OGP Storage Incident Frequencies

Risk Assessment Data Directory Report No. 434 – 3 March 2010

Storage incident frequencies International Association of Oil & Gas Producers

P

ublications

Global experience The International Association of Oil & Gas Producers has access to a wealth of technical knowledge and experience with its members operating around the world in many different terrains. We collate and distil this valuable knowledge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines Our overall aim is to ensure a consistent approach to training, management and best practice throughout the world. The oil and gas exploration and production industry recognises the need to develop consistent databases and records in certain fields. The OGP’s members are encouraged to use the guidelines as a starting point for their operations or to supplement their own policies and regulations which may apply locally.

Internationally recognised source of industry information Many of our guidelines have been recognised and used by international authorities and safety and environmental bodies. Requests come from governments and non-government organisations around the world as well as from non-member companies.

Disclaimer Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms. This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.

Copyright notice The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged. All other rights are reserved.” Any other use requires the prior written permission of the OGP. These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.

RADD – Storage incident frequencies

Contents: 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

1.2.1 1.2.2 1.2.3 1.2.4 1.2.5

Atmospheric Storage Tanks...................................................................................... 1 Refrigerated Storage Tank Designs ......................................................................... 2 Pressurised Storage Vessels .................................................................................... 3 Non-process Hydrocarbon Storage Offshore.......................................................... 3 Underground Storage Tanks..................................................................................... 4

2.0 2.1 2.2 2.3 2.4 2.5 2.6

Summary of Recommended Data ............................................ 4 Atmospheric Storage Tanks .......................................................................... 4 Refrigerated Storage Tanks ........................................................................... 5 Pressurised Storage Vessels......................................................................... 6 Oil Storage on FPSOs..................................................................................... 6 Non-process Hydrocarbon Storage Offshore .............................................. 6 Underground Storage Tanks ......................................................................... 7

3.0 3.1 3.2

Guidance on Use of Data ....................................................... 7 General validity ............................................................................................... 7 Uncertainties ................................................................................................... 7

4.0 4.1

Review of Data Sources ......................................................... 8 Atmospheric Storage Tanks .......................................................................... 8

4.1.1 4.1.2

Selection of Generic Value for Atmospheric Storage Tanks ................................. 8 Overfilling.................................................................................................................... 9

4.2

Refrigerated Storage Tanks ......................................................................... 10

4.2.1

Selection of Generic Value for Refrigerated Storage Tanks ................................ 10

4.3

Pressurised Storage Vessels....................................................................... 11

4.3.1 4.3.2

Accident Source Data .............................................................................................. 11 Selection of Generic Value for Pressurised Storage Vessels.............................. 12

4.4 4.5

Oil Storage on FPSOs................................................................................... 13 Non-process Hydrocarbon Storage Offshore ............................................ 13

4.5.1 4.5.2

Methanol.................................................................................................................... 14 Diesel......................................................................................................................... 14

5.0

Recommended Data Sources for Further Information ........... 15

6.0

References .......................................................................... 15

©OGP

1

RADD – Storage incident frequencies

Abbreviations: API ASME ATK BG BLEVE DNV FPSO GRI HSE IPO LNG LPG MIC OREDA QRA SRD WOAD

2

American Petroleum Institute American Society of Mechanical Engineers Aviation Turbine Kerosene British Gas Boiling liquid expanding vapour explosion Det Norske Veritas Floating Production, Storage and Offloading Unit Gas Research Institute Health & Safety Executive Interprovinciaal Overleg Liquefied Natural Gas Liquefied Petroleum Gas Methyl Isocyanate Offshore Reliability Database Quantified Risk Assessment Safety and Reliability Directorate World-wide Offshore Accident Databank

©OGP

RADD – Storage incident frequencies

1.0

Scope and Definitions

1.1

Application

This datasheet presents (Section 2.0) frequencies of releases from the following types of storage: 1. Atmospheric storage 2. Refrigerated storage 3. Pressurised storage 4. Oil storage on FPSOs 5. Non-process Hydrocarbon Storage Offshore 6. Underground storage For refrigerated storage tanks previous studies and available historical data have been reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture for different designs of refrigerated storage tanks. FPSOs typically store large quantities of crude oil in cargo oil tanks; this is periodically transferred to shuttle tankers. Only fires/explosions from the cargo oil tanks are considered, Non-process hydrocarbon storage offshore includes methanol, diesel and ATK systems together with the associated pipework. Underground storage tanks can be divided into buried or mounded storage tanks (mainly for fuels such as petrol and LPG), and excavated or leached storage caverns. Section 2.0 presents guidance how failure frequencies for buried or mounded storage tanks might be estimated.

1.2

Definitions

1.2.1

Atmospheric Storage Tanks

Atmospheric storage tanks contain liquids ambient pressure and at or near ambient temperature. They are usually fabricated from mild steel on a concrete base, surrounded by a low bund wall. They are designed to withstand an internal pressure/vacuum of 0.07 bar. The main types are [1]: •

Fixed roof tanks. These have a vapour space between the liquid surface and the tank roof. They require a vent for vapour at the top of the tank. They are subdivided by roof design: − −

•

Floating roof tanks. These have a roof that floats on the liquid surface to reduce vapour loss. The roof requires a seal around the edge against the tank walls. Types of roof design include: − − −

•

Domed roof – up to about 20 m diameter. Cone roof – up to about 76 m diameter.

Pan roof. Annular pontoon roof. Double-deck roof.

Fixed plus internal floating roof tanks. These are a combination of both types.

