REPORT
434-03
RISK ASSESSMENT DATA DIRECTORY
Storage incident frequencies
AUGUST
2022
Acknowledgements
This Report was developed by DNV GL under the supervision of the IOGP
Safety Committee.
Front cover photography used with permission courtesy of
© Olivier Lantzendörffer/iStockphoto and © jackstudio/iStockphoto
About
This document is part of the Risk Assessment Data Directory (RADD) and
presents frequencies of releases from the following types of storage: atmospheric
storage tanks, refrigerated storage tanks, pressurized storage vessels, nonprocess storage, underground storage, and oil storage on floating production,
storage and offloading units (FPSOS).
The objective of the Risk Assessment Data Directory is to provide data and
information that can be used to improve the quality and consistency of risk
assessments with readily available benchmark data. The directory includes
references for common incidents analysed in upstream production operations.
Feedback
IOGP welcomes feedback on our reports: publications@iogp.org
Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither IOGP nor any of its Members past present
or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which
liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms
of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.
Please note that this publication is provided for informational purposes and adoption of any of its recommendations is at the discretion of the user. Except
as explicitly stated otherwise, this publication must not be considered as a substitute for government policies or decisions or reference to the relevant
legislation relating to information contained in it.
Where the publication contains a statement that it is to be used as an industry standard, IOGP and its Members past, present, and future expressly disclaim all
liability in respect of all claims, losses or damages arising from the use or application of the information contained in this publication in any industrial application.
Any reference to third party names is for appropriate acknowledgement of their ownership and does not constitute a sponsorship or endorsement.
Copyright notice
The contents of these pages are © International Association of Oil & Gas Producers. Permission is given to reproduce this report in whole or in part provided
(i) that the copyright of IOGP and (ii) the sources are acknowledged. All other rights are reserved. Any other use requires the prior written permission of IOGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be
exclusively subject to the jurisdiction of the courts of England and Wales.
REPORT
434-03
AUGUST
2022
RISK ASSESSMENT DATA DIRECTORY
Storage incident frequencies
Revision history
VERSION
DATE
AMENDMENTS
2.0
August 2022
Major revision: updated data/frequencies for atmospheric storage tanks,
refrigerated storage tanks, pressurized storage vessels, non-process
storage, underground storage, and oil storage on floating production,
storage and offloading units
1.0
March 2010
First issue
Storage incident frequencies
Contents
Abbreviations
5
1. Scope and Definitions
6
1.1 Application
6
1.2 Definitions
6
2. Summary of Recommended Data
11
2.1 Atmospheric Storage Tanks
11
2.2 Refrigerated Storage Tanks
11
2.3 Pressurized Storage Vessels
12
2.4 Non-Process Storage
13
2.5 Onshore Underground Storage
15
2.6 Oil Storage on FPSOs
16
3. Guidance on Use of Data
17
3.1 General Validity
17
3.2 Uncertainties
17
4. Review of Data Sources
18
4.1 Atmospheric Storage Tanks
18
4.2 Refrigerated Storage Tanks
23
4.3 Pressurized Storage Vessels
30
4.4 Non-Process Storage
33
4.5 Onshore Underground Storage
37
4.6 Oil Storage on FPSOs
38
5. References
41
4
Storage incident frequencies
Abbreviations
API
American Petroleum Institute
BLEVE
Boiling liquid expanding vapour explosion
DNV
Det Norske Veritas
FLNG
Floating LNG [Facility]
FPSO
Floating Production, Storage and Offloading [Unit]
FSU
Floating Storage Unit
GRT
Gross Register Tonnage
HSE
Health & Safety Executive
IBC
Intermediate Bulk Container
IFR
Internal Floating Roof [Tank]
IMO
International Maritime Organization
ISO
International Organization for Standardization
LASTFIRE
Large Atmospheric Storage Tank FIRE
LNG
Liquefied Natural Gas
LPG
Liquefied Petroleum Gas
MIC
Methyl Isocyanate
NFPA
National Fire Protection Association
OTFR
Open Top Floating Roof [Tank]
PHMSA
Pipeline and Hazardous Materials Administration
QRA
Quantitative Risk Assessment
RADD
Risk Assessment Data Directory
SRD
Safety and Reliability Directorate
UK
United Kingdom
USA
United States of America
WOAD
World-wide Offshore Accident Databank
5
Storage incident frequencies
1. Scope and Definitions
1.1
Application
This document is part of the Risk Assessment Data Directory (RADD) and presents
frequencies of releases from the following types of storage in Section 2:
1)
Atmospheric storage tanks
2)
Refrigerated storage tanks
3)
Pressurized storage vessels
4)
Non-process storage
5)
Underground storage
6)
Oil storage on Floating Production, Storage and Offloading units (FPSOs)
These types of storage are defined in Section 1.2.
No data sources have been identified that give sufficient information to differentiate
hydrogen or carbon dioxide storage units from the generic values given in this document.
If the design is broadly equivalent to that used for hydrocarbons, with a similar service
and operating conditions, then the same frequencies can be applied. If the design features
improvements or additional safety features, then these can be taken into account through
a site-specific derivation of the release frequencies.
1.2
Definitions
1.2.1 Atmospheric Storage Tanks
Atmospheric storage tanks contain liquids near ambient atmospheric pressure at the liquid
surface. The temperature of the liquid is close to, or above, the ambient temperature,
whereas tanks contained refrigerated liquids are addressed in Section 1.2.2. Atmospheric
storage tanks are usually fabricated from mild steel on a concrete base, surrounded by
a low bund wall. They are typically designed to withstand an internal overpressure or
underpressure change of less than 100 mbarg. The main types are [1]:
• Fixed roof tanks. These have a vapour space between the liquid surface and the tank
roof. They require a vent for vapour at the top of the tank. They are sub-divided by roof
design:
– ­Domed roof – typically up to about 20 metres diameter and 20 metres high
– ­Cone roof – typically up to about 76 metres diameter and 22 metres high
• Floating roof tanks. These have a roof that floats on the liquid surface to reduce
vapour loss. The roof requires a seal around the edge against the tank walls.
6
Storage incident frequencies
Types of roof design include:
– ­Pan roof
– ­Annular pontoon roof
– ­Double-deck roof
• Fixed plus internal floating roof tanks. These are a combination of both types.
Releases from the tanks themselves are considered in Section 2.1. Strictly, failures of
associated equipment such as inlet/outlet valves, pipes within the bund and pressure relief
valves should be excluded, and are covered by document 434-01 within the Risk Assessment
Data Directory [2]. In practice, many studies include releases at these points because
available failure data often does not distinguish them clearly from failures of the tank itself.
However, when considering tank ruptures and roof fires, the distinction is not important.
1.2.2 Refrigerated Storage Tanks
These tanks are typically large and store liquid at low temperatures close to atmospheric
pressure. There are several different designs of refrigerated atmospheric storage tank, and
different failure frequencies may be applicable, as summarized in Section 2.2. The main
types used onshore are [3], [4], [5], [6]:
• Single containment tanks. These tanks have a self-supporting steel cylindrical
primary container to hold the liquid contents. An outer tank is included to support
insulation but would not be expected to contain any refrigerated liquid released from
the primary container, so a bund is usually required. The tank is sealed to contain any
vapour evolved from the liquid.
• Double containment tanks. These tanks include two layers of containment where
both the inner selfsupporting primary container and the secondary container are
capable of independently containing the stored refrigerated liquid. The primary, inner
container holds the refrigerated liquid under normal operating conditions. It also
contains any vapour evolved from the liquid. The secondary container is intended to
contain any leakage of the refrigerated liquid, up to the entire contents of the tank, but
is not intended to contain any vapour resulting from this leakage as it can be open at
the top. There is normally a requirement for the secondary containment to be within
6 metres of the primary containment, to minimize pool spread.
• Full containment tanks. These tanks are similar to double containment tanks, as
described above. However, in this case, the outer container is also gas-tight and
capable of containing the vapour (although controlled venting of the outer container
is permitted). The primary, inner container holds the refrigerated liquid under normal
operating conditions.
• Spherical storage tanks. A spherical, single containment tank consists of an
unstiffened, sphere supported at the equator by a vertical cylinder. They can be
designed for high earthquake accelerations.
• Membrane tank. When onshore, these tanks consist of a primary metallic membrane
that is capable of containing both the refrigerated liquid and its vapour under normal
operating conditions, and the concrete secondary container. The secondary container
supports the primary container and should be capable of containing all the liquefied
gas stored in the primary container. Note that membrane tanks used in LNG carrier
ships and FLNG facilities have a different construction.
7
Storage incident frequencies
Figure 1.1 illustrates the failure events that are possible for single, double and full
containment storage tanks. Note that the ‘Spill into bund’ event could involve liquid
overtopping the bund and spreading beyond it, depending on the nature of the release
and the configuration of the bund.
Liquid release
from tank
Bund present?
Yes
Spill into bund
No
Uncontrolled spill
Single
containment tank
Liquid release
from inner
container
Double
containment tank
Liquid release
from inner
container
Full containment
tank
Does the outer
container
also fail?
No
Vapour release from
between containers
Yes
Bund present?
Yes
No
Does the outer
container
also fail?
No
Spill into bund
Uncontrolled spill
Controlled venting only
Yes
Bund present?
No
Yes
Spill into bund
Uncontrolled spill
Figure 1.1: Failure Modes for Refrigerated Storage Tanks
Underground refrigerated tanks have been constructed in the past. These are typically
earth pits where the ground around the pit is frozen by the cold liquid, thus providing a seal.
Due to practical difficulties, this type is now rare.
8
Storage incident frequencies
1.2.3 Pressurized Storage Vessels
Pressurized storage vessels are considered to operate at a pressure of at least 0.5 barg.
They include a wide variety of vessels, and are categorized for the purposes of quantitative
risk assessment (QRA) as follows:
• Storage vessels. Fluids are held under stable conditions. These vessels include
pressurized spheres, cylindrical vessels and bullets.
• Small cylinders. These are portable cylinders typically of capacity less than 1 m3.
• ISO containers. These containers are built to a standard frame for transport purposes
and contain a pressurized vessel that can be used for portable liquified gas storage,
including LNG.
Other small portable containers are discussed in Section 2.4.1.
Section 2.3 covers pressurized storage vessels and any equipment directly associated with
them, including nozzles and instrumentation (with associated flanges), and the inspection
cover (manway). Connection points are included up to the first flange, although the flange
itself is not included. Lines into and out of the vessel, and the associated flanges and valves
are not included in the scope. Components such as the flanges and valves are covered by
document 434-01 within the Risk Assessment Data Directory [2].
Although the lines into and out of the vessel are not included in the scope, the number
of lines would have an influence on the failure rate, as failures are more likely at the
connection points where these lines join the vessel. Other equipment may influence the
failure rate, such as relief systems being blocked. Such issues are not addressed in this
document but should be considered separately if appropriate.
Note that process pressure vessels are not considered in this document as they are within
the scope of document 434-01 within the Risk Assessment Data Directory [2]. The guidance
in document 434-01 also applies to vessels within the main process streams that are
constructed like pressurized vessels, even if they operate at relatively low pressures
(less than 1 barg).
