along the pipeline route as needed to maintain pressure and volume. Pumps are driven by electric motors or diesel engines, and turbines may be powered by fuel oil, gas or steam. Many of these stations are automatically controlled and not staffed at most times. Pumps, with and without vapour return lines or pressure equalizing lines, are commonly used in smaller pipelines for transport of LNG, LPG and compressed natural gas (CNG). Pressure drop detectors are installed to signal any leaks in pipelines, and excess flow valves or other flow limiting devices are used to minimize the rate of flow in case of a pipeline leak. Storage vessels and reservoirs may be isolated from main pipelines by manually operated or remote control valves or fusible link valves.

• Pipeline product storage. Crude and petroleum product pipeline terminals have breakout storage tanks to which shipments may be diverted, where they are held until required by a refinery, terminal or user (see figure 1). Other tanks at pipeline pumping stations contain fuel for operating diesel-driven pump motors or for running electrical generators. Because gas fields produce continuously and gas pipelines operate continuously, during times of reduced demand, such as summertime, liquefied natural and petroleum gases are stored underground in natural caverns or salt domes until needed.

• Pipeline cleaning. Pipelines are cleaned on a scheduled basis or as necessary in order to continue flow by reducing friction and maintaining as large a diameter interior as possible. A special cleaning device, called a pig or go-devil, is placed into the pipeline and pushed along by the flow of oil from one pumping station to the next. As the pig passes through the pipeline it scrapes off any dirt, wax or other deposits which have built up inside the pipeline walls. When it reaches a pumping station, the pig is removed, cleaned and reinserted into the pipeline to travel to the next station.

• Communications. It is important that there be communication and agreement concerning schedules, pumping rates and pressures and emergency procedures between pipeline stations and operators and those shipping and receiving crude oil, gas and petroleum products. Some pipeline companies have private telephone systems which transmit the signal along the pipeline, while others use radios or public telephones. Many pipelines use ultra-high-frequency microwave transmitter systems for computer communications between control centres and pumping stations.

• Petroleum product shipment. Petroleum products may be shipped a number of different ways on pipelines. A company operating a refinery may blend a specific grade of its own gasoline with appropriate additives (additize) and ship a batch through a pipeline directly to its own terminal for distribution to its customers. Another method is for a refinery to produce a batch of gasoline, called a frangible or specification product, which is blended to meet a common carrier pipeline company’s product specifications. The gasoline is placed into the pipeline for delivery to any company’s terminals which are connected to the pipeline system. In a third method, products are shipped by companies to each other’s terminals and exchanged in order to avoid extra transportation and handling. Frangible and exchange products are usually blended and additized at the terminal which receives the product from the pipeline, to meet the specific requirements of each company operating from the terminal. Finally, some products are delivered by pipeline from terminals and refineries direct to large commercial consumers—jet fuel to airports, gas to gas distribution companies and fuel oil to electric generating plants.

• Product receipt and delivery. Pipeline operators and terminal operators should jointly establish programmes to provide for the safe receipt and transfer of products and to coordinate actions in case an emergency occurs on the pipeline or at the terminal during shipment which requires shutdown or diversion of product.

Figure 1. A terminal operator transfers product the Pasagoula Refinery into holding tanks in the Deraville Terminal near Atlanta, Georgia, US.

American Petroleum Institute

Instructions for receiving pipeline deliveries should include verification of the availability of the storage tanks to hold the shipment, opening and aligning tank and terminal valves in anticipation of delivery, checking to assure that the proper tank is receiving product immediately after the start of delivery, conducting required sampling and testing of batches at the start of delivery, performing batch changes and tank switches as required, monitoring receipts to assure that overfills do not occur and maintaining communications between the pipeline and the terminal. The use of written communications between terminal workers, especially when shift changes occur during product transfer, should be considered.

Batch shipments and interface

Although pipelines originally were used to move only crude oil, they evolved into carrying all types and different grades of liquid petroleum products. Because petroleum products are transported in pipelines by batches, in succession, there is commingling or mixing of the products at the interfaces. The product intermix is controlled by one of three methods: downgrading (derating), using liquid and solid spacers for separation or reprocessing the intermix. Radioactive tracers, colour dyes and spacers may be placed into the pipeline to identify where the interfaces occur. Radioactive sensors, visual observation or gravity tests are conducted at the receiving facility to identify different pipeline batches.

Petroleum products are normally transported through pipelines in batch sequences with compatible crude oils or products adjoining one another. One method of maintaining product quality and integrity, downgrading or derating, is accomplished by lowering the interface between the two batches to the level of the least affected product. For example, a batch of high-octane premium gasoline is typically shipped immediately before or after a batch of lower-octane regular gasoline. The small quantity of the two products which has intermixed will be downgraded to the lower octane rating regular gasoline. When shipping gasoline before or after diesel fuel, a small amount of diesel interface is allowed to blend into the gasoline, rather than blending gasoline into the diesel fuel, which could lower its flashpoint. Batch interfaces are typically detected by visual observation, gravitometers or sampling.

Liquid and solid spacers or cleaning pigs may be used to physically separate and identify different batches of products. The solid spacers are detected by a radioactive signal and diverted from the pipeline into a special receiver at the terminal when the batch changes from one product to another. Liquid separators may be water or another product that does not commingle with either of the batches it is separating and is later removed and reprocessed. Kerosene, which is downgraded (derated) to another product in storage or is recycled, can also be used to separate batches.

A third method of controlling the interface, often used at the refinery ends of pipelines, is to return the interface to be reprocessed. Products and interfaces which have been contaminated with water may also be returned for reprocessing.

Environmental protection

Because of the large volumes of products which are transported by pipelines on a continuous basis, there is opportunity for environmental damage from releases. Depending on company and regulatory safety requirements and the pipeline’s construction, location, weather, accessibility and operation, a considerable amount of product may be released should a break in the line or leak occur. Pipeline operators should have emergency response and spill contingency plans prepared and have containment and clean-up materials, personnel and equipment available or on call. Simple field solutions such as building earth dykes and drainage ditches can be quickly implemented by trained operators to contain and divert spilled product.

Maintaining pipelines and worker health and safety

The first pipelines were made of cast iron. Modern trunk pipelines are constructed of welded, high-strength steel, which can withstand high pressures. Pipe walls are periodically tested for thickness to determine whether internal corrosion or deposits have occurred. Welds are checked visually and with gamma radiation to assure that no defects are present.

Plastic pipe may be used for low-pressure, small-diameter flow lines and gathering lines in gas and crude-oil-producing fields, since plastic is light in weight and easy to handle, assemble and move.

When a pipeline is separated by cutting, spreading flanges, removing a valve or opening the line, an electrostatic arc may be created by impressed cathodic protection voltage, corrosion, sacrificial anodes, nearby high-voltage power lines or stray ground currents. This should be minimized by grounding (earthing) the pipe, de-energizing the cathodic rectifiers closest to both sides of the separation and connecting a bonding cable to each side of the piping prior to starting work. As additional pipeline sections, valves and so on are added to an existing line, or during construction, they should first be bonded to the pipelines in place.

Work on pipelines should cease during electrical storms. Equipment used to lift and place pipe should not be operated within 3 m of high-voltage electric lines. Any vehicles or equipment working in the vicinity of high-voltage lines should have trailing grounding straps attached to the frames. Temporary metal buildings should also be grounded.

Pipelines are specially coated and wrapped to prevent corrosion. Cathodic electrical protection may also be required. After the pipeline sections are coated and insulated, they are joined by special clamps connected to metallic anodes. The pipeline is subjected to a grounded source of direct current of sufficient capacity so that the pipeline acts as a cathode and does not corrode.

All pipeline sections are hydrostatically tested prior to entering gas or liquid hydrocarbon service and, depending on regulatory and company requirements, at regular intervals during the life of the pipeline. Air must be eliminated from pipelines prior to hydrostatic testing, and hydrostatic pressure built up and reduced at safe rates. Pipelines are regularly patrolled, usually by aerial surveillance, to visually detect leaks, or monitored from the control centre to detect a drop in flow rate or pressure, which would signify that a break in the pipeline has occurred.

Pipeline systems are provided with warning and signalling systems to alert operators so they may take corrective action in an emergency. Pipelines may have automatic shutdown systems which activate emergency pressure valves upon sensing increased or reduced pipeline pressure. Manually or automatically operated isolation valves are typically located at strategic intervals along pipelines, such as at pumping stations and at both sides of river crossings.

An important consideration when operating pipelines is to provide a means of warning contractors and others who may be working or conducting excavations along the pipeline route, so that the pipeline is not inadvertently ruptured, breached or punctured, resulting in a vapour or gas explosion and fire. This is usually done by regulations which require construction permits or by pipeline companies and associations providing a central number which contractors can call prior to excavation.

Because crude oil and flammable petroleum products are transported in pipelines, the possibility exists for fire or explosion in case of a line break or release of vapour or liquid. Pressure should be reduced to a safe level before working on high-pressure pipelines. Combustible gas testing should be conducted and a permit issued prior to repair or maintenance involving hot work or hot tapping on pipelines. The pipeline should be cleared of flammable liquids and vapours or gas prior to starting work. If a pipeline cannot be cleared and an approved plug is used, safe work procedures should be established and followed by qualified workers. The line should be vented a safe distance from the hot work area to relieve any build-up of pressure behind the plug.

Proper safety procedures should be established and followed by qualified workers when hot tapping pipelines. If welding or hot tapping is conducted in an area where a spill or leak has occurred, the outside of the pipe should be cleaned of liquid, and contaminated soil should be removed or covered to prevent ignition.

It is very important to notify operators at the nearest pumping stations on each side of the operating pipeline where maintenance or repair is to be performed, in case shutdown is required. When crude oil or gas is being pumped into pipelines by producers, the pipeline operators must provide specific instructions to the producers as to actions to take during repair, maintenance or in an emergency. For example, prior to tie-in of production tanks and lines to pipelines, all gate valves and bleeders for the tanks and lines involved in the tie-in should be closed and locked or sealed until the operation is completed.

Normal safety precautions concerning pipe and materials handling, toxic and hazardous exposures, welding and excavation apply during pipeline construction. Workers clearing right-of-way should protect themselves from climatic conditions; poisonous plants, insects and snakes; falling trees and rocks; and so on. Excavations and trenches should be sloped or shored to prevent collapse during underground pipeline construction or repair (see the article “Trenching” in the chapter Construction). Workers should follow safe work practices when opening and de-energizing electrical transformers and switches.

