You are on page 1of 5

PLANT SAFETY AND ENVIRONMENT

SPECIALREPORT

Water among causes for


storage tank explosion
Reinvestigation uncovers true accident events
M. FERJENCIK and B. JANOVSKY, University of Pardubice, Pardubice, Czech Republic

n explosion occurred inside a bitumen storage tank. An abrupt interruption of the purging steam discharge from the tank preceded the accident.
The suspected ignition sources alone would
not be able to cause the observed explosion. An additional impulse must have been
present. Careful analysis of the event led to
the conclusion that the explosion was probably preceded by water that was introduced
inside the tank. Iron sulfides were present
under the tank roof and combined with
the injection of water (causing the fresh air
suction and atmosphere movement inside
the tank) and this explained the explosion
under actual conditions.
Introduction. Trevor Kletz wrote an

anecdote in which he exaggerated the dangerous properties of water.1 Nevertheless,


he still described water as an extinguishing agent. However, in the accident that
occurred, a situation encountered showed
that water played the opposite role. Even
introducing a relatively small amount of
water into a large bitumen tank seems to
have triggered the accident that resulted in
an explosion and a fire.
This article will present the accidents
reinvestigation. It is based on a report
that was prepared by a plant investigation
committee. However, the original report
ignored the necessity to explain an abrupt
interruption of purging steam discharge
from the tank which preceded the accident.
The reinvestigation concentrates on this
event and makes it the focal point to shed
light on why the accident occurred.
Installation. The accident occurred more
than five years ago in a plant that processed
heavy-oil hydrocarbons. The event involved
an almost 40-yr-old bitumen storage tank.
The tank was an insulated, carbon-steel,

vertical cylinder with a fixed roof. It was


standing in a concrete emergency sump. The
tank communicated with the surrounding
air via a couple of vents which were placed
at the southern edge of its roof. The total
tank volume was 1,200 m3height 10 m,
diameter 12.4 m (Fig. 1).
The tank was equipped with openings
and pipe connections. One hatch and seven
pipe connections were in the bottom part of
its wall. There were two connections of the
steam heating system that kept the bitumen
inside the tank hot and liquid. The second
hatch and seven other openings were in
the roof of the tank, and one blind nozzle
was in the upper part of the tank wall. Fig.
2 only shows the roof openings that were
considered to play a role in the accident.
The steam inlet (50-mm diameter) was
located close to two vent nozzles (200-mm
diameter each). A steam pipe with a 25-mm
diameter was inserted into the steam inlet.
Its end piece inside the tank was used for
steam purging. It was less than 1.5-m long;
its mouth was blind and its wall was perforated. The bitumen circulation inlet pipe
nozzle (125-mm diameter) position was
across the roof at the northwest edge. The
bitumen circulation inleta carbon steel
pipe, 100-mm diameter was insertedwas
the newest tank opening. It was welded during a scheduled outage of the tank, roughly
six weeks before the accident. The second
most recent opening was two years old.

ing was to be used only when the bitumen


temperature inside the tank was higher
than 190C. More than one day before the
accident, the bitumen level was 65 cm and
at 155C. These parameters were kept for
more than 24 hr. Conditions inside the
tank started to change again approximately
3 hrs 40 minutes before the accident.
At that time, 120 ton batch of bitumen
was transported into the storage tank. Since
the temperature of the influent bitumen was
higher than 200C (up to 250C), steam
purging was commenced. The transport
was finished 40 min before the accident
the bitumen level was 180 cm and at 205C.
Steam heating and steam purging were left
in operation; steam pressure was about 4.5
bar and temperature about 140C. The filling pipeline was emptied into the storage
tank by pressurized air. All manipulations
connected with the transport were finished
25 min before the accident.
About 25 min later, an explosion
occurred inside the bitumen storage, blowing off the tank roof. After the explosion,
the tank contents started to burn. The roof
fell beside the emergency sump and leaned
against the southwest wall. The explosion
did not damage the tank wall, but a subsequent fire destroyed the south-southwestern
part. A layer of coke sediments were prob-

Chronological order. Operational

records showed that during the last four


days before the accident, the bitumen level
inside the storage tank was relatively low
(maximum 330 cm) and the temperature
was between 150C155C. Steam heating was operated permanently and steam
purging was inactive. It was in accordance
with operational instructions: steam purg-

FIG. 1

Bitumen storage tank, front view.

