Risk Assessment Data Directory

Report No. 434 – 3

March 2010

Storage
incident
frequencies
International Association of Oil & Gas Producers
P ublications

Global experience
The International Association of Oil & Gas Producers has access to a wealth of technical
knowledge and experience with its members operating around the world in many different
terrains. We collate and distil this valuable knowledge for the industry to use as guidelines
for good practice by individual members.

Consistent high quality database and guidelines

Our overall aim is to ensure a consistent approach to training, management and best prac-
tice throughout the world.
The oil and gas exploration and production industry recognises the need to develop consist-
ent databases and records in certain fields. The OGP’s members are encouraged to use the
guidelines as a starting point for their operations or to supplement their own policies and
regulations which may apply locally.

Internationally recognised source of industry information

Many of our guidelines have been recognised and used by international authorities and
safety and environmental bodies. Requests come from governments and non-government
organisations around the world as well as from non-member companies.

Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication,
neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless
of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use
by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform
any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing
herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In
the event of any conflict or contradiction between the provisions of this document and local legislation,
applicable laws shall prevail.

Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission
is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii)
the source are acknowledged. All other rights are reserved.” Any other use requires the prior written
permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of Eng-
land and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of
England and Wales.
 RADD – Storage incident frequencies

Contents:
1.0 Scope and Definitions ........................................................... 1
1.1 Application ...................................................................................................... 1
1.2 Definitions ....................................................................................................... 1
1.2.1 Atmospheric Storage Tanks...................................................................................... 1
1.2.2 Refrigerated Storage Tank Designs ......................................................................... 2
1.2.3 Pressurised Storage Vessels .................................................................................... 3
1.2.4 Non-process Hydrocarbon Storage Offshore.......................................................... 3
1.2.5 Underground Storage Tanks..................................................................................... 4
2.0 Summary of Recommended Data ............................................ 4
2.1 Atmospheric Storage Tanks .......................................................................... 4
2.2 Refrigerated Storage Tanks ........................................................................... 5
2.3 Pressurised Storage Vessels......................................................................... 6
2.4 Oil Storage on FPSOs..................................................................................... 6
2.5 Non-process Hydrocarbon Storage Offshore .............................................. 6
2.6 Underground Storage Tanks ......................................................................... 7
3.0 Guidance on Use of Data ....................................................... 7
3.1 General validity ............................................................................................... 7
3.2 Uncertainties ................................................................................................... 7
4.0 Review of Data Sources ......................................................... 8
4.1 Atmospheric Storage Tanks .......................................................................... 8
4.1.1 Selection of Generic Value for Atmospheric Storage Tanks ................................. 8
4.1.2 Overfilling.................................................................................................................... 9
4.2 Refrigerated Storage Tanks ......................................................................... 10
4.2.1 Selection of Generic Value for Refrigerated Storage Tanks ................................ 10
4.3 Pressurised Storage Vessels....................................................................... 11
4.3.1 Accident Source Data .............................................................................................. 11
4.3.2 Selection of Generic Value for Pressurised Storage Vessels.............................. 12
4.4 Oil Storage on FPSOs................................................................................... 13
4.5 Non-process Hydrocarbon Storage Offshore ............................................ 13
4.5.1 Methanol.................................................................................................................... 14
4.5.2 Diesel......................................................................................................................... 14
5.0 Recommended Data Sources for Further Information ........... 15
6.0 References .......................................................................... 15

©OGP 1
 RADD – Storage incident frequencies

Abbreviations:
API American Petroleum Institute
ASME American Society of Mechanical Engineers
ATK Aviation Turbine Kerosene
BG British Gas
BLEVE Boiling liquid expanding vapour explosion
DNV Det Norske Veritas
FPSO Floating Production, Storage and Offloading Unit
GRI Gas Research Institute
HSE Health & Safety Executive
IPO Interprovinciaal Overleg
LNG Liquefied Natural Gas
LPG Liquefied Petroleum Gas
MIC Methyl Isocyanate
OREDA Offshore Reliability Database
QRA Quantified Risk Assessment
SRD Safety and Reliability Directorate
WOAD World-wide Offshore Accident Databank

2 ©OGP
 RADD – Storage incident frequencies

1.0 Scope and Definitions

1.1 Application
This datasheet presents (Section 2.0) frequencies of releases from the following types
of storage:
1. Atmospheric storage
2. Refrigerated storage
3. Pressurised storage
4. Oil storage on FPSOs
5. Non-process Hydrocarbon Storage Offshore
6. Underground storage
For refrigerated storage tanks previous studies and available historical data have been
reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture
for different designs of refrigerated storage tanks.
FPSOs typically store large quantities of crude oil in cargo oil tanks; this is periodically
transferred to shuttle tankers. Only fires/explosions from the cargo oil tanks are
considered,
Non-process hydrocarbon storage offshore includes methanol, diesel and ATK systems
together with the associated pipework.
Underground storage tanks can be divided into buried or mounded storage tanks (mainly
for fuels such as petrol and LPG), and excavated or leached storage caverns. Section
2.0 presents guidance how failure frequencies for buried or mounded storage tanks
might be estimated.

1.2 Definitions
1.2.1 Atmospheric Storage Tanks
Atmospheric storage tanks contain liquids ambient pressure and at or near ambient
temperature. They are usually fabricated from mild steel on a concrete base,
surrounded by a low bund wall. They are designed to withstand an internal
pressure/vacuum of 0.07 bar. The main types are [1]:
• Fixed roof tanks. These have a vapour space between the liquid surface and the
tank roof. They require a vent for vapour at the top of the tank. They are sub-
divided by roof design:
− Domed roof – up to about 20 m diameter.
− Cone roof – up to about 76 m diameter.
• Floating roof tanks. These have a roof that floats on the liquid surface to reduce
vapour loss. The roof requires a seal around the edge against the tank walls. Types
of roof design include:
− Pan roof.
− Annular pontoon roof.
− Double-deck roof.
• Fixed plus internal floating roof tanks. These are a combination of both types.