1.2.4 Non-Process Storage
The term ‘non-process fires’ covers any fires and explosions that are not covered by the
modelling of process hydrocarbon events. Here ‘non-process storage’ refers to any tank or
container that is not directly connected to the main process streams of the facility, typically
within the utility systems of a facility. It does not include product storage, which is covered
in Sections 1.2.1, 1.2.2 and 1.2.3.
Non-process hydrocarbons such as methanol, diesel and Aviation Turbine Kerosene are
frequently stored in unpressurized tanks with capacities of up to a few cubic metres. In
the event of a leak or rupture, these materials may be ignited and so have the potential to
cause a fire that could result in injury or possibly fatality. Some data are available for such
systems, as summarized in Section 2.4.
9
Storage incident frequencies
Although most non-process fires are very small incidents (e.g. a cooking fire in the galley
that has no significant consequences), some have been larger and caused damage and
fatalities. The frequency of non-process fires may be larger than process fires, suggesting
that they should not be overlooked if the risk analysis is to be comprehensive.
Note that non-process storage can include toxic fluids or asphyxiants, and these hazards
should also be considered in risk assessments. Non-flammable fluids should be
considered if they pose hazards.
1.2.5 Onshore Underground Storage
There are several types of underground storage tanks:
• Petrol or diesel tanks. These small buried atmospheric tanks are typically used at
vehicle refuelling stations.
• Underground pressure vessels. Small buried or mounded pressure vessels, such as
those typically used to store LPG.
• Caverns. These are large excavated in-ground tanks, typically used for liquefied gas
or crude oil storage at refineries or storage terminals.
• Salt dome caverns. These are large capacity storage spaces located deep underground
in natural rock formations, typically used for storage of gas under pressure.
Failures of the underground storage facilities are discussed in Section 2.5.
Only failures of the tank itself are considered; associated infrastructure is excluded. On a
petrol tank, these facilities may include underground pipes and metering as well as aboveground dispensing pumps. For a gas storage cavern, surface facilities may include surge
vessels, injection pumps, gas driers and metering systems.
Failures of the supply system, such as loading from road tankers and leaks from loading
hoses are excluded from the analysis in this document. Many of these items are covered by
document 434-01 within the Risk Assessment Data Directory [2].
1.2.6 Oil Storage on FPSOs
FPSOs typically store large quantities of crude oil or condensate in cargo tanks, with the
product being periodically transferred to shuttle tankers. Only fires and explosions from the
cargo tanks are considered here, as releases involving the topside process equipment and
product transfer facilities are beyond the scope of this document.
Further details are given in Section 2.6.
10
Storage incident frequencies
2. Summary of Recommended Data
2.1
Atmospheric Storage Tanks
The best available estimates of leak frequencies for onshore storage tanks operating
close to ambient pressure and temperature are summarized in Table 2.1, based on the
discussion in Section 4.1. It should be noted that a bund, if present, would not necessarily
contain all released liquid, depending on the nature of the failure and the size and position
of the bund.
Table 2.1: Atmospheric Storage Tank Release Frequencies
Failure Mode
Description
Release Frequency
(per tank per year)
Catastrophic Failure
Instantaneous or very rapid release of the contents
5.0 × 10-6
Major Failure
250 mm diameter hole with release outside tank shell
1.0 × 10-4
Minor Failure
10 mm diameter hole with release outside tank shell
3.0 × 10-4
Roof Failure
Liquid spill onto the roof (floating roof tanks only)
3.0 × 10-4
Note that the values given above are release frequencies, and that a suitable ignition
probability should be applied to determine fire event frequencies [7].
The frequency of overfilling should be determined from a tank-specific assessment, as
discussed in Section 4.1.3.
Similarly, the possibility of overfilling leading to vapour cloud generation and an explosion,
as occurred at Buncefield, UK in 2005, should be considered on a site-specific basis.
2.2
Refrigerated Storage Tanks
Estimates of frequencies of releases from different designs of onshore refrigerated
atmospheric storage tanks are shown in Table 2.2. These frequencies are intended to apply
to any refrigerated liquid, including LNG. The failure modes are the same as described for
single containment atmospheric temperature tanks in Table 2.1 above, and represent the
following events:
• Catastrophic failures leading to liquid releases outside the tank, onto the ground. The
subsequent liquid spread modelling can take into account any bunding or features
that would limit the size of the pool. However, a proportion of the released liquid could
slosh over the bund, or the initiating event that failed the tank could also have been
severe enough to breach the bund.
• Major and minor failures. The treatment depends on the tank type:
– For
­ single containment tanks, these failures lead to a liquid release outside the
tank, and subsequent spread on the ground. Bunding can be taken into account
when modelling the pool spread.
11
Storage incident frequencies
– ­For double containment tanks, these failures lead to a liquid release into the
outer shell, which limits the size of the pool to be considered. Vapour evolution
from the pool is possible.
– ­Full containment and membrane tanks would contain the liquid released from
the inner tank, and any vapour that subsequently evolves, so holes do not need
to be considered.
• A liquid spill onto the roof of the tank. This event should be considered if the roof is steel.
Further details are given in Section 4.2. Very little data is available for spherical storage
tanks, so it is recommended that the values for single containment tanks are used.
Table 2.2: Summary of Refrigerated Storage Tank Release Frequencies
Release Frequency (per tank per year)
Failure Mode
Description
Double Containment
Single
Containment
Metal Outer
Container
Concrete
Outer
Container
Full
Containment
Membrane
Catastrophic Failure
Instantaneous
5.0 × 10-6
5.0 × 10-7
1.3 × 10-8
1.0 × 10-8
1.0 × 10-8
Major Failure
250 mm Hole*
1.0 × 10-4
1.0 × 10-5
N/A
N/A
N/A
Minor Failure
10 mm Hole*
3.0 × 10-4
1.0 × 10-4
N/A
N/A
N/A
Steel Roof Failure
Spill onto Roof
3.0 × 10-4
1.0 × 10-4
1.0 × 10-4
4.0 × 10-5
4.0 × 10-5
Note that the values given above are release frequencies, and that a suitable ignition
probability should be applied to determine fire event frequencies [7].
The release frequencies given in Table 2.2 are generic in nature and are low for the more
severe events. Where relevant, a site-specific analysis should be carried out to determine
appropriate contributions to the failure frequencies from:
• Escalation from fires and explosions, both on-site and from neighbouring sites.
• Natural hazards such as earthquakes, lightning, extreme wind, wildfires, flooding
and storm surges.
• Impact from aircraft or road vehicles.
2.3
Pressurized Storage Vessels
Table 2.3 gives frequencies for various pressurized storage vessel failure modes, as
discussed in Section 4.3.
12
Storage incident frequencies
Table 2.3: Summary of Pressure Vessel Release Frequencies
Failure Mode
Release Frequency (per vessel per year)
Storage Vessels*
Small Cylinders
ISO Containers**
1 to 3 mm Hole
1.3 × 10
N/A
N/A
3 to 10 mm Hole
6.9 × 10-6
1.0 × 10-5
3.0 × 10-4
10 to 50 mm Hole
-6
3.7 × 10
N/A
1.2 × 10-4
50 to 150 mm Hole
1.0 × 10-6
N/A
N/A
Catastrophic Failure
9.5 × 10-7
1.0 × 10-6
-5
4.0 × 10-6, no pressure relief
3.0 × 10-6, with pressure relief
* The failure frequencies for pressurized storage vessels are based on the approach applied to pressurized process vessels in
document 43401 within the Risk Assessment Data Directory [2], but with a reduction factor of 25. Details are given in Section 4.3.
** This is a simplification of the failure modes detailed in Table 4.6 in Section 4.3 for ISO containers. In addition, vapour
releases and liquid releases due to dropped containers should be considered.
The catastrophic failure given in Table 2.3 is intended to represent a ‘cold’ failure. The
frequency of a pressure vessel Boiling Liquid Expanding Vapour Explosion (BLEVE) should
also be considered. The BLEVE frequency should ideally be calculated using site-specific
analysis, taking account of adjacent fire sources capable of causing this event and the
response of the vessel to fire loading. A frequency between 1 × 10-7 and 1 × 10-5 per
vessel per year would be expected for a large above ground storage vessel. For simple
assessments or screening studies a value of 1 × 10-5 per vessel per year could be used,
which is likely to be a conservative approach. A value of 1 × 10-6 per vessel per year is likely
to be more representative of the BLEVE frequency for pressurized above ground storage
vessels on new or recently built sites.
The failure frequencies given above are intended to apply to vessels containing
hydrocarbons. Failure frequencies for vessels containing hydrogen, carbon dioxide and
other fluids should be derived using site-specific analysis.
Mounded or buried pressurized storage vessels should use the release frequencies given in
Table 2.3, although it is acknowledged that the consequences of a release would be different to
those on an above ground vessel. BLEVE failures can be omitted entirely in risk assessments if
the vessel and its connections are adequately protected from thermal radiation.
2.4
Non-Process Storage
2.4.1 Onshore
The frequencies given in Table 2.4 can be applied to fixed onshore non-process storage
tanks of volume up to 450 m3. Such tanks can be constructed of steel or plastic and usually
hold liquids such as diesel and methanol in the utility units of a facility.
13
Storage incident frequencies
Table 2.4: Release Frequencies for Onshore Non-Process Storage Tanks
Release Frequency (per tank per year)
Failure Mode
Description
Non-Flammable Contents
Flammable Contents
Catastrophic
Instantaneous release, or release of the
contents over a few seconds
8.0 × 10-6
1.6 × 10-5
Large
Large hole leading to loss of the contents
over 5 minutes (maximum of 250 mm)
5.0 × 10-5
1.0 × 10-4
Small
Small hole leading to loss of the contents
over 30 minutes (maximum of 75 mm)
5.0 × 10-4
1.0 × 10-3
Intermediate Bulk Containers (IBCs) have release frequencies calculated in terms of the number
of containers in storage and the number of containers passing through the site per year:
• Catastrophic failures at 1.4 × 10-5 per IBC per year stored, plus 7.1 × 10-5 per IBC
passing through per year.
• 10 mm holes at 1.3 × 10-5 per IBC per year stored, plus 1.13 × 10-4 per IBC passing
through per year.
• 5 mm holes at 5.2 × 10-5 per IBC per year stored, plus 9.3 × 10-4 per IBC passing
through per year.
Failures of small, pressurized containers up to around 3 m3 capacity, can be assigned
failure frequencies as follows:
• Catastrophic failures at 2 × 10-6 per container per year, based on the average number
of containers present.
• Holes of 10 mm diameter at 1.2 × 10-6 per container movement.
• Hole of 5 mm diameter at 5.0 × 10-6 per container movement.
Further information is given in Section 4.4.1.
2.4.2 Offshore
Table 2.5 presents release frequencies for non-process storage tanks in use offshore.
These frequencies are based on the approach applied to pressurized process vessels in
document 434-01 within the Risk Assessment Data Directory [2], but with a factor of 5
increase. Further details are given in Section 4.4.2.
