REVIEW OF FAILURES, CAUSES & CONSEQUENCES IN THE BULK STORAGE INDUSTRY

REVIEW OF FAILURES, CAUSES & CONSEQUENCES
IN THE BULK STORAGE INDUSTRY

W. Atherton1 and J. W. Ash2

Liverpool John Moores University, Faculty of Technology and Environment, School of
the Built Environment, The Cherie Booth Building, Byrom Street, Liverpool L3 3AF,
UK

ABSTRACT

The cataclysmic events, which occurred at the Buncefield Oils Storage Depot in
Hertfordshire on Sunday 11th December 2005, resulted in what is widely regarded as
the largest explosion in Europe since the Second World War. This event placed the
bulk storage industry in the spotlight, raising many yet unanswered questions.
Accidents of this nature involving the catastrophic failure of tanks used for the storage
of hazardous liquids are rare, and the risk of such incidents occurring is estimated to
be low, somewhere in the region of 5 x 10–6 per tank year (Thyer et al 2002). In
contrast to this statistical approach, Michels et al (1988) adopted the view that “a tank
will fail somewhere sometime”. Causalities of such events vary; the consequences
however are ordinarily the same, incurring environmental, financial and infrastructure
losses.

A review of the various causes of failures aims to highlight the extent of the problems,
which have occurred in the bulk storage industry together with the environmental and
human impact of such incidents. Through a process of spill modelling the magnitudes
of such losses have been identified across a range of scenarios. Recent results have
indicated that the losses incurred during less dramatic modes of failure can ultimately
be significant. This gives rise to the conclusion that a suitably practicable means of
mitigation has to be identified and implemented if the levels of potential risks are to
be suitably controlled.


Keywords: bulk storage, catastrophic failure, environmental impact, hazardous
liquids, risks.

INTRODUCTION

The failure of above ground atmospheric storage tanks, of which a variety of types are
in use around the world, can be liable to failure. Types include open top tanks with or
without floating roofs and closed-top tanks either with or without floating roofs.
Within the European Union (EU) the specification for the design of such tanks is
covered by BS EN 14015:2004.

The United States Environmental Protection Agency (USEPA) commissioned a study
to investigate the common sources of failure and stated that a significant factor in tank

1 E-mail: w.atherton@ljmu.ac.uk
2 E-mail: j.w.ash@ljmu.ac.uk

---

farm accidents is human error. The study covering the ten-year period (1990 - 2000)
highlighted that the number of accidents at long-term storage facilities had remained
relatively constant. Of the 312 accidents at tank farms examined in this period it was
found that operator error accounted for 22%. Additionally, 55% were attributable to
tank failure, 10% to valve failure, 4% to pump failure and 3% to bolted fitting failure.
Human error also accounted for 100% of accidents that resulted in fatalities, 88%
involving stock loss and 87% of property damage, with the root cause attributed to
overfilling/over-pressurisation (USEPA 2000).

The failure of bulk storage tanks can be attributed to a number of causes including
human error, poor maintenance, vapour ignition, differential settlement, earthquake,
lightening strike, hurricane, flood damage and over-pressurisation. Such incidents
have highlighted the need for the proper assessment of potential risks and the
requirement for suitable methods of mitigation.


MAJOR INCIDENTS

There have been numerous storage facilities around the world damaged by
earthquakes including major incidents in Alaska USA 1964, Chile in 1960, and two in
Japan, Niigata in 1964 and Tokachi in 2003. The incident in 1964 at Niigata resulted
in the loss of containment of several tanks due to damage sustained during the
earthquake, which added to the ensuing inferno and continued to burn for 13 days.
This incident highlighted several problems including that of floating roofs becoming
dislodged and jamming, with the resulting fire being attributed to sparks from the
damaged roof being shaken violently. More importantly, this was the first time that
the phenomena of liquefaction had been observed, raising concerns over the integrity
of storage tank foundations at similar coastal locations (Akatashi and kobayashi
2006).