Pipeline operating and maintenance personnel often work alone and are responsible for long stretches of pipeline. Atmospheric testing and the use of personal and respiratory protective equipment is needed to determine oxygen and flammable vapour levels and protect against toxic exposures to hydrogen sulphide and benzene when gauging tanks, opening lines, cleaning spills, sampling and testing, shipping, receiving and performing other pipeline activities. Workers should wear dosimeters or film badges and avoid exposure when working with density gauges, source holders or other radioactive materials. The use of personal and respiratory protective equipment should be considered for exposure to burns from the hot protective tar used in pipe-coating operations and from toxic vapours which contain polynuclear aromatic hydrocarbons.

Marine Tankers and Barges

The majority of the world’s crude oil is transported by tankers from producing areas such as the Middle East and Africa to refineries in consumer areas such as Europe, Japan and the United States. Oil products were originally transported in large barrels on cargo ships. The first tanker ship, which was built in 1886, carried about 2,300 SDWT (2,240 pounds per ton) of oil. Today’s supertankers can be over 300 m long and carry almost 200 times as much oil (see figure 2). Gathering and feeder pipelines often end at marine terminals or offshore platform loading facilities, where the crude oil is loaded into tankers or barges for transport to crude trunk pipelines or refineries. Petroleum products also are transported from refineries to distribution terminals by tanker and barge. After delivering their cargoes, the vessels return in ballast to loading facilities to repeat the sequence.

Figure 2. SS Paul L. Fahrney oil tanker.

American Petroleum Institute

Liquefied natural gas is shipped as a cryogenic gas in specialized marine vessels with heavily insulated compartments or reservoirs (see figure 3). At the delivery port, the LNG is off-loaded to storage facilities or regasification plants. Liquefied petroleum gas may be shipped both as a liquid in uninsulated marine vessels and barges and as a cryogenic in insulated marine vessels. Additionally, LPG in containers (bottled gas) may be shipped as cargo on marine vessels and barges.

Figure 3. LNG Leo tanker loading at Arun, Sumatra, Indonesia.

American Petroleum Institute

LPG and LNG marine vessels

The three types of marine vessels used for transport of LPG and LNG are:

• vessels with reservoirs pressurized up to 2 mPa (LPG only)

• vessels with heat-insulated reservoirs and a reduced pressure of 0.3 to 0.6 mPa (LPG only)

• cryogenic vessels with heat-insulated reservoirs pressurized close to atmospheric pressure (LPG and LNG).

Shipment of LHGs on marine vessels requires constant safety awareness. Transfer hoses must be suitable for the correct temperatures and pressures of the LHGs being handled. To prevent a flammable mixture of gas vapour and air, inert gas (nitrogen) blanketing is provided around reservoirs, and the area is continually monitored to detect leaks. Before loading, storage reservoirs should be inspected to ensure that they are free of contaminants. If reservoirs contain inert gas or air, they should be purged with LHG vapour prior to loading the LHG. Reservoirs should be constantly inspected to ensure integrity, and safety valves should be installed to relieve the LHG vapour generated at maximum heat load. Marine vessels are provided with fire suppression systems and have comprehensive emergency response procedures in place.

Crude oil and petroleum products marine vessels

Oil tankers and barges are vessels designed with the engines and quarters at the rear of the vessel and the remainder of the vessel divided into special compartments (tanks) to carry crude oil and liquid petroleum products in bulk. Cargo pumps are located in pump rooms, and forced ventilation and inerting systems are provided to reduce the risk of fires and explosions in pump rooms and cargo compartments. Modern oil tankers and barges are built with double hulls and other protective and safety features required by the United States Oil Pollution Act of 1990 and the International Maritime Organization (IMO) tanker safety standards. Some new ship designs extend double hulls up the sides of the tankers to provide additional protection. Generally, large tankers carry crude oil and small tankers and barges carry petroleum products.

• Supertankers. Ultra-large and very large crude carriers (ULCCs and VLCCs) are restricted by their size and draft to specific routes of travel. ULCCs are vessels whose capacity is over 300,000 SDWTs, and VLCCs have capacities ranging from 160,000 to 300,000 SDWTs. Most large crude carriers are not owned by oil companies, but are chartered from transportation companies which specialize in operating these super-sized vessels.

• Oil tankers. Oil tankers are smaller than VLCCs, and, in addition to ocean travel, they can navigate restricted passages such as the Suez and Panama Canals, shallow coastal waters and estuaries. Large oil tankers, which range from 25,000 to 160,000 SDWTs, usually carry crude oil or heavy residual products. Smaller oil tankers, under 25,000 SDWT, usually carry gasoline, fuel oils and lubricants.

• Barges. Barges operate mainly in coastal and inland waterways and rivers, alone or in groups of two or more, and are either self-propelled or moved by tugboat. They may carry crude oil to refineries, but more often are used as an inexpensive means of transporting petroleum products from refineries to distribution terminals. Barges are also used to off-load cargo from tankers offshore whose draft or size does not allow them to come to the dock.

Barge and ship loading and unloading

Vessel-to-shore procedures, safety checklists and guidelines should be established and agreed upon by terminal and marine vessel operators. The International Safety Guide for Oil Tankers and Terminals (International Chamber of Shipping 1978) contains information and samples of checklists, guidelines, permits and other procedures covering safe operations when loading or unloading vessels, which may be used by vessel and terminal operators.

Although marine vessels sit in water and are thereby intrinsically grounded, there is a need to provide protection from static electricity which can build up during loading or unloading. This is accomplished by bonding or connecting metal objects on the dock or loading/unloading apparatus to the metal of the vessel. Bonding is also accomplished by use of conductive loading hose or piping. An electrostatic spark of ignitable intensity may also be generated when lowering equipment, thermometers or gauging devices into compartments immediately after loading; enough time must be allowed for the static charge to dissipate.

Ship-to-shore electric currents, which are different from static electricity, may be generated by cathodic protection of the vessel’s hull or dock, or by galvanic potential differences between the vessel and the shore. These currents also build up in metal loading/unloading apparatus. Insulating flanges may be installed within the length of the loading arm and at the point where flexible hoses connect to the shore pipeline system. When the connections are broken, there is no opportunity for a spark to jump from one metal surface to another.

All vessels and terminals need mutually agreed upon emergency response procedures in case of a fire or release of product, vapour or toxic gas. These must cover emergency operations, stopping product flow and emergency removal of a vessel from the dock. The plans should consider communications, fire-fighting, vapour cloud mitigation, mutual aid, rescue, clean-up and remediation measures.

Fire protection portable equipment and fixed systems should be in accord with government and company requirements and appropriate to the size, function, exposure potential and value of the dock and wharf facilities. The International Safety Guide for Oil Tankers and Terminals (International Chamber of Shipping 1978) contains a sample fire notice which may be used as a guide by terminals for dock fire prevention.

Marine vessel health and safety

In addition to the usual maritime working hazards, transporting crude oil and flammable liquids by marine vessel creates a number of special health, safety and fire prevention situations. These include surging and expansion of liquid cargo, flammable vapour hazards during transport and when loading and unloading, possibility of pyrophoric ignition, toxic exposures to materials such as hydrogen sulphide and benzene and safety considerations when venting, flushing and cleaning compart-ments. The economics of operating modern tankers requires them to be at sea for extended periods of time with only short intervals in port to load or unload cargo. This, together with the fact that tankers are highly automated, creates unique mental and physical demands on the few crew members used to operate the vessels.

Fire and explosion protection

Emergency plans and procedures should be developed and implemented that are appropriate for the type of cargo on board and other potential hazards. Fire-fighting equipment must be supplied. Response team members who have shipboard fire-fighting, rescue and spill clean-up responsibilities should be trained, drilled and equipped to handle potential emergencies. Water, foam, dry chemicals, halon, carbon dioxide and steam are used as cooling, inhibiting and smothering fire-fighting agents aboard marine vessels, although halon is being phased out due to environmental concerns. The requirements for vessel fire-fighting equipment and systems are established by the country under whose flag the vessel sails and by company policy, but usually follow the recommendations of the 1974 International Convention for the Safety of Life at Sea (SOLAS).

Strict control of flames or naked lights, lighted smoking materials and other sources of ignition, such as welding or grinding sparks, electrical equipment and unprotected light bulbs, is required on vessels at all times to reduce the risk of fire and explosion. Prior to conducting hot work on board marine vessels, the area should be examined and tested to assure that conditions are safe, and permits should be issued for each specific task allowed.

One method of preventing explosions and fires in the vapour space of cargo compartments is to maintain the level of oxygen below 11% by making the atmosphere inert with a noncombustible gas. Sources for inert gas are exhaust gases from the vessel’s boilers or an independent gas generator or a gas turbine fitted with an afterburner. The 1974 SOLAS Convention implies that vessels carrying cargo with flashpoints below 60°C should have compartments fitted with inert systems. Vessels using inert gas systems should maintain cargo compartments in non-flammable conditions at all times. Inert gas compartments should be constantly monitored to assure safe conditions and should not be allowed to become flammable, because of the danger of ignition from pyrophoric deposits.

Confined spaces

Confined spaces on marine vessels, such as cargo compartments, paint lockers, pump rooms, fuel tanks and spaces between double hulls, must be treated the same as any confined space for entry, hot work and cold work. Tests for oxygen content, flammable vapours and toxic substances, in that order, must be conducted prior to entering confined spaces. A permit system should be established and followed for all confined space entry, safe (cold) work and hot work, which indicates safe exposure levels and required personal and respiratory protective equipment. In waters of the United States, these tests may be conducted by qualified individuals called “marine chemists”.

Compartments on marine vessels such as cargo tanks and pump rooms are confined spaces; when cleaning those which have been made inert or have flammable vapour, toxic or unknown atmospheres, they should be tested, and special safety and respiratory protection procedures should be followed. After crude oil has been unloaded, a small amount of residue, called clingage, remains on the interior surfaces of the compartments, which may then be washed and filled with water for ballast. One method of reducing the amount of residue is to install fixed equipment which removes up to 80% of the clingage by washing down the sides of inerted compartments with crude oil during unloading.