Table 2.5: Non-Process Storage Tank Release Frequencies (per year)
Failure Mode
Release Frequency (per tank per year)
1 to 3 mm Hole
1.7 × 10-3
3 to 10 mm Hole
8.6 × 10-4
10 to 50 mm Hole
4.7 × 10-4
50 to 150 mm Hole
1.3 × 10-4
Catastrophic Failure
1.2 × 10-4
The same frequencies can be applied to any non-process fluid including diesel,
methanol and Aviation Turbine Kerosene.
14
Storage incident frequencies
2.5
Onshore Underground Storage
2.5.1 Large Liquid Storage Tanks
There is inadequate historical data to estimate the failure frequencies of underground tanks
directly, so they are usually obtained using data for above ground tanks and eliminating
contributions from hazards that are not relevant. In general, this involves eliminating
external impact and escalation cases. In addition, a leak from a buried or mounded tank is
likely to be into the surrounding soil and may not reach the open air in a way that poses a
major accident hazard.
In the absence of a site-specific analysis, the guidance summarized in Section 4.2.7
suggests the following release frequencies for large mounded tanks:
• Catastrophic failure leading to an instantaneous release at a frequency of 1.0 × 10-8
per tank per year. This failure should be modelled in a manner similar to an above
ground tank.
• A release of the entire contents of the tank over 10 minutes, with a frequency of 1.0 ×
10-8 per tank per year.
• No smaller holes are modelled.
For large underground tanks, the following approach can be taken:
• Catastrophic failure leading to an instantaneous release at a frequency of 1.0 × 10-8
per tank per year. The pool size can be limited to the footprint of the tank.
• No other releases are modelled.
Note that modelling of small releases is not necessary for safety assessments addressing
the risk to people and assets, but they could have significant environmental consequences.
2.5.2 Vehicle Refuelling Stations
Releases from single skin underground storage tanks at vehicle refuelling stations are
estimated to occur at a frequency of 5 × 105 per tank per year [8] based on UK data. No
events were recorded that involved the failure of both layers of double skin tanks, but the
release frequency would be expected to be significantly lower, especially if leak detection is
installed in the second layer of containment.
2.5.3 Underground Storage Cavities
Failures from onshore underground storage caverns are discussed in Section 4.5. The
following frequencies are relevant for underground releases:
• Failures of salt caverns at 3 × 10-5 per well per year.
• Failures of cavities in depleted oil/gas fields at 8 × 10-6 per well per year.
• Well failures involving the underground pipework from the cavern to the surface at 1 ×
10-5 per well per year.
15
Storage incident frequencies
These events are environmental issues, rather than immediate hazards that could cause
harm to people. The above ground equipment on an underground storage site should be
treated like any other process equipment, using the failure frequencies given in document
43401 within the Risk Assessment Data Directory [2].
2.6
Oil Storage on FPSOs
Several studies of historical incidents on FPSOs are summarized in Section 4.6. Based
on relevant experience with oil tankers, a frequency of 3.9 × 10-4 per FPSO per year is
recommended for fires/explosions in oil or condensate storage tanks. This value can be
halved if tank cleaning and repair are excluded from the scope of an assessment.
No specific information source concerning failure rates of storage tanks on FLNG facilities
was identified. As FLNG facilities are either purpose-built or converted from relatively
modern LNG carriers, it would be expected that the storage tank failure rate is similar to
that of LNG carriers. No significant LNG spills have occurred from carrier storage tanks.
For both FPSOs and FLNG facilities, an asset-specific assessment could be carried out to
determine the leak frequency from storage tanks based on factors such as the likelihood of
overfilling, ship collision or extreme weather.
16
Storage incident frequencies
3. Guidance on Use of Data
3.1
General Validity
The data presented in Sections 2.1 to 2.3 is intended be used for storage tanks and
containers on onshore facilities. The similar large atmospheric pressure storage tanks on
ships are subject to different failure modes and would not be expected to have the same
failure frequencies, although Section 2.6 contains some data for ship tank failures.
The information presented in Section 2.4 can be used for unpressurized storage of nonprocess liquids, typically in the utility units of facilities. Separate sections are given for
onshore and offshore application.
Section 2.5 is applicable only to onshore underground facilities.
It is expected that the failure frequencies given in this document would be sub-divided
into release scenarios with different liquid fill levels, and hence different consequences,
for storage tanks where the quantity of liquid in the tank varies significantly over time.
Typically, this is the case with product storage tanks, but not for emergency diesel
storage tanks, for example.
The derivation and application of the data is discussed further in Section 4.
3.2
Uncertainties
The uncertainty in the frequencies presented in Section 2 tends to be greatest for
catastrophic failures due to lack of historical experience. Furthermore, the applicability of
the failure modes in the historical events to modern tanks may also be cautious because of
improvements in tank design, materials and operations over time.
For example, the uncertainty in values for failures of double containment and full
containment storage tanks could be represented by a range of at least a factor of 10 higher
or lower. More historical experience is available for single containment atmospheric tanks,
such that the failure rates given in Section 2 are broadly in agreement, but there is still
some uncertainty in the values, as noted in Section 4.1.2.
17
Storage incident frequencies
4. Review of Data Sources
4.1
Atmospheric Storage Tanks
4.1.1 Information Sources
Historical tank failure incidents are listed in a number of sources including:
• An update to the LASTFIRE project [9] involves 175 incidents involving releases
outside the tank shell that occurred between 1984 and 2011. An additional 48 releases
in the roof area are included.
• An Energy Institute report [10] lists 89 incidents involving single storage tank failures
and 15 events involving multiple tanks that occurred between 1919 and 2009.
• The US Chemical Safety and Hazard Investigation Board report of the tank fire
incident in Puerto Rico on 23rd October 2009 [11] contains a list of 22 previous
incidents, 19 of which involved overfilling of storage tanks. The events occurred
between 1962 and 2014 and are examples, rather than a complete list.
In addition, guidance on failure frequencies of atmospheric storage tanks is available in
several sources, as summarized in Sections 4.1.2 and 4.1.3.
4.1.2 Generic Frequency Values
Introduction
The failure frequencies suggested by various commonly used sources for large single
containment liquid storage tanks operating at atmospheric temperature and pressure are
summarized below. It should be noted that some sources differentiate tanks based on their
construction type, while others base the failure frequencies on their contents.
LASTFIRE
An analysis of incidents between 1984 and 2011 recorded in the LASTFIRE database [9]
gives release and fire frequencies based on 441,185 tank-years of operational experience.
This includes 132,380 tank-years for Open Top Floating Roof (OTFR) tanks, 22,795 tankyears for Internal Floating Roof (IFR) tanks, and 286,010 tank-years for fixed roof tanks. The
following storage tank release frequencies are given:
• Liquid spills onto the tank roof at a frequency of 3.09 × 10-4 per tank per year, for
floating roof tanks. This is based on 48 incidents, averaged across OTFR and IFR
tanks. The causes were:
– ­14 earthquakes
– ­10 roof drain failures
– ­6 related to heavy rain
– ­9 other incidents spread over 7 categories
– ­9 ‘other’ incidents, not specified
18
Storage incident frequencies
• Sunken roof events at a frequency of 2.96 × 10-4 per tank per year. This is averaged
across OTFR and IFR floating roof tanks and is based on 46 incidents, with the
following causes:
– ­16 related to heavy rain
– ­6 earthquakes
– ­6 other causes spread over 4 categories
– ­18 ‘other’ incidents, not specified
• Liquid spills outside the tank shell in a bund at a frequency of 3.97 × 10-4 per tank per
year, averaged over all tanks. This is based on 175 incidents, with the following causes:
– ­33 corrosion events of the tank bottom
– ­20 drain failures
– ­20 overfill events
– ­6 leaks from pipework, flanges or valves
– ­5 mixer leaks
– ­17 other causes spread over 8 categories
– ­74 ‘other’ incidents, not specified
• Frequencies of tank fires of various types are also given, ranging from rim seal fires
to full surface and bund fires. Table 4.1 gives a summary of ignited event frequencies
from the LASTFIRE report based on 83 ignited releases that are recorded in the
database.
• The frequency of boilover events was not calculated. It is assumed that all full surface
fires lead to boilover, for susceptible liquids within the tank [9], [12].
Table 4.1: Summary of LASTFIRE Data for Ignited Releases [9]
Event
Rim Seal Fire
Frequency
(per tank per year)
Notes
2.00 × 10-4
Based on 31 fires, and applies to OTFR and IFR tanks only
2.27 × 10-4
Based on 30 rim seal fires on OTFR tanks only
4.39 × 10
Based on 1 rim seal fire on IFR tanks only
-5
Vent Fire
9.71 × 10-6
Based on 3 vent fires, and applies to fixed roof and IFR tanks only
Pipe, Flange or Valve Fire
9.07 × 10-6
Based on 4 fires, averaged over all tank types
Bund Fire
1.13 × 10
Based on 5 fires in bunds, averaged over all tank types
Spill on Roof Fire
4.53 × 10-6
Based on 2 fires of this type, averaged over all tank types
2.95 × 10-5
Based on 13 fires across all tank types
5.29 × 10
Based on 7 fires on OTFR tanks
Full Surface Fire*
-5
-5
2.10 × 10-5
Based on 6 fires on fixed roof tanks
Other
3.40 × 10-5
Based on 15 incidents, averaged over all tank types
Vapour Space Explosion
2.27 × 10-5
Based on 7 explosions, and applies to fixed roof and IFR tanks
Pontoon Explosion
2.27 × 10-5
Based on 3 explosions on OTFR tanks only
* No full surface fires were recorded for IFR tanks, which suggests that the frequency is less than 4.39 × 10-5 per year based
on the operational experience for that tank type.
19
Storage incident frequencies
Energy Institute
An Energy Institute report [10] contains a summary of multiple sources of data but is based
primarily on the LASTFIRE database. It is noted that the data set is small and might contain
under-reporting of loss of containment events, particularly where ignition did not occur.
It suggests the following release frequencies:
• Release into secondary containment at a frequency of 7.5 × 10-4 per tank per year.
• Catastrophic tank failures at a frequency of 1.9 × 10-5 per tank per year, based on
three incidents. This frequency is stated to lie between 4.0 × 10-6 per tank per year
and 5.5 × 10-5 per tank per year with 95% confidence. This represents a severe failure
resulting in the majority of the tank’s contents being released in a short period, with
specific criteria being given.
• A major loss of containment event frequency of less than 1.0 × 10-5 per tank per
year, with no exact value given. This frequency is stated to lie between 2.0 × 10-7 per
tank per year and 3.5 × 10-5 per tank per year with 95% confidence. These events are
significant, but do not meet the criteria for a catastrophic tank failure in terms of the
duration of the release or the total quantity of liquid released.
• The report contains an attempt to differentiate between different tank types,
but the numbers of incidents are too small to draw any robust conclusions about
their relative failure frequencies.
UK Guidance
The HSE in the UK gives tank failure frequencies in Land Use Planning guidance [13]:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of
5.0 × 10-6 per tank per year.
• A ‘major failure’ resulting in a release from a hole with a diameter between 500 mm
and 1000 mm, depending on the tank volume, with a frequency of 1.0 × 10-4 per tank
per year.
• A ‘minor failure’ resulting in a release from a hole with a diameter between 150 mm
and 300 mm, depending on the tank volume, with a frequency of 2.5 × 10-3 per tank
per year.
