Environment

and Safety
S. ZARDYNEZHAD, Contributing Writer,
Calgary, Alberta, Canada

Design atmospheric aboveground storage tanks

for accident prevention
The design and construction of oil, gas and petrochemical To be considered “competent” to perform design activities
facilities is continuously improving, as increasing compliance and tasks, designers must be qualified, trained and experienced.
with ever-changing codes and standards, such as the American They should understand codes, standards and regulations, and
Petroleum Institute (API) and the National Fire Protection interpret them correctly. Designers should participate in the
Association (NFPA), is resulting in fewer atmospheric above- identification of the project’s technical risks related to AAST
ground storage tank (AAST) accidents. design and plant layout. TABLE 1 shows modified input, tools and
The frequency of tank accidents has decreased with better techniques, and output for identifying risks related to AAST de-
design considerations and improved inspection, operation and sign activities,1 with some modifications.
maintenance activities, but fires and other incidents still occur. Incorrect roof selection for an AAST can be a potential cause
Due to the size of most AASTs, fire accidents involving large of fire. According to a study of 242 AAST accidents that oc-
AASTs carry increased consequences in terms of cost, property curred in industrial facilities over a 40-yr period (1960–2003),
damage, health, safety and environmental impacts, the inter- the external floating roof tank (EFRT) was the most frequent
ruption of operations and damaged public opinion. The fol- type of roof that experienced fire, followed by the atmospheric
lowing will review some main causes of fires or other types of cone fixed-roof tank.2
accidents, and discuss AAST design requirements that impact
safe and reliable tank operation. In addition, accident preven- Roof selection. Fixed-cone/dome-roof storage tanks include
tion methods will be detailed. vent nozzles to atmosphere that normally allow the tank to
AASTs are used to store or mix/blend flammable and com- breathe during loading, unloading and temperature changes.
bustible liquids in various ways, and may also be used for crys- Vent fires are typically related to fixed-roof tanks, such as cone/
tallization, phase separation and heat exchange. Each year, dome and internal floating roof tanks (IFRTs). The main cause
numerous AAST fires or other types of accidents occur in the of fire is a lightning strike that can ignite fugitive vapors that
US and around the world, despite different and updated stud- might be present at the vent. Depending on the location of the
ies and techniques—such as risk studies, hazard and operability tanks in the plant and their proximity to the local community,
(HAZOP) studies, failure mode effects analysis (FMEA), etc.—
that have been conducted during design or operation stages. Sizing and range
of liquids
Many factors must be considered during AAST sizing, se- Fire protection and Engineering and technical
lection and design to construct AASTs that are reliable for the fighting study requirements
Causes of accidents
entire service life of the plant (FIG. 1). It is important for design- (lesson learned)
Hazard identification Codes,
ers and for operations and maintenance personnel to be familiar standards,
with the causes of fires and the respective prevention methods. regulations
Material selection AAST
At first glance, it seems that the major causes of an AAST fire selection
are operational and maintenance errors, corrosion, lightning and design Environmental
Corrosion requirements
or sparks, or static electricity. All signs may indicate that these prevention
causes point to plant operators and the maintenance team. How-
Layout study Local fire department
ever, by using a detailed root cause analysis (RCA), the main Risk study/FMEA review and feedback
causes of a fire can be easily captured. For example, the generally
held belief is that the sinking of the Titanic was caused by the im- Community firefighting
pact of an iceberg. Actually, a post-tragedy RCA determined that facilities
more than 100 factors caused the great ship to sink. Poor AAST
design can trigger operation and maintenance errors, corrosion FIG. 1. Key factors that must be considered during AAST design
and selection.
or static electricity that may cause a fire or other incident.
Hydrocarbon Processing | OCTOBER 2017 77
 Environment and Safety