©OGP

1

RADD – Storage incident frequencies

In Section 2.0 failures from the tank walls are considered. Strictly, failures of associated equipment such as inlet/outlet valves, pipes within the bund and pressure relief valves should be excluded. In practice, many studies include failures at these points because available failure data often does not distinguish them clearly from failures of the tank itself. However, when considering tank ruptures and roof fires, the distinction is not important. 1.2.2

Refrigerated Storage Tank Designs

There are several different designs of refrigerated storage tank, and different failure frequencies may be applicable. The main types are [2]: •

Single containm ent tanks. These are a single primary container and generally an outer shell designed and constructed so that the primary container is required to meet the low temperature ductility requirements for storage of the product.

•

Double containm ent tanks. These are designed and constructed so that both the inner self supporting primary container and the secondary container are capable of independently containing the refrigerated liquid stored. To minimise the pool of escaping liquid, the secondary container should be located at a distance not exceeding 6m from the primary container. The primary container contains the refrigerated liquid under normal operating conditions. The secondary container is intended to contain any leakage of the refrigerated liquid, but is not intended to contain any vapour resulting from this leakage.

•

Full containm ent tanks. These are designed and constructed so that both self supporting primary container and the secondary container are capable of independently containing the refrigerated liquid stored and for one of them its vapour. The secondary container can be 1m to 2m distance from the primary container. The primary container contains the refrigerated liquid under normal operating conditions. The outer roof is supported by the secondary container. The secondary containment shall be capable both of containing the refrigerated liquid and of controlled venting of the vapour resulting from product leakage after a credible event.

•

Spherical Storage Tanks. Spherical, single containment tanks consisting of an unstiffened, sphere supported at the equator by a vertical cylinder. For onshore tanks, the lower part of the support cylinder is made of concrete and the tank is protected by a domed concrete cover. The outside of the tank and the aluminium part of the support cylinder are insulated by means of a panel system to the required thickness for the specified boil-off rate.

•

Mem brane tank. These are designed and constructed so that the primary container, constituted by a membrane, is capable of containing both the liquefied gas and its vapour under normal operating conditions and the concrete secondary container, which supports the primary container, should be capable of containing all the liquefied gas stored in the primary container and of controlled venting of the vapour resulting from product leakage of the inner tank. The vapour of the primary container is contained by a steel liner which forms with the membrane an integral gastight containment. The action of the liquefied gas acting on the primary container (the metal membrane) is transferred directly to the pre-stressed concrete secondary container through the load bearing insulation.

Underground tanks have been constructed in the past. These are typically earth pits where the ground around the pit is frozen by the cold liquid, thus providing a seal. Due to practical difficulties, this type is now rare.

2

©OGP

RADD – Storage incident frequencies

The characteristics of each type are set out in BS EN 1473.

1.2.3

Pressurised Storage Vessels

Pressurised storage tanks are considered to be storage tanks operating under pressure of at least 0.5 bar. They include a wide variety of vessels, and are categorised for the purposes of QRA (quantified risk assessment) as follows: •

•

Storage vessels – in which fluids are held under stable conditions. subdivided for this analysis into:

These are

−

Large storage vessels – spheres and bullets (long cylindrical tanks) in excess of approximately 50 m3 capacity, typically used in dedicated storage installations.

−

Medium storage vessels – fixed cylindrical tanks less than approximately 50 m3 capacity, typically used in industrial or domestic installations.

Small containers – portable cylinders and drums less than approximately 2 m3 capacity.

The main UK design code is BS 5500:1991 Specification for Unfired Fusion Welded Pressure Vessels (see [1] p12/20). It divides vessels into 3 categories. The highest standard, Category 1, requires full non-destructive testing of main seam welds. The corresponding US code is the ASME Boiler and Pressure Vessel Code, 1992. Section 2.0 covers pressure vessels and any equipment directly associated with them, i.e. nozzles and instrumentation (with associated flanges), and the inspection cover (manway). Connection points are included up to the first flange, although the flange itself is not included. Lines into and out of the vessel, and the associated flanges and valves are not included in the scope. Although the lines into and out of the vessel are not included in the scope, the actual number of lines would have an influence on the failure rate, as failures are more likely at the connection points where these lines join the vessel. Other equipment may influence the failure rate, such as relief systems being blocked. Such issues are not addressed in this datasheet but should be considered separately if appropriate, 1.2.4

Non-process Hydrocarbon Storage Offshore

The term “non-process fires” covers any fires and explosions that are not covered by the modelling of process hydrocarbon events. Most types of non-process fire involve materials other than hydrocarbons (e.g. electrical fires, chemical gas explosions). However, non process hydrocarbons such as diesel and ATK, and other hazardous materials such as methanol, are frequently stored on offshore installations in unpressurised tanks of a few m3 capacity. In the event of a leak or rupture, these materials may be ignited and so have the potential to cause a fire that could result in injury or possibly fatality. Some data are available for such systems. Although most non-process fires are very small incidents (e.g. a chip-pan fire in the galley lasting a few seconds), some have been larger causing damage and fatalities. The frequency of non-process fires may be larger than process fires, suggesting that they should not be overlooked if the risk analysis is to be comprehensive.

©OGP

3

RADD – Storage incident frequencies

1.2.5

Underground Storage Tanks

There are several types of underground storage tanks: •

Petrol filling station tanks – small buried atmospheric tanks, typically used for petrol at filling stations.

•

Underground pressure vessels – small buried or mounded pressure vessels, typically used for LPG.

•

Caverns – large excavated in-ground tanks, typically used for liquefied gas or crude oil storage at refineries or storage terminals.

•

Salt dome caverns – large capacity storage located deep underground in natural rock formations, typically used for storage of gas under pressure.