• Roof failure at a frequency of 2.0 × 10-3 per tank per year. This includes all failures
of the roof, including some that could have relatively minor consequences, such as
vapour releases.
• Very similar values are also given in an older HSE publication [14] so are not explicitly
listed here.
This guidance was last updated in 2019 but the storage tank frequencies appear to be
based on work carried out in 2001, and have not changed since at least 2004.
The Netherlands Guidance
Guidance published in The Netherlands [15], [16] includes the following failure modes:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of
5.0 × 10-6 per tank per year.
• A hole sized such that the entire contents of the tank (presumably when full) is
released in 10 minutes, with a frequency of 5.0 × 10-6 per tank per year.
20
Storage incident frequencies
• A release through a 10 mm diameter hole with a frequency of 1.0 × 10-4 per tank per year.
• If the tank has a protective outer shell, then the first two failure modes are reduced to
1.0 × 10-6 per tank per year each. For both modes, it is assumed that the inner shell
has failed and this frequency is split equally between cases where the outer shell is
intact or has failed.
Belgium Guidance
A Belgian publication [17] follows a similar approach, but additional failure modes:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of
5.0 × 10-6 per tank per year.
• A hole sized such that the entire contents of the tank (presumably when full) is
released in 10 minutes, with a frequency of 5.0 × 10-6 per tank per year.
• A large hole with a frequency of 1.4 × 10-4 per tank per year. This is in the range of
40 mm to 350 mm diameter, depending on the maximum connection size, and is
typically around 150 mm to 250 mm diameter
• A medium hole with a frequency of 2.8 × 10-4 per tank per year. This is in the range
of 20 mm to 100 mm diameter, depending on the maximum connection size, and is
typically around 50 mm to 75 mm diameter.
• A small hole with a frequency of 2.4 × 10-3 per tank per year. This is in the range of
5 mm to 15 mm diameter, depending on the maximum connection size, and is
typically around 10 mm diameter.
• The frequencies of the ‘large’, ‘medium’ and ‘small’ holes are reduced by an order of
magnitude for double-walled single containment tanks. The catastrophic failure and
10-minute releases have the same frequencies for singlewalled or double-walled tanks.
American Petroleum Institute
API 353 [18] gives a method for calculating tank-specific failure modes in a relatively
detailed manner. The following failure types are considered:
• Small bottom leaks with a base frequency of 7.2 × 10-3 per tank per year. Several
modifying factors can be applied. This is intended to represent a small leak equivalent
to a circle of up to half an inch (approximately 13 mm) diameter.
• Rapid bottom failure with a base frequency of 2.0 × 10-5 per tank per year. Several
modifying factors can be applied. This is intended to represent catastrophic failure
leading to loss of the entire tank contents.
• Small leaks from the tank shell due to corrosion with a base frequency of 1.0 × 10-4
per tank per year for welded tanks, and 1.0 × 10-3 per tank per year for riveted tanks.
Several modifying factors can be applied. This is intended to represent a small leak
equivalent to a circle of one eighth of an inch (approximately 3 mm) diameter.
• Small leaks from the tank shell due to tank fitting failures, with a frequency 1.0 ×
10-5 per fitting per year (not per tank). Fittings include manways, valves and other
features. No modifying factors are applied. This is represented by holes of one eighth
inch (approximately 3 mm) diameter, and full bore ruptures of the attached pipe.
• Rapid shell failure as a frequency of 1.0 × 10-7 per tank per year if the tank is
maintained according to API 653, and 4.0 × 10-6 per tank per year otherwise.
No modifying factors are applied. This represents a catastrophic failure.
• Floating roof drain leak frequencies are also given.
21
Storage incident frequencies
Discussion
It can be seen that approaches vary across the various guidance documents. The following
approach is taken for the purposes of specifying failure frequencies in Section 2.1:
• The LASTFIRE report [9] is the most transparent and complete dataset that is
available, so it is used as the basis of the suggested frequencies where possible.
However, the general approaches and values suggested elsewhere are taken into
account.
• The total frequency of liquid spills outside the tank shell is consistent with the LASTFIRE
value of 3.97 × 10-4 per tank per year. This is split into major and minor releases like all of
the information summarized above suggests, albeit with different formats.
– The
­
major failure is broadly consistent with the UK [13], Dutch [15], [16] and
Belgian [17] guidance in terms of the magnitude of the release modelled.
– The
­
minor failure is broadly consistent with the Dutch [15], [16] and Belgian
[17] guidance, and with the failure causes listed in API 353 [18], in terms of the
magnitude of the release modelled.
• LASTFIRE is not a large enough dataset to derive a catastrophic tank failure
frequency with any certainty, so the corresponding value is taken from the other
documents, which are all essentially in agreement. The Energy Institute report [10]
is based primarily on the LASTFIRE data and its conclusions are consistent with the
catastrophic tank failure frequency that is given in Section 2.1.
4.1.3 Overfilling
Frequency of Overfilling
The main causes of liquid spill onto the roof are roof fracture and overfill. Results from
the LASTFIRE database [9] suggest that 11% of all leaks outside of storage tanks were
caused by overfilling. There are a large number of variables involved in the mechanism for
overfill. It is therefore recommended that to model overfill effectively would require detailed
analysis using fault tree techniques.
During a recent study, carried out in 2018, a member company of the IOGP conducted
a survey of known atmospheric tank overfills during the preceding 20 years across
approximately 60 of their terminal operations in numerous different countries (the actual
number varied between 33 and 70 by year as assets were bought and sold). The company
also estimated the total number of tank fill operations which were considered to be capable
of overfilling a tank (i.e. receipts from pipelines and large shipping carriers but not fills
from road tankers, for example) over the same period. It was noted that the means of
monitoring and controlling the tank levels varied greatly from facility to facility and during
the time span over which the survey was taken. There was insufficient data to determine
any trends in the data due to these factors, but there were 2 overfill events in a total of
approximately 935,000 fill operations. This corresponds to an overfill frequency of 2.1 × 10-6
per filling operation.
Marsh [19] states that, “Data has been compiled by a reputable operator in the USA that
indicates that overfilling occurs once every 3,300 filling operations.” This rate of overfilling
incidents is over 100 times greater than the experience of the IOGP member company,
22
Storage incident frequencies
possibly due to the site-specific factors. This corresponds to an overfill frequency of 3.0 ×
10-4 per filling operation.
API 353 [18] includes a method for calculating site-specific overfilling frequencies. A base
overfilling rate of 1.0 × 10-4 per filling operation is given, and factors are applied to represent
the filling process, instrumentation and the safety measures that are in place. This results in
a range of possible overfill incident frequencies from 9.0 × 10-7 per filling operation to 6.0 ×
10-4 per filling operation.
Generation of Vapour Clouds
Overfilling incidents involving certain storage tank types and petroleum products with a
high enough fraction of lighter components can lead to the generation of low-lying vapour
clouds. If ignited in the presence of confinement or congestion, it is possible that the
cloud can detonate, leading to severe explosion incidents such as those that occurred at
Buncefield, UK in 2005 and in Jaipur, India in 2009. Analysis of these incidents is beyond the
scope of this report, but the possibility of similar incidents occurring should be considered
on a site-specific basis. The frequency for a particular site is dependent on a number of
factors including the liquids handled, the frequency of tank filling operations, the safety
measures in place and the local weather conditions.
4.2
Refrigerated Storage Tanks
4.2.1 Information Sources
Refrigerated storage tanks operating near atmospheric pressure are used to hold liquids
such as LPG or LNG. These tanks are often considered to have lower failure frequencies
than ambient temperature atmospheric storage tanks, which are discussed in Section 4.1.
Guidance from various commonly used sources is summarized below, with the information
grouped for each tank type.
There is no dataset large enough to derive frequencies of severe failures of refrigerated
storage tanks from historical data with any accuracy. An example of historical data specific
to LNG is discussed in Section 4.2.2, and some of the sources quoted in Sections 4.2.3 to
4.2.6 are applicable specifically to LNG. For the purposes of determining the frequencies
that are given in Section 2.2, LNG and all other refrigerated liquids are treated together.
4.2.2 PHMSA Data
The Pipeline and Hazardous Materials Administration (PHMSA) within the US Department
of Transportation publishes leak data from pipelines and LNG facilities. The raw data is
freely available [20] and was downloaded in January 2021 for the operational period of 2010
to 2019 inclusive. This gives 10 years of data for all LNG facilities in the US, including:
• A list of facilities in operation
• The type of each site
• The number of storage tanks
• The capacities of the storage tanks
• The number of leaks that occurred, in several categories
23
Storage incident frequencies
Although the data set is not large, it is LNG-specific and can be used to check against
traditional oil and gas industry data.
The site on which each leak occurred can be determined, but no information is given about
the nature of the leak. The data does not indicate the number of ignited releases.
There are 26 leaks listed related to LNG storage tanks. Of these, 18 are classified as
equipment failures, 7 are related to construction, installation or fabrication, and 1 is
recorded as ‘other causes’. The leak frequencies derived from this data are summarized in
Table 4.2. The types of sites are described as follows:
• A satellite site is a small facility typically comprising a road or rail LNG offloading area,
horizontal above ground LNG tanks and a vaporisation unit to feed local customers.
• A peak shaving site is used to liquefy natural gas to be stored as LNG during periods
of low use. The LNG is then regasified during periods of high gas use.
• A base load site produces LNG from natural gas throughout the year and includes
LNG storage and export facilities.
• A mobile storage site often consists of LNG trailers or ISO tankers parked at a location.
These sites would not be expected to include fixed refrigerated storage tanks.
Table 4.2: Release Frequencies for LNG Storage Tanks from PHMSA Data [20]
Type of Facility
Exposure (tank-years)
Number of Leaks
Release Frequency
(per tank per year)
Satellite
358
1
2.8 × 10-3
Peak Shaving
1,025
11
1.1 × 10-2
Base Load
580
13
2.2 × 10-2
Mobile/Temporary
116
0
0
Other
66
1
1.5 × 10-2
Total
2,145
26
1.2 × 10-2
It is noted that there is uncertainty in these values, given the small data set, and this does
not indicate the severity of the leaks. However, the leak rates of the tanks on the different
sites are similar. These leak frequencies are relatively high and are likely to be associated
with failures of equipment or fittings associated with storage tanks, rather than leaks from
the tank itself. This dataset is therefore of limited use in determining the frequency of
severe failures of LNG storage tanks.
4.2.3 Single Containment Tanks
UK Guidance
The UK HSE guidance [13] gives values for refrigerated single containment tanks:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of
4.0 × 10-5 per tank per year. This is 8 times higher than the equivalent value for
ambient temperature tanks.
• A ‘major failure’ resulting in a release through a hole with a diameter between 500 mm
and 1000 mm, depending on the tank volume, with a frequency of 1.0 × 10-4 per tank per
year. This is the same as applied to ambient temperature single containment tanks.
24
Storage incident frequencies
• A ‘minor failure’ resulting in a release through a hole with a diameter between
150 mm and 300 mm, depending on the tank volume, with a frequency of 8.0 × 10-5
per tank per year. This is more than a factor of 3 lower than the value specified for
ambient temperature tanks.
• Failures with a release of vapour only at a frequency of 2.0 × 10-4 per tank per year.
