Introduction

In recent years with the development of industry, energy demand is increasing, especially fossil fuels, and this issue is becoming much more serious; therefore, the scale of the petrochemical industry becomes greater and greater [1,2,3,4]. The petrochemical industry, especially refineries, normally uses large storage tanks. Due to the advantages of presentation and the accurate and full solution for providing appropriate and lockable on-site oil storage, atmospheric storage tanks are commonly used. However, these oil tanks, and in particular floating roof tanks which are commonly used for the storage of large amount of crude oil, are the most vulnerable equipment.

Storage tanks contain significant amounts of flammable and hazardous hydrocarbon fuels and chemicals [5,6,7]. Thus, the occurrence of a storage tank accident is possible and usually leads to fire and explosions [7,8,9]. As evident based on industry experience, oil tank fire is enormous and has strong radiation and high flame and it is considered a major challenge both to control and to extinguish [5, 10].

The storage tank type used in storing flammable and combustible liquids depends on the physical characteristics of the product stored and the tank’s location [5, 11, 12]. Many flammable products, for example, liquid hydrocarbons at normal temperature and pressure, are usually stored in large tank at atmospheric pressure [13, 14]. These tanks can hold more than 1.5 million barrels of flammable or combustible liquids [12]. Due to this high volume storage of flammable and/or hazardous chemicals, atmospheric storage tank incidents are a major concern [15] with regards to industrial safety such as ignition of a hydrocarbon–air mixture in such tanks which can lead to fire and explosion [16].

Floating roof tanks are a type of atmospheric storage tank [17, 18]. Vertical cylindrical tank, including the floating roof type, is the most commonly used metal storage tank [10]. Floating roof tanks are not intended for all products, but they are mainly used to store large quantities of high-volatility products such as crude oil or gasoline [13, 19, 20].

The purpose of this paper is prioritizing the causes of fire and explosion in the external floating roof tanks using ANP method. We hope that this work will be beneficial to tank operators and engineers.

External Floating Roof Tank

External floating roof tanks (EFRT) have cylindrical steel shells equipped with a roof that floats on the product in an open tank; the roof is open to the atmosphere and rises and falls along with the liquid level [21,22,23,24]. As opposed to a fixed roof tank, there is almost no vapor space between floating plate and oil surface and this significantly eliminates breathing losses and reduces evaporation losses of the stored liquid. The external floating roof crude storage tank is the most common storage tank. The floating roof system consists of a deck, fittings, and rim seal system [21, 25]. The rim seal system is between the tank shell and roof that is attached to the deck perimeter and contacts the tank wall to reduce rim evaporation [26,27,28].

An external floating roof tank is usually used in steel open-top tank larger than 20,000 m3 and mainly used to store large quantities of petroleum products such as crude oil or condensate, gasoline, kerosene [29].

Impact of Major Accidents in the External Floating Roof Tank

Nowadays, explosion and fire accidents are one of the main reasons for high risk of large-scale crude oil depots because crude oil is flammable and combustible. Among the types of tank, large-scale floating roof tanks are the main type of tanks for storing crude oil.

Results of the study of Chang and Lin presented on 242 accidents of storage tanks that occurred in industrial facilities over 40 years showed that 74% of the accidents occurred in petroleum refineries, oil terminals or storage parks, while fire and explosion account for 85% of the accidents. The most common contents of the tank were crude oil and oil products such as gasoline, fuel oil, and diesel oil. The study also showed that the fires occurred more frequently in the atmospheric external floating roof tank instead of fixed roof tanks [30].

Another study by Persson and Lonnermark identified 480 storage tank fire incidents worldwide between 1951 and 2003. The number of tank fires reported by worldwide media is in the range of 15–20 each year. About one-third (31%) of reported tank fire incidents have been attributed to lightning striking atmospheric external floating roof tanks [31].

In the LASTFIRE incident review sponsored by 16 oil industry companies in 2012, it was reported that 52 of the 62 initial fire events within the scope of the survey were lightning-ignited rim seal fires in external floating roof tank [32,33,34]. In another study conducted by the LASTFIRE project in 1997, it was found that rim seal fires in external floating roof tank are the most common scenario [34].