©OGP 1
 RADD – Storage incident frequencies

In Section 2.0 failures from the tank walls are considered. Strictly, failures of associated
equipment such as inlet/outlet valves, pipes within the bund and pressure relief valves
should be excluded. In practice, many studies include failures at these points because
available failure data often does not distinguish them clearly from failures of the tank
itself. However, when considering tank ruptures and roof fires, the distinction is not
important.

1.2.2 Refrigerated Storage Tank Designs

There are several different designs of refrigerated storage tank, and different failure
frequencies may be applicable. The main types are [2]:
• Single containm ent tanks. These are a single primary container and generally
an outer shell designed and constructed so that the primary container is required to
meet the low temperature ductility requirements for storage of the product.
• Double containm ent tanks. These are designed and constructed so that both
the inner self supporting primary container and the secondary container are capable
of independently containing the refrigerated liquid stored. To minimise the pool of
escaping liquid, the secondary container should be located at a distance not
exceeding 6m from the primary container. The primary container contains the
refrigerated liquid under normal operating conditions. The secondary container is
intended to contain any leakage of the refrigerated liquid, but is not intended to
contain any vapour resulting from this leakage.
• Full containm ent tanks. These are designed and constructed so that both self
supporting primary container and the secondary container are capable of
independently containing the refrigerated liquid stored and for one of them its
vapour. The secondary container can be 1m to 2m distance from the primary
container. The primary container contains the refrigerated liquid under normal
operating conditions. The outer roof is supported by the secondary container. The
secondary containment shall be capable both of containing the refrigerated liquid
and of controlled venting of the vapour resulting from product leakage after a
credible event.
• Spherical Storage Tanks. Spherical, single containment tanks consisting of an
unstiffened, sphere supported at the equator by a vertical cylinder. For onshore
tanks, the lower part of the support cylinder is made of concrete and the tank is
protected by a domed concrete cover. The outside of the tank and the aluminium
part of the support cylinder are insulated by means of a panel system to the required
thickness for the specified boil-off rate.
• Mem brane tank. These are designed and constructed so that the primary
container, constituted by a membrane, is capable of containing both the liquefied
gas and its vapour under normal operating conditions and the concrete secondary
container, which supports the primary container, should be capable of containing all
the liquefied gas stored in the primary container and of controlled venting of the
vapour resulting from product leakage of the inner tank. The vapour of the primary
container is contained by a steel liner which forms with the membrane an integral
gastight containment. The action of the liquefied gas acting on the primary
container (the metal membrane) is transferred directly to the pre-stressed concrete
secondary container through the load bearing insulation.
Underground tanks have been constructed in the past. These are typically earth pits
where the ground around the pit is frozen by the cold liquid, thus providing a seal. Due
to practical difficulties, this type is now rare.

2 ©OGP
 RADD – Storage incident frequencies

The characteristics of each type are set out in BS EN 1473.

1.2.3 Pressurised Storage Vessels

Pressurised storage tanks are considered to be storage tanks operating under pressure
of at least 0.5 bar. They include a wide variety of vessels, and are categorised for the
purposes of QRA (quantified risk assessment) as follows:
• Storage vessels – in which fluids are held under stable conditions. These are
subdivided for this analysis into:
− Large storage vessels – spheres and bullets (long cylindrical tanks) in excess of
approximately 50 m3 capacity, typically used in dedicated storage installations.
− Medium storage vessels – fixed cylindrical tanks less than approximately 50 m3
capacity, typically used in industrial or domestic installations.
• Small containers – portable cylinders and drums less than approximately 2 m3
capacity.
The main UK design code is BS 5500:1991 Specification for Unfired Fusion Welded
Pressure Vessels (see [1] p12/20). It divides vessels into 3 categories. The highest
standard, Category 1, requires full non-destructive testing of main seam welds. The
corresponding US code is the ASME Boiler and Pressure Vessel Code, 1992.
Section 2.0 covers pressure vessels and any equipment directly associated with them,
i.e. nozzles and instrumentation (with associated flanges), and the inspection cover
(manway). Connection points are included up to the first flange, although the flange
itself is not included. Lines into and out of the vessel, and the associated flanges and
valves are not included in the scope.
Although the lines into and out of the vessel are not included in the scope, the actual
number of lines would have an influence on the failure rate, as failures are more likely at
the connection points where these lines join the vessel. Other equipment may influence
the failure rate, such as relief systems being blocked. Such issues are not addressed in
this datasheet but should be considered separately if appropriate,

1.2.4 Non-process Hydrocarbon Storage Offshore

The term “non-process fires” covers any fires and explosions that are not covered by
the modelling of process hydrocarbon events. Most types of non-process fire involve
materials other than hydrocarbons (e.g. electrical fires, chemical gas explosions).
However, non process hydrocarbons such as diesel and ATK, and other hazardous
materials such as methanol, are frequently stored on offshore installations in
unpressurised tanks of a few m3 capacity. In the event of a leak or rupture, these
materials may be ignited and so have the potential to cause a fire that could result in
injury or possibly fatality. Some data are available for such systems.
Although most non-process fires are very small incidents (e.g. a chip-pan fire in the
galley lasting a few seconds), some have been larger causing damage and fatalities.
The frequency of non-process fires may be larger than process fires, suggesting that
they should not be overlooked if the risk analysis is to be comprehensive.

