Introduction
When it comes to storage tank safety, engineers often focus on the "major" components: shell thickness (calculated precisely according to the API 650 "one-foot method" or Variable Design Point method), foundations, seismic design, wind girders, and complex finite element analysis-all of which are, of course, vital. Yet, a review of accident records reveals that the true catalysts for disaster are frequently the most inconspicuous "accessories"-breather valves, flame arresters, level gauges and high/high-high level interlocks, floating roof seals and grounding systems, gauging hatches, manways, and vents.
A telling statistic highlights this: industry data indicates that approximately 52.9% of leaks involving storage tanks for hazardous chemicals are caused by breather valves (common failures include valve discs becoming stuck, bonded, clogged, frozen, or rusted, as well as bent guide stems or spring failures). In short, these "small parts" are, in fact, the most frequent points of failure. This article examines several notable accidents-both domestic and international-to shed light on these often-overlooked tank accessories, while outlining the relevant regulatory standards and key control measures. Key technical terms are provided with both Chinese and English equivalents to facilitate cross-lingual review and project delivery.
Key Terminology (Bilingual Glossary)
· Breather Valve / Pressure-Vacuum Relief Valve (PVRV)
· Flame Arrester
· Independent High-Level Switch (IHLS) / High-Level Alarm & Trip
· Floating Roof Seal (Primary Seal / Secondary Seal)
· Bonding & Grounding
· Gauge Hatch; Manhole; Vent Outlet
I. Breather Valves and Flame Arresters: The "Respiratory System" of Storage Tanks
1.1 Their Function
In atmospheric or low-pressure fixed-roof tanks, the internal pressure fluctuates with liquid levels and temperatures during filling (outbreathing) and withdrawal or cooling (inbreathing). The breather valve-or Pressure-Vacuum Relief Valve (PVRV)-maintains a slight positive pressure within the tank, keeping it within a safe operating range. It vents vapors when pressure rises too high and admits air or nitrogen when pressure drops too low, thereby preventing the tank from bulging due to overpressure or collapsing due to a vacuum. A flame arrester is installed in the venting path to prevent external flames from traveling back into the tank.
1.2 Incidents: When "Breathing" Is Blocked
Methanol Tank Collapse: At a methanol tank farm, three pumps were operated simultaneously, causing a rapid drop in liquid level. Two DN300 breather valves failed to provide sufficient make-up air, leading to negative pressure inside the tank. This resulted in severe deformation, with three areas on the upper southern side of the tank buckling inward. Contributing factors included liquid accumulation in the nitrogen-blanketing control valve (hindering nitrogen supply) and low atmospheric pressure during rainfall, which ultimately triggered the collapse.
2014 Styrene Tank Implosion: A styrene storage tank at a chemical plant suddenly deformed inward during operation. Polymer deposits caused the breather valve to seize and the flame arrester to become clogged. As product was withdrawn, a vacuum formed inside the tank; because air could not enter, the pressure differential exceeded the tank's structural resistance to vacuum, causing the shell walls to buckle inward. The root cause was the accumulation of polymers within the venting system.
1.3 Mechanism: A Slight Vacuum, A Massive Load
The criterion for vacuum-induced collapse can be expressed as follows:
P_ext > P_int + σ_wall,
where P_ext is the atmospheric pressure, P_int is the internal pressure of the tank, and σ_wall is the structural resistance of the tank wall.
An often-overlooked intuition: even a minor vacuum can generate significant structural loads. In engineering terms, a pressure differential of approximately 1 kPa acting on the projected surface area of a 10-meter-diameter tank roof exerts a force of about 78.5 kN (roughly 8 tonnes-force). This explains why a "seemingly insignificant" negative pressure can cause a thin-walled storage tank to collapse.
1.4 Common Issues and Standards
Common problems with breather valves (pressure-vacuum relief valves) include jamming, sticking, clogging, freezing, rusting, bending of guide stems, and spring failure. In cold regions, they may freeze shut. For media prone to polymerization or crystallization-such as styrene, acrylates, glacial acetic acid (which solidifies at approximately 16.35 °C), or phenol (which solidifies at approximately 41 °C)-substances can accumulate as gels or crystals on valve seats, vacuum-relief mechanisms, or flame arresters, narrowing flow passages until the device fails.
Key standards include: API 2000, "Venting Atmospheric and Low-Pressure Storage Tanks," and SY/T 0511-2024, "Accessories for Vertical Cylindrical Welded Steel Storage Tanks"-both serve as authoritative references for determining venting capacity and sizing breather valves or emergency relief vents. Other relevant standards include ISO 16852, API 2028, and GB 5908, which cover the performance and installation of flame arresters, as well as NFPA 30 (§21.8.6), which addresses the maintenance of venting equipment and flame arresters.