HYDROCARBON PROCESSING NOVEMBER 2010

I 35

SPECIALREPORT

PLANT SAFETY AND ENVIRONMENT

ably burned at relatively high temperatures.


The fire was localized and extinguished in
less than 5 hr. It did not cause material damage outside the bitumen storage tank nor
any fatalities or injuries. Unburned bitumen
had to be placed in barrels and reprocessed.
No anomalies were found in the unburned
liquid during its removal and reprocessing.
Additional observations. The south-

ern part of the tank roof, with vent nozzles,


was within the scope of one camera belonging to the plant security system. Relevant
record analysis provided interesting additional information about what happened
a few minutes before the accident. Records
confirmed that emptying the filling line was
performed within a 15-min time period,
ending 25 min before the accidentperformed in accordance with operational
instructions. Records showed that a permanent and stable steam discharge from
tank vents occurred 3 hr 40 min before the
accident and finished abruptly 47 s before
the explosion. During the last 47 s, no
outflows from vents were visible. Also, the
course of the explosion was recorded. The
lifting of the roof was visible, followed by
a rising fireball and flames. Evidently, the
tank roof was blown off by the explosion
of a flammable mixture in the tank atmosphere. The investigations after the accident
showed that the vents were free and that the
steam pipeline to the steam-purging inlet
was open and free, too.
Searching for accident causes. The
fire triangle describes three requirements
that have to be fulfilled for a fire/explosion of a gas mixture: an oxidant, a fuel and
an ignition source.2 Accident causes combine the three requirements. Identifying
the direct accident cause was not possible
without identifying the specific oxidant,
fuel and ignition source that were present
inside the bitumen storage tank.
Steam inlet
pipe
Vent
nozzles

Bitumen
circulation
inlet pipe

FIG. 2

36

Bitumen storage tank; an aerial


view with selected openings.

I NOVEMBER 2010 HYDROCARBON PROCESSING

Oxidant. For at least four days before the

accident, steam purging had been inactive


on the tank. Its gaseous volume communicated freely with the atmosphere outside
vent openings. Tank space above the liquid
level undoubtedly contained mainly air
at the start of steam purging 3 hr 40 min
before the accident. Sweep steam purging
was used to make the atmosphere of the
tank inert, but it was not able to perfectly
mix the whole gaseous volume when the
liquid level was low.2 Steam is much lighter
than air (and hydrocarbon vapors). The
arrangement of the steam inlet pipe did not
make the steam move into the lower parts
of the tank. Only the upper part of the tank
(about 20% of its total volume, according
to an estimation made by plant personnel)
is believed to have been filled with a steam
blanket. Lower parts of the gaseous volume
probably still contained mainly air during
the explosion.
Large volumes of bitumen in the storage
tank were used from time to time as terminal volume to empty various connected
pipes by air. These emptying operations
brought additional oxidant into the tank.
Fuel. Flammable, gaseous substances had

to be present in the atmosphere inside the


tank in a concentration above the lower
flammability limit for the explosion to
occur. The bitumen itself releases a certain
amount of light hydrocarbons, but measurements indicate that the total content
above the bitumen level is one order below
any conceivable lower flammable limit
(LFL). The bitumen present inside the tank
before the accident was of standard quality;
therefore, the fuel source for the explosion
had to be found elsewhere.
The filling pipeline came into the tank
from a manifold to which pipelines from
a few other storage tanks were also connected. Analyzing operational records
showed that asphalt varnish was pumped
through a pipeline that was connected to
the manifold, more than two days before
the accident. The asphalt varnish represented a mixture of bitumen (identical
with the stored one) and lacquer diluents.
If a check valve in the pipeline that was
used for pumping asphalt varnish had
not worked properly, a certain amount of
varnish would have entered the manifold.
Insufficiently closing the check valve in its
closing direction is a rather frequent defect
that cannot be excluded.
The liquid amount that would have
entered the manifold in this case might
have easily reached many liters. Undesir-