©OGP 3
 RADD – Storage incident frequencies

1.2.5 Underground Storage Tanks

There are several types of underground storage tanks:
• Petrol filling station tanks – small buried atmospheric tanks, typically used for petrol
at filling stations.
• Underground pressure vessels – small buried or mounded pressure vessels,
typically used for LPG.
• Caverns – large excavated in-ground tanks, typically used for liquefied gas or crude
oil storage at refineries or storage terminals.
• Salt dome caverns – large capacity storage located deep underground in natural
rock formations, typically used for storage of gas under pressure.
In Section 2.0 failures of the first two types are discussed. Only failures of the tank
itself are considered; surface facilities are excluded. On a petrol tank, the surface
facilities may include underground pipes, and metering as well as above-ground
dispensing pumps. On a gas storage tank, surface facilities may include surge vessels,
injection pumps, gas driers and metering systems. Failures of the supply system, such
as loading from road tankers and leaks from loading hoses are also excluded.

2.0 Summary of Recommended Data

2.1 Atmospheric Storage Tanks
The best available estimates of leak frequencies for atmospheric tanks are summarised
in Table 2.1.

Table 2.1 Atm ospheric Storage Tank Leak Frequencies

Type of Tank Type of Release Leak Frequency

(per tank year)
-3
Floating roof Liquid spill on roof 1.6 × 10
-3
Sunken roof 1.1 × 10
-3
Fixed/ floating roof Liquid spill outside tank 2.8 × 10
-6
Tank rupture 3.0 × 10

The frequencies of different types of fire/explosion are summarised in Table 2.2.

4 ©OGP
 RADD – Storage incident frequencies

Table 2.2 Atm ospheric Storage Tank Fire Frequencies

Type of Fire Floating Roof Fixed Roof Fixed plus

Tank Tank (per tank Internal
(per tank year) year) Floating Roof
Tank
(per tank year)
-3 -3
Rim seal fire 1.6 × 10 1.6 × 10
-4
Full surface fire on roof 1.2 × 10
-5 -5
Internal explosion & full surface 9.0 × 10 9.0 × 10
fire
-5 -5
Internal explosion without fire 2.5 × 10 2.5 × 10
-5
Vent fire 9.0 × 10
-5 -5 -5
Small bund fire 9.0 × 10 9.0 × 10 9.0 × 10
-5 -5 -5
Large bund fire (full bund area) 6.0 × 10 6.0 × 10 6.0 × 10

2.2 Refrigerated Storage Tanks

Estimates of frequencies of catastrophic rupture for different designs of refrigerated
storage tanks are shown in Table 2.3.

Table 2.3 Sum m ary of Refrigerated Storage Tank Leak Frequencies

Tank Design Catastrophic Rupture Frequency Leak Frequency

(per tank per year) (per connection
year)
Primary Secondary Primary
Containment Containment 2 Containment Only
Only 1
-5 -6 -5
Existing Single 2.3 × 10 7.3 × 10 1.0 × 10
Containment Tanks
-6 -7 -5
New Single Containment 2.3 × 10 7.3 × 10 1.0 × 10
Tanks
-7 -8 -5
Double Containment 1.0 × 10 2.5 × 10 1.0 × 10
Tanks
-7 -8
Full containment tanks3 1.0 × 10 1.0 × 10 0
-7 -8
Membrane tank 3
1.0 × 10 1.0 × 10 0
1
The pool area is that of the secondary containment
2
For single containment tanks this scenario corresponds to bund overtopping
3
No collapse is considered for these tank types if they have a concrete roof

A leak or rupture of the tank, releasing some or all of its contents, can be caused by
brittle failure of tank walls, welds or connected pipework due to use of inadequate
materials, combined with loading such as wind, earthquake or impact. Where there is
the potential for such loading – in particular, in seismically active zones – specialist
analysis of the failure likelihood should be sought.

©OGP 5
 RADD – Storage incident frequencies

2.3 Pressurised Storage Vessels

Table 2.4 gives leak frequencies for typical hole size categories.

Table 2.4 Sum m ary of Pressure Vessel Leak Frequencies

Hole Diameter Leak Frequency (per

vessel year)
Range Nominal Storage Small
Vessels Containers
-5 -7
1-3 mm 2 mm 2.3 × 10 4.4 × 10
-5 -7
3-10 mm 5 mm 1.2 × 10 4.6 × 10
-6
10–50 mm 25 mm 7.1 × 10
-6
50-150 mm 100 mm* 4.3 × 10
-7 -7
>150 mm Catastrophic 4.7 × 10 1.0 × 10
-5 -6
TOTAL 4.7 × 10 1.0 × 10

*Or diameter of largest pipe connection if this is smaller

The frequency of a tank BLEVE (Boiling Liquid Expanding Vapour Explosion) should be
calculated using fault tree analysis, taking account of adjacent fire sources capable of
causing this event. Previous such analysis indicates that a frequency in the range 10-7
to 10-5 per vessel year would be expected for a large storage vessel.

2.4 Oil Storage on FPSOs

A frequency of fires in cargo oil tanks of 8.8 x 10-4 per tanker year was derived from data
on oil tankers [33]. This data is over 15 years old and based on oil tankers, and there
was very limited experience with FPSOs at that time compared with now. However,
more recent data (see Section 4.4) does not permit a better estimate. A suitable
frequency for QRA is therefore best obtained by a theoretical approach, e.g. using fault
tree analysis, taking account of the specific design features of the installation and the
potential for human error.

2.5 Non-process Hydrocarbon Storage Offshore

Table 2.5 and Table 2.6 present release frequencies for methanol and diesel/ATK
systems offshore, where the system includes the tank and the associated pipework.
Where there is more than one tank, the tank frequencies given can be multiplied up and
the totals recalculated.