Breather valves must be used in conjunction with flame arresters; ideally, the latter should be of the "endurance burning" (burn-proof) type. For specialized operating conditions-such as those involving corrosive substances, materials prone to crystallization, or low-temperature environments-appropriate protective features (e.g., anti-corrosion, anti-freezing, or anti-polymerization designs) must be selected. Regarding maintenance, routine visual inspections should be conducted at least once a month, while comprehensive overhauls and pressure calibration should be performed annually or biennially. Calibration procedures include verifying opening pressure, reseating pressure, leak tightness, and venting capacity.
II. High-High Level Interlocks and Level Gauges: The "Blind Filling" Disaster at Buncefield (Overfill Protection)
2.1 Incident Overview
On December 11, 2005, a gasoline storage tank (Tank 912) at the Buncefield oil depot in the United Kingdom was being filled. The tank was equipped with two level-monitoring systems: a level gauge for operator surveillance and an Independent High-High Level Switch (IHLS)-a safety system designed to automatically shut off the product flow if the liquid level became too high. However, following maintenance in August 2005, the level gauge began to stick intermittently (remaining fixed at approximately two-thirds of the tank's capacity), while the IHLS was rendered inoperable due to the absence of a padlock required to secure its sensing rod. This resulted in "blind filling": fuel overflowed from the top of the tank, creating a vapor cloud on the ground that ignited, leading to an explosion. The resulting fire burned for five days, destroyed over 20 storage tanks, injured 43 people, and caused direct economic losses of approximately £250 million.
2.2 Overlooked "Small Components"
The true culprits were not the tanks themselves, but two seemingly minor and inexpensive components-the level gauge and the Independent High-High Level Switch (IHLS). The simultaneous failure of both, compounded by management shortcomings-such as a failure to respond to clear signs that the instrumentation was unreliable, and a "production-over-safety" culture driven by increased throughput-culminated in one of the largest fire and explosion disasters in European history.
2.3 Standards and Lessons Learned
· API 2350, *Overfill Protection for Aboveground Storage Tanks*-the core standard for the design and management of overfill protection systems. Additionally, API 2000 addresses the relationship between tank venting and overfill protection. The lesson here underscores a fundamental tenet of Process Safety Management (PSM): for safety-critical equipment, there must be clear mechanisms for identifying failure signals and ensuring rapid response. Temporary patches or "operating with known defects" are no substitute for addressing root causes.
III. Floating Roof Seals and Lightning Protection: The "Ignition Trigger" During Thunderstorms
3.1 A Series of Lightning-Induced Seal Fires
The annular seal area of a floating-roof tank is a high-risk zone for fires caused by lightning. Notable incidents include: the Huangdao Oil Depot (August 12, 1989)-where a 23,000 m³ concrete crude oil tank was struck by lightning, triggering an explosion and subsequent fire that lasted 104 hours, resulting in 19 deaths, over 100 injuries, and direct economic losses of 35.4 million RMB. Underlying causes included the lack of independent lightning rods for non-metallic tanks, unreliable lightning grounding, and the failure of fire-suppression systems. Other instances-such as those in Yizheng (2006), Zhenhai Lanshan (three incidents between 2007 and 2010), Dalian Xingang (2011), Dongguan Liaobu (2015-where a lightning strike punctured the rain cover of an internal floating-roof vent), Cuba (2022-involving a chain reaction across four tanks), and Guiding Baota (2024-where lightning struck the area of a breather valve)-span more than 30 years and involve various types of storage tanks across different countries, yet they all share the exact same underlying mechanism.
3.2 Common Mechanism
An explosive gas mixture is persistently present within the annular space (between the primary/secondary seals and the tank wall). A direct lightning strike or an induced lightning surge causes electrical discharge-either between the floating roof's conductive grounding strips and the tank wall, or between the secondary seal's conductive components and the tank wall-creating sparks that ignite the oil vapors at the seal. The "small components" often overlooked here include: primary and secondary seals for floating roofs, electrical bonding between the floating roof and the tank shell, insulation of secondary seal metal components from the tank wall, and the installation of independent lightning rods with reliable lightning protection grounding.
3.3 Evolution of Standards
· GB 15599-2025, *Safety Code for Lightning Protection in Enterprises Handling Hazardous Chemicals*-a major revision of the 2009 version: introduces a new chapter on "Lightning Early Warning" (mandatory for large-scale oil depots or those in high-lightning-incidence areas; requires a lead time of ≥10 minutes and an effective alarm rate of ≥80%); specifies that external floating roofs must use flexible stranded copper conductors (cross-sectional area ≥50 mm²) for electrical bonding, and that metal components of secondary seals must be insulated from the tank wall; mandates that non-metallic storage tanks be equipped with independent lightning rods (or meshes); increases the inspection frequency from annually to semi-annually, with an additional requirement for a specialized inspection prior to the thunderstorm season.
· GB 50160, *Code for Fire Protection Design of Petrochemical Enterprises*; API 650 (Appendices C and D, covering aluminum floating roofs and seals) are also relevant.