Pumps, valves and equipment

A work permit should be issued and safe work procedures followed, such as bonding, draining and vapour freeing, flammable vapour and toxic exposure testing, and providing stand-by fire protection equipment when operations, maintenance or repair requires opening cargo pumps, lines, valves or equipment on board marine vessels.

Toxic exposures

There is an opportunity for vented gases such as flue gas or hydrogen sulphide to reach the decks of vessels, even from specially designed vent systems. Testing should be continuously conducted to determine inert gas levels on all vessels and hydrogen sulphide levels on vessels which contain or previously carried sour crude oil or residual fuel. Tests should be conducted for benzene exposure on vessels carrying crude oil and gasoline. Inert gas scrubber effluent water and condensate water is acidic and corrosive; PPE should be used when contact is possible.

Environmental protection

Marine vessels and terminals should establish procedures and provide equipment to protect the environment from spills on water and land, and from releases of vapour to the air. The use of large vapour recovery systems at marine terminals is growing. Care must be taken to comply with air pollution requirements when vessels vent compartments and enclosed spaces. Emergency response procedures should be established, and equipment and trained personnel should be available to respond to spills and releases of crude oil and flammable and combustible liquids. A responsible person should be designated to ensure that notifications are made to both the company and the appropriate authorities should a reportable spill or release occur.

In the past, the oil-contaminated ballast water and tank washings were flushed out of the compartments at sea. In 1973, the International Convention for Prevention of Pollution from Ships established requirements that before the water is discharged at sea, the oily residue must be separated and retained on board for eventual onshore processing. Modern tankers have segregated ballast systems, with different lines, pumps and tanks than those used for cargo (in accordance with international recommen-dations), so that there is no possibility of contamination. Older vessels still carry ballast in cargo tanks, so special procedures, such as pumping oily water into designated onshore tanks and processing facilities, must be followed when discharging ballast in order to prevent pollution.

Motor Vehicle and Railroad Transport of Petroleum Products

Crude oil and petroleum products were initially transported by horse-drawn tank wagons, then by railroad tank cars and finally by motor vehicles. Following receipt at terminals from marine vessels or pipelines, bulk liquid petroleum products are delivered by non-pressure tank trucks or rail tank cars directly to service stations and consumers or to smaller terminals, called bulk plants, for redistribution. LPG, gasoline anti-knock compounds, hydrofluoric acid and many other products, chemicals and additives used in the oil and gas industry are transported in pressure tank cars and tank trucks. Crude oil may also be transported by tank truck from small producing wells to gathering tanks, and by tank truck and railroad tank car from storage tanks to refineries or main pipelines. Packaged petroleum products in bulk bins or drums and pallets and cases of smaller containers are carried by package truck or railroad box car.

Government regulations

Transportation of petroleum products by motor vehicle or railroad tank car is regulated by government agencies throughout most of the world. Agencies such as the US DOT and the Canadian Transport Commission (CTC) have established regulations governing the design, construction, safety devices, testing, preventive maintenance, inspection and operation of tank trucks and tank cars. Regulations governing railroad tank car and tank truck operations typically include tank pressure and pressure relief device testing and certification before being placed into initial service and at regular intervals thereafter. The Association of American Railroads and the National Fire Protection Association (NFPA) are typical of organizations which publish specifications and requirements for the safe operation of tank cars and tank trucks. Most governments have regulations or adhere to United Nations Conventions which require the identification of and information concerning hazardous materials and petroleum products which are shipped in bulk or in containers. Railroad tank cars, tank trucks and package trucks are placarded to identify any hazardous products being transported and to provide emergency response information.

Railroad tank cars

Railroad tank cars are constructed of carbon steel or aluminium and may be pressurized or unpressurized. Modern tank cars can hold up to 171,000 l of compressed gas at pressures up to 600 psi (1.6 to 1.8 mPa). Non-pressure tank cars have evolved from small wooden tank cars of the late 1800s to jumbo tank cars which transport as much as 1.31 million litres of product at pressures up to 100 psi (0.6 mPa). Non-pressure tank cars may be individual units with one or multiple compartments or a string of interconnected tank cars, called a tank train. Tank cars are loaded individually, and entire tank trains can be loaded and unloaded from a single point. Both pressure and non-pressure tank cars may be heated, cooled, insulated and thermally protected against fire, depending on their service and the products transported.

All railroad tank cars have top- or bottom-liquid or vapour valves for loading and unloading and hatch entries for cleaning. They are also equipped with devices intended to prevent the increase of internal pressure when exposed to abnormal con-ditions. These devices include safety relief valves held in place by a spring which can open to relieve pressure and then close; safety vents with rupture discs that burst open to relieve pressure but cannot reclose; or a combination of the two devices. A vacuum relief valve is provided for non-pressure tank cars to prevent vacuum formation when unloading from the bottom. Both pressure and non-pressure tank cars have protective housings on top surrounding the loading connections, sample lines, thermometer wells and gauging devices. Platforms for loaders may or may not be provided on top of cars. Older non-pressure tank cars may have one or more expansion domes. Fittings are provided on the bottom of tank cars for unloading or cleaning. Head shields are provided on the ends of tank cars to prevent puncture of the shell by the coupler of another car during derailments.

LNG is shipped as a cryogenic gas in insulated tank truck and rail pressure tank cars. Pressure tank trucks and rail tank cars for LNG transport have a stainless steel inner reservoir suspended in an outer reservoir of carbon steel. The annular space is a vacuum filled with insulation to maintain low temperatures during shipment. To prevent gas from igniting back to the tanks, they are equipped with two independent, remotely controlled fail-safe emergency shut-off valves on the filling and discharge lines and have gauges on both the inside and outside reservoirs.

LPG is transported on land in specially designed rail tank cars (up to 130 m³ capacity) or tank trucks (up to 40 m³ capacity). Tank trucks and rail tank cars for LPG transport are typically uninsulated steel cylinders with spherical bottoms, equipped with gauges, thermometers, two safety relief valves, a gas level meter and maximum fill indicator and baffles.

Rail tank cars transporting LNG or LPG should not be overloaded, since they may sit on a siding for some period of time and be exposed to high ambient temperatures, which could cause overpressure and venting. Bond wires and grounding cables are provided at rail and tank truck loading racks to help neutralize and dissipate static electricity. They should be connected before operations commence and not disconnected until operations are complete and all valves are closed. Truck and rail loading facilities are typically protected by fire water spray or mist systems and fire extinguishers.

Tank trucks

Petroleum products and crude oil tank trucks are typically constructed of carbon steel, aluminium or a plasticized fibreglass material, and vary in size from 1,900-l tank wagons to jumbo 53,200-l tankers. The capacity of tank trucks is governed by regulatory agencies, and usually is dependent upon highway and bridge capacity limitations and the allowable weight per axle or total amount of product allowed.

There are pressurized and non-pressurized tank trucks, which may be non-insulated or insulated depending on their service and the products transported. Pressurized tank trucks are usually single compartment, and non-pressurized tank trucks may have single or multiple compartments. Regardless of the number of compartments on a tank truck, each compartment must be treated individually, with its own loading, unloading and safety-relief devices. Compartments may be separated by single or double walls. Regulations may require that incompatible products and flammable and combustible liquids carried in different compartments on the same vehicle be separated by double walls. When pressure testing compartments, the space between the walls should also be tested for liquid or vapour.

Tank trucks have either hatches which open for top loading, valves for closed top- or bottom-loading and unloading, or both. All compartments have hatch entries for cleaning and are equipped with safety relief devices to mitigate internal pressure when exposed to abnormal conditions. These devices include safety relief valves held in place by a spring which can open to relieve pressure and then close, hatches on non-pressure tanks which pop open if the relief valves fail and rupture discs on pressurized tank trucks. A vacuum relief valve is provided for each non-pressurized tank truck compartment to prevent vacuum when unloading from the bottom. Non-pressurized tank trucks have railings on top to protect the hatches, relief valves and vapour recovery system in case of a rollover. Tank trucks are usually equipped with breakaway, self-closing devices installed on compartment bottom loading and unloading pipes and fittings to prevent spills in case of damage in a rollover or collision.

Rail tank car and tank truck loading and unloading

While railroad tank cars are almost always loaded and unloaded by workers assigned to these specific duties, tank trucks may be loaded and unloaded by either loaders or drivers. Tank cars and tank trucks are loaded at facilities called loading racks, and may be top loaded through open hatches or closed connections, bottom loaded through closed connections, or a combination of both.

Loading

Workers who load and unload crude oil, LPG, petroleum products, and acids and additives used in the oil and gas industry, should have a basic understanding of the characteristics of the products handled, their hazards and exposures and the operating procedures and work practices needed to perform the job safely. Many government agencies and companies require the use and completion of inspection forms upon receipt and shipment and prior to loading and unloading railroad tank cars and tank trucks. Tank trucks and railroad tank cars may be loaded through open hatches on the top or through fittings and valves at the top or bottom of each tank or compartment. Closed connections are required when pressure loading and where vapour recovery systems are provided. If loading systems do not activate for any reason (such as improper operation of the vapour recovery system or a fault in the grounding or bonding system), by-pass should not be attempted without approval. All hatches should be closed and securely latched during transit.

Workers should follow safe work practices to avoid slips and falls when top loading. If loading controls use pre-set meters, loaders must be careful to load the correct products into the assigned tanks and compartments. All compartment hatches should be shut when bottom loading, and when top loading, only the compartment being loaded should be open. When top loading, splash loading should be avoided by placing the loading tube or hose close to the bottom of the compartment and starting to load slowly until the opening is submerged. During manual top loading operations, loaders should remain in attendance, not tie down the loading shut-off (deadman) control and not overfill the compartment. Loaders should avoid exposures to product and vapour by standing upwind and averting the head when top loading through open hatches and by wearing protective equipment when handling additives, obtaining samples and draining hoses. Loaders should be aware of and follow prescribed response actions in case of a hose or line rupture, spill, release, fire or other emergency.