Table 2.5 Offshore Methanol Storage Leak Frequencies (per year)

Small Medium Large Rupture Total

-3 -4 -4 -5 -3
Tank 1.6 × 10 4.6 × 10 2.3 × 10 3.0 × 10 2.3 × 10
-3 -3 -3 -2
Pipework 7.9 × 10 1.6 × 10 1.1 × 10 - 1.1 × 10
-3 -3 -3 -5 -2
Total 9.5 × 10 2.0 × 10 1.3 × 10 3.0 × 10 1.3 × 10
Fraction 74% 15% 10% 0.2% 100%

6 ©OGP
 RADD – Storage incident frequencies

Table 2.6 Offshore Diesel/ATK Storage Leak Frequencies (per year)

Small Medium Large Rupture Total

-3 -4 -4 -5 -3
Tank 1.6 × 10 4.6 × 10 2.3 × 10 3.0 × 10 2.3 × 10
-2 -3 -3 -2
Pipework 2.1 × 10 4.1 × 10 2.8 × 10 - 2.7 × 10
-2 -3 -3 -5 -2
Total 2.2 × 10 4.6x 10 2.9 × 10 3.0 × 10 3.0 × 10
Fraction 74% 15% 10% 0.1% 100%

2.6 Underground Storage Tanks

There is inadequate data to estimate the frequencies of failures of underground tanks
directly, and they are usually obtained using data for above ground tanks and
eliminating contributions from hazards that are not relevant. In general, this involves
eliminating external impact and fire escalation cases. These approaches are not yet
sufficiently developed to recommend standard frequencies and so for buried/ mounded
tanks a specific assessment by a risk specialist is recommended. Note also that a leak
from a buried or mounded tank is likely first to be into the surrounding soil and may not
reach the open air; even if it does, it may not eject the intervening soil and so may be
limited in rate and velocity by this.
Likewise, there is inadequate data to estimate the frequencies of leaks from storage
caverns and a specialist assessment of this is recommended.

3.0 Guidance on Use of Data

3.1 General validity
The data presented in Section 2.0 can be used for storage tanks and containers for
onshore facilities containing refrigerated and ambient liquids; those presented in
Section 2.4 should be used for unpressurised storage of methanol and non-process
hydrocarbons offshore. The derivation and application of the data is discussed further
in Section 4.0.

3.2 Uncertainties
The sources of uncertainty in the estimated leak and fire frequencies are discussed in
Section 4.0 for the different tank types.
The uncertainty in the frequencies presented in Section 2.0 tends to be greatest for
catastrophic failures due to lack of failure experience. Furthermore, the applicability of
the failure modes in the historical events to modern tank designs may also be
inappropriate because of improvements in tank design.
The uncertainty in values for atmospheric storage tanks could be represented by a
range of at least a factor of 10 higher or lower. Estimates of leak frequencies for large
pressure vessels, for both the overall leak frequencies and the rupture frequencies,
range over 4 orders of magnitude.

©OGP 7
 RADD – Storage incident frequencies

4.0 Review of Data Sources

4.1 Atmospheric Storage Tanks
Failure experience was reviewed from a number of sources:
• [3] includes 122 cases of atmospheric storage tank fires world-wide during 1965-89.
• [4] lists 69 such events during 1981-96.
• [5] lists 107 events during 1951-95 (see [1] App I).

4.1.1 Selection of Generic Value for Atmospheric Storage Tanks

A wide variation is apparent in the source data. The LASTFIRE data [4] is considered
the most reliable source for releases from floating roof tanks. The frequency based on
US petroleum industry tanks >10,000 bbl is believed to be the best estimate for rupture
frequency.
For large floating roof tanks, the LASTFIRE study [4] provides the best available fire
frequencies. In the absence of any other data, they are assumed applicable to all sizes
of floating roof tanks. The bund fire frequencies are assumed applicable to all types of
tanks.
For fixed roof tanks, the best available estimate is from a Technica study for tank
operators in Singapore [3]. For explosions in fixed roof tanks, the ratio of fires and
explosions in world-wide event data has been used. For tanks with both fixed and
internal floating roof, the frequencies of appropriate fire/explosion types have been
selected from the other tank types. For catastrophic ruptures, an estimate based on US
petroleum industry experience has been used, which is consistent with the absence of
ruptures in the LASTFIRE data.
Comparison of sources for atmospheric tank leak frequency data suggests that the
uncertainty in these values could be represented by a range of at least a factor of 10
higher or lower.
For fixed roof tanks, the Singapore study [3] and API [5] give values in the range
1.8 × 10-4 to 3.0 × 10-4 per tank year. The Singapore data is considered to be
comprehensive and is more recent, so the value of 1.8 × 10-4 per tank year is adopted
here. The full surface fire frequency is 50% of this, i.e. 9 × 10-5 per tank year.
For tanks with fixed plus internal floating roof, the fire frequency might be expected to
be lower than for the other designs. However, these tend to be used for more highly
flammable products, so this may offset any reduction in the average fire frequency. In
the absence of better information, it is assumed that the frequency of rim seal fires is as
for open-top floating roof tanks, while the frequency of full-surface fires is as for fixed
roof tanks.
Explosions may occur inside fixed roof tanks if flammable vapour is ignited. If the tank
contains liquid, this is likely to result in a full-surface fire. If the tank is empty but not
gas free, there may be no further fire, although the event may be fatal for people inside
the tank at the time (e.g. 2 events described in [6]). Explosions inside fixed roof tanks
may produce debris that damages adjacent tanks (e.g. Romeoville, 24 September 1977).
Floating roof tanks are designed to eliminate flammable vapour within the tank, but in
principle explosions may also occur:
• Inside the tank when empty, while the roof is supported on legs above the tank base.
However, no such incidents are known.

