Bonus Report Safety Developments

V. RAMNATH, Aker Solutions, Pune, India

Key aspects of design and operational safety

in offsite storage terminals
The Buncefield incident in the UK and the Jaipur fire in Process safety improvement. These incidents highlight the
India stand out as major offsite storage terminal disasters in need for an exhaustive design and safety review of practices
the European and Asian regions. In the Americas, a similar while designing and operating offsite storage terminals to mini-
explosion rocked the Gulf terminal in San Juan, Puerto Rico, mize the risk of fatalities and property damage.
destroying 22 tanks and forcing the evacuation of hundreds of Process safety and risk reduction can be effectively achieved
nearby residents. by applying multiple layers of protection (FIG. 3), which are
Storage terminal accidents continue to impose considerable known in the industry as “onion layers.” Each protection layer,
costs in terms of human lives and health, property damage and when called for, can function independently to prevent or miti-
public welfare. Multiple segments of the public—particularly
citizens, citizens’ groups and the media—are likely to become
more interested in chemical safety and chemical release risk
reduction once they become aware of the potentially large con-
sequences if proper proceedures are not followed.
On December 11, 2005, at the Hertfordshire oil storage ter-
minal in Buncefield, UK, an unconfined vapor cloud explosion
(UVCE) occurred that eventually overwhelmed 20 large stor-
age tanks (FIG. 1). Fortunately, there were no fatalities; how-
ever, 60 people were injured and there was large-scale damage
and disruption to local businesses and residents.

Recent events. A major accident involving a gasoline vapor

cloud explosion followed by an ignition occurred at Indian
Oil’s petroleum, oil and lubricants (POL) terminal on October
29, 2009, in Jaipur, India (FIG. 2). Buildings in the immediate
neighborhood were heavily damaged. The effect of this acci-
dent was felt up to 2 km from the site.
FIG. 2. Fire at the Indian Oil storage terminal in Jaipur, India.

Emergency response

Mitigation layers
Embankment

Relief devices
SIS
Alarms,
operators

BPCS Prevention layers

Process

FIG. 1. Damaged tanks at the Buncefield disaster. FIG. 3. Protection layers.

Hydrocarbon Processing | MARCH 2013 71

 Safety Developments
gate the undesirable event. These protection layers have the
common goal to control and/or mitigate risk from the facility.
Broadly, these layers, as shown in FIG. 4, can be classified
into prevention and mitigation layers. The objective of the
Process safety and risk reduction can be
effectively achieved by employing multiple
layers of protection, which are known in the
industry as “onion layers.” Each protection
layer can function independently to prevent
or mitigate the undesirable event.
prevention layers is to reduce the frequency of the undesired
event; whereas, mitigation layers take action in the event of
full or partial failure of the prevention layers.
In the context of storage terminals, several key aspects can
be implemented that play a role in prevention or mitigation of
uncontrolled releases.
Prevention layers. For terminal design, engineers should:
• Ensure that the receiving tank has ultimate control of
tank filling, allowing it to safely stop or divert a transfer with-
out depending on the actions of a remote third party
• The first body valve on the tank should be a fail and fire
safe remote operated shutoff valve (ROSOV) on the tank noz-
zle inside the dike, operable remotely from outside the dike as
well as from the control room
• All other operational valves must be outside the dike area
• The piping layout inside the tank dike area should ensure
easy accessibility for any operation
• Structural design should be followed to ensure installa-
tion of sleeves to eliminate emissions from slotted guide poles
on floating roof tanks.
• Use double seal systems for floating roof tanks where ap-
propriate, based on the nature of the material being stored, the
tank size, throughputs, location considerations and meteorology
• Carry out a hazardous operations (HAZOP) study of the
facility during engineering and at decided frequencies during
operation.
Protection layers
Prevention
Process F&G system,
operation
SIS
relief system
Basic Alarms
Terminal
control
design system
FIG. 4. Classifying the layers of protection.
72MARCH 2013 | HydrocarbonProcessing.com
• Conduct a critical quantitative risk assessment (QRA) of
the facility, which should stress worst case scenarios
• Consider fuel storage terminals as hazardous locations
• The control room should be located remotely from po-
tential leak sources as is practical; the QRA will de-
termine the blast pressure structural design require-
ments for control rooms
• Water tanks and the water pump house should
be located a safe distance from potential leak sources
and the tankage area
• Locate buildings and structures in the upwind
direction
• Avoid congestion in the storage terminal area,
with the location of individual facilities determined
by the QRA
• All buildings not related to terminal operation
should be located outside the plant area, including the
canteen or any other area where sparks and open flames may exist
• When a tank storage terminal includes pipeline operations
in the same location, the control rooms for both the tank termi-
nal and pipeline division should be located in the same opera-
tional building
• Locate the emergency exit gate away from the main gate
and in a location that is always available for use
• Consider radar-level gauges as minimum instrumentation
• Leak-detection devices must be installed on the bottom
of all tanks
• Install cathodic protection to prevent deterioration of the
tanks through corrosion
• To prevent an overflow, tanks should have headspace mar-
gins that enable the filling line to be closed off in time.
For process operations, engineers should:
• Develop procedures for periodic testing of overfill pro-
tection
• Ensure effective communication within and between op-
erations, maintenance and contractors
• Standard operating procedures (SOPs) should be pre-
pared that not only give what the procedures are, but also why
they are needed.
• Regular inspections of pipelines, including thickness sur-
veys and pipeline support system analysis should be carried
out and recorded
• Closed-circuit television systems should be installed,
covering tank farm areas and other critical areas
• Near-miss reporting systems should be in place
• Collate incident data on potential failures and operation-
al failures and share the information on risks with the industry.
• Develop incident investigation mechanisms for failures
Mitigation
and safety malfunctions.
For basic control systems, engineers should:
• The control system needs to have inventory checks to
ensure that the receiving tank has adequate empty volume to
Emergency
response receive material
• Setpoints of high-level trips and alarms requiring opera-
tor action should allow sufficient time for action to be taken to
Bunds/dikes
deal with the developing situation.
For alarms, engineers should:
• High-level and high-high-level alarms should occur from
independent sensors
 When you own a
and take the recommendation of ASME, DIN, ISO and
EN into consideration to place a washer underneath the
nut to eliminate galling and great frictional variation…