IV. Static Electricity and Grounding: The Invisible "Detonator"
4.1 Incident: High-Velocity Filling + Vapor Space = Static Spark
In 2003, at Glenpool, USA (NTSB PAR-04/02): Diesel Tank No. 11-previously used for gasoline-had not been thoroughly cleaned or purged. During a high-velocity filling operation while the liquid level was low, diesel entered the vapor space at the top of the tank. The excessive flow velocity generated static electricity, which discharged within the flammable vapor, triggering an explosion. The resulting fire lasted 21 hours, damaged two adjacent tanks, and caused losses exceeding $2 million. The NTSB identified the root cause as "unsafe filling procedures combined with an excessively high flow velocity." In the "August 29" incident at the PetroChina Dalian Petrochemical facility, the average flow velocity at the oil inlet of Tank 875# reached 4.34 m/s. This far exceeded the limit stipulated by API RP 2003 for floating-roof tanks-which requires a flow velocity of no more than 1 m/s (3 ft/s) until the floating roof has risen from its supports. The high-velocity flow generated a high electrical potential on the liquid surface, leading to brush-type discharges between the surface and grounded conductors (such as the floating-roof supports or the tank wall), which ignited the oil vapors.
4.2 Overlooked "Small Components"
The critical factors here are not the major pieces of equipment, but rather the bonding and grounding, the use of submerged fill pipes, and the control of flow velocity. Liquids with low electrical conductivity (< 50 pS/m, such as diesel) are classified as "static accumulators," making them more prone to electrification when subjected to high-velocity, turbulent flow.
4.3 Standards
· API RP 2003, *Protection Against Ignitions Arising Out of Static, Lightning, and Stray Currents*: When discharging liquid into a container that may contain flammable vapors, the flow velocity must not exceed 3 ft/s (approximately 1 m/s) until the inlet pipe is fully submerged (to a depth of twice the pipe diameter or 2 ft, whichever is less). Furthermore, containers must be thoroughly cleaned and purged before the stored medium is changed.
V. Gauge Hatches, Manholes, and Vent Outlets: The "Butterfly Effect" of Small Openings
5.1 Small Openings, Major Consequences
In the 1989 Huangdao incident, the sampling port (a type of gauge hatch) on Concrete Tank No. 5 was covered with a nine-layer wire mesh. The shielding mesh designed to protect the tank roof from induced lightning strikes was secured only with iron clamps; additionally, steel reinforcement bars were exposed, and several electrical connections were unreliable. Consequently, the induced voltage from a nearby lightning strike generated sparks across these gaps, igniting the oil vapors. Dongguan Liaobu (2015): A direct lightning strike penetrated the rain cap of a vent on an internal floating-roof tank. High-temperature molten metal droplets fell into the tank, triggering a flash explosion of the oil-gas mixture inside.
Small components-such as gauge hatches, sighting ports, manholes, and vent outlets-can become ignition sources or leakage paths if protective measures are inadequate or connections are unreliable. Furthermore, if a flame arrester is installed backward, becomes frozen/clogged, or accumulates liquid, its intended function of "normal venting" is compromised, rendering it a failed or obstructed pathway.
5.2 Standards
· NFPA 30 §5704.2.7.3: Vents for storage tanks containing Class I liquids must be located at a safe height in a secure area outside the building (typically ≥ 12 ft / approx. 3.6 m above ground level). They should be oriented upward or horizontally away from building openings to prevent vapors from being trapped by eaves or overhangs.
· API 2000 (regarding vent sizing and quantity) and GB 50160 (regarding tank farm layout) are also relevant.
From a methodological perspective, these accessories should be managed as "safety-critical equipment":
1. Inventory Management: Maintain a comprehensive register of accessories and prioritize them using a Risk-Based Inspection (RBI) approach.
2. Selection Based on Operating Conditions: Choose equipment-such as specialized breather valves (designed to resist freezing, polymerization, or corrosion) and flame arresters-that aligns with the specific characteristics of the stored medium.
3. Periodic Calibration and Maintenance: Conduct monthly inspections of breather valves; perform semi-annual checks on flame arresters and lightning protection systems; and regularly test liquid-level interlock functions.
4. Management of Change (MOC): Whenever there are modifications to processes, media, or pumps, the capabilities of these accessories must be re-evaluated. (For example, ensure that a change in pump specifications doesn't lead to an oversight regarding the adequacy of the existing breather valve.)
5. Rapid Response to Failure Indicators: Never allow equipment to remain in service when it is clearly unreliable or malfunctioning.
Conclusion
While the tank shell itself can be engineered for robustness and reliability-following standards like ASME VIII-1 or API 650-the true vulnerabilities often lie in the "minor" accessories-the components deemed too insignificant to even warrant a dedicated meeting. Breather valves, flame arresters, liquid-level interlocks, floating-roof seals, grounding systems, and gauging hatches-each may seem trivial on its own, yet any one of them has the potential to trigger a major disaster.
Small components, immense responsibility. The inherent safety of a storage tank begins with treating every single accessory as safety-critical equipment.