8 ©OGP
 RADD – Storage incident frequencies

• Above the roof but inside the shell, if vapour leaks past the floating roof. In an open-
top tank, this is expected to produce a flash fire rather than an explosion, if ignited.
However, such explosions may occur in tanks with fixed plus internal floating roof.
• Outside the tank area, if vapour drifts into a confined space before ignition occurs.
However, this should be modelled in the risk analysis as a tank leak.
No previous estimate of explosion frequency is available for storage tanks. Most
reports of explosions are derived from press accounts (e.g. MHIDAS), which do not
identify the type of tank involved. They also refer to world-wide experience, for which
the tank population is not known.
LASTFIRE [4] gives no cases of explosions in 33,906 tank years for open-top floating-
roof tanks. Making the common assumption that this is equivalent to “0.7 explosions to
date”, the frequency is assumed to be 2 × 10-5 per tank year. This may be conservative,
as it is similar to the frequency for tanks with fixed plus internal floating roof estimated
below.
Technica [3] analysed 122 tank fires from MHIDAS, in which 2% were initiated by
explosions. A total of about 22% of these incidents were recorded as involving
explosions. It is not known how many of these were in fixed or floating roof tanks.
These would be included in the fire frequencies above.
DNV [7] analysed MHIDAS reports of fires on crude oil tanks, in which 19 out of 92 were
reported as explosions followed by fires. This suggests that as many as 20% of fires
may begin with explosion-like events. It is not known how many of these were in fixed
or floating roof tanks.
Failure experience for fires/explosions where there is definite information about the roof
type and ignition consequences indicate that in tanks without an internal floating roof,
all full surface fires began with explosions. In addition, there were 3 explosions that did
not result in fires in the tank. Based on the frequency of 9 × 10-5 per year adopted above
for full surface fires, this suggests an additional frequency of 2.5 × 10-5 per year for
explosions without fires.
In tanks with an internal floating roof, there has been one incident of a full-surface fire
with no report of any preceding explosion. However, this event has little practical
significance for risk analysis. There is insufficient information to give a ratio of fires
and explosions significantly different to that estimated above for open top floating roof
tanks.

4.1.2 Overfilling
The main causes of liquid spill onto the roof were roof fracture and overfill. The
LASTFIRE report suggests that 19% of all leaks outside of a storage tanks were caused
by overfilling. There are a large number of variables involved in the mechanism for
overfill. It is therefore recommended that to model overfill effectively would require
detailed analysis using fault tree techniques.

©OGP 9
 RADD – Storage incident frequencies

4.2 Refrigerated Storage Tanks

There have been several estimates of the failure frequency for refrigerated storage
tanks, addressing different tank designs. Historical data is mainly influenced by single
wall tanks. The Second Canvey Study [8] addressed double-wall LNG tanks; the COVO
study [9] addressed double integrity tanks; and IPO [10] further addressed double and
full containment tanks. No single study is superior in all respects. All these sources
and available historical data have been reviewed to produce a consistent set of
estimates of frequencies of catastrophic rupture for different designs of refrigerated
storage tanks.

4.2.1 Selection of Generic Value for Refrigerated Storage Tanks

During the last 30 years, there have been only 2 spontaneous catastrophic ruptures of
large refrigerated tanks although this might rise to 3 if the small tank at Varennes was
included and to 4 if the escalation event at Guayaquil was included.
The world-wide population of refrigerated storage tanks is not known with any
precision, although it has been estimated as approximately 2000 tanks. This would give
a historical catastrophic rupture frequency of 2/(2000 × 30) = 3 × 10-5 per tank year. This
would be 6 × 10-5 per tank year if the small tank and escalation events were included.
This approach is very uncertain, and the applicability of the failure modes in the
historical events to modern tank designs is unclear. Nevertheless, it does indicate that
rupture frequencies as low as 10-6 per tank year would be very difficult to justify when
compared to actual accident experience.
16 leaks from refrigerated storage tanks have been reported during the period 1965-95.
The total number of liquid leaks may be lower, since some of these may have been
vapour leaks, but this may be offset if some events have been omitted from MHIDAS.
Using this value, an overall leak frequency is 16 / (2000 × 30) = 2.7 × 10-4 per tank year.
Excluding ruptures and escalation events, this becomes 2.1 × 10-4 per tank year. These
leaks were mainly small.
A number of sources were reviewed in estimating the generic values for refrigerated
storage. These include:
• First Canvey Report [11]
• BG Estimate [12, 13, 14]
• Second Canvey Report [8]
• SRD LPG Study
• LA LNG Study
• COVO Study [9]
• GRI Data
• IPO Values [10]

None of the above analyses are superior in all respects. The BG estimate is based on
the most extensive engineering investigation of failure modes, but it appears to neglect
some failure modes (e.g. aircraft impacts) and is strongly influenced by judgement. The
estimate based on historical failure experience automatically includes all failure modes,
but some may not be applicable to modern tanks, and both the failure experience and
the tank exposure estimates may be inaccurate.
The values from the Second Canvey Report are between the BG and historical estimates
above. They also have the merit of having been used in a well-known public-domain
QRA. They are therefore adopted as cautious best estimates. The BG and historical

10 ©OGP
 RADD – Storage incident frequencies

estimates could be used as optimistic and pessimistic sensitivity tests respectively.

The IPO values could be used as a more optimistic sensitivity test.
There have been no formal considerations of the effects of tank design on failure
frequencies. With the exception of the IPO study, each of the studies referenced above
addresses a different type of tank, so frequencies cannot be compared.
The historical data is probably dominated by single-wall ammonia tanks, and hence the
catastrophic failure frequency of 3 × 10-5 is appropriate for them. The Canvey studies
related to double-wall LNG tanks, and hence the value of 7.3 × 10-6 is appropriate for
them. The difference is a factor of 4, which seems subjectively realistic. This can be
compared to the difference of a factor of 10 assumed in the LA LNG study.
The effect of double integrity tanks would be to reduce the frequency further. The
COVO value [9] of 1 × 10-6 may be appropriate for this, i.e. a further reduction by a factor
of 7.
Double containment tanks have the same frequencies, but these apply to releases into
the middle space. The further probability of release beyond the secondary containment
depends on the likelihood of common cause failures. The IPO judgements suggest a
probability of 0.25.
Full containment tanks do reduce the frequencies of release further. The IPO
judgements suggest a frequency of 1 × 10-8 may be appropriate for them, i.e. a further
reduction by a factor of 100 compared to double integrity tanks.