In Section 2.0 failures of the first two types are discussed. Only failures of the tank itself are considered; surface facilities are excluded. On a petrol tank, the surface facilities may include underground pipes, and metering as well as above-ground dispensing pumps. On a gas storage tank, surface facilities may include surge vessels, injection pumps, gas driers and metering systems. Failures of the supply system, such as loading from road tankers and leaks from loading hoses are also excluded.

2.0

Summary of Recommended Data

2.1

Atmospheric Storage Tanks

The best available estimates of leak frequencies for atmospheric tanks are summarised in Table 2.1. Table 2.1 Atm ospheric Storage Tank Leak Frequencies Type of Tank Floating roof Fixed/ floating roof

Type of Release

Leak Frequency (per tank year)

Liquid spill on roof

1.6 × 10

-3

Sunken roof

1.1 × 10

-3

Liquid spill outside tank

2.8 × 10

-3

Tank rupture

3.0 × 10

-6

The frequencies of different types of fire/explosion are summarised in Table 2.2.

4

©OGP

RADD – Storage incident frequencies

Table 2.2 Atm ospheric Storage Tank Fire Frequencies Type of Fire

Floating Roof Tank (per tank year)

Rim seal fire

1.6 × 10

-3

Full surface fire on roof

1.2 × 10

-4

Fixed Roof Tank (per tank year)

Fixed plus Internal Floating Roof Tank (per tank year) 1.6 × 10

-3

Internal explosion & full surface fire

9.0 × 10

-5

9.0 × 10

-5

Internal explosion without fire

2.5 × 10

-5

2.5 × 10

-5

Vent fire

9.0 × 10

-5

Small bund fire

9.0 × 10

-5

9.0 × 10

-5

9.0 × 10

-5

Large bund fire (full bund area)

6.0 × 10

-5

6.0 × 10

-5

6.0 × 10

-5

2.2

Refrigerated Storage Tanks

Estimates of frequencies of catastrophic rupture for different designs of refrigerated storage tanks are shown in Table 2.3. Table 2.3 Sum m ary of Refrigerated Storage Tank Leak Frequencies Tank Design

Catastrophic Rupture Frequency (per tank per year) Primary Containment Only 1

Secondary Containment 2

Leak Frequency (per connection year) Primary Containment Only

Existing Single Containment Tanks

2.3 × 10

-5

7.3 × 10

-6

1.0 × 10

-5

New Single Containment Tanks

2.3 × 10

-6

7.3 × 10

-7

1.0 × 10

-5

Double Containment Tanks

1.0 × 10

-7

2.5 × 10

-8

1.0 × 10

-5

Full containment tanks3

1.0 × 10

-7

1.0 × 10

-8

0

1.0 × 10

-7

1.0 × 10

-8

0

Membrane tank

3

1

The pool area is that of the secondary containment For single containment tanks this scenario corresponds to bund overtopping 3 No collapse is considered for these tank types if they have a concrete roof 2

A leak or rupture of the tank, releasing some or all of its contents, can be caused by brittle failure of tank walls, welds or connected pipework due to use of inadequate materials, combined with loading such as wind, earthquake or impact. Where there is the potential for such loading – in particular, in seismically active zones – specialist analysis of the failure likelihood should be sought.

©OGP

5

RADD – Storage incident frequencies

2.3

Pressurised Storage Vessels

Table 2.4 gives leak frequencies for typical hole size categories. Table 2.4 Sum m ary of Pressure Vessel Leak Frequencies Hole Diameter Range

Leak Frequency (per vessel year)

Nominal

Storage Vessels

Small Containers

1-3 mm

2 mm

2.3 × 10

-5

4.4 × 10

-7

3-10 mm

5 mm

1.2 × 10

-5

4.6 × 10

-7

10–50 mm

25 mm

7.1 × 10

-6

50-150 mm

100 mm*

4.3 × 10

-6

>150 mm

Catastrophic

4.7 × 10

-7

1.0 × 10

-7

4.7 × 10

-5

1.0 × 10

-6

TOTAL

*Or diameter of largest pipe connection if this is smaller

The frequency of a tank BLEVE (Boiling Liquid Expanding Vapour Explosion) should be calculated using fault tree analysis, taking account of adjacent fire sources capable of causing this event. Previous such analysis indicates that a frequency in the range 10-7 to 10-5 per vessel year would be expected for a large storage vessel.

2.4

Oil Storage on FPSOs

A frequency of fires in cargo oil tanks of 8.8 x 10-4 per tanker year was derived from data on oil tankers [33]. This data is over 15 years old and based on oil tankers, and there was very limited experience with FPSOs at that time compared with now. However, more recent data (see Section 4.4) does not permit a better estimate. A suitable frequency for QRA is therefore best obtained by a theoretical approach, e.g. using fault tree analysis, taking account of the specific design features of the installation and the potential for human error.