It is estimated that lightning accounts for 61% of all accidents in storage and
processing activities, where natural events are identified as the root cause of the
incidents. In North America, 16 out of 20 accidents involving petroleum products
storage tanks were as a result of lightning strikes. Persson and Lönnormark (2004) in
a review of fires in the petroleum industry claim there have been 150 tank fires in a
52-year period as a result of lightning. Some of the more recent incidents include
Brisbane, Australia 4th June 2003, where a floating roof crude tank was struck by
lightning. Nigeria, 20th July 2002, 180000 bbl (one blue barrel is equal to 42 gallons)
were lost when fire fighters failed to gain control of a rim fire caused by a lightning
strike. Poland 5th May 2002, a 10,000m³ tank was destroyed as a result of being
struck by lightning, this was compounded by the failure of the semi-fixed fire fighting
system. Kansas, USA 21st August 2001, five tanks were destroyed in one incident
after fire spread from a tank which had been struck by lightning.

Naples, Italy 21st December 1985

During a filling operation, fuel overflowed through the roof of a floating roof tank for
almost an hour and a half. An estimated 700 tonnes of fuel escaped into the secondary
containment. The pool of liquid covered the bund area of the tank and the adjacent
pumping area, which was connected through a drain duct. The spill was followed by a
vapour cloud, which rapidly formed and ignited, the source of the ignition being a

---

pumping station. The explosion resulted in the injury of five personnel, and the
destruction of the facility. Twenty-four tanks were destroyed in the fire, together with
the failure of numerous pipelines, which contributed to the fire, and the loss of the
main fire-fighting control centre. The fire lasted for seven days (Clark et al. 2001).

Pennsylvania, USA 16th October 1995

Five workers were killed when two tanks exploded at the Pennzoil Product Company
Refinery. A welding operation was in progress on a service stairway sited between
the two waste liquid storage tanks. One tank failed along its bottom seam, the shell
being propelled vertically away from the base as a result of rapid over-pressurisation
caused by ignition of combustible vapour. The tank contents were instantly released,
igniting the contents of the second tank, this also exploded, releasing its entire
contents. There was no secondary containment surrounding these tanks and the surge
of burning liquid rapidly spread across the entire site, damaging another thirteen
storage tanks. The contents of another five other tanks were ignited, resulting in the
loss of 95,000 gallons of solvent and fuel oil (USEPA 1998).

Delaware, USA 17th July 2001

One worker was killed and eight injured, when a large sulphuric acid tank exploded.
The explosion was the result of sparks from hot work on a catwalk above one of
several tanks on the site, entering a tank through corrosion holes. Due to the
subsequent ignition of flammable vapours, the tank shell was propelled away from its
base resulting in a significant volume of sulphuric acid being released into the
environment. An estimated 660,000 gallons of acid was released, with extensive
environmental damage including a large quantity of the escaping material entering the
Delaware River killing thousands of fish and other wildlife. The operator, Motiva,
part of the Premcor refining group were ordered to pay costs of $58 million, this
included a sum of $36million to the widow and family of the employee killed in the
accident. An additional $24million was also deemed payable in fines for various
environmental violations (US Chemical Safety & Hazard Investigation Board 2002).

Belgium, 25th October 2004

A storage tank failed catastrophically releasing its entire content of 37,000m³ of crude
oil. It is estimated that only 3m³ escaped the secondary containment during this
incident, this was a result of a combination of factors. The height of the containment
dyke itself was in excess of 4m and this combined with the unusual nature of the
incident limited the extent of the losses. The mode of failure is best described, as a
jetting release and it was this directionality, which possibly prevented further losses.
One month prior to the incident a leak was detected in a neighbouring tank, which was
consequently drained to allow for maintenance. Of seven tanks within the dyke at the
time of the failure only three where in operation, the release being preceded by a low-
level alarm indicator, which identified a change in content level. The incident began
as a minor release rapidly changing to a major failure, with total loss of containment
occurring within fifteen minutes of the alarm sounding. The release from the base
was powerful enough to cause displacement and resulted in the tilting of the tank due
to erosion of the foundation.