4.3 Pressurised Storage Vessels

4.3.1 Accident Source Data
Lees [1] lists several major accidents involving large storage vessels including:
• Ruptures, BLEVEs and leaks of LPG tanks, including the well known Feyzin and
Mexico City disasters.
• The rupture of an ammonia tank at Potchefstroom, South Africa, 13 July 1973, that
caused 18 fatalities.
• A leak from a chlorine tank, Baton Rouge, Louisiana, USA, 10 December 1976. There
were no fatalities but 10,000 people were evacuated.

Major accidents involving medium storage vessels listed by Lees [1] include:
• Leak from of LPG tank, Wealdstone, Middlesex, UK, 20 November 1980.
• Leak of MIC from tank, Bhopal, India, 3 December 1984. A 46 m3 refrigerated
stainless steel pressure vessel containing methyl isocyanate (MIC) suffered a
release through the relief valve. The release may have been due to entry of water
causing an exothermic reaction that increased the temperature and pressure until
the relief valve lifted. The cloud of toxic gas caused approximately 2000 fatalities
among nearby residents.
• Rupture of a CO2 tank, Worms, Germany, 21 November 1988.
• Rupture of an ammonia tank, Dakar, Senegal, March 1992, causing 41 fatalities.
Gould [15] lists 16 failures of chlorine tanks in the range 4 to 30 tonnes.

©OGP 11
 RADD – Storage incident frequencies

4.3.1.1 Additional Source Data for BLEVEs

In the UK, only one BLEVE of a fixed LPG vessel is known (a domestic vessel of less
than 1 tonne capacity, at Kings Ripton in 1988) in a population of approximately 925,000
vessel years up to 1989 [16]. This indicates a BLEVE frequency of 1 × 10-6 per vessel
year. An earlier published estimate was 3 × 10-6 per vessel year [17]. Using the
population of 132,000 vessels in 1991 [18] allows the exposure up to the end of 1998 to
be estimated as 2,113,000 vessel years, giving a frequency of 5 × 10-7 per vessel year.
Since 98% of the exposure relates to vessels under 5 tonnes capacity, this is
appropriate for medium storage vessels.

4.3.2 Selection of Generic Value for Pressurised Storage Vessels

The best available source of leak frequencies for hydrocarbon process pressure vessels
is provided by the HSE hydrocarbon release database [19].
In the absence of any collection of data on leak frequencies from storage vessels
(spheres and bullet tanks), available analyses indicate that these are not significantly
different to the leak frequencies from steam boilers [20]. This source does not give a
leak size distribution, but it gives frequencies a factor of 100 lower than estimated above
for process vessels, and therefore this factor has been applied to the process vessel
size distribution.
Available estimates of leak frequencies from small containers (drums and cylinders) for
liquefied gases indicate leak frequencies a further factor of 50 lower than for steam
boilers.
Comparison of the above estimates of leak frequencies for large pressure vessels
suggests both the overall leak frequencies and the rupture frequencies range over 4
orders of magnitude.
Pressure vessel design and inspection involves extensive effort to avoid catastrophic
cold rupture. Some studies have argued that such events are not possible. Fracture
mechanics analysis [21] has indicated that under normal circumstances defects in a
stress-relieved vessel will cause a leak rather than a catastrophic failure. For vessels
that are not stress-relieved, critical crack lengths could be so short that a leak-before-
break condition can be excluded.
A realistic leak size distribution might therefore use a continuous function up to the size
of the largest connecting pipe, together with a rupture probability. However, for
modelling purposes, the catastrophic rupture of the vessel will need to be represented
in a different way to a rupture the size of the connecting pipe.
For large/medium storage vessels, there is no high-quality data on leak frequency. Most
studies have used data on steam boilers, which is of questionable relevance, although
Davenport [20] shows no significant difference in the frequencies. Nevertheless, its use
is only justifiable in the absence of better data. Gould [15] considered that the air
receiver data from [20] was more appropriate for storage vessels, due to the absence of
temperature cycling. Arulanantham & Lees [22] show a leak frequency for storage
vessels that is not significantly different to that for process vessels, but this is not
supported by other sources.
Several judgmental reviews of data applied to LPG storage vessels [9,23,24,25] give leak
frequencies in the range 5 × 10-6 to 6 × 10-5 per vessel year. These appear to be based
on Davenport [20]. None are particularly authoritative. These judgements could be
represented by a size distribution 100 times lower than the HSE offshore data. This
would be a leak frequency of 5 × 10-5 per vessel year and a rupture frequency of 5 × 10-7
per year.

12 ©OGP
 RADD – Storage incident frequencies

The published estimate of rupture frequency of 2.7 × 10-8 by Sooby & Tolchard [18] is as
yet unsupported by any collection of failure data. It is a factor of 20 below that
proposed above, and is considered suitable for a sensitivity test.
Similar leak frequencies have been observed for process vessels in the onshore
process industry [22] and the offshore industry (OREDA and HSE). It is therefore
assumed that otherwise similar pressure vessels in different industries have
approximately the same leak frequencies.

4.3.2.1 BLEVE Data

There were at least 25 large storage spheres world-wide subjected to fire impingement
during 1955-87, of which 12 were destroyed by BLEVE, leading to a BLEVE frequency of
approximately 10-5 per vessel year [27]. This value does not take account of design
improvements that resulted from these events. Few BLEVEs of storage vessels have
been reported since 1984. Therefore the current frequency should be lower.
The likelihood of a BLEVE on a given tank depends on its fire protection measures and
the site layout. This is best addressed using a fault tree approach, combined with
modelling of possible fire scenarios and their impact on the tank.