Unloading and delivery

When unloading tank cars and tank trucks, it is important first to assure that each product is unloaded into the proper designated storage tank and that the tank has sufficient capacity to hold all of the product being delivered. Although valves, fill pipes, lines and fill covers should be colour coded or otherwise marked to identify the product contained, the driver should still be responsible for product quality during delivery. Any misdelivery of product, mixing or contamination should be immediately reported to the recipient and to the company to prevent serious consequences. When drivers or operators are required to additize products or obtain samples from storage tanks following delivery to assure product quality or for any other reason, all safety and health provisions specific to the exposure should be followed. Persons engaged in delivery and unloading operations should remain in the vicinity at all times and know what to do in an emergency, including notification, stopping product flow, cleaning spills and when to leave the area.

Pressurized tanks may be unloaded by compressor or pump, and unpressurized tanks by gravity, vehicle pump or recipient pump. Tank trucks and tank cars which carry lubrication or industrial oils, additives and acids are sometimes unloaded by pressurizing the tank with an inert gas such as nitrogen. Tank cars or tank trucks may need to be heated using steam or electric coils in order to unload heavy crude oils, viscous products and waxes. All of these activities have inherent dangers and exposures. Where required by regulation, unloading should not commence until the vapour recovery hoses have been connected between the delivery tank and the storage tank. When delivering petroleum products to residences, farms and commercial accounts, drivers should gauge any tank which is not equipped with a vent alarm in order to prevent an overfill.

Loading-rack fire protection

Fires and explosions at top and bottom tank car and tank truck loading racks may occur from causes such as electrostatic build-up and incendiary spark discharge in a flammable atmosphere, unauthorized hot work, flashback from a vapour recovery unit, smoking or other unsafe practices.

Sources of ignition, such as smoking, running internal combustion engines and hot work activity, should be controlled at the loading rack at all times, and particularly during loading or other operations when a spill or release may occur. Loading racks may be equipped with portable fire extinguishers and manually or automatically operated foam, water or dry chemical fire extinguishing systems. If vapour recovery systems are in use, flame arrestors should be provided to prevent flashback from the recovery unit to the loading rack.

Drainage should be provided at loading racks to divert product spills away from the loader, tank truck or tank car and the loading rack pad. Drains should be provided with fire traps to prevent migration of flames and vapours through sewer systems. Other loading-rack safety considerations include emergency shut-down controls placed at loading spots and other strategic locations in the terminal and automatic pressure-sensing valves which stop product flow to the rack in case of a leak in the product lines. Some companies have installed automatic brake lock systems on their tank truck fill connections, which lock the brakes and will not allow the truck to be moved from the rack until the fill lines have been disconnected.

Electrostatic ignition hazards

Some products such as intermediate distillates and low-vapour-pressure fuels and solvents tend to accumulate electrostatic charges. When loading tank cars and tank trucks, there is always an opportunity for electrostatic charges to be generated by friction as product goes through lines and filters and by splash loading. This can be mitigated by designing loading racks to allow for relaxation time in piping downstream from pumps and filters. Compartments should be checked to assure that they do not contain any unbonded or floating objects which could act as static accumulators. Bottom loaded compartments may be provided with internal cables to help dissipate electrostatic charges. Sample containers, thermometers or other items should not be lowered into compartments until a waiting period of at least 1 minute has elapsed, to allow any electrostatic charge which has accumulated in the product to dissipate.

Bonding and grounding are important considerations in dissipating electrostatic charges which build up during loading operations. By keeping the fill pipe in contact with the metal side of the hatch when top loading, and through the use of metal loading arms or conductive hose when loading through closed connections, the tank truck or tank car is bonded to the loading rack, maintaining the same electrical charge between the objects so that a spark is not created when the loading tube or hose is removed. The tank car or tank truck may also be bonded to the loading rack by use of a bonding cable, which carries any accumulated charge from a terminal on the tank to the rack, where it is then grounded by a grounding cable and rod. Similar bonding precautions are needed when unloading from tank cars and tank trucks. Some loading racks are provided with electronic connectors and sensors which will not allow loading pumps to activate until a positive bond is achieved.

During cleaning, maintenance or repair, pressurized LPG tank cars or tank trucks are usually opened to the atmosphere, allowing air to enter the tank. In order to prevent combustion from electrostatic charges when loading these cars for the first time after such activities, it is necessary to reduce the oxygen level below 9.5% by blanketing the tank with inert gas, such as nitrogen. Precautions are needed to prevent liquid nitrogen from entering the tank if the nitrogen is provided from portable containers.

Switch loading

Switch loading occurs when intermediate- or low-vapour-pressure products such as diesel fuel or fuel oil are loaded into a tank car or tank truck compartment which previously contained a flammable product such as gasoline. The electrostatic charge generated during loading can discharge in an atmosphere which is within the flammable range, with a resultant explosion and fire. This hazard can be controlled when top loading by lowering the fill tube to the bottom of the compartment and loading slowly until the end of the tube is submerged to avoid splash loading or agitation. Metal to metal contact should be maintained during loading in order to provide a positive bond between the loading tube and the tank hatchway. When bottom loading, initial slow fill or splash deflectors are used to reduce static build-up. Prior to switch loading, tanks which cannot be drained dry may be flushed out with a small amount of the product to be loaded, to remove any flammable residue in sumps, lines, valves and onboard pumps.

Shipping products by rail box cars and package vans

Petroleum products are shipped by motor truck package vans and railroad box cars in metal, fibre and plastic containers of various sizes, from 55-gallon (209-l) drums to 5-gallon (19-l) pails and from 2-1/2-gallon (9.5-l) to 1-quart (.95-l) containers, in corrugated boxes, usually on pallets. Many industrial and commercial petroleum products are shipped in large metal, plastic or combination intermediate bulk containers ranging in size from 380 to over 2,660 l capacity. LPG is shipped in large and small pressure containers. In addition, samples of crude oil, finished products and used products are shipped by mail or express freight carrier to laboratories for assay and analysis.

All of these products, containers and packages have to be handled in accordance with government regulations for hazardous chemicals, flammable and combustible liquids and toxic materials. This requires the use of hazardous materials manifests, shipping documents, permits, receipts and other regulatory requirements, such as marking the outsides of packages, containers, motor trucks and box cars with proper identification and a hazard warning label. Proper utilization of tank trucks and tank cars is important to the petroleum industry. Because storage capacity is finite, delivery schedules need to be met, from the delivery of crude oil to keep refineries running to the delivery of gasoline to service stations, and from the delivery of lubricants to commercial and industrial accounts to the delivery of heating oil to homes.

LPG is supplied to consumers by bulk tank trucks which pump directly into smaller onsite storage tanks, both above ground and below ground (e.g., service stations, farms, commercial and industrial consumers). LPG is also delivered to consumers by truck or van in containers (gas cylinders or bottles). LNG is delivered in special cryogenic containers which have an inner fuel tank surrounded by insulation and an outer shell. Similar containers are provided for vehicles and appliances which use LNG as a fuel. Compressed natural gas is normally delivered in conventional compressed gas cylinders, such as those used on industrial lift trucks.

In addition to the normal safety and health precautions required in rail car and package trucking operations, such as moving and handling heavy objects and operating industrial trucks, workers should be familiar with the hazards of the products they are handling and delivering, and know what to do in case of a spill, release or other emergency. For example, intermediate bulk containers and drums should not be dropped out of box cars or from the tailgates of trucks onto the ground. Both companies and government agencies have established special regulations and requirements for drivers and operators who are involved in the transport and delivery of flammable and hazardous petroleum products.

Tank truck and package van drivers often work alone and may have to travel great distances for a number of days to deliver their loads. They work both day and night and in all sorts of weather conditions. Manoeuvring super-sized tank trucks into service stations and customer locations without hitting parked vehicles or fixed objects requires patience, skill and experience. Drivers should have the physical and mental characteristics required for this work.

Driving tank trucks is different from driving package vans in that the liquid product tends to shift forward as the truck stops, backwards as the truck accelerates and from side to side as the truck turns. Tank truck compartments should be fitted with baffles which restrict the movement of product during transport. Considerable skill is required by drivers to overcome the inertia created by this phenomenon, called “mass in motion”. Occasionally, tank truck drivers are required to pump out storage tanks. This activity requires special equipment, including suction hose and transfer pumps, and safety precautions, such as bonding and grounding to dissipate electrostatic build-up and to prevent any release of vapours or liquids.

Motor vehicle and rail car emergency response

Drivers and operators should be familiar with notification requirements and emergency response actions in case of a fire or a release of product, gas or vapour. Product identification and hazard warning placards in compliance with industry, association or national marking standards are posted on trucks and rail cars to allow emergency responders to determine the precautions needed in case of a spill or release of vapour, gas or product. Motor vehicle drivers and train operators may also be required to carry material safety data sheets (MSDSs) or other documentation describing the hazards and precautions for handling the products being transported. Some companies or government agencies require that vehicles transporting flammable liquids or hazardous materials carry first aid kits, fire extinguishers, spill clean-up materials and portable hazard warning devices or signals to alert motorists if the vehicle is stopped alongside a highway.

Special equipment and techniques are required if a tank car or tank truck needs to be emptied of product as the result of an accident or rollover. Removal of product through fixed piping and valves or by using special knock-out plates on tank truck hatches is preferred; however, under certain conditions holes may be drilled in tanks using prescribed safe work procedures. Regardless of the method of removal, tanks should be grounded and a bond connection provided between the tank being emptied and the receiving tank.

Cleaning tank cars and tank trucks

Entering a tank car or tank truck compartment for inspection, cleaning, maintenance or repair is a hazardous activity requiring that all ventilation, testing, gas freeing and other confined-space entry and permit system requirements be followed in order to assure a safe operation. Cleaning tank cars and tank trucks is not any different from cleaning petroleum-product storage tanks, and all the same safety and health exposure precautions and procedures apply. Tank cars and tank trucks may contain residue of flammable, hazardous or toxic materials in sumps and unloading piping, or have been unloaded using an inert gas, such as nitrogen, so that what may appear to be a clean, safe space is not. Tanks which have contained crude oil, residues, asphalt or high-melting-point products may need to be steam or chemically cleaned prior to ventilation and entry, or may have a pyrophoric hazard. Ventilating tanks to free them from vapours and toxic or inert gases may be accomplished by opening the lowest and furthest valve or connection on each tank or compartment and placing an air eductor at the furthest top opening. Monitoring should be performed prior to entry without respiratory protection to assure that all of the corners and low spots in the tank, such as sumps, have been thoroughly vented, and ventilation should continue while working in the tank.