---

Primarily, the cause was traced to the construction process with similar problems later
identified with the remaining tanks on the site. The tanks had been erected on a base
of sand with an outer annulus of compacted crushed rock acting as the foundation.
This overlaid a layer of sand and soft clay with the tank bases designed to incorporate
a ‘dome-up’ to allow run of any water. Upon initial fill, due to the soft ground
conditions, all of the tanks experienced subsidence, which resulted in deformation of
the bases. This allowed the formation of a ‘gutter’, which trapped and concentrated
moisture away from the sump pumps. In the tank that failed this ‘gutter’ was some
35m in length and 0.2m in width and resulted in severe corrosion culminating in the
breach of the primary containment (Federal Public Service – Employment, Labour and
Social dialogue 2006).

Louisiana, U.S.A. 3rd September 2005

Numerous refineries closed down production prior to Hurricane Katrina striking,
however in the wake of the hurricane several refineries reported spills, the worst being
at the Meraux Refinery operated by Murphy Oil. A crude oil storage tank holding
65,000 bbl was damaged during the storm and an estimated 25,110 bbl of oil was
released. The surrounding dyke was damaged and large quantities of oil escaped into
the local environment. The cause of the damage to the dyke is uncertain; it was either
as a direct result of the storm or due to the force of material escaping from a tank. At
least one tank was lifted and moved 10 metres away from its foundations by the
immense power of the floodwaters (Murphy Oil Corporation 2006 / USEPA 2006).

(Buncefield) Hertfordshire, U.K. 11th December 2005

A tank overfilled at an estimated rate of 550 m³ per hour for several hours overflowed
into the bund generating vast quantities of vapour. This was a result of
instrumentation failure, as high-level gauges failed to show that the tank was full.
This was the second major catastrophe in less than 10 months, where vessels had been
over-pressurised due to faulty instrumentation. In the first case the explosion and
subsequent damage occurred at the BP America Refinery, Texas, where a distillation
tower was over-pressurised during a start up operation and resulted in the loss of 15
lives with a further 170 injured (US Chemical Safety & Hazard Board ID=52 2006).
The devastation at Buncefield has been estimated at in excess of £10,000,000 in stored
materials alone, in addition to the destruction of the site itself and the effect on
surrounding businesses. The nearby industrial estate housed some 630 businesses
with at least 20 of these losing their premises, affecting the livelihood of some 500
people (Buncefield Investigation 2006).

Mississippi, U.S.A. 5th June 2006

Three contractors were killed and one was seriously injured in an explosion and fire at
an oilfield. The contractors were stood on a gantry situated above four oil production
tanks, preparing to weld piping, when it is assumed that a welding tool ignited
flammable vapours from one of the tanks (U.S. Chemical Safety & Hazard
Investigation Board ID=62 2006).

---

FAILURE MODES

Assuming the bund wall or earthen dyke remains intact in the event of a tank failure,
material will inevitably be lost due to the energy of the surge wave or jet of fluid
impacting against the secondary containment. Estimates made in the wake of actual
incidents have calculated losses to range between at least 25% and 50% of the original
contents. Research has shown that the quantity that can overflow the secondary
containment can be far greater, even when considering vertical bund walls. The losses
over earthen dykes or constructed embankments can be even higher, with such losses
having a significant impact. The capital losses can be immense, while the impact on
the environment almost immeasurable. A recent example being the damage sustained
in the outlying areas of New Orleans, where in the wake of Hurricane Katrina several
storage facilities experienced losses of containment. The most significant was
attributed to Murphy Oil in Meraux. The environmental damage sustained due to
losses from that one site, led to fines of $50,000,000 being imposed on the operator
(Murphy Oil Corporation 2006/ MSN News 2006). Murphy Oil has since agreed to
settle all additional claims at a recorded cost of $330,000,000 (Cicero 2006).