the vents are equipped with environmental controls and flame
arresters/diverters to capture emissions.
An EFRT comprises vertical steel cylinders with a roof that
floats on the surface of the liquid in the tank. It is open to the
atmosphere above; i.e., there is no fixed roof above the floating
roof. The risk of a fire in this type of tank is very high and prob-
able because the wetted shells are open to atmosphere when the
floating roof travels downward. In addition, any leak could re-
sult in stock on the deck, which can cause a fire. Pontoon failure
of the EFRT is another source of accident and can be caused by
several factors, including an incorrect selection of weld design.
FIG. 2 shows welding inside the pontoon, which is normally in-
complete in length. Welding outside the pontoon (FIG. 3) can-
not be done due to limited access and space between the tank
shell and outer ring of the pontoon, which is 300 mm–400 mm.
This clearance will not provide suitable access to weld the outer
ring plate to the deck plate, as shown in FIG. 4.
This design is most common in EFRTs, based on the au-
thor’s experience. To weld the outside angle between the deck
plate and the outer ring plate (FIG. 5), the design of the angle
should be modified, as shown in FIG. 6. Basically, the outer ring
plate of the pontoon is extended vertically to make a 90° angle
with the deck plate. This will allow the welder to weld the angle
from below the deck when the deck sits on supports. In FIG. 3,
the deck plate is extended horizontally rather than the outer
ring plate extending vertically, as shown in FIG. 6. The details
shown in FIGS. 3 and 5 may cause leakage of the liquid to the
pontoon and sink the roof accordingly, causing many problems
(even during hydrostatic test operations).
Rim-seal fires are the main cause of a large majority of EFRT
fires, and can occur in IFRTs, as well. Lightning is the primary
source of ignition for rim fires for EFRTs, and an induced electri-
cal charge may also spark ignition.
In addition to manual semi-fixed or fully-fixed, rim-seal fire

FIG. 2. Welding inside the pontoon is normally incomplete FIG. 3. Limited access between the tank shell and outer ring of the
in length. pontoon prohibits welding.

TABLE 1. Inputs, tools and techniques, and outputs of risk-identification processes for AAST design activities
Inputs Tools and techniques Outputs
Equipment criticality table Expert judgment Risk register
Technical document and drawing Design review
Decision criteria Information gathering techniques
FMEA for each tank Group creativity techniques
Hidden failure study Analytic hierarchy process (AHP)
Mean-time between failures (MTBF) Assumption validity analysis
Causes of accidents/lessons learned Diagnostic techniques
Technical deviations
Prototype design identification
Plant layout
Plant hazard identification/HAZOP
Plant safety philosophy
Stockholder register and analysis
Community/neighborhood study
Codes, standards and regulations