In a review of tank incidents conducted by Thyer et al. [15], 64 single-tank fires were identified between 1919 and 2004, with the causes being attributed to many factors that most of them are sinking floating roof in floating roof tank. American Petroleum Institute (API) collected 22 full-surface fire accidents among the 81 large-scale floating roof tank fire accidents from 1951 to 1995, and this accounted for 27% and the diameter of those collected tanks was among 30.5–100 m [35].

Causes of Fire and Explosion in the External Floating Roof Tanks

Effective direct and indirect causes of fire and explosion in oil tankers were obtained as a result from a library research and data collection of accidents records and documents of oil tankers through validated articles, LASTFIRE project, API report, Fire magazines, NFPA Special Data Information Package, and output of methods of risk assessment conducted on tanks such as HAZOP, FMEA, FTA, and Internet. To assign the causes to the floating roof tanks, a few visits to tanks were performed. Causes obtained due to the views of several process engineering, safety, and fire were finalized. Lastly, the 11 criteria and 71 sub-criteria obtained in accordance with Table 1 were classified.

Table 1 Causes of fire and explosion in the external floating roof tanks
Full size table

Prioritizing the Causes Using ANP Method

ANP Method

The analytic network process is a method proposed by Saaty [36]. Analytic network process (ANP) is a novel tool for multi-criteria decision-making (MCDM) but can also be applied in academic research to prioritize factors or criteria [37]. ANP is a generalization of the analytic hierarchy process (AHP), by considering the dependence between the elements of the hierarchy [38]. Many decision problems cannot be structured hierarchically because they involve the interaction and dependence of higher-level elements in a hierarchy on lower-level elements. Therefore, ANP is represented by a network, rather than a hierarchy. Although most of the studies implemented in the context of supply chain risks have employed AHP, it should be acknowledged that risk is a complicated factor and its clusters and sub-factors have implicit effects on each other [39].

The advantage of using the ANP in a supply chain is to designate the impact of risks on each other, so that each of the risks can interact with other clusters (i.e., risks) and their sub-factors. Moreover, sub-factors of each risk can influence other factors. The ANP method needs to apply a pairwise comparison matrix. This complicated and sensitive pairwise comparison would be completed by a skilled expert team [40].

In the literature, ANP has been applied in many complicated decision-making problems. The ANP has its own advantages and has produced ideal results in various fields. In the field of oil and gas products, Jafarnezhad et al. [41] proposed ANP for priority of technology transfer methods in oil drilling industry. Valipour et al. [42] developed and tested a comprehensive model for risk assessment of gas refinery EPC projects using the ANP technique. Moradi et al. [43] proposed the risk analysis of oil projects using fuzzy ANP technique.

In this paper, ANP was used to prioritize the causes. Thereafter, all factors affecting fire and explosions of external floating roof tanks were collected and approved. In the next step, checklist composed of criteria and sub-criteria affecting fire and explosion of external floating roof tanks was taken from the previous step. Then, checklist was sent to 30 process and safety experts familiar with the tankers in the oil refinery and they did pairwise comparison between variables in the checklist.

In the first stage, the main criteria are regarding independence, together with the pairwise comparison. In the second stage, sub-criteria for each main criterion were pairwise comparison. For pairwise comparison criteria and sub-criteria, comparison scale of nine levels presented by Saaty was used (Table 2).

Table 2 Scale of relative importance (according to Saaty [39])
Full size table

To find the matrix priority and compute the consistency ratio (CR), we applied the Expert Choice software.

Steps for applying the ANP methodology are mentioned below [39]:

  • Step 1: Analyze the problem and determine the main goal.

  • Step 2: Determine the criteria and sub-criteria that affect the main goal.

  • Step 3: Determine alternatives for the problem.

  • Step 4: Determine the interactions between criteria, sub-criteria, and alternatives with respect to the main goal.