Aboveground Tank Storage of Liquid Petroleum Products

Crude oil, gas, LNG and LPG, processing additives, chemicals and petroleum products are stored in aboveground and underground atmospheric (non-pressure) and pressure storage tanks. Storage tanks are located at the ends of feeder lines and gathering lines, along truck pipelines, at marine loading and unloading facilities and in refineries, terminals and bulk plants. This section covers aboveground atmospheric storage tanks in refinery, terminal and bulk plant tank farms. (Information concerning aboveground pressure tanks is covered below, and information concerning underground tanks and small aboveground tanks is in the article “Motor vehicle fuelling and servicing operations”.)

Terminals and bulk plants

Terminals are storage facilities which generally receive crude oil and petroleum products by trunk pipeline or marine vessel. Terminals store and redistribute crude oil and petroleum products to refineries, other terminals, bulk plants, service stations and consumers by pipelines, marine vessels, railroad tank cars and tank trucks. Terminals may be owned and operated by oil companies, pipeline companies, independent terminal operators, large industrial or commercial consumers or petroleum product distributors.

Bulk plants are usually smaller than terminals and typically receive petroleum products by rail tank car or tank truck, normally from terminals but occasionally direct from refineries. Bulk plants store and redistribute products to service stations and consumers by tank truck or tank wagon (small tank trucks of approximately 9,500 to 1,900 l capacity). Bulk plants may be operated by oil companies, distributors or independent owners.

Tank farms

Tank farms are groupings of storage tanks at producing fields, refineries, marine, pipeline and distribution terminals and bulk plants which store crude oil and petroleum products. Within tank farms, individual tanks or groups of two or more tanks are usually surrounded by enclosures called berms, dykes or fire walls. These tank farm enclosures may vary in construction and height, from 45-cm earth berms around piping and pumps inside dykes to concrete walls that are taller than the tanks they surround. Dykes may be built of earth, clay or other materials; they are covered with gravel, limestone or sea shells to control erosion; they vary in height and are wide enough for vehicles to drive along the top. The primary functions of these enclosures are to contain, direct and divert rain water, physically separate tanks to prevent the spread of fire in one area to another, and to contain a spill, release, leak or overflow from a tank, pump or pipe within the area.

Dyke enclosures may be required by regulation or company policy to be sized and maintained to hold a specific amount of product. For example, a dyke enclosure may need to contain at least 110% of the capacity of the largest tank therein, allowing for the volume displaced by the other tanks and the amount of product remaining in the largest tank after hydrostatic equilibrium is reached. Dyke enclosures may also be required to be constructed with impervious clay or plastic liners to prevent spilled or released product from contaminating soil or groundwater.

Storage tanks

There are a number of different types of vertical and horizontal aboveground atmospheric and pressure storage tanks in tank farms, which contain crude oil, petroleum feedstocks, intermediate stocks or finished petroleum products. Their size, shape, design, configuration, and operation depend on the amount and type of products stored and company or regulatory requirements. Aboveground vertical tanks may be provided with double bottoms to prevent leakage onto the ground and cathodic protection to minimize corrosion. Horizontal tanks may be constructed with double walls or placed in vaults to contain any leakage.

Atmospheric cone roof tanks

Cone roof tanks are aboveground, horizontal or vertical, covered, cylindrical atmospheric vessels. Cone roof tanks have external stairways or ladders and platforms, and weak roof to shell seams, vents, scuppers or overflow outlets; they may have appurtenances such as gauging tubes, foam piping and chambers, overflow sensing and signalling systems, automatic gauging systems and so on.

When volatile crude oil and flammable liquid petroleum products are stored in cone roof tanks there is an opportunity for the vapour space to be within the flammable range. Although the space between the top of the product and the tank roof is normally vapour rich, an atmosphere in the flammable range can occur when product is first put into an empty tank or as air enters the tank through vents or pressure/vacuum valves when product is withdrawn and as the tank breathes during temperature changes. Cone roof tanks may be connected to vapour recovery systems.

Conservation tanks are a type of cone roof tank with an upper and lower section separated by a flexible membrane designed to contain any vapour produced when the product warms up and expands due to exposure to sunlight in the daytime and to return the vapour to the tank when it condenses as the tank cools down at night. Conservation tanks are typically used to store aviation gasoline and similar products.

Atmospheric floating roof tanks

Floating roof tanks are aboveground, vertical, open top or covered cylindrical atmospheric vessels that are equipped with floating roofs. The primary purpose of the floating roof is to minimize the vapour space between the top of the product and the bottom of the floating roof so that it is always vapour rich, thus precluding the chance of a vapour-air mixture in the flammable range. All floating roof tanks have external stairways or ladders and platforms, adjustable stairways or ladders for access to the floating roof from the platform, and may have appurtenances such as shunts which electrically bond the roof to the shell, gauging tubes, foam piping and chambers, overflow sensing and signalling systems, automatic gauging systems and so on. Seals or boots are provided around the perimeter of floating roofs to prevent product or vapour from escaping and collecting on the roof or in the space above the roof.

Floating roofs are provided with legs which may be set in high or low positions depending on the type of operation. Legs are normally maintained in the low position so that the greatest possible amount of product can be withdrawn from the tank without creating a vapour space between the top of the product and the bottom of the floating roof. As tanks are brought out of service prior to entry for inspection, maintenance, repair or cleaning, there is a need to adjust the roof legs into the high position to allow room to work under the roof once the tank is empty. When the tank is returned to service, the legs are readjusted into the low position after it is filled with product.

Aboveground floating roof storage tanks are further classified as external floating roof tanks, internal floating roof tanks or covered external floating roof tanks.

External (open top) floating roof tanks are those with floating covers installed on open-top storage tanks. External floating roofs are usually constructed of steel and provided with pontoons or other means of flotation. They are equipped with roof drains to remove water, boots or seals to prevent vapour releases and adjustable stairways to reach the roof from the top of the tank regardless of its position. They may also have secondary seals to minimize release of vapour to the atmosphere, weather shields to protect the seals and foam dams to contain foam in the seal area in case of a fire or seal leak. Entry onto external floating roofs for gauging, maintenance or other activities may be considered confined-space entry, depending on the level of the roof below the top of the tank, the products contained in the tank and government regulations and company policy.

Internal floating roof tanks usually are cone roof tanks which have been converted by installing buoyant decks, rafts or internal floating covers inside the tank. Internal floating roofs are typically constructed of various types of sheet metal, aluminium, plastic or metal-covered plastic expanded foam, and their construction may be of the pontoon or pan type, solid buoyant material, or a combination of these. Internal floating roofs are provided with perimeter seals to prevent vapour from escaping into the portion of the tank between the top of the floating roof and the exterior roof. Pressure/vacuum valves or vents are usually provided at the top of the tank to control any hydrocarbon vapours which may accumulate in the space above the internal floater. Internal floating roof tanks have ladders installed for access from the cone roof to the floating roof. Entry onto internal floating roofs for any purpose should be considered confined-space entry.

Covered (external) floating roof tanks are basically external floating roof tanks that have been retrofitted with a geodesic dome, snow cap or similar semi-fixed cover or roof so that the floating roof is no longer open to the atmosphere. Newly constructed covered external floating roof tanks may incorporate typical floating roofs designed for internal floating roof tanks. Entry onto covered external floating roofs for gauging, maintenance or other activities may be considered confined-space entry, depending on the construction of the dome or cover, the level of the roof below the top of the tank, the products contained in the tank and government regulations and company policy.

Pipeline and marine receipts

An important safety, product quality and environmental concern in tank storage facilities is to prevent intermixing of products and overfilling tanks by developing and implementing safe operating procedures and work practices. Safe operation of storage tanks depends on receiving product into tanks within their defined capacity by designating receiving tanks prior to delivery, gauging tanks to determine the available capacity and ensuring that valves are properly aligned and that only the receiving tank inlet is opened, so the correct amount of product is delivered into the assigned tank. Drains in dyke areas surrounding tanks receiving product should normally be kept closed during receipt in case an overfill or spill occurs. Overfill protection and prevention can be accomplished by a variety of safe operating practices, including manual controls and automatic detection, signalling and shut-down systems and a means of communication, all of which should be mutually understood and acceptable to product transfer personnel at the pipeline, marine vessel and terminal or refinery.

Government regulations or company policy may require that automatic product level detection devices and signal and shut-down systems be installed on tanks receiving flammable liquids and other products from trunk pipelines or marine vessels. Where such systems are installed, electronic system integrity tests should be conducted on a regular basis or prior to product transfer, and if the system fails, transfers should follow manual receipt procedures. Receipts should be monitored manually or automatically, onsite or from a remote control location, to ensure that operations are proceeding as planned. Upon completion of transfer, all valves should be returned to normal operating position or set for the next receipt. Pumps, valves, pipe connections, bleeder and sample lines, manifold areas, drains and sumps should be inspected and maintained to assure good condition and to prevent spills and leakage.

Tank gauging and sampling

Tank storage facilities should establish procedures and safe work practices for gauging and sampling crude oil and petroleum products which take into consideration the potential hazards involved with each product stored and each type of tank in the facility. Although tank gauging is often done using automatic mechanical or electronic devices, manual gauging should be performed at scheduled intervals to assure the accuracy of the automatic systems.

Manual gauging and sampling operations usually require the operator to climb to the top of the tank. When gauging floating roof tanks, the operator then has to descend onto the floating roof unless the tank is fitted with gauging and sampling tubes that are accessible from the platform. With cone roof tanks, the gauger must open a roof hatch in order to lower the gauge into the tank. Gaugers should be aware of the confined-space entry requirements and potential hazards when entering onto covered floating roofs or down upon open-top floating roofs which are below established height levels. This may require the use of monitoring devices, such as oxygen, combustible gas and hydrogen sulphide detectors and personal and respiratory protective equipment.

Product temperatures and samples may be taken at the same time as manual gauging is conducted. Temperatures may also be recorded automatically and samples obtained from built-in sample connections. Manual gauging and sampling should be restricted while tanks are receiving product. Following the completion of receipt, a relaxation period of from 30 minutes to 4 hours, depending on the product and company policy, should be required to allow any electrostatic build-up to dissipate before conducting manual sampling or gauging. Some companies require that communications or visual contact be established and maintained between gaugers and other facility personnel when descending upon floating roofs. Entry onto tank roofs or platforms for gauging, sampling or other activities should be restricted during thunderstorms.