able liquid containing light hydrocarbons


would then have been transported into the
bitumen storage tank as soon as any of the
pipelines connected to the manifold would
have been emptied into it. Other potential
sources of fuel such as catalytic cracking on
steam heating pipes or steam reforming are
not considered to be probable since temperatures inside the tank were not high enough.
Observed explosion outcomes enabled
estimating the amount of light hydrocarbons that had to be present in a flammable
cloud inside the tank. The light hydrocarbons originated from lacquer diluents, the
boiling interval was 135C220C, LFL
is 0.8% vol. and upper flammable level
(UFL) is 6.5% vol. To assess the minimum
amount of light hydrocarbons necessary to
have lifted the tank roof off, it was necessary to start with the overpressure, which
could have caused it. Overpressure at 12
kPa is enough pressure to lift a storage
tank roof off.3
The question is, how large does the
flammable cloud have to be if it is capable
of generating 12 kPa of overpressure inside
the tank? From the state equation, it follows that if the vapor space volume inside
the tank is 989 m 3, then an increase in
the vapor volume should be equal to 117
m3 under normal pressure. This volume
increase is caused by generating hot combustion products. The number of moles
inside the tank should not change during
combustion. Only the temperature difference between the initial and final states
could cause the volume increase. The systems initial temperature was supposed to
be equal to 478 K. The combustion products temperature was estimated to be 1,500
K. This temperature is in accordance that
the flame temperature at the LFL for methane is 1,498 K and approximately 1,573 K
for other lower paraffinic hydrocarbons.4
Comparing these final and initial states,
an expansion factor equal to 3.14 was
obtained. The equation for the volume of
the explosive mixture capable of producing
the given pressure increase is:
Vexpl + 117 = Vexpl 3.14.
This results in 54.7 m3 of the explosive
mixture, with a concentration equal to LFL.
The light hydrocarbons may be represented
by C9 fraction with a mean molecular
weight of 148.4 g/mol. Using the molecular weight, the evaporated flammable vapor
amount is 1.66 kg. It is certainly the lowest
possible amount, not taking into account
the product cooling and venting through
the two vent nozzles. Higher amounts of

PLANT SAFETY AND ENVIRONMENT


evaporated flammable vapors (e.g., 5 kg and
10 kg) would lead to higher values of the
calculated overpressures (36.2 kPa and 72.4
kPa, respectively). Since these values are
well above the 12 kPa, neither cooling nor
venting through two vent nozzles would
have prevented the roof from lifting off.
Such an amount of flammable vapors could
have easily originated in the asphalt varnish
that entered the tank via the manifold. The
flammable cloud could have been formed
after the temperature increase during the
inflow of hot bitumen between 3:40 and
0:40 hr. Hydrocarbon vapors are heavier
than air so the operation of sweep steam
purging would not have removed them
from the tank with a low bitumen level.
Fig. 3 illustrates the situation that is
supposed to have been established inside
the tank after adding hot bitumen.
Possible ignition sources. Some igni-

tion sources may include hot work, static


electricity, hot surfaces, pyrophoric iron sulfides, pressure (compression ignition), friction and mechanical sparks, sudden decom-

pression and catalysts.5 Some alternatives


may be excluded immediately.
There was no hot work carried out at
the tank weeks before the accident. A compression or decompression sharp enough to
ignite the flammable vapors is not conceivable under conditions inside the tank. No
moving mechanical parts that would be
able to cause friction or sparks were present
inside the tank.
Movement of nonconductive liquid into
the tank finished at least 25 min before the
accident; hence collection and discharge of
static electricity are not considered to be
probable to ignite the explosion. Hot surfaces, in the usual meaning of this term,
were not present inside the tank. However,
a layer of coke sediments were found on the
southsouthwestern wall, burning intensely
after the explosion. Suspicion arosethe
coke sediments had been smoldering even
before the accident and they ignited the
flammable cloud. The possible presence of
catalysts (e.g., coke particles with large active
surfaces) in liquid bitumen was considered,
too. The presence of catalytic surfaces could