2.5

Non-process Hydrocarbon Storage Offshore

Table 2.5 and Table 2.6 present release frequencies for methanol and diesel/ATK systems offshore, where the system includes the tank and the associated pipework. Where there is more than one tank, the tank frequencies given can be multiplied up and the totals recalculated. Table 2.5 Offshore Methanol Storage Leak Frequencies (per year) Small

Large

Rupture

Tank

1.6 × 10

Pipework

7.9 × 10

-3

1.6 × 10

-3

1.1 × 10

-3

Total

9.5 × 10

-3

2.0 × 10

-3

1.3 × 10

-3

Fraction

6

Medium -3

74%

4.6 × 10

-4

2.3 × 10

-4

15%

10%

©OGP

3.0 × 10

-5

3.0 × 10 0.2%

-5

Total 2.3 × 10

-3

1.1 × 10

-2

1.3 × 10

-2

100%

RADD – Storage incident frequencies

Table 2.6 Offshore Diesel/ATK Storage Leak Frequencies (per year) Small Tank

1.6 × 10

Pipework

2.1 × 10

-2

4.1 × 10

Total

2.2 × 10

-2

4.6x 10

Fraction

2.6

Medium -3

74%

Large

Rupture

4.6 × 10

-4

2.3 × 10

-4

-3

2.8 × 10

-3

-3

2.9 × 10

-3

15%

10%

3.0 × 10

-5

3.0 × 10 0.1%

-5

Total 2.3 × 10

-3

2.7 × 10

-2

3.0 × 10

-2

100%

Underground Storage Tanks

There is inadequate data to estimate the frequencies of failures of underground tanks directly, and they are usually obtained using data for above ground tanks and eliminating contributions from hazards that are not relevant. In general, this involves eliminating external impact and fire escalation cases. These approaches are not yet sufficiently developed to recommend standard frequencies and so for buried/ mounded tanks a specific assessment by a risk specialist is recommended. Note also that a leak from a buried or mounded tank is likely first to be into the surrounding soil and may not reach the open air; even if it does, it may not eject the intervening soil and so may be limited in rate and velocity by this. Likewise, there is inadequate data to estimate the frequencies of leaks from storage caverns and a specialist assessment of this is recommended.

3.0

Guidance on Use of Data

3.1

General validity

The data presented in Section 2.0 can be used for storage tanks and containers for onshore facilities containing refrigerated and ambient liquids; those presented in Section 2.4 should be used for unpressurised storage of methanol and non-process hydrocarbons offshore. The derivation and application of the data is discussed further in Section 4.0.

3.2

Uncertainties

The sources of uncertainty in the estimated leak and fire frequencies are discussed in Section 4.0 for the different tank types. The uncertainty in the frequencies presented in Section 2.0 tends to be greatest for catastrophic failures due to lack of failure experience. Furthermore, the applicability of the failure modes in the historical events to modern tank designs may also be inappropriate because of improvements in tank design. The uncertainty in values for atmospheric storage tanks could be represented by a range of at least a factor of 10 higher or lower. Estimates of leak frequencies for large pressure vessels, for both the overall leak frequencies and the rupture frequencies, range over 4 orders of magnitude.

©OGP

7

RADD – Storage incident frequencies

4.0

Review of Data Sources

4.1

Atmospheric Storage Tanks

Failure experience was reviewed from a number of sources: •

[3] includes 122 cases of atmospheric storage tank fires world-wide during 1965-89.

•

[4] lists 69 such events during 1981-96.

•

[5] lists 107 events during 1951-95 (see [1] App I).

4.1.1

Selection of Generic Value for Atmospheric Storage Tanks

A wide variation is apparent in the source data. The LASTFIRE data [4] is considered the most reliable source for releases from floating roof tanks. The frequency based on US petroleum industry tanks >10,000 bbl is believed to be the best estimate for rupture frequency. For large floating roof tanks, the LASTFIRE study [4] provides the best available fire frequencies. In the absence of any other data, they are assumed applicable to all sizes of floating roof tanks. The bund fire frequencies are assumed applicable to all types of tanks. For fixed roof tanks, the best available estimate is from a Technica study for tank operators in Singapore [3]. For explosions in fixed roof tanks, the ratio of fires and explosions in world-wide event data has been used. For tanks with both fixed and internal floating roof, the frequencies of appropriate fire/explosion types have been selected from the other tank types. For catastrophic ruptures, an estimate based on US petroleum industry experience has been used, which is consistent with the absence of ruptures in the LASTFIRE data. Comparison of sources for atmospheric tank leak frequency data suggests that the uncertainty in these values could be represented by a range of at least a factor of 10 higher or lower. For fixed roof tanks, the Singapore study [3] and API [5] give values in the range 1.8 × 10-4 to 3.0 × 10-4 per tank year. The Singapore data is considered to be comprehensive and is more recent, so the value of 1.8 × 10-4 per tank year is adopted here. The full surface fire frequency is 50% of this, i.e. 9 × 10-5 per tank year. For tanks with fixed plus internal floating roof, the fire frequency might be expected to be lower than for the other designs. However, these tend to be used for more highly flammable products, so this may offset any reduction in the average fire frequency. In the absence of better information, it is assumed that the frequency of rim seal fires is as for open-top floating roof tanks, while the frequency of full-surface fires is as for fixed roof tanks. Explosions may occur inside fixed roof tanks if flammable vapour is ignited. If the tank contains liquid, this is likely to result in a full-surface fire. If the tank is empty but not gas free, there may be no further fire, although the event may be fatal for people inside the tank at the time (e.g. 2 events described in [6]). Explosions inside fixed roof tanks may produce debris that damages adjacent tanks (e.g. Romeoville, 24 September 1977). Floating roof tanks are designed to eliminate flammable vapour within the tank, but in principle explosions may also occur: •

8

Inside the tank when empty, while the roof is supported on legs above the tank base. However, no such incidents are known.

©OGP

RADD – Storage incident frequencies

•

Above the roof but inside the shell, if vapour leaks past the floating roof. In an opentop tank, this is expected to produce a flash fire rather than an explosion, if ignited. However, such explosions may occur in tanks with fixed plus internal floating roof.

•

Outside the tank area, if vapour drifts into a confined space before ignition occurs. However, this should be modelled in the risk analysis as a tank leak.