  • Step 5: Construct a super-matrix according to the network and then construct a weighted super-matrix and limit super-matrix. In a super-matrix, each element is represented by one row and one respective column. If the column sum of any column in the composed super-matrix is greater than 1, that column will be normalized. Such a super-matrix is known as weighted super-matrix. The weighted super-matrix is then raised to a significantly large power in order to have converged or stable values. The values of this limit matrix are the desired priorities of the elements with respect to the goal.

  • Step 6: Prioritize the alternatives and choose the best alternative with the highest priority.

The use of ANP method to solve practical problems is complex; hence, we must use special calculation software. The Super Decisions software will be used to prioritize the causes in this paper.

Super Decisions Software

Super Decisions software is decision-making software which works based on two multi-criteria decision-making methods.

The ANP is implemented in the Super Decisions software and has been applied to various decision problems. It is a coupling of two parts. The first consists of a control hierarchy or network of criteria and sub-criteria that control the interactions in the system under study. The second is a network of influences among the elements and clusters. Applications may be simple, consisting of a single network, or complex, and consisting of the main network and two or more layers of sub-networks. Each network and sub-network is created in its own window [44].

Steps to build an ANP hierarchical decision model using the Super Decisions software as shown below.

Creation of Clusters and Making Connections Between Them

First, we created priority among the main criteria. To do this, 11 main criteria as nodes within a cluster were created and the connections between them linked them with each other. The main criteria model is shown in Fig. 1. Similarly, node and cluster and internal communication among them were created individually for each sub-criterion.

Fig. 1
figure 1

Main criteria model

Full size image

Criteria and Sub-criteria Pairwise Comparisons

One of the major strengths of the ANP is the use of pairwise comparisons to derive accurate ratio-scale priorities, as opposed to the use of traditional approaches of “assigning weights” which can also be difficult to justify. There are four pairwise comparison assessment modes. We have chosen questionnaire mode to carry out pairwise comparisons.

Formation of Super-Matrix

The priorities derived from the pairwise comparisons are entered in the unweighted super-matrix. In a hierarchical model like this, the weighted super-matrix is the same as the unweighted super-matrix because the clusters are not weighted. Raising the weighted super-matrix to powers yields the limit matrix from which the final answers are extracted. The final priorities for the alternatives are in the column of the goal. Limit matrix for main criteria is shown in Fig. 2. Similarly, the super-matrix tables for each of the sub-criteria were formed.

Fig. 2
figure 2

Limit matrix for main criteria

Full size image

Synthesis and Sensitivity

The results for the alternatives are obtained with the synthesis command. The Normals column presents the results in the form of priorities. This is the usual way to report results. The Ideals column is obtained from the Normals column by dividing each of its entries by the largest value in the column. The Raw column is read directly from the limit super-matrix. In hierarchical model such as this, the Raw and the Normals columns are the same. These results showed that natural disasters have the highest priority in the causes of fire and explosion in the external floating roof tanks.

The “Ideal” column shows that the results are divided by the largest value so that the more important choice has a priority of 1.0. The others are in the same proportion as in “Normals” and are interpreted this way: Static electricity with 72.8% is important from operational error and that with 61.4% is important from faulty fire safety system.

Sensitivity analysis is used to analyze how the priorities of the alternative solutions change as we vary the priority of one or more decision-making factors (criteria). Sensitivity rate is desirable to have a value of less than 0.1.

The results of synthesis and sensitivity rate for main criteria are shown in Figs. 3 and 4. Also, the final weight for main criteria and sub-criteria is listed in Table 3.

Fig. 3
figure 3

Main criteria synthesis

Full size image
Fig. 4
figure 4

Main criteria sensitivity rate

Full size image
Table 3 Weight prioritization main criteria and sub-criteria for fire and explosion in the external floating roof tanks
Full size table

Important Findings and Discussion

By the weight of the various risk factors, we can conclude that several big risk factors (causes) in fire and explosion in the external floating roof tanks are natural disasters, static electricity, operational error, faulty firefighting system, maintenance error, piping rupture/leak, equipment/instrument failure, open flames, tank crack/rupture, runaway reactions, and sabotage, respectively (Results of Table 3). In the following, criteria and sub-criteria in order of priority are discussed.