Tank venting and cleaning

Storage tanks are taken out of service for inspection, testing, maintenance, repair, retrofitting and tank cleaning as needed or at regular intervals dependent on government regulations, company policy and operating service requirements. Although tank venting, cleaning and entry is a potentially hazardous operation, this work can be accomplished without incident, provided that proper procedures are established and safe work practices followed. Without such precautions, injury or damage can occur from explosions, fires, lack of oxygen, toxic exposures and physical hazards.

Preliminary preparations

A number of preliminary preparations are required after it has been decided that a tank needs to be taken out of service for inspection, maintenance or cleaning. These include: scheduling storage and supply alternatives; reviewing the tank history to determine whether it has ever contained leaded product or has previously been cleaned and certified lead free; determining the amount and type of products contained and how much residue will remain in the tank; inspecting the outside of the tank, the surrounding area and the equipment to be used for product removal, vapour freeing and cleaning; assuring that personnel are trained, qualified and familiar with facility permit and safety procedures; assigning job responsibilities in accordance with the facility’s confined-space entry and hot- and safe-work permit requirements; and holding a meeting between terminal and tank cleaning personnel or contractors before tank cleaning or construction starts.

Control of ignition sources

After the removal of all available product from the tank through fixed piping, and before any water draws or sample lines are opened, all sources of ignition should be removed from the surrounding area until the tank is declared vapour free. Vacuum trucks, compressors, pumps and other equipment which is electrically or motor driven should be located upwind, either on top of or outside the dyke area, or, if inside the dyke area, at least 20 m from the tank or any other sources of flammable vapours. Tank preparation, venting and cleaning activities should cease during electrical storms.

Removing residue

The next step is to remove as much remaining product or residue in the tank as possible through pipeline and waterdraw connections. A safe-work permit may be issued for this work. Water or distillate fuel may be injected into the tank through fixed connections to help float product out of the tank. Residue removed from tanks that have contained sour crude should be kept wet until disposal to avoid spontaneous combustion.

Isolating the tank

After all available product has been removed through fixed piping, all piping connected to the tank, including product lines, vapour recovery lines, foam piping, sample lines and so on, should be disconnected by closing the valves nearest the tank and inserting blinds in the lines on the tank side of the valve to prevent any vapours from entering the tank from the lines. The portion of piping between the blinds and the tank should be drained and flushed. Valves outside the dyke area should be closed and locked or tagged. Tank pumps, internal mixers, cathodic protection systems, electronic gauging and level detection systems and so on should be disconnected, de-energized and locked or tagged out.

Vapour freeing

The tank is now ready to be made vapour free. Intermittent or continuous vapour testing should be conducted and work in the area restricted during tank ventilation. Natural ventilation, through opening the tank to the atmosphere, is not usually preferred, since it is neither as fast nor as safe as forced ventilation. There are a number of methods of mechanically venting a tank, depending on its size, construction, condition and internal configuration. In one method, cone roof tanks may be vapour freed by placing an eductor (a portable ventilator) at a hatch on the top of the tank, starting it slowly while a hatch at the bottom of the tank is opened and then setting it on high speed to draw air and vapours through the tank.

A safe- or hot-work permit should be issued covering ventilation activities. All blowers and eductors should be securely bonded to the tank shell to prevent electrostatic ignition. For safety purposes, blowers and eductors should preferably be operated by compressed air; however, explosion-proof electric- or steam-driven motors have been used. Internal floating roof tanks may need to have the portions above and below the floating roof vented separately. If vapours are discharged from a bottom hatch, a vertical tube at least 4 m above ground level and no lower than the surrounding dyke wall is needed in order to prevent vapours from collecting at low levels or reaching a source of ignition before dissipating. If necessary, vapours may be directed to the facility vapour recovery system.

As ventilation progresses, the remaining residue can be washed down and removed through the open bottom hatch by water and suction hoses, both of which should be bonded to the tank shell to prevent electrostatic ignition. Tanks which have contained sour crude oil or high-sulphur residual products may generate spontaneous heat and ignite as they dry out during ventilation. This should be avoided by wetting the inside of the tank with water to blanket the deposits from air and prevent a rise in temperature. Any iron sulphide residue should be removed from the open hatch to prevent ignition of vapours during ventilation. Workers engaged in washdown, removal and wetting activities should wear appropriate personal and respiratory protection.

Initial entry, inspection and certification

An indication of the progress being made in vapour freeing the tank can be obtained by monitoring vapours at the point of eduction during ventilation. Once it appears that the flammable vapour level is below that established by regulatory agencies or company policy, entry can be made into the tank for inspection and testing purposes. The entrant should wear appropriate personal and air-supplied respiratory protection; after testing the atmosphere at the hatch and obtaining an entry permit, the worker may enter the tank to continue testing and inspection. Checks for obstructions, falling roofs, weak supports, holes in the floor and other physical hazards should be conducted during the inspection.

Cleaning, maintenance and repair

As ventilation continues and the vapour levels in the tank drop lower, permits may be issued allowing entry by workers with appropriate personal and respiratory equipment, if needed, to start cleaning the tank. Monitoring for oxygen, flammable vapours and toxic atmospheres should continue, and if the levels inside the tank exceed those established for entry, the permit should automatically expire and the entrants should immediately leave the tank until the safe level is again achieved and the permit is reissued. Ventilation should continue during cleaning operations as long as any residue or sludge remains in the tank. Only low-voltage lighting or approved flashlights should be used during inspection and clean-up.

After tanks have been cleaned and dried, a final inspection and testing should be conducted before maintenance, repair or retrofitting work is started. Careful inspection of sumps, wells, floor plates, floating roof pontoons, supports and columns is needed to assure that no leaks have developed which allowed product to enter these spaces or seep beneath the floor. Spaces between foam seals and weather shields or secondary containment should also be inspected and tested for vapours. If the tank has previously contained leaded gasoline, or if no tank history is available, a lead-in-air test should be conducted and the tank certified lead free before workers are allowed inside without air-supplied respiratory equipment.

A hot-work permit should be issued covering welding, cutting and other hot work, and a safe-work permit issued to cover other repair and maintenance activities. Welding or hot work can create toxic or noxious fumes inside the tank, requiring monitoring, respiratory protection and continued ventilation. When tanks are to be retrofitted with double bottoms or internal floating roofs, a large hole is often cut into the side of the tank to provide unrestricted access and avoid the need for confined-space entry permits.

Blast cleaning and painting the outside of tanks usually follows tank cleaning and is completed before the tank is returned to service. These activities, together with cleaning and painting tank farm piping, may be performed while tanks and pipes are in service, by implementing and following prescribed safety procedures, such as conducting monitoring for hydrocarbon vapours and stopping blast cleaning while nearby tanks are receiving flammable liquid products. Blast cleaning with sand has the potential for hazardous exposure to silica; therefore, many government agencies and companies require the use of special non-toxic blast cleaning materials or grit, which may be collected, cleaned and recycled. Special vacuum collection blast cleaning devices may be used in order to avoid contamination when cleaning leaded paint from tanks and piping. Following blast cleaning, spots in the tank walls or piping suspected of having leaks and seeps should be tested and repaired before being painted.

Returning the tank to service

In preparation for return to service upon completion of tank cleaning, inspection, maintenance or repair, the hatches are closed, all blinds are removed and the piping is reconnected to the tank. Valves are unlocked, opened and aligned, and mechanical and electrical devices are reactivated. Many government agencies and companies require tanks to be hydrostatically tested to assure that there are no leaks before they are returned to service. Since a considerable amount of water is required to obtain the necessary pressure head for an accurate test, a water bottom topped with diesel fuel is often used. Upon completion of the testing, the tank is emptied and made ready to receive product. After receipt is completed and a relaxation time has elapsed, the legs on floating roof tanks are reset into the low position.

Fire protection and prevention

Whenever hydrocarbons are present in closed containers such as storage tanks in refineries, terminals and bulk plants, the potential exists for release of liquids and vapours. These vapours could mix with air in the flammable range and, if subjected to a source of ignition, cause an explosion or fire. Regardless of the capability of fire protection systems and personnel in the facility, the key to fire protection is fire prevention. Spills and releases should be stopped from entering sewers and drainage systems. Small spills should be covered with wet blankets, and larger spills with foam, to prevent vapours from escaping and mixing with air. Sources of ignition in areas when hydrocarbon vapours may be present should be eliminated or controlled. Portable fire extinguishers should be carried on service vehicles and located at accessible and strategic positions throughout the facility.

The establishment and implementation of safe work procedures and practices such as hot- and safe- (cold-) work permit systems, electrical classification programmes, lockout/tagout programmes, and employee and contractor training and education is critical to preventing fires. Facilities should develop preplanned emergency procedures, and employees should be knowledgeable in their responsibilities for reporting and responding to fires and evacuation. Telephone numbers of responsible persons and agencies to be notified in case of an emergency should be posted at the facility and a means of communication provided. Local fire departments, emergency response, public safety and mutual aid organizations should also be aware of the procedures and familiar with the facility and its hazards.

Hydrocarbon fires are controlled by one or a combination of methods, as follows:

• Removing fuel. One of the best and easiest methods of controlling and extinguishing a hydrocarbon fire is to shut off the source of fuel by closing a valve, diverting product flow or, if a small amount of product is involved, controlling exposures while allowing the product to burn away. Foam may also be used to cover hydrocarbon spills to prevent vapours from being emitted and mixing with the air.

• Removing oxygen. Another method is to shut off the supply of air or oxygen by smothering fires with foam or water fog, or by using carbon dioxide or nitrogen to displace air in enclosed spaces.

• Cooling. Water fog, mist or spray and carbon dioxide may be used to extinguish certain petroleum product fires by cooling the temperature of the fire below the product’s ignition temperature and by stopping vapours from forming and mixing with air.

• Interrupting combustion. Chemicals such as dry powders and halon extinguish fires by interrupting the chemical reaction of the fire.