SPECIALREPORT

cause a decrease in the auto-ignition temperature of flammable vapors and lead to


ignition after an induction period.2 Without
a catalyst, auto-ignition of lacquer diluent
vapors is not possible under 240C.
Pyrophoric iron sulfides form when iron
is exposed to hydrogen sulfide (H2S), or any
other compound that contains sulfur, in an
oxygen-deficient atmosphere. Pyrophoric
iron sulfide may form in heated bitumen
storage tanks as the result of a reaction
between H2S given off from the bitumen
surface and iron in the form of rust on the
tank roof.6 H2S was present inside the tank.
Hence, the area of new bitumen circulation
inlet welds seemed to fulfill all conditions
for pyrophoric iron sulfide formation.
Examining the facts and formulating hypotheses. Three possible

ignition sources were identified: smoldering coke, auto-ignition catalysts and


pyrophoric iron sulfides. Examination of
these three hypotheses with known facts is
necessary, and Table 1 represents the fact/
hypothesis matrix.7

TABLE 1. Fact/hypothesis matrix. Legend: (+) compatible with hypothesis; () not likely

Fact or condition/hypothesis

Temperatures inside tank


between 140C and 205C,
steam blanket under roof

No anomalies (coke particles,


hot spots) were found in
unburned bitumen

Abrupt interruption of
steam discharge 47 sec
before the explosion

Tank roof fell beside


tank in south
southwest direction

Light hydrocarbon vapors


ignited by smoldering coke
on southsouthwest wall

Light hydrocarbon vapors


auto-ignited after
induction period

Light hydrocarbon vapors


ignited by pyrophoric iron
sulfides from new weld

Steam
outlet

Steam
inlet

Air Injection
intake of water

Bitumen circulation inlet pipe

Steam blanket, 140C

Position of
new weld

Air with hydrocarbon vapors

Fresh air
movement

Shrinking
of steam
and air

Hydrocarbon vapors
raised by water
evaporation
Bitumen, 205C

FIG. 3

Situation inside the tank, 30 min before the accident.

FIG. 4

Situation inside the tank during water injection.

HYDROCARBON PROCESSING NOVEMBER 2010

I 37

SPECIALREPORT

PLANT SAFETY AND ENVIRONMENT

TABLE 2. Modified fact/hypothesis matrix. Legend: (+) compatible with hypothesis; () not likely

Fact or condition/hypothesis

Temperatures inside tank


between 140C205C,
steam blanket under roof

No anomalies (coke particles,


hot spots) were found in
unburned bitumen

Abrupt interruption of steam


discharge 47 s before
the explosion

Roof of the tank fell


beside tank in south to
south-west direction

Light hydrocarbon vapors ignited


by smoldering coke on south
southwest wall after the
introduction of a small amount
of water

Auto-ignition of light hydrocarbon


vapors occurred after the
introduction of a small amount
of water

Light hydrocarbon vapors ignited


by pyrophoric iron sulfides from
new weld after introducing small
amounts of water

Welding of the
bitumen
circulation
pipe inlet
approximately
6 weeks before

Emptying of
pipe line, 10 m3
of air introduced
inside the tank
between -0:40
and -0.25 hr

FIG. 5

Return of
bitumen tank
back into
operation
Approximately
4 weeks before

Introduction of
waste into
steam inlet pipe
at -00:00:47 sec

Penetration of
light hydrocarbons into
bitumen
inside tank
Approximately
2 days before

Interruption of
steam discharge
between
-00:00:47 and
00:00:00 sec

Penetration of
fresh air to
pyrophoric iron
suldes at
new weld
< 00:00:00

Start of steam
purging
At -03:40 hr

Spontaneous
ignition of
pyrophoric
iron suldes,
release of
sparks
< 00:00:00 sec

120 t of bitumen
added, level
raised to 180
cm, temp. to
205C between
-3:40 and -0:40 hr

Explosion of air
and hydrocarbon
vapors mixture
at 00:00:00 sec

Development of the accident.