No previous estimate of explosion frequency is available for storage tanks. Most reports of explosions are derived from press accounts (e.g. MHIDAS), which do not identify the type of tank involved. They also refer to world-wide experience, for which the tank population is not known. LASTFIRE [4] gives no cases of explosions in 33,906 tank years for open-top floatingroof tanks. Making the common assumption that this is equivalent to “0.7 explosions to date”, the frequency is assumed to be 2 × 10-5 per tank year. This may be conservative, as it is similar to the frequency for tanks with fixed plus internal floating roof estimated below. Technica [3] analysed 122 tank fires from MHIDAS, in which 2% were initiated by explosions. A total of about 22% of these incidents were recorded as involving explosions. It is not known how many of these were in fixed or floating roof tanks. These would be included in the fire frequencies above. DNV [7] analysed MHIDAS reports of fires on crude oil tanks, in which 19 out of 92 were reported as explosions followed by fires. This suggests that as many as 20% of fires may begin with explosion-like events. It is not known how many of these were in fixed or floating roof tanks. Failure experience for fires/explosions where there is definite information about the roof type and ignition consequences indicate that in tanks without an internal floating roof, all full surface fires began with explosions. In addition, there were 3 explosions that did not result in fires in the tank. Based on the frequency of 9 × 10-5 per year adopted above for full surface fires, this suggests an additional frequency of 2.5 × 10-5 per year for explosions without fires. In tanks with an internal floating roof, there has been one incident of a full-surface fire with no report of any preceding explosion. However, this event has little practical significance for risk analysis. There is insufficient information to give a ratio of fires and explosions significantly different to that estimated above for open top floating roof tanks. 4.1.2

Overfilling

The main causes of liquid spill onto the roof were roof fracture and overfill. The LASTFIRE report suggests that 19% of all leaks outside of a storage tanks were caused by overfilling. There are a large number of variables involved in the mechanism for overfill. It is therefore recommended that to model overfill effectively would require detailed analysis using fault tree techniques.

©OGP

9

RADD – Storage incident frequencies

4.2

Refrigerated Storage Tanks

There have been several estimates of the failure frequency for refrigerated storage tanks, addressing different tank designs. Historical data is mainly influenced by single wall tanks. The Second Canvey Study [8] addressed double-wall LNG tanks; the COVO study [9] addressed double integrity tanks; and IPO [10] further addressed double and full containment tanks. No single study is superior in all respects. All these sources and available historical data have been reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture for different designs of refrigerated storage tanks. 4.2.1

Selection of Generic Value for Refrigerated Storage Tanks

During the last 30 years, there have been only 2 spontaneous catastrophic ruptures of large refrigerated tanks although this might rise to 3 if the small tank at Varennes was included and to 4 if the escalation event at Guayaquil was included. The world-wide population of refrigerated storage tanks is not known with any precision, although it has been estimated as approximately 2000 tanks. This would give a historical catastrophic rupture frequency of 2/(2000 × 30) = 3 × 10-5 per tank year. This would be 6 × 10-5 per tank year if the small tank and escalation events were included. This approach is very uncertain, and the applicability of the failure modes in the historical events to modern tank designs is unclear. Nevertheless, it does indicate that rupture frequencies as low as 10-6 per tank year would be very difficult to justify when compared to actual accident experience. 16 leaks from refrigerated storage tanks have been reported during the period 1965-95. The total number of liquid leaks may be lower, since some of these may have been vapour leaks, but this may be offset if some events have been omitted from MHIDAS. Using this value, an overall leak frequency is 16 / (2000 × 30) = 2.7 × 10-4 per tank year. Excluding ruptures and escalation events, this becomes 2.1 × 10-4 per tank year. These leaks were mainly small. A number of sources were reviewed in estimating the generic values for refrigerated storage. These include: • • • • • • • •

First Canvey Report [11] BG Estimate [12, 13, 14] Second Canvey Report [8] SRD LPG Study LA LNG Study COVO Study [9] GRI Data IPO Values [10]

None of the above analyses are superior in all respects. The BG estimate is based on the most extensive engineering investigation of failure modes, but it appears to neglect some failure modes (e.g. aircraft impacts) and is strongly influenced by judgement. The estimate based on historical failure experience automatically includes all failure modes, but some may not be applicable to modern tanks, and both the failure experience and the tank exposure estimates may be inaccurate. The values from the Second Canvey Report are between the BG and historical estimates above. They also have the merit of having been used in a well-known public-domain QRA. They are therefore adopted as cautious best estimates. The BG and historical

10

©OGP

RADD – Storage incident frequencies

estimates could be used as optimistic and pessimistic sensitivity tests respectively. The IPO values could be used as a more optimistic sensitivity test. There have been no formal considerations of the effects of tank design on failure frequencies. With the exception of the IPO study, each of the studies referenced above addresses a different type of tank, so frequencies cannot be compared. The historical data is probably dominated by single-wall ammonia tanks, and hence the catastrophic failure frequency of 3 × 10-5 is appropriate for them. The Canvey studies related to double-wall LNG tanks, and hence the value of 7.3 × 10-6 is appropriate for them. The difference is a factor of 4, which seems subjectively realistic. This can be compared to the difference of a factor of 10 assumed in the LA LNG study. The effect of double integrity tanks would be to reduce the frequency further. The COVO value [9] of 1 × 10-6 may be appropriate for this, i.e. a further reduction by a factor of 7. Double containment tanks have the same frequencies, but these apply to releases into the middle space. The further probability of release beyond the secondary containment depends on the likelihood of common cause failures. The IPO judgements suggest a probability of 0.25. Full containment tanks do reduce the frequencies of release further. The IPO judgements suggest a frequency of 1 × 10-8 may be appropriate for them, i.e. a further reduction by a factor of 100 compared to double integrity tanks.