This is a factor of 10 lower than that given for ambient temperature tanks.
It is explicitly stated that these values also apply to LNG tanks. This guidance was last
updated in 2019 but the storage tank frequencies appear to be based on work carried out in
2000, and have not changed since at least 2004.
National Fire Protection Association
NFPA 59A [5] concerns the storage and handling of LNG. Failure frequencies are given
for single containment storage tanks, including those containing LNG but also ‘other
hazardous material releases’, so they are assumed to apply to other refrigerated liquids
too. The frequencies given are:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of 1.0
× 10-6 per tank per year. There is a note to consider external events when determining
this failure frequency.
• Steel roof failure at a frequency of 1.0 × 10-4 per tank per year.
Discussion
Although guidance that is specific to refrigerated single containment tanks is limited, it
might be expected that LNG tanks in particular have lower failure rates than the historical
average over all ambient temperature tanks. This is due to the standards followed, the
typical age of these tanks, the operating conditions, the tank designs and other factors.
Within the UK HSE guidance [13], double containment LNG tanks are assumed to fail less
frequently than other double containment refrigerated tanks, as noted in Section 4.2.4.
However, in that guidance, there is no differentiation between single containment LNG
tanks and single containment tanks that hold any other refrigerated liquid. In this context,
the catastrophic failure frequency of 4.0 × 10-5 per tank per year given above for refrigerated
single containment tanks appears to be inconsistent with the value of 5.0 × 10-6 per tank
per year that is recommended in the same UK HSE guidance for oil or petroleum single
containment tanks, for example. In addition, the frequency given for a ‘major failure’ of a
refrigerated single containment tank is larger than that applied to a ‘minor failure’ of the
same tank, which is not intuitive.
The failure frequencies for refrigerated single containment tanks that are given in Section
2.2 are selected bearing in mind the guidance given by the UK HSE [13] and in NFPA 59A
[5], the values recommended for ambient temperature single containment tanks in Section
4.1.2, and the values recommended for double containment refrigerated tanks in Section
4.2.4. The recommended values given by various sources are not all in agreement, so a set
of release frequencies have been specified that is consistent across all tank types. As part
of this process, LNG tanks are not differentiated from other refrigerated storage tanks.
In addition, refrigerated single containment tanks are assumed to take the same failure
frequencies as ambient temperature single containment tanks because the guidance is not
in agreement, with two credible sources recommending higher and lower values.
25
Storage incident frequencies
4.2.4 Double Containment Tanks
UK Guidance
The UK HSE guidance [13] includes values for refrigerated double containment tanks. The
liquid release frequencies are lower than the equivalent values for single containment tanks:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of
5.0 × 10-7 per tank per year.
• A ‘major failure’ resulting in a release through a hole with a diameter between 500
mm and 1000 mm, depending on the tank volume, with a frequency of 1.0 × 10-5 per
tank per year.
• A ‘minor failure’ resulting in a release through a hole with a diameter between 150
mm and 300 mm, depending on the tank volume, with a frequency of 3.0 × 10-5 per
tank per year.
• Failures with a release of vapour only at a frequency of 4.0 × 10-4 per tank per year.
• If the tank contains LNG then the failure frequencies are all a factor of 10 lower.
This guidance was last updated in 2019 but the storage tank frequencies appear to be
based on work carried out in 2000, and have not changed since at least 2004.
Guidance from The Netherlands [15], [16] includes double containment tanks, although the
fluid within the tank does not seem to be relevant:
• Catastrophic failure of the inner and outer shells, leading to an instantaneous or rapid
release at a frequency of 1.25 × 10-8 per tank per year.
• Instantaneous failure of the inner shell with the liquid contained within the outer shell
at a frequency of 5.0 × 10-8 per tank per year.
• A hole sized such that the entire contents of the tank (presumably when full) is released
from the outer shell in 10 minutes, with a frequency of 1.25 × 10-8 per tank per year.
• A hole sized such that the entire contents of the inner shell (presumably when full)
is released into the intact outer shell in 10 minutes, with a frequency of 5.0 × 10-8 per
tank per year.
• A 10 mm diameter hole in the inner tank shell, releasing the liquid into the intact
outer shell, with a frequency of 1.0 × 10-4 per tank per year.
Belgium Guidance
Belgian guidance [17] features failure frequencies for double containment storage tanks
that are summarized in Table 4.3. It is assumed that the inner container is metal, but some
failure modes depend on whether the outer container is metal or concrete. The ‘small’,
‘medium’ and ‘large’ holes depend on the size of the largest connection to the tank, as for
the single containment tanks discussed in Section 4.1.2.
26
Storage incident frequencies
Table 4.3: Failure Frequencies for Double Containment Storage Tanks from Belgian
Guidance [17]
Failure Frequency (per tank per year)
Failure Mode
Metal Outer Container
Catastrophic Failure
Hole Sized for Outflow over 10 minutes
Intact Outer Container
Concrete Outer
Container
Loss of 100% of Contents
5 × 10-7
N/A
Loss of 10% of Contents
N/A
1.3 × 10-8
Loss of 100% of Contents
5 × 10-7
N/A
Loss of 10% of Contents
N/A
1.3 × 10-8
Total Failure of Inner Container
1 × 10-6
1 × 10-7
Large Hole
1.4 × 10-4
1.4 × 10-4
Medium Hole
2.8 × 10-4
2.8 × 10-4
Small Hole
2.4 × 10-3
2.4 × 10-3
National Fire Protection Association
NFPA 59A [5] gives failure frequencies for double containment LNG storage tanks that can
also be applied to similar tanks for other refrigerated liquids:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency
of 1.25 × 10-8 per tank per year. There is a note to consider external events when
determining this failure frequency.
• Steel roof failure at a frequency of 1.0 × 10-4 per tank per year.
Discussion
The frequencies vary slightly across the various information sources. The summary given
in Section 2.2 differentiates between double containment tanks with metal and concrete outer
shells.
Only the UK HSE guidance appears to suggest that holes including spills outside the outer
container should be considered. At the other extreme, NFPA 59A implies that holes do not
need to be considered at all, as they are not mentioned as a potential failure mode. The
guidance from the Netherlands and Belgium suggests that releases through holes into
the outer tank should be considered, so this intermediate approach is taken here as it is
consistent with the description of the tank type, as given in Section 1.2.2.
4.2.5 Full Containment Tanks
UK Guidance
The UK HSE guidance [13] states that the failure frequencies given above for double
containment tanks also apply to full containment tanks, other than the vapour release
frequency can be set to zero.
27
Storage incident frequencies
The Netherlands Guidance
Guidance from The Netherlands [15], [16] includes only one failure mode for full
containment tanks. Catastrophic failure of the inner and outer shells leading to an
instantaneous of the tank’s contents is assumed to occur at a frequency of 1.0 × 10-8
per tank per year.
Belgium Guidance
Belgian guidance [17] features failure frequencies for full containment storage tanks that
are summarized in Table 4.4. It is assumed that the inner container is metal, but the failure
modes depend on whether the outer container is metal or concrete.
Table 4.4: Failure Frequencies for Full Containment Storage Tanks from Belgian Guidance [17]
Failure Frequency (per tank per year)
Failure Mode
Metal Outer Container
Catastrophic Failure
Hole Sized for Outflow over 10 minutes
Concrete Outer
Container
Loss of 100% of Contents
5 × 10-7
N/A
Loss of 10% of Contents
N/A
5 × 10-9
Loss of 100% of Contents
5 × 10-7
N/A
Loss of 10% of Contents
N/A
5 × 10-9
National Fire Protection Association
NFPA 59A [5] gives failure frequencies for full containment refrigerated storage tanks:
• Catastrophic failure leading to an instantaneous or rapid release at a frequency of 1.0
× 10-8 per tank per year. There is a note to consider external events when determining
this failure frequency.
• Steel roof failure at a frequency of 4.0 × 10-5 per tank per year.
Discussion
The frequencies of catastrophic failure are similar in all the sources. As for double
containment tanks, the Belgian guidance differentiates between metal and concrete outer
containers. The UK HSE guidance mentions holes in the tank walls, which are treated the
same way as for double containment tanks, but this is likely intended to apply to tanks with
steel outer containers. Holes are not mentioned in the guidance from The Netherlands
and NFPA 59A, so it is implied that they do not need to be considered, presumably for
tanks with concrete outer containers. For consistency with the approach applied to double
containment tanks, it is assumed that releases from the inner tank into the outer shell
are possible, but that these events do not need to be considered within risk assessments
as they would not lead to loss of containment outside the gas-tight outer container. The
recommended release frequencies are summarized in Section 2.2.
28
Storage incident frequencies
4.2.6 Membrane Storage Tanks
The Netherlands Guidance
Guidance from The Netherlands [15], [16] includes membrane tanks:
• Catastrophic failure of the inner and outer shells, leading to an instantaneous release
of the entire contents at a frequency of 1.0 × 10-8 per tank per year.
National Fire Protection Association
NFPA 59A [5] gives failure frequencies for membrane storage tanks:
• Catastrophic failure leading to an instantaneous or rapid release of the entire
contents at a frequency of 1.0 × 10-8 per tank per year.
• Steel roof failure at a frequency of 4.0 × 10-5 per tank per year.
Discussion
The two sources are in agreement and these values are used in Section 2.2. Frequencies of
less severe failures are not given in these data sources, which implies that they do not need
to be considered.
4.2.7 Underground Storage
The Netherlands Guidance
Guidance from The Netherlands [15], [16] includes the same failure frequency of 1.0 × 10-8
per tank per year for underground and mounded storage tanks. Mounded storage tanks are
assumed to suffer a total loss of contents like an above ground tank. Underground tanks
are assumed to form a liquid pool the size of the tank, from which evaporation occurs.
Belgium Guidance
The Belgian guidance document [17] gives the following failure frequencies for
underground or mounded storage tanks:
• Catastrophic failure leading to an instantaneous release, or release of the contents
over a few seconds, at a frequency of 5.0 × 10-9 per tank per year.
• A hole sized such that the entire contents of the tank is released in 10 minutes,
with a frequency of 5.0 × 10-9 per tank per year.
Discussion
Smaller holes are not mentioned in either guidance document, but they are unlikely to be
a safety concern for releases into the ground. There could be environmental implications
of such a leak.
The failure frequencies are used in Section 2.5.1.
29
Storage incident frequencies
4.3
Pressurized Storage Vessels
4.3.1 Accident Source Data
Historical Data
Lees [1] lists several major accidents involving large storage vessels including:
• Ruptures, BLEVEs and leaks of LPG tanks, including the well-known Feyzin and
Mexico City disasters.
• The rupture of an ammonia tank at Potchefstroom, South Africa on 13th July 1973
that caused 18 fatalities.
• A leak from a chlorine tank at Baton Rouge, Louisiana, USA on 10th December 1976.
There were no fatalities but 10,000 people were evacuated.
Major accidents involving medium storage vessels listed by the latest and earlier versions
of Lees [1] include:
• Leak from an LPG tank at Wealdstone, Middlesex, UK on 20th November 1980.
• Leak of methyl isocyanate (MIC) from a tank at Bhopal, India on 3rd December 1984.