4.4 Oil Storage on FPSOs

A 1990 study [33] obtained a frequency of fires/explosions on oil tankers over 6000 GRT
of 2.2 × 10-3 per year from IMO data [34] for the period 1982-86. This frequency was
adjusted assuming the COT fire frequency is related to the number of tanks, and hence
the tanker frequency was reduced by 50% (6 tanks on FPSO compared with typically 12
on tankers.) A further 20% reduction was applied to reflect the historical trend in risk
between 1972 and 1986 to obtain a frequency of 8.8 × 10-4 per year for cargo tank
fires/explosions on FPSOs.
Based on data in [32], there have been no fire/explosion incidents on FPSOs operating
in UKCS up to 2005. There have been 2 incidents involving cargo tanks. One involved
overfilling and the other involved dropping liquid nitrogen onto the deck (above a tank),
which consequently cracked; both of these can be considered to be due to human error.
In neither case was there ignition. There have been no incidents of FPSO cargo oil tank
failure up to 2005 [32] other than due to human error.

4.5 Non-process Hydrocarbon Storage Offshore

The main source of data on non-process fires is the WOAD database [28]. It includes
802 fire/explosion events up to 1996, of which 516 did not involve a hydrocarbon leak
and hence were probably non-process fires. Most of these were recently reported
events in the Norwegian Sector, where reporting standards are highest. Since WOAD
relies on public domain reports, classification into process and non-process fires may
be imprecise.
The HSE hydrocarbon release database includes 117 leaks involving non-process
hydrocarbons in the UK Sector during 1992-97, 43 of which ignited. The published
report [29] includes system populations and leak frequencies for different utilities
systems.
The installation names and incident dates are not available, and hence this data is
impossible to combine with the WOAD data. The HSE offshore accident and incident

©OGP 13
 RADD – Storage incident frequencies

statistics reports (e.g. [30]) include numbers of fires/explosions, but do not provide any
information to distinguish process and non-process fires.

4.5.1 Methanol
In [29] methanol leaks may be included under several systems. Although leak size
distributions are included, there is insufficient leak experience to give smooth
distributions.
Calculating methanol leak frequencies is awkward because the systems in the HSE
database include both methanol and other fluids. For flow lines and manifolds, the
systems are dedicated to a single product, but the population data includes condensate
lines.
Therefore the frequency should use the total number of leaks. This assumes that the
frequencies are the same for methanol and condensate. For process systems, both
methanol and other lines are included in all systems. Therefore the frequency should
use only the methanol leaks, and leaks from the oil and gas lines should be included
under process leaks.
An alternative approach is to use generic equipment leak frequencies. For example, the
tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year.
In the HSE database, none of the 12 methanol leaks during 1992-97 were from methanol
tanks. Methanol leaks might occur due to over-filling of the tank, and a fault tree
analysis could be made of this, taking account of the filling frequency and the tank’s
high-level and high-pressure trips. A further contribution to the failure frequency might
arise from escalation of other events near to the tank. The deluge system should be
adequate to cover the whole tank evenly as well as the tank supports, to prevent
collapse of the tank in a fire.
The data presented in Table 2.5 is a “system” leak frequency combining a tank leak
frequency distribution and a pipe work leak. The total number of leaks from a methanol
system is taken from [31] and set at 1.3 × 10-2 per system year.
Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year.
The rupture frequency is 3.0 × 10-5 per yr and the remaining small, medium and large
tank leak frequencies are calculated based on a continuous leak frequency function.
The contribution from pipework, pumps and flanges is calculated by dividing the
remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large
(10%) releases.

4.5.2 Diesel
In [29] diesel leaks may be included under several systems. Although leak size
distributions are included, there is insufficient leak experience to give smooth
distributions.
Calculating diesel leak frequencies from these is awkward because the systems in the
HSE database include both diesel and other fluids. The HSE use the 31 leaks
categorised as “utilities, oil, diesel” and an exposure 1511 diesel utilities systems, to
give a frequency of 2.1 × 10-2 per system year. However, this omits diesel leaks from
other systems. An alternative approach would be to divide the total of 52 leaks by the
1511 diesel utilities systems, to give a frequency of 3.4 × 10-2 per system year.
An alternative approach is to use generic equipment leak frequencies. For example, the
tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year.

14 ©OGP
 RADD – Storage incident frequencies

In the HSE database, 5 of the 52 diesel leaks during 1992-97 were from tanks and one
was from a pressure vessel. Assuming that each of the diesel systems had one tank,
these 6 leaks in 1511 system-years would give a frequency of 4 × 10-3 per tank year.
The data presented in Table 2.6 have been calculated using a similar approach to that
used for methanol leaks. The total number of leaks from a diesel system is taken from
[31] and set at 3.4 × 10-2 per year. However, this frequency includes oil export and well
systems. Eliminating leaks involving these systems gives a system leak frequency of
3.0 × 10-2 per year.
Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year.
The rupture frequency is 3.0 × 10-5 per year and the remaining small, medium and large
tank leak frequencies are calculated based on a continuous leak frequency function.
The contribution from pipework, pumps and flanges is calculated by dividing the
remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large
(10%) releases.

5.0 Recommended Data Sources for Further Information

For further information, the data sources used to develop the release frequencies
presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.