4.3

Pressurised Storage Vessels

4.3.1

Accident Source Data

Lees [1] lists several major accidents involving large storage vessels including: •

Ruptures, BLEVEs and leaks of LPG tanks, including the well known Feyzin and Mexico City disasters.

•

The rupture of an ammonia tank at Potchefstroom, South Africa, 13 July 1973, that caused 18 fatalities.

•

A leak from a chlorine tank, Baton Rouge, Louisiana, USA, 10 December 1976. There were no fatalities but 10,000 people were evacuated.

Major accidents involving medium storage vessels listed by Lees [1] include: •

Leak from of LPG tank, Wealdstone, Middlesex, UK, 20 November 1980.

•

Leak of MIC from tank, Bhopal, India, 3 December 1984. A 46 m3 refrigerated stainless steel pressure vessel containing methyl isocyanate (MIC) suffered a release through the relief valve. The release may have been due to entry of water causing an exothermic reaction that increased the temperature and pressure until the relief valve lifted. The cloud of toxic gas caused approximately 2000 fatalities among nearby residents.

•

Rupture of a CO2 tank, Worms, Germany, 21 November 1988.

•

Rupture of an ammonia tank, Dakar, Senegal, March 1992, causing 41 fatalities.

Gould [15] lists 16 failures of chlorine tanks in the range 4 to 30 tonnes.

©OGP

11

RADD – Storage incident frequencies

4.3.1.1 Additional Source Data for BLEVEs In the UK, only one BLEVE of a fixed LPG vessel is known (a domestic vessel of less than 1 tonne capacity, at Kings Ripton in 1988) in a population of approximately 925,000 vessel years up to 1989 [16]. This indicates a BLEVE frequency of 1 × 10-6 per vessel year. An earlier published estimate was 3 × 10-6 per vessel year [17]. Using the population of 132,000 vessels in 1991 [18] allows the exposure up to the end of 1998 to be estimated as 2,113,000 vessel years, giving a frequency of 5 × 10-7 per vessel year. Since 98% of the exposure relates to vessels under 5 tonnes capacity, this is appropriate for medium storage vessels. 4.3.2

Selection of Generic Value for Pressurised Storage Vessels

The best available source of leak frequencies for hydrocarbon process pressure vessels is provided by the HSE hydrocarbon release database [19]. In the absence of any collection of data on leak frequencies from storage vessels (spheres and bullet tanks), available analyses indicate that these are not significantly different to the leak frequencies from steam boilers [20]. This source does not give a leak size distribution, but it gives frequencies a factor of 100 lower than estimated above for process vessels, and therefore this factor has been applied to the process vessel size distribution. Available estimates of leak frequencies from small containers (drums and cylinders) for liquefied gases indicate leak frequencies a further factor of 50 lower than for steam boilers. Comparison of the above estimates of leak frequencies for large pressure vessels suggests both the overall leak frequencies and the rupture frequencies range over 4 orders of magnitude. Pressure vessel design and inspection involves extensive effort to avoid catastrophic cold rupture. Some studies have argued that such events are not possible. Fracture mechanics analysis [21] has indicated that under normal circumstances defects in a stress-relieved vessel will cause a leak rather than a catastrophic failure. For vessels that are not stress-relieved, critical crack lengths could be so short that a leak-beforebreak condition can be excluded. A realistic leak size distribution might therefore use a continuous function up to the size of the largest connecting pipe, together with a rupture probability. However, for modelling purposes, the catastrophic rupture of the vessel will need to be represented in a different way to a rupture the size of the connecting pipe. For large/medium storage vessels, there is no high-quality data on leak frequency. Most studies have used data on steam boilers, which is of questionable relevance, although Davenport [20] shows no significant difference in the frequencies. Nevertheless, its use is only justifiable in the absence of better data. Gould [15] considered that the air receiver data from [20] was more appropriate for storage vessels, due to the absence of temperature cycling. Arulanantham & Lees [22] show a leak frequency for storage vessels that is not significantly different to that for process vessels, but this is not supported by other sources. Several judgmental reviews of data applied to LPG storage vessels [9,23,24,25] give leak frequencies in the range 5 × 10-6 to 6 × 10-5 per vessel year. These appear to be based on Davenport [20]. None are particularly authoritative. These judgements could be represented by a size distribution 100 times lower than the HSE offshore data. This would be a leak frequency of 5 × 10-5 per vessel year and a rupture frequency of 5 × 10-7 per year. 12

©OGP

RADD – Storage incident frequencies

The published estimate of rupture frequency of 2.7 × 10-8 by Sooby & Tolchard [18] is as yet unsupported by any collection of failure data. It is a factor of 20 below that proposed above, and is considered suitable for a sensitivity test. Similar leak frequencies have been observed for process vessels in the onshore process industry [22] and the offshore industry (OREDA and HSE). It is therefore assumed that otherwise similar pressure vessels in different industries have approximately the same leak frequencies. 4.3.2.1 BLEVE Data There were at least 25 large storage spheres world-wide subjected to fire impingement during 1955-87, of which 12 were destroyed by BLEVE, leading to a BLEVE frequency of approximately 10-5 per vessel year [27]. This value does not take account of design improvements that resulted from these events. Few BLEVEs of storage vessels have been reported since 1984. Therefore the current frequency should be lower. The likelihood of a BLEVE on a given tank depends on its fire protection measures and the site layout. This is best addressed using a fault tree approach, combined with modelling of possible fire scenarios and their impact on the tank.