A 46 m3 refrigerated stainless steel pressure vessel containing MIC suffered a release
through the relief valve. The release may have been due to entry of water causing an
exothermic reaction that increased the temperature and pressure until the relief valve
lifted. The cloud of toxic gas caused thousands of injuries and fatalities among nearby
residents, and long-term health effects for many thousands of additional people.
• Rupture of a CO2 tank at Worms, Germany on 21st November 1988.
• Rupture of an ammonia tank in Dakar, Senegal in March 1992, causing 41 fatalities.
Gould [21] lists 16 failures of chlorine tanks in the range 4 to 30 tonnes.
BLEVE Failures
Some information involving Boiling Liquid Expanding Vapour Explosion (BLEVE) incidents
is available.
In the UK, only one BLEVE of a fixed LPG vessel is known (a domestic vessel of less than
1 tonne capacity, at Kings Ripton in 1988) in a population of approximately 925,000 vessel
years up to 1989 [22]. This indicates a BLEVE frequency of around 1 × 10-6 per vessel per
year. An earlier published estimate was around an order of magnitude lower, with some
sensitivity to site-specific parameters [23]. Based on a population of 132,000 vessels in 1991
[24], the exposure up to the end of 1998 can be estimated as 2,113,000 vessel years, giving
a frequency of around 5 × 10-7 per vessel per year. Since 98% of the exposure relates to
vessels under 5 tonnes capacity, this is more appropriate for medium storage vessels.
There were at least 25 large storage spheres world-wide subjected to fire impingement
during between 1955 and 1987, of which 12 were destroyed by BLEVE. This gives a BLEVE
frequency of approximately 1 × 10-5 per vessel per year [25]. This value does not take
account of design improvements that resulted from these events. Few BLEVEs of storage
vessels have been reported since 1984. Therefore, the current frequency should be lower.
30
Storage incident frequencies
4.3.2 Generic Frequency Values
Spontaneous Failures of Fixed Pressure Vessels
The HSE in the UK [13] has published failure frequencies that should be used for pressurized
vessels in land use planning assessments. It does not differentiate between process and
storage vessels. The values are summarized in Table 4.5. It is not clear why the different types
of vessels are discussed separately as the release frequencies are very similar in all cases. This
guidance was last updated in 2019 but these frequencies have not changed since at least 2004.
Table 4.5: Release Frequencies for Pressure Vessels [13]
Release Frequency (per vessel per year)
Failure Mode
General Vessels
Chlorine
LPG
Spherical
Catastrophic
2 × 10-6 to 6 × 10-6
2 × 10-6
2 × 10-6
2 × 10-6 to 6 × 10-6
50 mm Hole
5 × 10-6
5 × 10-6
5 × 10-6
5 × 10-6
25 mm Hole
5 × 10-6
5 × 10-6
5 × 10-6
5 × 10-6
13 mm Hole
1 × 10-5
1 × 10-5
1 × 10-5
1 × 10-5
6 mm Hole
4 × 10-5
4 × 10-5
4 × 10-5
The following failure frequencies for pressurized storage vessels are given in guidance from
The Netherlands [15], [16]:
• Instantaneous release of the entire contents at 5 × 10-7 per vessel per year.
• Release of entire contents in 10 minutes at a constant rate at 5 × 10-7 per vessel per year.
• Release of entire contents through a 10 mm hole at 1 × 10-5 per vessel per year.
The same frequencies are applied to above ground or mounded pressure vessels, although
the consequences would be expected to be different. In particular, it is noted that BLEVE
failures would not be expected to be possible for mounded vessels [15], [16].
Guidelines published by the Flemish Government in Belgium [17] give the following failure
rates for pressurized storage vessels:
• Instantaneous release of the entire contents at 3.2 × 10-7 per vessel per year for above
ground vessels, and 1.6 × 107 per vessel per year for mounded vessels.
• Release of entire contents in 10 minutes at a constant rate at 3.2 × 10-7 per vessel per
year for above ground vessels, and 1.6 × 10-7 per vessel per year for mounded vessels.
• Large leak at 1.1 × 10-6 per vessel per year. This represents holes over 50 mm
diameter and depends on the largest connection size.
• Medium leak of 25 mm diameter at 1.0 × 10-5 per vessel per year.
• Small leak of 10 mm diameter at 5.5 × 10-5 per vessel per year.
NFPA 59A [5] includes suggested failure frequencies for pressurized storage vessels:
• Instantaneous release of the entire contents at 5 × 10-7 per vessel per year. This
can be reduced to a value of 1 × 108 per vessel per year if the vessel is constructed
according to particular requirements.
• Leak of 10 mm diameter at 1 × 10-5 per vessel per year.
31
Storage incident frequencies
Note that process pressure vessels are not considered here as they are within the scope of
document 434-01 within the Risk Assessment Data Directory [2]. The failure frequencies for
pressurized storage vessels given in Section 2.3 are in the same format as those specified for
pressurized process vessels within document 434-01, for consistency. Based on the guidance
summarized above, it would be expected that the failure rates of storage vessels would be
lower than those applied to process vessels, so all of the release frequencies are reduced by
a factor of 25 to be broadly consistent with the various data sources discussed above.
BLEVE Data
The likelihood of a BLEVE for a given pressurized storage vessel containing hydrocarbons
depends on its fire protection measures and the site layout. This is best addressed using
a site-specific approach, with modelling of possible fire scenarios and their impact on
the tank. The response of the tank to fire loading can be determined, taking into account
factors such as vessel construction and wall thickness, the fluid contained within it,
the operating conditions, and the presence of protective measures such as passive fire
protection and pressure relief systems.
However, the HSE in the UK [13] suggests a value of 1 × 10-5 per vessel per year for
hydrocarbon vessels for use in land use planning studies for new onshore sites. Mounding
or burying a pressure vessel is considered to significantly reduce the possibility of a BLEVE
failure, if not remove it completely. BLEVE failures of buried or mounded storage vessels
would be expected to occur at a frequency at least two orders of magnitude lower than for
an above ground vessel.
BLEVEs of liquid hydrogen vessels are possible but there is insufficient operational data
to derive an appropriate generic frequency. A site-specific approach should be used to
determine a value. The mechanism is similar to that of a vessel containing hydrocarbons,
although the thermodynamic behaviour of hydrogen is different to that of hydrocarbons, so
that should be taken into account.
BLEVEs of pressurized carbon dioxide vessels are possible without an external fire as
the initiating event. In this case the mechanism is different to that experienced with
hydrocarbon vessels. As experience with hydrocarbon vessels cannot be applied directly, a
site-specific approach is required.
ISO Tankers
Release frequencies for ISO tanks are given in the UK HSE guidance [13], as summarized in
Table 4.6. The frequencies ‘per vessel per year’ should be applied for the proportion of time
that the ISO tank is present, in addition to the ‘per lifting operation’ frequency for every tank
movement.
32
Storage incident frequencies
Table 4.6: Release Frequencies for ISO Tank Containers [13]
Release Frequency
Failure Mode
per vessel per year
Catastrophic Failure
Liquid Release
per lifting
operation
Without Pressure Relief
4 × 10-6
3 × 10-8
With Pressure Relief
3 × 10-6
3 × 10-8
50 mm Diameter Hole
3 × 10-5
6 × 10-7
25 mm Diameter Hole
3 × 10-5
N/A
13 mm Diameter Hole
6 × 10-5
N/A
4 mm Diameter Hole
3 × 10-4
N/A
5 × 10
N/A
Vapour Release through 50 mm Hole
-4
These release frequencies are summarized in Section 2.3.
Small Vessels
The ‘Purple Book’ [15] gives a catastrophic failure frequency of gas cylinders as 1 × 10-6 per
cylinder per year. This is assumed to apply to small pressurized cylinders, such as those
filled with acetylene and used for welding, or small LPG cylinders used for camping and as
fuel supplies to some domestic properties.
Guidelines published in Belgium [17] give the following failure rates for small pressurized
storage vessels and cylinders:
• Instantaneous release of the entire contents of a gas cylinder at 1.1 × 10-6 per cylinder
per year. This applies to containers with a maximum volume of 150 litres.
• For small pressure vessels with volumes between 150 litres and 1,000 litres (or 1 m3),
instantaneous release of the entire contents at 1.1 × 10-6 per vessel per year.
• For small pressure vessels with volumes between 150 litres and 1,000 litres (or 1 m3),
a leak from the largest connection at 1.1 × 10-5 per vessel per year.
4.4
Non-Process Storage
4.4.1 Onshore
Fixed Storage Tanks
The HSE in the UK [13] has published recommended failure frequencies for onshore, metal
or plastic atmospheric tanks of volume less than 450 m3. This is often appropriate to nonprocess storage tanks. The values are reproduced in Table 4.7. Note that the HSE guidance
document does not give full details, but it’s clear that the non-flammable and flammable
fluids are deliberately treated separately due to differences in the typical tank designs.
33
Storage incident frequencies
Table 4.7: Release Frequencies for Small Atmospheric Tanks [13]
Release Frequency (per tank per year)
Failure Mode
Description
Catastrophic
Non-Flammable
Contents
Flammable
Contents
Instantaneous release, or release of the contents
over a few seconds
8.0 × 10-6
1.6 × 10-5
Large
Large hole leading to loss of the contents over
5 minutes (maximum of 250 mm)
5.0 × 10-5
1.0 × 10-4
Small
Small hole leading to loss of the contents over
30 minutes (maximum of 75 mm)
5.0 × 10-4
1.0 × 10-3
The guidance published in The Netherlands [15], [16] does not differentiate between
storage tanks based on size. The following failure frequencies for single containment
atmospheric storage tanks are given:
• Instantaneous release of the entire contents at 5 × 10-6 per tank per year.
• Release of entire contents in 10 minutes at a constant rate at 5 × 10-6 per tank per
year.
• Release of entire contents through a 10 mm hole at 1 × 10-4 per tank per year.
Methanol is given as an example of the liquids that are stored in these tanks, so the
guidance can be interpreted as applying to non-process storage as well as product storage.
However, although it is not explicitly stated, it is likely that these failure frequencies were
intended to apply to large storage tanks, such as those considered in Section 4.1. Therefore,
it is recommended that the HSE values in Table 4.7 are applied to onshore nonprocess
tanks, as noted in Section 2.4.
Portable Containers
The UK HSE guidance [13] contains release frequencies for various types of portable
containers. Each of these types of container has multiple failure modes that depend on
the number of units present and the frequency of handling operations. There is too much
information to reproduce here, but the following containers are discussed:
• Drums of 1 tonne capacity. Includes catastrophic failures at a frequency of 2 × 10-6
per drum per year, which is consistent with the values applied to pressurized storage
vessels, as noted in Section 4.3.2. Various holes, valve and coupling failures are also
discussed.
• Steel drums of 210 litre capacity stored on pallets. Catastrophic and ‘major’ failures
are discussed, including releases from two drums simultaneously. The release
frequencies are based on the ‘throughput’ of the site, which appears to refer to the
number of forklift handling operations.
• Intermediate Bulk Containers (IBCs). Release frequencies are given in terms of the
number of containers in storage and the number of containers passing through the
site per year:
34
Storage incident frequencies
– Catastrophic
­
failures at 1.4 × 10-5 per IBC per year stored, plus 7.1 × 10-5 per IBC
passing through per year.