HERE IS WHAT YOUR HYTORC WILL DO FOR YOU:

* Supreme Safety: You finally operate your HYTORC

without a hazardous reaction arm and backup wrench
and without holding the tool on vertical or inverted
applications
* Top Joint Reliability: You avoid joint-failure and
leakage with precise and even, circumferential joint
compression, which we guaranty
* Top Tool Reliability: You drastically improve your
HYTORC’s longevity and warranty
* Always on Time: You cut the number of passes in half
to avoid delayed startups
* Better Handling: You simplify tool handling to reduce
human error

Being # 1… is no coincidence!

www.hytorc.com Select 162 at www.HydrocarbonProcessing.com/RS

• High-level alarms should trigger facility operators to initi-
ate corrective actions, resulting in a shutdown of the pumping
system and isolation of the tank.
For safety instrumented systems (SIS), engineers should:
• The overall system for tank filling control should be of
high integrity, with sufficient independence to ensure timely
and safe shutdowns to prevent tank overflow
• When changes or modifications to an SIS are planned, the
changes should be subject to a management-of-change process
identifying and addressing any potential safety implications
from the modification
• A functional safety assessment should be performed on
each system, typically at the design stage before the system is
commissioned.
Mitigation layers. For fire and gas detection and relief sys-
tems, engineers should:
• Review the classification of places where explosive atmo-
spheres may occur and then evaluate the siting and/or protec-
tion of response facilities, such as fire fighting pumps and emer-
gency switch devices
• Apply measures to detect hazardous conditions arising
from loss of primary containment
• Install gas detectors in bunds
• The thermal safety valve should be provided at the operat-
ing manifold (outside of the dike)
• Hydrocarbon detectors need to be installed near all poten-
tial leak sources
• Install a rim-seal fire detection and protection system in all
floating roof tanks of the terminal
• Each facility needs to maintain adequate firefighting
equipment at each pump station and breakout tank area. The
equipment should be plainly marked as firefighting equipment
and located so that it is easily accessible during a fire.
For embankment, engineers should:
• Ensure secondary containment, like dikes and bunds, are
constructed from concrete and are leak-proof; the lining re-
quirements must prevent soil or ground contamination
• Install systems that prevent or limit the passage of stored
materials via drains to the normal effluent processing route.
For emergency responses, engineers should:
• Locate push buttons on motorized valves outside the dike,
where it’s easily accessible by the operator
• Terminal emergency switch devices should be located in
the control room as well as in other strategic locations
• Emergency procedures should be written and made avail-
able to all facility personnel, outlining the actions to be taken
during a major incident
• Mock drills should include the full shutdown system
activation.
• A system should exist to warn neighboring industries of
impending danger and arrangements should be made to enable
their assistance, if necessary.
VINOD RAMNATH works for Aker Solutions’ process
department in Pune, India. He has experience in the detailed
engineering of process plants, offsite design, quantitative
risk assessment, safety integrity studies and process plant
commissioning/debottlenecking. Mr. Ramnath started his
career with Reliance Industries.

Hydrocarbon Processing | MARCH 2013 73