Natural Disasters

As indicated in Table 3, natural disasters are allocated the highest rank in the cause of fire and explosion. The oil industry can be adversely affected by natural disasters such as lightning, earthquakes, tornados. Natural events are identified as the principal cause of the accidents in atmospheric storage tanks [45]. Among natural disasters, lightning sub-criteria had the highest priorities, although lightning is by far the most frequent source of ignition in oil tanks with regards to the occurrence of fires within floating roof storage tanks [16]. According to previous findings, lightning accounts for about 61% of all accidents in storage and processing operations [45].

Static Electricity

The second rank of fire and explosion cause in tanks is static electricity. In the storage tanks, static electricity is generated during the filling of the product which can develop a static charge between the tank shell and liquid surface [46]. In atmospheric storage tanks, static electricity may be produced in some ways, such as the attendance of debris which may float and thus be isolated from the floor and become charged as the liquid is static [47].

On the other hand, static discharge and sinking of floating roof sub-criteria had the highest rating. In the LASTFIRE survey (2012), static electricity has been assumed as the source of ignition that has occurred when foam has been placed onto tanks upon discovery that the roof has sunk or partly sunk [48]. LASTFIRE survey (2012) described that the static discharge may occur if the electrical bonding between the shell and roof of the tank or the earthing of the tank is insufficient [48]. External floating roof tanks require bonding shunts between the wall and the floating roof tank. Although these shunts are used for lightning protection, they also provide protection from electrostatic charges caused by the product’s movement [46].

Operational Error

Good operating procedures are the main point in the safe operation of a process industry. Operating procedures are integral to the general management of process safety, as both a source and a safeguard against operational error.

One of the most important operational sub-criteria is standard operating procedure (SOP). SOPs are used for the safe and effective operation of industrial plants, including oil and gas facilities [49]. Sometimes instead of the term SOP, terms such as protocols, instructions, worksheets, and laboratory operating procedures may also be used. But SOPs are frequently developed late in the project after the design is completed and construction is well underway. SOPs may be used for little other than operator training. Being used this way, SOPs have little impact on either the design or the operation of the facility (Fig. 5) [50].

Fig. 5
figure 5

Wrong set-up of the SOP

Full size image

Faulty Firefighting System

A fixed or a semi-fixed firefighting system is one practical method to protect flammable liquid storage tanks against fire. If these systems are incorrectly installed, they may cause damage to the owner’s property and forced outage risks will increase, while operator’s personnel safety will decrease. A firefighting system can be used for fire prevention, control, or direct extinguishing of any flammable liquid fire within the tank. Presently, in floating roof tanks, fixed foam system is used for extinguishing rim seal fires [51]. Fire system infrastructure failure is one of the most important weaknesses in firefighting. When engineered, installed, and maintained correctly, these systems will offer many years of reliable service [52].

Maintenance Error

Maintenance is a key activity to reduce the risk of major accidents. On the other hand, maintenance may have a negative effect on barrier performance if the execution is incorrect, insufficient, delayed, or excessive. Also, it can be the cause of an incident, for example, by operating equipment wrongly [53].

Based on the results, one of the most dangerous factors which create a risk of fire among maintenance error is welding. According to the LASTFIRE incident survey (1997) result, two rim seal fires were recorded due to hot work on tanks. In these cases, heat from welding caused flammable vapors to be emitted from hydrocarbon deposits [34]. In August 2008, a fire occurred in a crude oil atmospheric storage tank with a capacity of 80,000 m3 in Ra’s Lanuf; the cause of the fire was attributed to hot work [54].

Piping Rupture/Leak

A leak or rupture of the tank or pipe can be caused by the brittle failure of tank walls, welds, or connected pipework due to the use of inadequate materials, combined with loading such as wind, earthquake, or impact that can release some or all of their contents. In the event of a leak or rupture, these materials may be ignited and cause a fire that could result in injury or possibly fatality [55]. The uncertainty in values for atmospheric storage tanks could be represented by a range of at least a factor of 10 either higher or lower. Estimates of leak frequencies for large pressure piping for both the overall leak frequencies and the rupture frequencies range over four orders of magnitude. The LASTFIRE data are considered the most reliable source for releases from floating roof tanks.