– 10
­ mm holes at 1.3 × 10-5 per IBC per year stored, plus 1.13 × 10-4 per IBC
passing through per year.
– 5
­ mm holes at 5.2 × 10-5 per IBC per year stored, plus 9.3 × 10-4 per IBC passing
through per year.
• Portable steel containers, typically of 1 m3 volume and pressurized to around 5 bar.
Three failures modes are considered:
– Catastrophic
­
failures at a frequency of 2.0 × 10-6 per container per year, based
on the average number of containers present.
– ­Holes of 10 mm diameter at a frequency of 1.2 × 10-6 per container movement.
– ­Hole of 5 mm diameter at a frequency of 5.0 × 10-6 per container movement.
• Cylinders and small containers are mentioned but not failure frequencies are given.
The ‘Purple Book’ [15] includes frequencies of releases from small storage containers
in warehouses. The frequency of a liquid spill of the entire contents is given as 1 × 10-5
per handling operation, but there is little context concerning the types of containers this
represents.
The Belgian guidance [17] includes failure frequencies for pressurized containers up to 1
m3 volume, as noted in Section 4.3.2. It also includes general mobile containers, including
those with hazardous contents. Three release frequencies are given:
• Releases at a frequency of 2.5 × 10-5 per unit per year when in storage.
• Releases at a frequency of 2.5 × 10-5 per handling operation involving one container.
• Releases at a frequency of 2.5 × 10-6 per handling operation involving all containers on
a pallet, if relevant.
Some failure frequencies of portable storage containers are summarized in Section 2.4.1,
based on these sources.
4.4.2 Offshore
UK HSE Analysis
The HSE published details of releases recorded in the Hydrocarbon Releases Database that
occurred in the UK sector of the North Sea between October 1992 and March 1999 [26].
The releases are reported in a variety of ways, including 2,335 system-years of exposure
for diesel systems. Table 4.8 summarizes the failure frequency for each category based on
this exposure. Clearly there is some uncertainty in these values as the numbers of releases
in most categories are small, but this gives an indication of the overall failure rate and the
distribution of hole sizes.
35
Storage incident frequencies
Table 4.8: Diesel System Release Data [26]
Failure Size
Number of Releases
Release Frequency (per system per year)
Up to 10 mm Hole
44
1.9 × 10-2
10 to 25 mm Hole
9
3.8 × 10-3
25 to 50 mm Hole
4
1.7 × 10-3
50 to 75 mm Hole
3
1.3 × 10-3
75 to 100 mm Hole
0
0
Over 100 mm Hole
3
1.3 × 10-3
N/A
1
4.3 × 10-4
Total
64
2.7 × 10-2
It is noted that this includes diesel pipework and other equipment such as pumps, but each
system is assumed to include one storage tank per system, and hence there were 2,335
tank-years of exposure. The majority of the pipework within the diesel systems would be
expected to be small diameter. The frequency associated with all holes of at least 50 mm
diameter is 3.0 × 10-3 large releases per system per year but some of these release could
be associated with equipment other than the storage tank. Assuming that half of these
large releases are associated with storage tanks gives a frequency of releases of at least 50
mm diameter of 1.5 × 10-3 per tank per year.
The same data is also reported as 1 ‘major’ release, 27 ‘significant’ releases and 36 ‘minor’
releases. These three categories are clearly defined in the report, and it is likely that the
‘major’ release was associated with a storage tank. This suggests that the failure frequency
should be at least 4.3 × 10-4 per tank per year, but could be higher depending on the
number of ‘significant’ releases that were associated with tanks, rather than the associated
pipework and equipment.
Updated Analysis
The Hydrocarbon Releases Database has been examined for releases recorded between
1992 and 2015 to determine an appropriate hole size distribution for releases from nonprocess systems. The overall release frequency of the systems was based on a 10-year
period from 2006 to 2015 to take credit for the trend for decreasing release rates over time.
The results of this analysis are summarized in Table 4.9. As above, these values apply to the
systems as a whole, rather than just the storage tanks.
Table 4.9 :Non-Process System Release Data
Failure Size
Release Frequency (per system per year)
1 to 10 mm Hole
1.9 × 10-3
10 to 25 mm Hole
1.1 × 10-3
25 to 50 mm Hole
7.9 × 10-4
50 to 75 mm Hole
4.0 × 10-4
75 to 100 mm Hole
1.3 × 10-4
Over 100 mm Hole
4.6 × 10-4
36
Storage incident frequencies
This analysis suggests that the release frequencies are lower than calculated from the data
that was collected between October 1992 and March 1999.
Discussion
Many diesel storage tanks offshore are constructed in a similar way to pressure vessels, as
opposed to onshore atmospheric pressure storage tanks, even though they operate at low
pressure. Process pressure vessels are not considered in this document but their failure
frequencies are given within document 434-01 of the Risk Assessment Data Directory
[2]. In order to obtain a robust hole size distribution, the failure frequencies for offshore
non-process storage tanks given in Section 2.4.2 is in the same format as those specified
for pressurized process vessels within document 434-01, for consistency. Based on the
historical data summarized above, the release frequencies for pressurized vessels within
each hole size range are increased by a factor of 5 to give approximately the correct total
frequency of large releases when compared with Table 4.9.
It is assumed that other non-process fluids such as methanol are stored in similar types of
tanks and therefore the same release frequencies can be applied.
4.5
Onshore Underground Storage
Hazardous incidents have occurred involving onshore underground cavern storage facilities
[27], [28], [29], including the following:
• 21st September 1978 – West Hackberry, Louisiana, USA.
• 3rd October 1980 – Mont Belvieu, Texas, USA.
• 7th April 1992 – Brenham, Texas, USA.
• 17th January 2001 – Hutchinson, Kansas, USA.
• 26th August 2001 – Fort-Saskatchewan, Canada.
• 19th August 2004 – Liberty County, Texas, USA.
• 23rd October 2015 – Aliso Canyon, California, USA.
Some of these incidents involved failures of the wells and above ground equipment,
resulting in releases much like any other major accident hazard that is represented within
a QRA. Other incidents involved underground gas leaks that migrated through the soil, in
at least one case over a distance of several miles. These types of incidents are not typically
included in site QRAs, but are nevertheless part of the overall risk posed by the operation of
this type of storage site.
A research report published by the HSE in the UK [29] includes a summary of information
regarding the frequency of underground storage cavity failures. Although the data is
now around 20 years old, the basis is clear and the number of events and assumed
operational experience is stated. Table 4.10 summarizes the frequencies of major releases
from underground storage cavities, as derived in the report. Table 4.11 summarizes the
frequencies of failures of the well pipework between the underground cavity and the surface.
37
Storage incident frequencies
Table 4.10: Summary of Release Frequencies for Onshore Underground Cavities [29]
Salt Caverns
Depleted Oil/Gas Fields
Europe
Worldwide
Europe
Worldwide
1*
2
1*
6
Upper Bound
65,000
83,000
153,000
860,000
Lower Bound
24,000
59,000
81,000
603,000
Lower Bound
1.5 × 10-5
2.4 × 10-5
6.5 × 10-6
7.0 × 10-6
Upper Bound
4.1 × 10-5
3.4 × 10-5
1.2 × 10-5
9.9 × 10-6
Number of Cavity Failures
Operating Experience (wellyears)
Release Frequency (per well per year)
* No failures had been recorded for European sites, so one failure was assumed for the purposes of calculating a release
frequency. This over-estimates the release frequency.
Table 4.11: Summary of Release Frequencies from Onshore Wells [29]
Salt Caverns
Depleted Oil/Gas Fields
Europe
Worldwide
Europe
Worldwide
1*
10
1*
5
Upper Bound
65,000
83,000
153,000
860,000
Lower Bound
24,000
59,000
81,000
603,000
Lower Bound
1.5 × 10-5
1.2 × 10-4
6.5 × 10-6
5.8 × 10-6
Upper Bound
4.1 × 10-5
1.7 × 10-4
1.2 × 10-5
8.3 × 10-6
Number of Well Failures
Operating Experience (wellyears)
Release Frequency (per well per year)
* No failures had been recorded for European sites, so one failure was assumed for the purposes of calculating a release
frequency. This over-estimates the release frequency.
The releases represented by both tables are appropriate for underground releases. These
events are an environmental issue, rather than an immediate hazard that could cause harm
to people. It is recommended that the above ground equipment on an underground storage
site is treated like any other process equipment, using the failure frequencies given in
document 43401 within the Risk Assessment Data Directory [2].
These frequencies given in the tables above are used as a basis for the recommended
values that are given in Section 2.5.3.
Values for blowouts of offshore wells are given in document 434-02 within the Risk
Assessment Data Directory [30].
4.6
Oil Storage on FPSOs
A 1990 study by Technica [31] obtained a frequency of fires/explosions on oil tankers over
6,000 GRT of 2.2 × 10-3 per tanker per year from IMO data [32] for the period from 1982 to
1986. This frequency was adjusted assuming the cargo oil tank fire frequency is related to
the number of tanks, and hence the tanker frequency was reduced by 50% (for an average
of 6 tanks on a FPSO compared with typically 12 on tankers). A further 20% reduction was
applied to reflect the historical trend in risk between 1972 and 1986 to obtain a frequency of
8.8 × 10-4 per FPSO per year for cargo tank fires/explosions.
38
Storage incident frequencies
Based on data published by the HSE [33], there had been no fire/explosion incidents on
FPSOs operating on the UK Continental Shelf up to 2005. There had been 2 incidents
involving cargo tanks: one involved overfilling and the other involved spilling liquid nitrogen
onto the deck (above a tank), which consequently cracked. Both of these events can be
considered to be due to human error. Ignition occurred in neither case. There have been no
incidents of FPSO cargo oil tank releases up to 2005 [33] other than due to human error.
The University of Lisbon [34] examined the same dataset of offshore incidents on the UK
Continental Shelf between 1980 and 2005. The analysis can be summarized as follows:
• The operation of 16 FPSOs and 6 FSUs in this period gave 170 unit-years of
experience.
• There were 508 events, covering a range of consequences, within this operational
experience, with 483 occurring on FPSOs and 25 occurring on FSUs.
• These 508 events included 19 ‘accidents’ with severe consequences, 340 ‘incidents’
with minor damage or injuries, and 149 events that were near misses or had
insignificant consequences. The number of events associated with the storage tanks
is not specified.
• Within these 508 events, 321 were spills or releases, 44 were fires and 2 were
explosions. Again, it is not clear if the storage tanks were involved in these events.
However, it is stated that 6 of the ‘accidents’ were spills or releases, 1 was a fire and 1
was an explosion.
• This analysis gives a frequency of severe spills or releases of 3.5 × 10-2 per unit per
year, and a frequency of 1.2 × 102 per unit per year for fires or explosions. However,
it should be noted that the sources of these releases are not given, and the data set
is relatively small. It might be expected that releases from the storage tanks would
make up a small proportion of all events.
DNV [35] analysed historical records of incidents involving explosions in the storage tanks of
FPSOs and oil tankers between 1980 and 2013. The following points are noted:
• There is relatively little operational experience of FPSOs, and no fires or explosions
have occurred in FPSO storage tanks.