While there may be a degree of scepticism concerning the probability of a catastrophic
failure of a storage tank and the subsequent instantaneous release of the contents,
these incidents do occur, however rare. Examples such as that at Ashland 1988, Iowa
1997, Michigan 1999 and Ohio 2000, where two catastrophic failures occurred within
days of each other, clearly demonstrate the possibility of sudden tank failure. Studies
have shown that in the event of such failures the secondary containment can be of
insufficient design to withstand the impacting surge wave and associated tank debris.
This is demonstrated in the incident, which occurred at the Azotas Fertilizer Plant,
Lithuania in 1989. In this case, an Ammonia storage tank failed as a result of over-
pressurisation, the tank split open releasing its contents and subsequently the tank
separated from its foundations and crashed through the surrounding reinforced
concrete bund (Clark et al 2001).

Of possible greater significance is the structural integrity of the bund wall or earthen
dyke as a result of the dynamic pressures involved, in what would possibly be
regarded the more realistic failure modes that can be encountered. Failure, which can
occur as a result of a damaged pipe or valve connection or even the partial removal of
a small section of a tank wall, can be particularly problematic. The issue here is the
magnitude of the dynamic pressure of the fluid striking the wall, which will be much
greater than any normal static pressure, combined with the duration of the impact. In
the case of a concrete wall this could possibly result in the loss of integrity of the
structure leading to the loss of secondary containment. In the instance of an earthen
dyke, there is a high probability that the earth will be eroded away, again resulting in
the total loss of secondary containment.

Modelling of asymmetric modes of failure or ‘jetting failures’ has been undertaken
over a number of tank and bund geometries and the results to date indicate that the
levels of overtopping and the magnitudes of the dynamic pressures are significantly
high enough to cause concern. Correlations to predict overtopping due to such
failures are currently being developed and should complement the work on
axisymmetric modes of failure previously published.

---

MITIGATION MEASURES

Previous researchers have proposed modifications to the bund in order to reduce
overtopping in the event of a catastrophic failure of the primary containment (Pettit
and Waite 2003). The level of success of increasing the bund capacity is limited as
substantial volumes of fluid can still be lost with bund capacities of 200% of the initial
tank contents. The latest research has concentrated efforts on modification of the
primary containment, which may be incorporated at the design stage or fitted
retrospectively. The aim of the work being to produce a practicable method of
minimising the level of overtopping and limiting the magnitudes of the dynamic
pressures produced due to the high energy surge wave.

The basis for suitable comparisons was the data produced by Atherton (2005) and by
using the same methodology, a series of mitigation measures were modelled across a
range of suitable configurations using a range of bund capacities (110% - 200%).
Initial findings were encouraging, with large reductions in overtopping obtained
throughout the range of tank and bund arrangements used in the trials. The measures
explored varied in terms of performance and practicality and as such a programme of
optimisation was used to eliminate some of the proposed designs. The criteria for
optimisation was not necessarily focused on the best performance in terms of reduced
overtopping and dynamic pressures, but on the overall ease of build, cost of
installation and level of intrusion on the available tank volume.

The most effective design to date has been named Mitigation of Tank Instantaneous
Failure (MOTIF) and the concept has been the focus of a recent Patent application.
The system performance is impressive in terms of the reduction in both the volume of
fluid overtopping the bund and in the resulting dynamic pressures applied to the bund.
This has proven to be the case for both the axisymmetric and the initial trial
asymmetric modes of tank failure, over the range of configurations explored.

CONCLUSION

The implications of the sudden loss of primary containment are clear and the ability of
existing measures to provide suitable secondary containment is in question. Research
over the past 30 years has proven the limitations of existing measures to perform
under certain modes of tank failure and suitable estimates of risk can now be made for
various events. Attention must now be given to the possibility of such failures and the
implications for both operators and the environment.