78 OCTOBER 2017 | HydrocarbonProcessing.com

protection systems, an automatic foam injection system mount-
ed on the floating roof deck in different locations should be con-
sidered to cover 360° and quickly inject foam to the rim seal.
Rim-seal fires for IFRTs are more difficult to combat compared
to EFRTs—particularly when semi-fixed or fully-fixed systems
are not considered by the designer—because the only access for
fire extinguishing is through the vents or access covers on the
fixed roof (FIG. 7).
Layout. One key aspect of AAST design is determining the best
location (for cost minimization, required safety, etc.) for the
AAST during the preparation of the plant plot plan. If a plant
is on a slope and must be designed over several terraces, design-
ers sometimes install the feed and intermediate products of
the AAST upstream of the process plant to minimize costs and
pumping power requirements. However, if the large-feed AAST
collapses due to fire, then the fire and hydrocarbon liquid may
reach the plant and create a dangerous and out-of-control situa-
tion. It is better to install the tanks downstream of the plant on
the slope—the overall plant layout should be carefully studied
on a case-by-case basis.
The surrounding areas and a suitable number of access routes
to the tank’s location have significant impacts on firefighting
activities and success. Safe distances from other process equip-
ment must be calculated. The layout and distance of the hydrant
and monitors around/to each tank should be carefully studied,
and decisions should be based on the number of tanks in each
area, wind direction, migration of fire risk to adjacent tanks, etc.
Water supply. A large volume of water is critical during AAST
firefighting operations for cooling and extinguishing purposes.
If the plant is located near the sea, connecting the main fire-wa-
ter piping system to the seawater in case of emergency is highly
recommended. Also, during the design phase, consider suitable
portable or fixed monitors around the tank to cool it evenly. Un-
even cooling of the AAST will allow the tank shell to soften and
ultimately fail where the uneven cooling was applied (FIG. 8).
The fixed cooling piping rings and associated supports in-
stalled around the tank perimeter are suitable for working under
high-temperature conditions as a result of fire, and are carefully
FIG. 4. The limited space between the tank shell and the outer ring
of the pontoon.
Environment and Safety
welded to the tank surfaces (FIG. 9). At the very least, the num-
ber of fixed cooling piping rings should cover from the top to
near the middle of the tank surface.
Tank height. Careful selection of tank height is important, as
it affects firefighting operations and productivity. Designers
prefer to reduce AAST diameter and increase the height for the
following reasons:
• To provide positive head for unloading pumps
[The AAST must always remain filled above the
“low pump-out” level (LPO) during operation,
which is a fixed distance above the bottom of the tank]
• The cost of a floating roof is proportionally higher
than that of a shell for a given tank capacity
• To reduce the bottom surface area, shorten the maximum
Outer ring plate Welding is not possible
Inner ring plate
Shell plate
Pontoon 300 mm–400 mm
FIG. 5. A method of pontoon welding design.
Outer ring plate
Inner ring plate
Shell plate
Pontoon
300 mm–400 mm
Welding is now possible from under the deck
FIG. 6. Recommended method of pontoon welding design.
FIG. 7. Automatic foam injection-deck mounted.
Hydrocarbon Processing | OCTOBER 2017 79
 Environment and Safety
distance to sump and minimize the formation of
“bird baths”
• To reduce vapor space in fixed-roof tanks
• To reduce the cost of foundation, cathodic protection,
earth work, etc.
The recommended height of an AAST is a maximum of 15
m, depending on land acquisition and cost limitations. It is im-
portant that the fire-water stream’s trajectory can reach to the
top of the tank. During a fire, obstructed full liquid surface
fires can occur in a fixed roof, EFRT and IFRT. The roof or pan
blocks access to the burning surface, and this becomes more dif-
ficult when the tank’s height is increased. If the tank height can-
not be limited at 15 m, then an elevated monitor tower should
be considered to allow fire water or foam to reach the top of the
tank for firefighting and cooling.
Open flames. Hot particles can ignite flammable vapors around
an AAST. The risk of explosion of process equipment, such as
large process towers, should be considered during plant layout,
and a safe distance should be determined following risk and other
required studies. In a fire case at a mega petrochemical plant, a
large process tower, with a height that exceeded 120 m, exploded