4.4

Oil Storage on FPSOs

A 1990 study [33] obtained a frequency of fires/explosions on oil tankers over 6000 GRT of 2.2 × 10-3 per year from IMO data [34] for the period 1982-86. This frequency was adjusted assuming the COT fire frequency is related to the number of tanks, and hence the tanker frequency was reduced by 50% (6 tanks on FPSO compared with typically 12 on tankers.) A further 20% reduction was applied to reflect the historical trend in risk between 1972 and 1986 to obtain a frequency of 8.8 × 10-4 per year for cargo tank fires/explosions on FPSOs. Based on data in [32], there have been no fire/explosion incidents on FPSOs operating in UKCS up to 2005. There have been 2 incidents involving cargo tanks. One involved overfilling and the other involved dropping liquid nitrogen onto the deck (above a tank), which consequently cracked; both of these can be considered to be due to human error. In neither case was there ignition. There have been no incidents of FPSO cargo oil tank failure up to 2005 [32] other than due to human error.

4.5

Non-process Hydrocarbon Storage Offshore

The main source of data on non-process fires is the WOAD database [28]. It includes 802 fire/explosion events up to 1996, of which 516 did not involve a hydrocarbon leak and hence were probably non-process fires. Most of these were recently reported events in the Norwegian Sector, where reporting standards are highest. Since WOAD relies on public domain reports, classification into process and non-process fires may be imprecise. The HSE hydrocarbon release database includes 117 leaks involving non-process hydrocarbons in the UK Sector during 1992-97, 43 of which ignited. The published report [29] includes system populations and leak frequencies for different utilities systems. The installation names and incident dates are not available, and hence this data is impossible to combine with the WOAD data. The HSE offshore accident and incident

©OGP

13

RADD – Storage incident frequencies

statistics reports (e.g. [30]) include numbers of fires/explosions, but do not provide any information to distinguish process and non-process fires. 4.5.1

Methanol

In [29] methanol leaks may be included under several systems. Although leak size distributions are included, there is insufficient leak experience to give smooth distributions. Calculating methanol leak frequencies is awkward because the systems in the HSE database include both methanol and other fluids. For flow lines and manifolds, the systems are dedicated to a single product, but the population data includes condensate lines. Therefore the frequency should use the total number of leaks. This assumes that the frequencies are the same for methanol and condensate. For process systems, both methanol and other lines are included in all systems. Therefore the frequency should use only the methanol leaks, and leaks from the oil and gas lines should be included under process leaks. An alternative approach is to use generic equipment leak frequencies. For example, the tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year. In the HSE database, none of the 12 methanol leaks during 1992-97 were from methanol tanks. Methanol leaks might occur due to over-filling of the tank, and a fault tree analysis could be made of this, taking account of the filling frequency and the tank’s high-level and high-pressure trips. A further contribution to the failure frequency might arise from escalation of other events near to the tank. The deluge system should be adequate to cover the whole tank evenly as well as the tank supports, to prevent collapse of the tank in a fire. The data presented in Table 2.5 is a “system” leak frequency combining a tank leak frequency distribution and a pipe work leak. The total number of leaks from a methanol system is taken from [31] and set at 1.3 × 10-2 per system year. Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year. The rupture frequency is 3.0 × 10-5 per yr and the remaining small, medium and large tank leak frequencies are calculated based on a continuous leak frequency function. The contribution from pipework, pumps and flanges is calculated by dividing the remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large (10%) releases. 4.5.2

Diesel

In [29] diesel leaks may be included under several systems. Although leak size distributions are included, there is insufficient leak experience to give smooth distributions. Calculating diesel leak frequencies from these is awkward because the systems in the HSE database include both diesel and other fluids. The HSE use the 31 leaks categorised as “utilities, oil, diesel” and an exposure 1511 diesel utilities systems, to give a frequency of 2.1 × 10-2 per system year. However, this omits diesel leaks from other systems. An alternative approach would be to divide the total of 52 leaks by the 1511 diesel utilities systems, to give a frequency of 3.4 × 10-2 per system year. An alternative approach is to use generic equipment leak frequencies. For example, the tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year. 14

©OGP

RADD – Storage incident frequencies

In the HSE database, 5 of the 52 diesel leaks during 1992-97 were from tanks and one was from a pressure vessel. Assuming that each of the diesel systems had one tank, these 6 leaks in 1511 system-years would give a frequency of 4 × 10-3 per tank year. The data presented in Table 2.6 have been calculated using a similar approach to that used for methanol leaks. The total number of leaks from a diesel system is taken from [31] and set at 3.4 × 10-2 per year. However, this frequency includes oil export and well systems. Eliminating leaks involving these systems gives a system leak frequency of 3.0 × 10-2 per year. Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year. The rupture frequency is 3.0 × 10-5 per year and the remaining small, medium and large tank leak frequencies are calculated based on a continuous leak frequency function. The contribution from pipework, pumps and flanges is calculated by dividing the remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large (10%) releases.

5.0

Recommended Data Sources for Further Information

For further information, the data sources used to develop the release frequencies presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.

6.0

References

The principal source references are shown in bold. 1. Lees, F.P. 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford: Butterworth-Heinemann. 2. BS EN 1473: 1997. onshore installations.