Leaking on the tank roof sub-criteria achieved the highest probability of fire and explosion in external floating roof tank. Water on the roof is usually drained from a flexible hose or other special drain line system that runs from a drain sump on the roof through the stored liquid to a drain valve on the shell at the base of the tank. A hose often develops leaks and drains both water and product, while other drain lines do not leak [56].

Equipment/Instrument Failure

Equipment failure could have a massive negative effect on employee safety and loss of production in the oil industry. Further, in the oil refinery, reliability and safety go hand-in-hand due to their growing recognition. Equipment that is improperly maintained, malfunctioning, or operating outside its design limits exposes employees to risk [57].

The most common failure on the floating roof is due to the sinking of the floating roof. The floating roof is overtopped by the liquid inside the tank and the roof sink or maybe the tank will ignite due to the spark generated during the unstable movement of the roof [16]. If the floating roofs are inadequately designed or wrong approaches were applied to the design, the roof will fail and the pontoon will be buckled and damaged. On January 25, 2014, the floating roof sank into the stabilized condensate tank 5E-220-TB002A at Mellitah complex due to the heavy fire water/foam [58].

Open Flames

Open flames can be considered as an external source of heat in the tanks fire and explosion. The most important open flames sub-criteria in the floating roof tank fire were ground fires or adjoining land fire, flammable vapors flare around tanks, and hot particles, respectively. In the incident at a Baton Rouge, Louisiana refinery fire was caused by the ground fires or explosion close by [31].

Tank Crack/Rupture

Most storage tank damage is attributable to age deterioration, corrosion, and seismic motions. Cracks usually occur at the bottom or the welding edges. A 1970 crack at the bottom of a crude oil storage tank at a Kaohsiung, Taiwan refinery, was attributed to the slow subsidence of the foundation [59]. Cracks in the floating roof tank top always occur only on the edge of the oil tank top which is just the weakest area [60, 61].

To prevent the shell distortion that was the first priority of the sub-criteria, Greenwood [62] suggested that an average tilt of possibly more than 0.5% of the best-fit rigid-settlement tilt plane could be experienced before the distortion (i.e., out-of-roundness) at the top ring girder of a floating roof tank and would cause binding between the roof and the shell [63]. Also in the floating roof tanks, mechanical seals are unsuitable for distorted tank shells or where shell coatings have been applied. Liquid seals are suitable for all tanks, but particularly where tank shell distortion is present.

Runaway Reactions

A runaway reaction is a chemical reaction over which control has been lost. It continues to accelerate in reaction speed until it runs out of reactants [64]. Exothermic runaway reactions may occur when impurities or foreign materials are present in the storage tanks.

According to the results, runaway reaction is less important in the development of external floating roof tanks fire. Many of the runaway chemical reactions occurred in reaction tanks that failed or even exploded by means of thermal runaway. The temperature of the reaction increased rapidly resulting in increased pressure as liquids evaporated, and the tank failed because of the increased pressure. Other incidents occurred because of inadvertent mixing of incompatible materials or chemicals that exploded because of instability [65]. As seen, volatile heating reactions had to be rated first among other sub-criteria.

Sabotage

The last criterion effective in external floating roof tank explosion fire is sabotage. In 1972, four external floating roof tanks containing 500,000 barrels were sabotaged in Trieste, Italy. During this incident, foam lines are widely burned and damaged and bomb attack destroyed two tanks [31]. Fire damaged six more tanks. Pit fires spread to roof seals; roof sank and boilover occurred. The use of candles or wicks achieved the highest degree from the perspective of experts in fire and explosion.

Conclusion

In this paper, prioritizing the causes of fire and explosion in the external floating roof tanks was put forward. The relationship between the 11 main criteria and 71 sub-criteria effective in the fire and explosions was evaluated. Weighting and prioritization of criteria and sub-criteria were performed by ANP method and Super Decisions software. This study will help to identify the importance of each of the effective risk factors in fire and explosion in external floating roof tanks. That way, we can prioritize and implement control measures to prevent any risk factors in fire and explosion.