The optimisation of MOTIF and the development of correlations relating to reduced
levels of overtopping, should give operators and other interested parties a means of
estimating the benefits of implementing the system. This will enable a cost effective,
practicable means of providing control in the event of a catastrophic failure.

One area of possible development is in the domain of simulation software, which will
make the assessment of losses based on site-specific anomalies. Geographical and
topographical information obtained from Global Information Systems (GIS) could be
used along with site and plant details, combined with a set of algorithms to produce a
suitable computer user interface. It is envisaged that such a tool would assess the
level of risk associated with various sites in the event of a major incident. This will

---

allow the extent of any spill to be modelled and permit the individual assessment of
various failure scenarios as well as permitting the evaluation of any mitigation
measures in terms of loss prevention.

REFERENCES

1. Akatashi, H. & Kobayashi, H., 2006,
http://shippai.jst.go.jp/en/Search?fn=1&dt=4 (Accessed 06/11/2006).
2. Atherton, W., 2005, An Experimental Investigation of Bund Wall Overtopping
and Dynamic pressure on the Bund Wall Following Catastrophic Failure of a
Storage Vessel, HSE Research Report 333, ISBN 0 7176 2988 0.
3. Buncefield Investigation,
http://www.buncefieldinvestigation.gov.uk/reports/index.htm


(Accessed 06/11/2006).
4. Cicero R., 2006, Andrews Publications,
http://news.findlaw.com/andrews/en/haz/20061006/20061006_turner.html
(Accessed 11/12/2006).
5. Clark, S.O. Deaves, D.M. Lines, I.G. & Henson, L.C., 2001, Effects of
Secondary Containment on Source Term Modelling, HSE Contract Research
Report 324/2001, ISBN 0 7176 1955 9.
6. Federal Public Service – Employment, Labour & Social Dialogue, 2006,
Safety Alert: Rupture of an (atmospheric) Crude Oil Storage Tank, Document
No CRC/ONG/013 – E, Version 1.
7. Michels, J. Richardson, S.M. & Sharifi, T., 1988, Catastrophic Failure of
Large Storage Tanks, I.Chem. E. Symposium series No. 110 – 1988.
8. MSN News, http://msnbc.msn.com/id/9365607 (Accessed 28/02/2006).
9. Murphy Oil Corporation, http://www.murphyoilcorp.com/im/
(Accessed 10/11/2006).
10. Persson, H. & Lönnormark, A., 2004, Tank Fires, Review of Fire Incidents
1951 – 2003, Brandsforsk Project 513-021, ISBN 91-7848-987-3.
11. Pettit, G. and Waite, P., 2003, Bund Design to Prevent Overtopping, I.Chem.
E. Symposium series No. 149 – 2003.
12. Thyer, A.M. Hirst, I.L. Jagger, S.F., 2002, Bund Overtopping – the
Consequence of Catastrophic Tank Failure, Journal of Loss Prevention in the
Process Industries – 15 (2002) 357 – 363 (Elsevier).
13. US Chemical Safety & Hazard Investigation Board, 2002, Report No 2001 –
05 – 1 – DE, Washington DC, USA.
14. US Chemical Safety & Hazard Investigation Board,
http://www.csb.gov/index.cfm?folder=completed_investigations&page=info&
INV_ID=52 (Accessed 02/10/2006).
15. US Chemical Safety & Hazard Investigation Board,
http://www.csb.gov/index.cfm?folder=completed_investigations&page=info&
INV_ID=62 (Accessed 02/10/2006).
16. USEPA, 1998, Chemical Accident Investigation Report – EPA 550-R-98-001.
17. USEPA,
http://www.epa.gov/compliance/resources/newsletters/cleanup/cleanup30.pdf


(Accessed 21/09/2006).
18. USEPA, 2000, Oil Spill Program Update, Vol3, No 2.

---