due to an increase of internal pressure caused by overheating. Hot
flying particles reached an EFRT that was used to store naphtha,
igniting a large fire. If the tank had been an IFRT rather than an
EFRT for this service, then the accident may not have happened.
Static electricity. Friction between two sliding or rolling parts
made of different materials or substances generates static elec-
tricity. The electrical charges on the surface of the objects bal-
ance each other by the free flow of electrons. However, when
they are separated, each part is left with an extra or shortage of
electrons, causing both parts to become electrically charged.
When the produced charges lack a rout to the ground (e.g.,
by grounding probe or wire), the charges create static electricity,
which, if not eliminated from the system, will build up and change
to a spark to a grounded part or another less highly charged part.
If a flammable or combustible vapor or dust mixture exists, as
in a hydrocarbon AAST, the result can be a fire or an explosion.
Static electricity can build up during liquid transfer and
through contact with other materials, such as when liquid is
pumped to a tank, agitated inside, stirred or transferred in pip-
ing. Designers should consider suitable designs and materials
to eliminate the risk of fire due to static electricity.
Special design considerations. Designers should remain
aware of, and plan to prevent, the following phenomena dur-
FIG. 8. Steel tank softens and fails when FIG. 9. Cooling piping supports soften.
heated. (Photo courtesy of Shana.) (Photo courtesy of Shana.)
80 OCTOBER 2017 | HydrocarbonProcessing.com
ing AAST operations: slop-over, froth-over, boil-over and py-
rophoric ignitions.
Dike designs. Dikes around the AAST serve two main purposes:
• Provide a physical barrier to prevent the spread of
tank contents if the tank overflows, or if the tank
structure fails due to corrosion or other causes
• Segregate and group tanks according to their
content classifications.
Dike types and materials (i.e., compacted earth, concrete or
other material) are carefully selected and designed. The dike’s di-
mensions (height, perimeter, etc.) are functions of the volume of
the tanks enclosed within a particular dike area. Dike design must
consider containment of the tank’s total contents, and it should be
designed according to the volume of the largest tank, plus an ad-
ditional percentage as a safety margin (FIG. 10). The dike’s waste
and rainwater drain piping system should be furnished with a
suitable gate valve located safely outside the dike area: that valve
should be normally closed with a proper locking device. Equip-
ment, lighting towers, transformers, etc., should also be installed
outside the dike area, and all openings on the dike walls should be
carefully and completely sealed by proper materials.
Emergency pumpouts. During firefighting, it is sometimes
necessary to decrease the volume or level of flammable and com-
bustible liquid inside the tank as quickly as possible, particularly
for floating-roof tanks where decks or pans block access to the
burning surface. Eliminating combustible material greatly as-
sists firefighting efforts. Designers should check the capacity of
tank unloading pumps—particularly large tanks—and consider
proper margins that allow higher flowrates when needed, such
as using variable frequency drives (VFD) and parallel opera-
tions. The temperature of the tank’s contents during a fire will be
increased, and designers should consider this when considering
materials and pump seal selections, as well as the transfer of hot
liquid to other tanks during the fire. However, when the prod-
uct is removed from the tank that is on fire, air is drawn into the
vapor space as liquid is removed, creating a hazard and bringing
more oxygen into the tank. This must also be considered.
Roof plate joint designs. The details of fixed-roof AAST
joints (including the fixed roof for an IFRT) are shown in
In the author’s opinion, this joint design is unsuitable
FIG. 11.3
because the vapor inside the tank can be diffused and trapped
between the gap of two roof plates (e.g., A and B) and condensed
by changing the ambient temperature or roof plate temperature.
This configuration helps sever the corrosion condition that
can happen between the two plates when
the vapor contains a corrosive element
(e.g., the high sulfur content in gasoil).
As the author was inspecting a gasoil
tank in an oil refinery with a high sulfur
content run for 30 yr, part of the roof be-
neath his feet broke. A detailed root study
showed high corrosion in the gap between
the two plates. An alternative to prevent
trapped vapor in the gap is to install plate
A on plate B, and plate C below plate B,
and so on. This configuration causes the