Installation and equipment of liquefied natural gas – Design of

3. Technica 1990. Atmospheric Storage Tank Study, Confidential Report for Oil & Petrochem ical Industries Technical and Safety Com m ittee, Singapore, Project No. C1998. 4. LASTFIRE 1997. Large Atmospheric Storage Tank Fires - A Joint Oil Industry Project to Review the Fire Related Risks of Large Open-Top Floating Roof Storage Tanks. 5. API 1998. Interim Study - Prevention and Suppression of Fires in Large Aboveground Atmospheric Storage Tanks, Am erican Petroleum Institute Publication 2021A. 6. DNV 1997. Fires and Explosions in Atmospheric Fixed Roof Storage Tanks, Confidential Report for Oil Refineries Ltd, Project No. C8263. 7. DNV 1998. HAZOP Study and Risk Assessment of Venezia Refinery, Confidential Report for AgipPetroli SpA, Project No. C383005. 8. HSE 1981. Canvey - A Second Report - An Investigation of Potential Hazards from Operations in the Canvey Island/Thurrock Area 3 years After Publication of the Canvey Report, Health & Safety Executive, London: HMSO. 9. Rijnm ond Public Authority 1982. A Risk Analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area - A Pilot Study, (the “COVO Study”), Dordrecht: D. Reidel Publishing Co. ©OGP

15

RADD – Storage incident frequencies

10. IPO 1994. Handleiding voor het opstellen en beoordelen van een extern veiligheidsrapport, Interprovinciaal Overleg. 11. HSE 1978. Canvey – An Investigation of Potential Hazards from Operations in the Canvey Island/Thurrock Area, Health & Safety Executive, London: HMSO. 12. British Gas 1979. Further Studies on the Integrity and Modes of Failure of Canvey Above Ground Storage Tanks, British Gas Engineering Research Station Report ERS R1983. 13. British Gas 1981a. The Hazard of Rollover – Canvey Terminal Above Ground Storage Tanks, British Gas Fundamental Studies Group Report FST 812. 14. British Gas 1981b. An Assessment of the Probability of Unintentionally Filling to the Roof an Above Ground LNG Storage Tank at the Canvey Island Methane Terminal. 15. Gould, J. 1993. Fault Tree Analysis of the Catastrophic Failure of Bulk Chlorine Vessels, AEA Technology, Report SRD/HSE/R603, London: HMSO. 16. ACDS 1991. 17. Blything, K.W. & Reeves, A.B. 1988. An Initial Prediction of the BLEVE Frequency of a 100 Tonne Butane Storage Vessel, SRD Report R488. 18. Sooby, W. & Tolchard, J.M. 1993. Estimation of Cold Failure Frequency of LPG Tanks in Europe”, Conference on Risk & Safety Management in the Gas Industry, Hong Kong. 19. HSE 2000. Offshore Hydrocarbon Releases Statistics 1999, Offshore Technology Report OTO 1999 079, Health & Safety Executive, London: HMSO. 20. Davenport, T.J. 1991. Reliability 91, London.

A Further Survey of Pressure Vessel Failures in the UK,

21. Smith, T.A. 1986. An Analysis of a 100 te Propane Storage Vesse”, UKAEA Safety and Reliability Directorate Report SRD R314. 22. Arulanatham, D.C. & Lees, F.P. 1981. Some Data on the Reliability of Pressure Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping 9 327-338. 23. Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W. 1988. Risk Assessment for the Siting of Developments near Liquefied Petroleum Gas Installations, IChemE Symp. Ser. 110. 24. Pape, R.P. and Nussey, C. 1985. A Basic Approach for the Analysis of Risks From Major Toxic Hazards, Assessment and Control of Major Hazards, EFCE event no. 322, Manchester, UK, IChemE Symp. Ser. 93, 367-388. 25. Whittle, K. 1993. LPG Installation Design and General Risk Assessment Methodology Employed by the Gas Standards Office, Conference on Risk & Safety Management in the Gas Industry, Hong Kong, October. 26. Reeves, A.B., Minah, F.C. & Chow, V.H.K. 1997. Quantitative Risk Assessment Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management in the Gas Industry, Hong Kong, March. 27. Selway, M. 1988, The Predicted BLEVE Frequency of a Selected 200 m3 Butane Sphere on a Refinery Site, SRD Report R492. 28. W OAD. W orld Offshore Accident Database, DNV. 29. HSE (1997a): Offshore Hydrocarbon Release Statistics, 1997, Offshore Technology Report OTO 97 950, Health & Safety Executive.

16

©OGP

RADD – Storage incident frequencies

30. HSE (1997b): Offshore Accident and Incident Statistics Report, 1997, Offshore Technology Report OTO 97 951, Health & Safety Executive. 31. Spouge, J R 1999. A Guide to Quantitative Risk Assessment for Offshore Installations, Publication No. 99/100, ISBN 1 870553 365, London: CMPT. 32. Det Norkse Veritas 2007. Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, Research Report RR567, Health & Safety Executive. 33. Technica, 1990. Port Risks in Great Britain from Marine Transport of Dangerous Substances in Bulk: A Risk Assessment, Report for The Health & Safety Executive, Project No. C1216. 34. IMO, 1987. Casualty Statistics, Report of the Steering Group, Annexes 1 – 3 (Analyses of Casualties to Tankers, 1972-1986), MSC 54/INf 6, 26.

©OGP

17

For further information and publications, please visit our website at

www.ogp.org.uk

209-215 Blackfriars Road London SE1 8NL United Kingdom Telephone: +44 (0)20 7633 0272 Fax: +44 (0)20 7633 2350 165 Bd du Souverain 4th Floor B-1160 Brussels, Belgium Telephone: +32 (0)2 566 9150 Fax: +32 (0)2 566 9159 Internet site: www.ogp.org.uk e-mail: [email protected]