• There are approximately 2,000 large oil tankers in services, so the operational history
is much greater than that of FPSOs. Incidents involving oil tankers occurring between
1980 and 2013 were examined, and 88 fires/explosions were identified.
• Although there is some randomness in the number of incidents occurring from
year to year, there is a clear trend in the reduction of incident frequency over
time, especially since around 1995. This is likely due to a combination of design
improvements and safety features being incorporated.
• The analysis for double hull tankers gives 8 serious incidents over 20,491 ship-years
of operation. This gives a frequency of storage tank fires/explosions of 3.9 × 10-4 per
tanker per year. This is considered to be representative of FPSO operations, although
various differences between FPSO and tanker operations are noted that could
increase or decrease this value.
• This value can be halved if tank cleaning and repair are excluded from the scope of an
assessment.
39
Storage incident frequencies
The World-wide Offshore Accident Databank (WOAD) [36] contains 12 events in the North
Sea involving the key word ‘storage’ between 1st January 1970 and 22nd January 2015. Of
these, only one that occurred in 1986 represents a small release of crude oil from a storage
tank on a FPSO. Two others represent releases of crude oil from shuttle tankers.
From the same database, there are 197 events listed between 1st January 1970 and 22nd
January 2015 that involved FPSOs and Floating Storage Units (FSUs). The majority of these
are not related to storage tanks. The following events are relevant and involved a loss of
containment of a storage tank:
• One event involved an oil leak from an FSU storage tank.
• Two events involved an oil leak from a FPSO storage tank.
• One event involved an oil leak, but probably from a related pipeline rather than a
storage tank.
• Two events involved gas leaking from a crude oil tank.
In addition, these events are ‘near misses’ that are the types of incidents that could have
led to a storage tank failure, but did not:
• Five events involved the collision of a shuttle tanker with a FPSO, but no storage tank
failure.
• One event involved a mooring failure of a FPSO and a subsequent collision with a
platform.
• One event involved the overpressurisation of a crude oil storage tank during production.
• Two events involved extreme sea conditions that caused damage to a FPSO.
This information does not directly give an indication of failure frequencies. However, Oil &
Gas UK [37] published an analysis of offshore accidents that occurred between 1990 and
2007, based on WOAD and other databases, which can be summarized as follows:
• The data includes exposure of 149.2 unit-years for FPSOs and 52.8 unit-years for FSUs.
• A total of 603 incidents are reported on FPSOs, giving a frequency of 4.1 incidents per
FPSO per year. However, this includes events of various severities.
• Breakdowns are given of the number of events in various categories, but it is not
possible to determine if storage tank failures were involved.
Confidential information was supplied by a member company of the IOGP concerning 14
FPSOs operating for 4 years between January 2017 and December 2020:
• Of the events associated with the cargo tanks, 33 involved a release of crude oil or oily
water and 10 involved a release of hydrocarbon gas. There were additional releases on
non-hazardous material that are not included here.
• One incident involved accidental ingress of an estimated 50 tonnes of crude oil into
the slop oil tank during an offloading operation. This is not a loss of containment
event where oil was lost to the surrounding sea.
• From the remaining crude oil events, the largest release was around 120 kg, with
29 of the 33 liquid releases being less than 25 kg. None of the events represent
significant failures of the storage tanks themselves.
• No fires or explosions are recorded.
The recommended fire/explosion event frequencies for storage tanks on FPSOs are given in
Section 2.6 based on the studies summarized above.
40
Storage incident frequencies
5. References
[1]Mannan, S. 2005. Lees’ Loss Prevention in the Process Industries, 3rd Edition, Elsevier
Butterworth-Heinemann, ISBN 0-7506-7555-1.
[2]International Association of Oil & Gas Producers 2021. Risk Assessment Data Directory,
Process Release Frequencies, Report 434-01, Version 1.1.
[3]EN 1473: 2021. Installation and Equipment for Liquefied Natural Gas – Design of Onshore
Installations.
[4]EN 14620-1: 2006. Design and Manufacture of Site Built, Vertical, Cylindrical, Flatbottomed Steel
Tanks for the Storage of Refrigerated, Liquefied Gases with Operating Temperatures between 0
°C and -165 °C - Part 1: General.
[5]NFPA 59A: 2019. Standard for the Production, Storage, and Handling of Liquefied Natural Gas
(LNG), National Fire Protection Association.
[6]Rath, S. and Krol, M. 2013. Comparative Risk Assessment for Different LNG-Storage Tank
Concepts, Chemical Engineering Transactions, Vol. 13.
[7]International Association of Oil & Gas Producers 2021. Risk Assessment Data Directory,
Ignition Probabilities, Report 434-06, Version 1.1.
[8]Energy Institute 2014. A Comparison of Risks Related to the Storage of Hydrocarbons in
Above-Ground and Underground Tanks at Petrol Filling Stations, 1st Edition, ISBN 978 0
85293 693 1.
[9]LASTFIRE 2012. LASTFIRE Project Update, Large Atmospheric Storage Tank Fire Project,
Incident Survey for 1984-2011.
[10]Energy Institute 2017. Research Report: Atmospheric Pressure Above-Ground Storage Tank Loss
of Containment Incidents Involving Petroleum, Petroleum Products, or Other Fuels, 1st Edition.
[11]US Chemical Safety and Hazard Investigation Board 2015. Final Investigation Report,
Caribbean Petroleum Tank Terminal Explosion and Multiple Tank Fires, Report 2010.02.I.PR.
[12]LASTFIRE 2016. LASTFIRE Boilover Research, Position Paper and Practical Lessons Learned,
Issue 3.
[13]HSE 2019. Failure Rate and Event Data for use within Risk Assessments (02/02/19), no version
number given.
[14]HSE 2001. Failure Rates for Atmospheric Storage Tanks for Land Use Planning, RAS/01/06.
[15]Rijksinstitut voor Volksgezondheid en Milieu 2005. Guidelines for Quantitative Risk
Assessment, Part One: Establishments, CPR 18E, ‘Purple Book’.
[16]Rijksinstitut voor Volksgezondheid en Milieu 2015. Handleiding Risicoberekeningen Bevi,
Version 3.3.
41
Storage incident frequencies
[17]Flemish Department of the Environment 2019. Handbook Riscioberekeningen, Richtlijnen voor
Kwantitatieve Riscioanalyse, Indirecte Risico’s en Milieurisicoanalyse, Version 2.0.
[18]API 353: 2006. Managing Systems Integrity of Terminal and Tank Facilities, Managing the Risk of
Liquid Petroleum Releases, 1st Edition, American Petroleum Institute.
[19]Marsh 2015. Risk Engineering Position Paper – 01, Atmospheric Storage Tanks.
[20]Pipeline and Hazardous Materials Safety Administration, Gas Distribution, Gas Gathering, Gas
Transmission, Hazardous Liquids, Liquefied Natural Gas (LNG), and Underground Natural Gas
Storage (UNGS) Annual Report Data, accessed 27th January 2021,
https://www.phmsa.dot.gov/data-and-statistics/pipeline/gas-distribution-gas-gatheringgas-transmission-hazardous-liquids.
[21]Gould, J. 1993. Fault Tree Analysis of the Catastrophic Failure of Bulk Chlorine Vessels, AEA
Technology, Report SRD/HSE/R603, London: HMSO.
[22]HSE Advisory Committee on Dangerous Substances 1991. Major Hazard Aspects of the
Transport of Dangerous Substances, ISBN 0 11 885676 6.
[23]Blything, K.W. and Reeves, A.B. 1988. An Initial Prediction of the BLEVE Frequency of a 100 TE
Butane Storage Vessel, Safety and Reliability Directorate, Report SRD/HSE/R 488.
[24]Sooby, W. & Tolchard, J.M. 1993. Estimation of Cold Failure Frequency of LPG Tanks in Europe,
Conference on Risk & Safety Management in the Gas Industry, Hong Kong.
[25]Selway, M. 1988, The Predicted BLEVE Frequency of a Selected 200 m3 Butane Sphere on a
Refinery Site, SRD Report R492.
[26]HSE 2000. Offshore Hydrocarbon Release Statistics, 1999, Offshore Technology Report OTO
1999 079.
[27]Bérest, P. and Brouard, B. 2003. Safety of Salt Caverns used for Underground Storage, Oil & Gas
Science and Technology – Revue d’IFP Energies Neuvelles, Volume 58, No. 3, pp 361-384.
[28]U.S. Department of Transportation, Pipeline and Hazardous Materials Safety Administration,
accessed 17th March 2021, Underground Natural Gas Storage Incidents,
https://hazmat.dot.gov/pipeline/underground-natural-gas-storage/ungs-major-incidents
[29]Keeley, D. 2008. Failure Rates for Underground Gas Storage, Health and Safety Laboratory,
Research Report RR671.
[30]International Association of Oil & Gas Producers 2019. Risk Assessment Data Directory,
Blowout Frequencies, Report 434-02, Version 1.0.
[31]Technica, 1990. Port Risks in Great Britain from Marine Transport of Dangerous Substances in
Bulk: A Risk Assessment, Report for The Health & Safety Executive, Project No. C1216.
[32]IMO, 1987. Casualty Statistics, Report of the Steering Group, Annexes 1 – 3 (Analyses of
Casualties to Tankers, 1972-1986), MSC 54/INf 6, 26.
[33]Det Norkse Veritas 2007. Accident Statistics for Floating Offshore Units on the UK Continental
Shelf 1980-2005, Health & Safety Executive, Research Report RR567.
42
Storage incident frequencies
[34]Bhardwaj, U. and Teixeira, A. P. and Guedes Soares, C. 2017. Analysis of FPSO Accident and
Incident Data, from Progress in the Analysis and Design of Marine Structures, 1st Edition.
[35]Spouge, J. 2017. Storage Tank Explosion Frequencies on FPSOs, Hazards 27, 10th to 12th May
2017, Birmingham, UK.
[36]WOAD. World Offshore Accident Database, DNV, incident data from 1st January 1970 to 22nd
January 2015.
[37]Oil & Gas UK 2009. Accident Statistics for Offshore Units on the UKCS 1990-2007, Issue 1.
43
This document is part of the Risk
Assessment Data Directory (RADD)
and presents frequencies of
releases from the following types
of storage: atmospheric storage
tanks, refrigerated storage tanks,
pressurized storage vessels, nonprocess storage, underground
storage, and oil storage on floating
production, storage and offloading
units (FPSOS).
The objective of the Risk Assessment
Data Directory is to provide data
and information that can be used to
improve the quality and consistency
of risk assessments with readily
available benchmark data. The
directory includes references for
common incidents analysed in
upstream production operations.
www.iogp.org
IOGP Headquarters
City Tower, 40 Basinghall St, London EC2V 5DE, United Kingdom
T: +44 (0)20 3763 9700
E: reception@iogp.org
IOGP Americas
IOGP Asia Pacific
IOGP Europe
IOGP Middle East & Africa
T: +1 713 261 0411
E: reception-americas@iogp.org
T: +61 4 0910 7921
E: reception-asiapacific@iogp.org
T: +32 (0)2 790 7762
E. reception-europe@iogp.org
T: +20 120 882 7784
E: reception-mea@iogp.org