condensed vapor to be drained from the gap between the roof
plates. This is not in compliance with API 650 (11th Ed.) and
should not be used without API and designer approval. How-
ever, the author believes that this alternative supplements the
standard design where highly corrosive vapor exists.
Frangible roof joint designs. Clause 5.10.2.6 of API 650
(11th Ed.) allows a frangible roof joint design for fixed-roof
AASTs, after securing purchaser approval. This is not a man-
datory requirement as per API 650, but rather a recommended
practice for emergency venting. (This causes the roof-to-shell
joint of the tank to fail before the shell-to-bottom plate or an-
nular plates in the event of excess internal pressure, preventing
tank collapse and catastrophic failure.) In this case, the design
pressure is limited to the equivalent pressure of the dead weight
of the roof plates, including structural rafters.
The designer should explain this API 650 requirement and
its respective advantages to the purchaser. If the frangible joint
is designed and fabricated carefully, the roof will only be sepa-
rated, causing a “fish mouth” opening and not rocketing the roof
into the air.
Brittle fractures. Knowing the type and range of fluid, operat-
ing temperature, design life, geographic location and minimum
design metal temperature (MDMT) for the plates is important.
MDMT defines which grade of steel is necessary to prevent
brittle fracture, and is the basis for establishing the required
toughness for the selected steel.
The susceptibility of the material to brittle fracture—the
tensile failure of a material showing little deformation or yield-
ing—is one of the most important material selection consider-
ations for an AAST. Literature provides evidence regarding tank
failure due to brittle fracture, even during hydrostatic tests.4
The designer should be aware of two ways to ensure that se-
lected steel for an AAST has adequate toughness for the tank’s
MDMT. The first is to proof-test each plate by impact tough-
ness testing samples at or below the MDMT (e.g., using the
Charpy V-notch method). The second method is purchasing a
material with adequate toughness (preferably one with a “tran-
sition temperature” that is below the MDMT), eliminating the
need for expensive impact testing, which can add 5%–10% to
the cost of the plate.
Older codes, along with some newer codes, do not have
toughness requirements, such as the API 12 series standards
and the Underwriters Laboratories (UL) tank standards. API
650 has clearly defined a basis for impact testing and toughness
requirements of the plates in clauses 4.2.8 and 4.2.9, as briefly
explained in FIG. 12 for plate material of A 283-C (Group 1) and
an MDMT of 14°F (–10°C).
The best practice for selecting steel for tank construction is
to use steel above its ductile-to-brittle transition temperature.
This helps ensure that the steel has adequate toughness for the
temperature conditions at the specified geographical location.
Corrosion allowance. The designer should clearly define the
corrosion allowance for AAST components to meet both eco-
nomic and safety requirements. Normally, 1.5 mm is the mini-
mum thickness for the shell, and 0.75 mm for the roof. However,
based on the water/corrosive elements content and the water
Environment and Safety
level, different shell courses may have different corrosion allow-
ances. The corrosion allowances for removable parts, such as pipe
spools, and permanently welded parts, such as columns, should
be considered. The roof structure may also require a corrosion
allowance, particularly if the service and vapor are corrosive.
Column design. The following example illustrates the design
of columns. A project has two aboveground atmospheric AASTs
with IFRTs, each with a diameter of 70 m and a height of 15 m.
Each AAST is being designed by a different engineer. One en-
gineer considers a fixed dome roof with 130 columns of 6 in. to
12 in., and the other is designing a dome roof without columns
and with a self-supported roof. Both meet code requirements
in terms of roof stability and strength. The fixed-roof columns
pose the following disadvantages:
• They must penetrate into the floating roof/pan,
causing vapor or liquid leakage from the opening and
requiring extra costs for sealing around the opening.
• They occupy the volume of the tank.
• They require inspection during operation and extra cost
for scaffolding.
• Corrosion may occur on the surfaces of the columns.
• They need adjustment and added shims after a field
hydrostatic test to prevent roof damage due to foundation
settlement.
• They increase the cost of the project.
• They may obstruct future inspections of the bottom, roof
plates and respective welds.
It is recommended to minimize the number of columns for
the AAST and, preferably, design the tank without the column.
Nozzle stress relief. API 650 (clauses 5.7.4.2 and 5.7.4.3) re-
quires post-weld heat treatment (PWHT) for all nozzle open-
ings of 12 in. and larger that are fabricated in a certain shell ma-
terial group. API requires that nozzle openings are prefabricated
into the shell plate or thickened insert plate, and that the pre-
fabricated assembly is thermally stress relieved together prior
to installation. In the author’s experience, most contractors and
vendors prefer to install nozzles in the field, do local PWHT
and request a deviation to API 650, as they normally erect and
weld the shell plates onsite without the nozzles to accelerate
construction activity.
FIG. 10. Common dike for several AASTs.
Plate C
Plate B
Plate A No seal weld; vapor/gas can enter
between plates and condense by
Roof-plate joint temperature change
FIG. 11. Roof-plate joint as per Figure 5-3A of API 650.
Hydrocarbon Processing | OCTOBER 2017 81
 Environment and Safety