6.0 References
The principal source references are shown in bold.
1. Lees, F.P. 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford:
Butterworth-Heinemann.
2. BS EN 1473: 1997. Installation and equipment of liquefied natural gas – Design of
onshore installations.
3. Technica 1990. Atmospheric Storage Tank Study, Confidential Report for
Oil & Petrochem ical Industries Technical and Safety Com m ittee,
Singapore, Project No. C1998.
4. LASTFIRE 1997. Large Atmospheric Storage Tank Fires - A Joint Oil
Industry Project to Review the Fire Related Risks of Large Open-Top
Floating Roof Storage Tanks.
5. API 1998. Interim Study - Prevention and Suppression of Fires in Large
Aboveground Atmospheric Storage Tanks, Am erican Petroleum Institute
Publication 2021A.
6. DNV 1997. Fires and Explosions in Atmospheric Fixed Roof Storage Tanks, Confidential
Report for Oil Refineries Ltd, Project No. C8263.
7. DNV 1998. HAZOP Study and Risk Assessment of Venezia Refinery, Confidential
Report for AgipPetroli SpA, Project No. C383005.
8. HSE 1981. Canvey - A Second Report - An Investigation of Potential Hazards
from Operations in the Canvey Island/Thurrock Area 3 years After
Publication of the Canvey Report, Health & Safety Executive, London:
HMSO.
9. Rijnm ond Public Authority 1982. A Risk Analysis of Six Potentially
Hazardous Industrial Objects in the Rijnmond Area - A Pilot Study, (the
“COVO Study”), Dordrecht: D. Reidel Publishing Co.

©OGP 15
 RADD – Storage incident frequencies

10. IPO 1994. Handleiding voor het opstellen en beoordelen van een extern
veiligheidsrapport, Interprovinciaal Overleg.
11. HSE 1978. Canvey – An Investigation of Potential Hazards from Operations in the Canvey
Island/Thurrock Area, Health & Safety Executive, London: HMSO.
12. British Gas 1979. Further Studies on the Integrity and Modes of Failure of Canvey Above
Ground Storage Tanks, British Gas Engineering Research Station Report ERS R1983.
13. British Gas 1981a. The Hazard of Rollover – Canvey Terminal Above Ground Storage
Tanks, British Gas Fundamental Studies Group Report FST 812.
14. British Gas 1981b. An Assessment of the Probability of Unintentionally Filling to the Roof
an Above Ground LNG Storage Tank at the Canvey Island Methane Terminal.
15. Gould, J. 1993. Fault Tree Analysis of the Catastrophic Failure of Bulk Chlorine Vessels,
AEA Technology, Report SRD/HSE/R603, London: HMSO.
16. ACDS 1991.
17. Blything, K.W. & Reeves, A.B. 1988. An Initial Prediction of the BLEVE Frequency of a
100 Tonne Butane Storage Vessel, SRD Report R488.
18. Sooby, W. & Tolchard, J.M. 1993. Estimation of Cold Failure Frequency of LPG
Tanks in Europe”, Conference on Risk & Safety Management in the Gas Industry, Hong
Kong.
19. HSE 2000. Offshore Hydrocarbon Releases Statistics 1999, Offshore
Technology Report OTO 1999 079, Health & Safety Executive, London:
HMSO.
20. Davenport, T.J. 1991. A Further Survey of Pressure Vessel Failures in the UK,
Reliability 91, London.
21. Smith, T.A. 1986. An Analysis of a 100 te Propane Storage Vesse”, UKAEA Safety and
Reliability Directorate Report SRD R314.
22. Arulanatham, D.C. & Lees, F.P. 1981. Some Data on the Reliability of Pressure
Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping 9 327-338.
23. Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W. 1988. Risk Assessment for the
Siting of Developments near Liquefied Petroleum Gas Installations, IChemE Symp.
Ser. 110.
24. Pape, R.P. and Nussey, C. 1985. A Basic Approach for the Analysis of Risks From
Major Toxic Hazards, Assessment and Control of Major Hazards, EFCE event no. 322,
Manchester, UK, IChemE Symp. Ser. 93, 367-388.
25. Whittle, K. 1993. LPG Installation Design and General Risk Assessment
Methodology Employed by the Gas Standards Office, Conference on Risk & Safety
Management in the Gas Industry, Hong Kong, October.
26. Reeves, A.B., Minah, F.C. & Chow, V.H.K. 1997. Quantitative Risk Assessment
Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management
in the Gas Industry, Hong Kong, March.
27. Selway, M. 1988, The Predicted BLEVE Frequency of a Selected 200 m3 Butane Sphere
on a Refinery Site, SRD Report R492.
28. W OAD. W orld Offshore Accident Database, DNV.
29. HSE (1997a): Offshore Hydrocarbon Release Statistics, 1997, Offshore
Technology Report OTO 97 950, Health & Safety Executive.

16 ©OGP
 RADD – Storage incident frequencies

30. HSE (1997b): Offshore Accident and Incident Statistics Report, 1997,
Offshore Technology Report OTO 97 951, Health & Safety Executive.
31. Spouge, J R 1999. A Guide to Quantitative Risk Assessment for Offshore
Installations, Publication No. 99/100, ISBN 1 870553 365, London: CMPT.
32. Det Norkse Veritas 2007. Accident statistics for floating offshore units on the UK
Continental Shelf 1980-2005, Research Report RR567, Health & Safety Executive.
33. Technica, 1990. Port Risks in Great Britain from Marine Transport of Dangerous
Substances in Bulk: A Risk Assessment, Report for The Health & Safety Executive,
Project No. C1216.
34. IMO, 1987. Casualty Statistics, Report of the Steering Group, Annexes 1 – 3 (Analyses of
Casualties to Tankers, 1972-1986), MSC 54/INf 6, 26.

©OGP 17
 For further information and publications,
please visit our website at

www.ogp.org.uk
209-215 Blackfriars Road
London SE1 8NL
United Kingdom
Telephone: +44 (0)20 7633 0272
Fax: +44 (0)20 7633 2350

165 Bd du Souverain
4th Floor
B-1160 Brussels, Belgium
Telephone: +32 (0)2 566 9150
Fax: +32 (0)2 566 9159

Internet site: www.ogp.org.uk

e-mail: reception@ogp.org.uk