Coke smoldering can develop slowly


and gradually, so there would have been no
reason for an abrupt interruption of steam
discharge. If the explosion was ignited by
smoldering coke at the southsouthwestern
wall, then the final position of the blown
roof would have been expected on the
opposite side of the tank. Catalyzed autoignition would require the presence of a
catalytic surface on the bitumen. However,
no corresponding anomalies were indicated
in the liquid. Auto-ignition develops slowly
and gradually, thus giving no explanation
for the abrupt interruption of steam discharge. Pyrophoric iron sulfides spontaneously ignite after they dry out and come in
contact with air, but there was no indication that the steam blanket was replaced by
air at new welds. Again, the abrupt interruption of steam is not compatible with
the hypothesis.
Water injection. None of the consid-

ered ignition sources were able to explain


satisfactorily the abrupt interruption of
steam discharge 47 sec before the explosion. Evidently, the interruption did not
result in any of the conceivable ignition
38

Bitumen level
65 cm,
temperature
155C
more than
1 day before

I NOVEMBER 2010 HYDROCARBON PROCESSING

processes. It resulted from an additional


cause and probably contributed to the
ignition process. Closing or plugging the
steam pipeline or the outage of the steam
supply system would have caused a slow
decrease of steam discharge, not an abrupt
interruption. An event must have occurred
that caused an immediate pressure decrease
inside the gaseous volume of the tank. Such
an event could have been the steam pipeline
plugging with water.
Steam lines need to be equipped by
steam traps. A steam trap is a device used to
discharge condensate and non-condensable
gases while not permitting live steam escaping. If the steam trap is not present or if it
fails, then a water plug may form inside the
pipeline. There are indications that a steam
trap was not present in the lower part of the
steam line to the steam purging inlet, so a
water plug formation seemed possible.
If one liter of water had penetrated into
the steam purging line it would have created a water plug about 2 m long. The plug
would have been transported into the end
piece of the steam purging pipe. The water
would have been injected into the tanks
vapor space through tiny holes in the end

piece at 4.5 bar. The injection would have


abruptly cooled steam and gases inside the
space, causing the gases to shrink. This
results in under pressure inside the space,
reversing the flow through the vent nozzles.
The situation is illustrated in Fig. 4.
In Fig. 4, superheated water leaves
the holes in the end piece and some of it
evaporates immediately (approximately
7.9%). Flash evaporation of water creates
an expanding zone around the end piece
inside. The temperature decreases to the
boiling point of water (100C). The volume
of this zone is relatively small since one liter
of water creates 0.14 m3 of flash evaporated
steam. Tiny droplets of boiling water fly
away from the expanding zone into much
warmer steam and/or air around and below.
The droplets are heated and evaporated. The
tank atmosphere cools down and shrinks.
Globally, 1.7 m3 of steam will emerge from
1 L of water. Simple calculations show that,
in evaporation and balancing temperatures
in 100 m3 of steam, the steam is cooled by
18.2C and shrinks to 4.4 m3. Analogously,
100 m3 of air would be cooled by 24.8C
and shrunk to 6.2 m3.
This process leads to a movement inside
the tank atmosphere towards the expanding
zone around the end piece of the steam-purging pipe. Possible evaporating droplets on the
tank walls make this movement even stronger. If some droplets fell on bitumen liquid
level, they would evaporate and raise hydrocarbon vapors above the liquid surface.
The mixture of water aerosol and cold
steam is relatively heavy and tends to sink
into the air and hydrocarbon mixture.
Expansion in the steam-aerosol area and
turbulences caused by water evaporation
make the steam-aerosol area less permeable
for downward flowing gas, especially in the
vicinity of the end piece.

BORSIG
Leading
Technology for
Innovative
Solutions
Pressure Vessels and
Heat Exchangers
Reciprocating and
Centrifugal Compressors
for Process Gases

Membrane Technology
e.g. Emission Control Systems,
Vapour Recovery Units

Industrial Boilers and


Power Plant Technology
Industrial and Power Plant
Services

BORSIG GROUP
Egellsstrasse 21
D-13507 Berlin/Germany
Phone: +49 (30) 4301-01
Fax:
+49 (30) 4301-2236
E-mail: info@borsig.de
www.borsig.de
Select 158 at www.HydrocarbonProcessing.com/RS

PLANT SAFETY AND ENVIRONMENT


The estimations confirm that after water
injection, the overall balance of water evaporation (with a positive influence on pressure inside the tank) and steam/air shrinkage (with a substantially higher negative
influence on pressure inside the tank) will
result in air intake through vent nozzles.
Cold and relatively heavy fresh air tends
to sink through the steam pad into the air
and to dilute the air and hydrocarbon mixture. However, there was a zone consisting of steam and aerosol that was denser
than steam and obstructive due to turbulences. This, combined with the sinking
and shrinking movements inside the zone,
would have caused part of the inflowing air
to be sucked in a perpendicular direction
between the zone and the tank roof and
to move along the roof into the peripheral
parts of the tank (Fig. 4). Sinking fresh air
and the steam pad at the southern wall may
have also caused air movement at the opposite side upward against the wall.