Storage tank fire protection

Storage tank fire protection and prevention is a specialized science which depends on the interrelationship of tank type, condition and size; product and amount stored in the tank; tank spacing, dyking and drainage; facility fire protection and response capabilities; outside assistance; and company philosophy, industry standards and government regulations. Storage tank fires may be easy or very difficult to control and extinguish, depending primarily on whether the fire is detected and attacked during its initial inception. Storage tank operators should refer to the numerous recommended practices and standards developed by organizations such as the American Petroleum Institute (API) and the US National Fire Protection Association (NFPA), which cover storage tank fire prevention and protection in great detail.

If open-top floating roof storage tanks are out of round or if the seals are worn or not tight against the tank shells, vapours can escape and mix with air, forming flammable mixtures. In such situations, when lightning strikes, fires may occur at the point where the roof seals meet the shell of the tank. If detected early, small seal fires can often be extinguished by a hand-carried dry powder extinguisher or with foam applied from a foam hose or foam system.

If a seal fire cannot be controlled with hand extinguishers or hose streams, or if a large fire is in progress, foam may be applied onto the roof through fixed or semi-fixed systems or by large foam monitors. Precautions are necessary when applying foam onto the roofs of floating roof tanks; if too much weight is placed on the roof, it may tilt or sink, allowing a large surface area of product to be exposed and become involved in the fire. Foam dams are used on floating roof tanks to trap foam in the area between the seals and the tank shell. As the foam settles, water drains out under the foam dams and should be removed through the tank roof drain system to avoid overweighing and sinking the roof.

Depending on government regulations and company policy, storage tanks may be provided with fixed or semi-fixed foam systems which include: piping to the tanks, foam risers and foam chambers on the tanks; subsurface injection piping and nozzles inside the bottom of tanks; and distribution piping and foam dams on the tops of tanks.With fixed systems, foam-water solutions are generated in centrally located foam houses and pumped to the tank through a piping system. Semi-fixed foam systems typically use portable foam tanks, foam generators and pumps which are brought to the tank involved, connected to a water supply and connected to the tank’s foam piping.

Water-foam solutions may also be centrally generated and distributed within the facility through a system of piping and hydrants, and hoses would be used to connect the nearest hydrant to the tank’s semi-fixed foam system. Where tanks are not provided with fixed or semi-fixed foam systems, foam may be applied onto the tops of tanks, using foam monitors, fire hoses and nozzles. Regardless of the method of application, in order to control a fully involved tank fire, a specific amount of foam must be applied using special techniques at a specific concentration and rate of flow for a minimum amount of time depending primarily on the size of the tank, the product involved and the surface area of the fire. If there is not enough foam concentrate available to meet the required application criteria, the possibility of control or extinguishment is minimal.

Only trained and knowledgeable fire-fighters should be allowed to use water to fight liquid petroleum tank fires. Instantaneous eruptions, or boil-overs, can occur when water turns into steam upon direct application onto tank fires involving crude or heavy petroleum products. As water is heavier than most hydrocarbon fuels, it will sink to the bottom of a tank and, if enough is applied, fill the tank and push the burning product up and over the top of the tank.

Water is typically used to control or extinguish spill fires around the outside of tanks so that valves can be operated to control product flow, to cool the sides of involved tanks to prevent boiling liquid–expanding vapour explosions (BLEVEs—see the section “Fire hazards of LHGs” below) and to reduce the effect of heat and flame impingement on adjacent tanks and equipment. Because of the need for specialized training, materials and equipment, rather than allow employees to attempt to extinguish tank fires, many terminals and bulk plants have established a policy to remove as much product as possible from the involved tank, protect adjacent structures from heat and flame and allow the remaining product in the tank to burn under controlled conditions until the fire burns out.

Terminal and bulk plant health and safety

Storage tank foundations, supports and piping should be regularly inspected for corrosion, erosion, settling or other visible damage to prevent loss or degradation of product. Tank pressure/vacuum valves, seals and shields, vents, foam chambers, roof drains, water draw-off valves and overfill detection devices should be inspected, tested and maintained on a regular schedule, including removal of ice in the winter. Where flame arrestors are installed on tank vents or in vapour recovery lines, they have to be inspected and cleaned regularly and kept free of frost in the winter to ensure proper operation. Valves on tank outlets which close automatically in case of fire or drop in pressure should be checked for operability.

Dyke surfaces should drain or slope away from tanks, pumps and piping to remove any spilled or released product to a safe area. Dyke walls should be maintained in good condition, with drain valves kept closed except when draining water and dyke areas excavated as needed to maintain design capacity. Stairways, ramps, ladders, platforms and railings to loading racks, dykes and tanks should be maintained in a safe condition, free of ice, snow and oil. Leaking tanks and piping should be repaired as soon as possible. The use of victaulic or similar couplings on piping within dyked areas which could be exposed to heat should be discouraged to prevent lines from opening during fires.

Safety procedures and safe work practices should be established and implemented, and training or education provided, so that terminal and bulk plant operators, maintenance personnel, tank truck drivers and contractor personnel can work safely. These should include, as a minimum, information concerning the basics of hydrocarbon fire ignition, control and extinguishment; hazards and protection from exposures to toxic substances such as hydrogen sulphide and polynuclear aromatics in crude oil and residual fuels, benzene in gasoline and additives such as tetraethyl lead and methyl-tert-butyl ether (MTBE); emergency response actions; and normal physical and climatic hazards associated with this activity.

Asbestos or other insulation may be present in the facility as protection for tanks and piping. Appropriate safe-work and personal protective measures should be established and followed for handling, removing and disposing of such materials.

Environmental protection

Terminal operators and employees should be aware of and comply with government regulations and company policies covering environmental protection of ground and surface water, soil and air from pollution by petroleum liquids and vapours, and for handling and removing hazardous waste.

• Water contamination. Many terminals have oil/water separators to handle contaminated water from tank containment areas, run-off from loading racks and parking areas and water drained from tanks and open-top tank roofs. Terminals may be required to meet established water quality standards and obtain permits before discharging water.

• Air pollution. Air pollution prevention includes minimizing releases of vapours from valves and vents. Vapour recovery units collect vapours from loading racks and marine docks, even when tanks are vented prior to entry. These vapours are either processed and returned to storage as liquids or burned.

• Spills on land and water. Government agencies and companies may require that oil storage facilities have spill prevention control and counter-measure plans, and that personnel be trained and aware of the potential hazards, notifications to be made and the actions to take in case of a spill or release. In addition to handling spills within the terminal facility, personnel are often trained and equipped to respond to offsite emergencies, such as a tank truck rollover.

• Sewage and hazardous waste. Terminals may be required to meet regulatory requirements and obtain permits for discharge of sewage and oily waste to public or privately owned treatment works. Various government requirements and company procedures may apply to the onsite storage and handling of hazardous waste such as asbestos insulation, tank cleaning residue and contaminated product. Workers should be trained in this activity and be made aware of the potential hazards from exposures which could occur.

LHG Storage and Handling

Bulk storage tanks

LHGs are stored in large bulk storage tanks at the point of process (gas and oil fields, gas plants and refineries) and at the point of distribution to the consumer (terminals and bulk plants). The two most commonly used methods of bulk storage of LHGs are:

• Under high pressure at ambient temperature. LHG is stored in steel pressure tanks (at 1.6 to 1.8 mPa) or in underground impermeable rock or salt formations.

• Under pressure close to atmospheric at low temperature. LHG is stored in thin-walled, heat-insulated steel storage tanks; in reinforced concrete tanks above and below ground; and in underground cryogenic storage tanks. Pressure is maintained close to atmospheric (0.005 to 0.007 mPa) at a temperature of –160°C for LNG stored in cryogenic underground storage tanks.

LPG bulk storage vessels are either cylindrically (bullet) shaped horizontal tanks (40 to 200 m³) or spheres (up to 8,000 m³). Refrigerated storage is typical for storage in excess of 2,400 m³. Both horizontal tanks, which are fabricated in shops and transported to the storage site, and spheres, which are built onsite, are designed and constructed in accordance with rigid specifications, codes and standards.

The design pressure of storage tanks should not be less than the vapour pressure of the LHG to be stored at the maximum service temperature. Tanks for propane-butane mixtures should be designed for 100% propane pressure. Consideration should be given to additional pressure requirements resulting from the hydrostatic head of the product at maximum fill and the partial pressure of non-condensible gases in the vapour space. Ideally, liquefied hydrocarbon gas storage vessels should be designed for full vacuum. If not, vacuum relief valves must be provided. Design features should also include pressure relief devices, liquid level gauges, pressure and temperature gauges, internal shut-off valves, back flow preventers and excess flow check valves. Emergency fail-safe shut-down valves and high level signals may also be provided.

Horizontal tanks are either installed aboveground, placed on mounds or buried underground, typically downwind from any existing or potential sources of ignition. If the end of a horizontal tank ruptures from over-pressurization, the shell will be propelled in the direction of the other end. Therefore, it is prudent to place an aboveground tank so that its length is parallel to any important structure (and so that neither end points toward any important structure or equipment). Other factors include tank spacing, location, and fire prevention and protection. Codes and regulations specify minimum horizontal distances between pressurized liquefied hydrocarbon gas storage vessels and adjoining properties, tanks and important structures as well as potential sources of ignition, including processes, flares, heaters, power transmission lines and transformers, loading and unloading facilities, internal combustion engines and gas turbines.

Drainage and spill containment are important considerations in designing and maintaining liquid hydrocarbon gas tank storage areas in order to direct spills to a location where they will minimize risk to the facility and surrounding areas. Dyking and impounding may be used where spills present a potential hazard to other facilities or to the public. Storage tanks are not usually dyked, but the ground is graded so that vapours and liquids do not collect underneath or around the storage tanks, in order to keep burning spills from impinging upon storage tanks.

Cylinders

LHGs for use by consumers, either LNG or LPG, are stored in cylinders at temperatures above their boiling points at normal temperature and pressure. All LNG and LPG cylinders are provided with protective collars, safety valves and valve caps. The basic types of consumer cylinders in use are:

• vapour withdrawal (1/2 to 50 kg) cylinders used by consumers, with larger ones usually refillable on an exchange basis with the supplier

• liquid withdrawal cylinders for dispensing into small consumer-owned refillable cylinders

• motor vehicle fuel cylinders, including vehicle cylinders (40 kg) permanently installed as fuel tanks on motor vehicles and filled and used in the horizontal position, and industrial truck cylinders designed to be stored, filled and handled in the upright position, but used in the horizontal position.