Average value of
3 nos test < 41 J Reject
Thk. > 9-mm Impact test Table 4-4
Figure 4-1 is required
A 283-C Average value of
MDMT = –10°C 3 nos test > = 41 J
Thk. < = 9-mm Impact test Table 4-4
Figure 4-1 is not required

One value of 3 nos

test < 20 J and > = 2/3 Accepted
(20J) = 13.3 J
(4.2.8.3 and Table 4-4) All of 3 nos test
> = 20 J (4.2.8.3 Accepted
Two values of 3 nos and Table 4-4)
test < 20 J and > = 2/3 Reject, re-test
(20J) = 13.3 J new 3 nos
(4.2.8.3 and Table 4-4) specimens (4.2.8.3) One value of 3 nos
> = 20 J (4.2.8.3 Reject
One value of and Table 4-4)
3 nos test > = 2/3
(20J) = 13.3 J
(4.2.8.3 and Table 4-4)

FIG. 12. Example of impact test chart according to API 650.4

to remove a larger portion of the shell, weld the nozzle into a

new plate, conduct a PWHT, butt-weld the inserted assembly
into the shell and then weld a re-pad onto it. This requirement
is unclear and must be addressed by API in detail.

Takeaways. Many studies have been conducted regarding the

FIG. 13. Nozzle to inserted plate assembly.
However, API does not allow local stress relief of a nozzle
after it has been welded into the shell plate. A designer cannot
accept this deviation because, as FIG. 13 shows, the local stress
relief in the field cannot be conducted for a nozzle-to-shell weld
(Point 1). However, it can be done for a flange-to-pipe weld
(Point 2). Schedule and cost are not valid reasons for deviating
from codes, standards and regulations.
The requirement is clear for a new AAST, but, when API 653
is used regarding nozzle replacement of an existing tank, the
PWHT requirement refers to API 650. For an existing tank that
requires a shell nozzle replacement for any reason, it is required
causes of accidents (mainly fires) on AASTs in oil, gas and pet-
rochemical facilities. Fishbone diagrams are used to categorize
and list causes and sub-causes in groups such as operational er-
ror, lighting, static electricity, tank crack/rupture, maintenance
errors and others. However, design is rarely reviewed and ad-
dressed—it is assumed that, if the design is based on API and
other standards, then it meets all technical requirements and
the designer’s job is completed. It should be noted that stan-
dards, codes and regulations only cover the minimum (and not
all) technical requirements. Most tank accidents could have
been avoided if good engineering practice in design had been
implemented and executed.
LITERATURE CITED
1
“A Guide to the Project Management Body of Knowledge: PMBOK Guide,”
Project Management Institute Inc., 5th Ed., January 2013.
2
Chang J. and C.-C. Lin, “A study of storage tank accidents,” Journal of Loss
Prevention in the Process Industries, December 2004.
3
“Welded steel tanks for oil storage,” American Petroleum Institute, API 650, 11th
Ed., Figure 5-3A, June 2007.
4
“Design and construction of large, welded, low-pressure storage tanks,” American
Petroleum Institute, API 620, 11th Ed., January 2008.
SHAHAB ZARDYNEZHAD is an Alberta-based Registered Senior
Mechanical Equipment Engineer with 25 yr of experience
working on many of the world’s largest oil, gas and
petrochemical projects. His areas of specialization and industrial
experience include the engineering, design, procurement,
inspection, installation, startup, maintenance and
troubleshooting of AASTs. He holds a BS degree in mechanical
engineering from the University of Petroleum, an MS degree in industrial
engineering from the Iran University of Science & Technology (IUST),
and an MEng degree in project management from the University of Calgary.

82 OCTOBER 2017 | HydrocarbonProcessing.com