into the bitumen inside the tank; the creation of pyrophoric iron sulfides at the new
weld; and the introduction of water into
the steam inlet pipe. The accident would
never have occurred if a small amount of
water had not been introduced into the
steam purging inlet pipe. It is highly probable that similar situations had occurred in
the tanks 40-yr history, but the necessary
causes never coincided. Fig. 5 illustrates
a probable multiple-root cause analysis,
which may lead to some lessons learned
from the accident while recommending
proper corrective measures. HP
1

Possible ignition sources after


water injection. Three new hypotheses

on possible ignition sources represent the


interactions of sources that were selected
with water injection. The results of the
examination are summarized in Table 2.
If the source were smoldering coke on the
southsouthwest wall after the water injection, then the abrupt interruption of the
steam discharge is understandable. However, there is no new explanation of why
the tank roof fell in the opposite direction
than would be expected. Similarly, for catalytic auto-ignition the presence of a catalyst remains unexplained. The situation has
changed only for pyrophoric iron sulfides.
The preceding section explains that fresh air
could penetrate to a new weld after water
injection. Hence, conditions for spontaneous ignition of pyrophoric iron sulfides
would have been fulfilled. There is evidence
that such an ignition may produce sparks.6
The immediate contact between the sulfide
and the flammable mixture is not necessary.
Consequently, the pyrophoric iron sulfides
at the new weld might have acted as an ignition source after introducing small amounts
of water into the steam inlet pipe.
Conclusions. The analysis helped com-

plete the time line of events leading to


the accident (Fig. 5). Dashed borderlines
denote the events that cannot be proved.
Probably, the combination of four direct
causes led to the accident: the inefficient
sweep steam purging of the bitumen storage
tank; the penetration of light hydrocarbons

LITERATURE CITED
Kletz, T. A., New Fire-fighting Agent Meets
Opposition, By accident ... a life preventing them in
industry, PFV Publications, London, 2000
Crowl, D. A., Understanding Explosions,
American Institute of Chemical Engineers, New
York, 2003.
Kletz, T. A., Myths of the Chemical Industry,
The Institution of Chemical Engineers, Rugby,
1985.
Lees, F. P., Loss Prevention in the Process
Industries, Second Edition, ButterworthHeinemann, Oxford, 1996.
IRP18 Committee, University of Calgary, Canada,
http://www.firesandexplosions.ca/hazards/
ignition sources.php, September 24, 2007.
Davie, F. M., T. W. Nolan and S. Hoban, Study
of Iron Sulfide as a Possible Ignition Source in
the Storage of Heated Bitumen, Journal of Loss
Prevention in the Process Industry, Vol. 6, Issue 3,
pp. 139143, September 1993.
Center for Chemical Process Safety, Guidelines for
Investigating Chemical Process Incidents,
American Institute of Chemical Engineers, New
York, 1992.

Milos Ferjencik studied nuclear


engineering at Prague Technical University and graduated in 1981. He
worked at Nuclear Research Institute,
and in various technical and research
positions. In 1991, Mr. Ferjencik concentrated on chemical risk analysis. In 1995 he started his own consultancy
profession. Mr. Ferjencik was an independent risk and
reliability consultant and an external teacher at University
of Pardubice. Most recently, Mr. Ferjencik has worked as
a full-time assistant professor of safety engineering at
the University of Pardubice.

Bretislav Janovsky received BS


and PhD degrees from the University
of Pardubice focusing on theory and
technology of explosives. He worked
in various technical and research positions at the University of Pardubice and a privately held
company, TLP Prague. Dr. Janovsky concentrated on
consequence analysis under risk analysis in the process
industries. He was a full-time assistant and associated
professor of safety engineering at the University of
Pardubice and started his own professional consultant
business in 1995. Today, Dr. Janovsky is the research and
development director at OZM Research Bliznovice and
teaches part-time at the University of Pardubice.

You might also like