Properties of hydrocarbon gases

According to the NFPA, flammable (combustible) gases are those which burn in the normal concentrations of oxygen in air. The burning of flammable gases is similar to flammable hydrocarbon liquid vapours, as a specific ignition temperature is needed to initiate the burning reaction, and each will burn only within a certain defined range of gas-air mixtures. Flammable liquids have a flashpoint, which is the temperature (always below the boiling point) at which they emit sufficient vapours for combustion. There is no apparent flashpoint for flammable gases, since they are normally at temperatures above their boiling points, even when liquefied, and are therefore always at temperatures well in excess of their flashpoints.

The NFPA (1976) defines compressed and liquefied gases as follows:

• “Compressed gases are those which at all normal atmospheric temperatures inside their containers, exist solely in the gaseous state under pressure.”

• “Liquefied gases are those which at normal atmospheric temperatures inside their containers, exist partly in the liquid state and partly in the gaseous state, and are under pressure as long as any liquid remains in the container.”

The major factor which determines the pressure inside the vessel is the temperature of the liquid stored. When exposed to the atmosphere, the liquefied gas very rapidly vaporizes, travelling along the ground or water surface unless dispersed into the air by wind or mechanical air movement. At normal atmospheric temperatures, about one-third of the liquid in the container will vaporize.

Flammable gases are further classified as fuel gas and industrial gas. Fuel gases, including natural gas (methane) and LPGs (propane and butane), are burned with air to produce heat in ovens, furnaces, water heaters and boilers. Flammable industrial gases, such as acetylene, are used in processing, welding, cutting and heat-treating operations. The differences in combustion properties of LNG and LPGs are shown in table 1.

Table 1. Typical approximate combustion properties of liquified hydrocarbon gases.

Safety hazards of LPG and LNG

The safety hazards applicable to all LHGs are associated with flammability, chemical reactivity, temperature and pressure. The most serious hazard with LHGs is the unplanned release from containers (canisters or tanks) and contact with an ignition source. Release can occur by failure of the container or valves for a variety of reasons, such as overfilling a container or from overpressure venting when the gas expands due to heating.

The liquid phase of LPG has a high coefficient of expansion, with liquid propane expanding 16 times and liquid butane 11 times as much as water with the same rise in temperature. This property must be considered when filling containers, as free space must be left for the vapour phase. The correct quantity to be filled is determined by a number of variables, including the nature of the liquefied gas, temperature at time of filling and expected ambient temperatures, size, type (insulated or uninsulated) and location of container (above or below ground). Codes and regulations establish allowable quantities, known as “filling densities”, which are specific for individual gases or families of similar gases. Filling densities may be expressed by weight, which are absolute values, or by liquid volume, which must always be temperature corrected.

The maximum amount that LPG pressure containers should be filled with liquid is 85% at 40 ºC (less at higher temperatures). Because LNG is stored under low temperatures, LNG containers may be liquid filled from 90% to 95%. All containers are provided with overpressure relief devices which normally discharge at pressures relating to liquid temperatures above normal atmospheric temperatures. As these valves cannot reduce the internal pressure to atmospheric, the liquid will always be at a temperature above its normal boiling point. Pure compressed and liquefied hydrocarbon gases are non-corrosive to steel and most copper alloys. However, corrosion can be a serious problem when sulphur compounds and impurities are present in the gas.

LPGs are 1-1/2 to 2 times heavier than air and, when released in air, tend to quickly disperse along the ground or water surface and collect in low areas. However, as soon as the vapour is diluted by air and forms a flammable mixture, its density is essentially the same as air, and it disperses differently. Wind will significantly reduce the dispersion distance for any size of leak. LNG vapours react differently from LPG. Because natural gas has a low vapour density (0.6), it will mix and disperse rapidly in open air, reducing the chance of forming a flammable mixture with air. Natural gas will collect in enclosed spaces and form vapour clouds which could be ignited. Figure 4 indicates how a liquefied natural gas vapour cloud spreads downwind in different spill situations.

Figure 4. Extension of LNG vapour cloud downwind from different spills (wind speed 8.05 km/h).

Although LHG is colourless, when released in air its vapours will be noticeable due to the condensation and freezing of water vapour contained in the atmosphere which is contacted by the vapour. This may not occur if the vapour is near ambient temperature and its pressure is relatively low. Instruments are available which can detect the presence of leaking LHG and signal an alarm at levels as low as 15 to 20% of the lower flammable limit (LFL). These devices may also stop all operations and activate suppression systems, should the concentrations of gas reach 40 to 50% of the LFL. Some industrial operations provide forced ventilation to keep leaking fuel-air concentrations below the lower flammable limit. Heater and furnace burners may also have devices which automatically stop the flow of gas if the flame is extinguished.

LHG leakage from tanks and containers may be minimized by the use of limiting and flow control devices. When decompressed and released, LHG will flow out of containers with a low negative pressure and low temperature. The auto refrigeration temperature of the product at the lower pressure must be considered when selecting materials of construction for containers and valves, to prevent metal embrittlement followed by rupture or failure due to exposure to low temperatures.

LHG can contain water in both its liquid and gaseous phases. Water vapour can saturate gas in a specific amount at a given temperature and pressure. If the temperature or pressure changes, or the water vapour content exceeds the evaporation limits, the water condenses. This can create ice plugs in valves and regulators and form hydrocarbon hydrate crystals in pipelines, devices and other apparatus. These hydrates can be decomposed by heating the gas, lowering the gas pressure or introducing materials, such as methanol, which reduce the water vapour pressure.

There are differences in the characteristics of compressed and liquefied gases which must be considered from safety, health and fire aspects. As an example, the differences in the characteristics of compressed natural gas and LNG are illustrated in table 2.

Table 2. Comparison of characteristics of compressed and liquified gas.

Health hazards of LHGs

The primary occupational injury concern in handling LHGs is the potential hazard of frostbite to the skin and eyes from contact with liquid during handling and storage activities including sampling, measuring, filling, receiving and delivery. As with other fuel gases, when improperly burned, compressed and liquefied hydrocarbon gases will emit undesirable levels of carbon monoxide.

Under atmospheric pressures and low concentrations, compressed and liquefied hydrocarbon gases are normally non-toxic, but they are asphyxiants—they will displace oxygen (air) if released in enclosed or confined spaces. Compressed and liquefied hydrocarbon gases may be toxic if they contain sulphur compounds, especially hydrogen sulphide. Because LHGs are colourless and odourless, safeguards include adding odourants, such as mercaptans, to consumer fuel gases to aid in leak detection. Safe work practices should be implemented to protect workers from exposure to mercaptans and other additives during storage and injection. Exposure to LPG vapours in concentrations at or above the LFL may cause a general central nervous system depression similar to anaesthesia gases or intoxicants.

Fire hazards of LHGs

Failure of liquefied gas (LNG and LPG) containers constitutes a more severe hazard than failure of compressed gas containers, as they release greater quantities of gas. When heated, liquefied gases react differently from compressed gases, because they are two-phase (liquid-vapour) products. As the temperature rises, the vapour pressure of the liquid is increased, resulting in increased pressure inside the container. The vapour phase first expands, followed by expansion of the liquid, which then compresses the vapour. The design pressure for LHG vessels is therefore assumed to be near that of the gas pressure at maximum possible ambient temperature.

When a liquefied gas container is exposed to fire, a serious condition can occur if the metal in the vapour space is allowed to heat. Unlike the liquid phase, the vapour phase absorbs little heat. This allows the metal to heat rapidly until a critical point is reached at which an instantaneous, catastrophic explosive failure of the container occurs. This phenomenon is known as a BLEVE. The magnitude of a BLEVE depends on the amount of liquid vaporizing when the container fails, the size of the pieces of exploded container, the distance they travel and the areas they impact. Uninsulated LPG containers may be protected against a BLEVE by applying cooling water to those areas of the container which are in the vapour phase (not in contact with LPG).

Other more common fire hazards associated with compressed and liquefied hydrocarbon gases include electrostatic discharge, combustion explosions, large open-air explosions and small leaks from pump seals, containers, valves, pipes, hoses and connections.

• Electrostatic charges may be generated when LHG is shipped in pipelines, when loaded and unloaded, in blending and filtering and during tank cleaning.

• Combustion explosions result when escaping gas or vapour is contained in a confined space or structure and combines with air to create a flammable mixture. When this flammable mixture contacts a source of ignition, it burns instantaneously and rapidly, producing extreme heat. The very hot air expands quickly, causing a considerable rise in pressure. If the space or structure is not strong enough to contain this pressure, a combustion explosion occurs.

• Flammable gas fires result when there is no confinement of the escaping gas or vapours, or ignition occurs when only a small amount of gas has been released.

• Large open-air explosions occur when a massive failure of a container releases a large vapour cloud of gas which is ignited before it disperses.

Controlling sources of ignition in hazardous areas is essential for the safe handling of compressed and liquefied hydrocarbon gases. This may be accomplished by establishing a permit system to authorize and control hot work, smoking, operation of motor vehicles or other internal combustion engines, and the use of open flames in areas where compressed and liquefied hydrocarbon gas is transported, stored and handled. Other safeguards include the use of properly classified electrical equipment and bonding and grounding systems to neutralize and dissipate static electricity.

The best means of reducing the fire hazard of leaking compressed or liquefied hydrocarbon gas is to stop the release, or shut off the flow of product, if possible. Although most LHGs will vaporize upon contact with air, lower vapour pressure LPGs, such as butane, and even some higher vapour pressure LPGs, such as propane, will pool if ambient temperatures are low. Water should not be applied to these pools, as it will create turbulence and increase the rate of vaporization. Vaporization from pool spills can be controlled by the careful application of foam. Water, if correctly applied against a leaking valve or small rupture, can freeze upon contact with the cold LHG and block the leak. LHG fires require controlling heat impingement upon storage tanks and containers by the application of cooling water. While compressed and liquefied hydrocarbon gas fires can be extinguished by the use of water spray and dry powder extinguishers, it is often more prudent to allow controlled burning so that a combustible explosive vapour cloud does not form and re-ignite should the gas continue to escape after the fire is extinguished.

Back