After formally adopting API Standard 653 for its tank inspection and repair program, Colonial Pipeline Co, Atlanta, Ga., has developed procedures based on risk-management principles to level the load of tanks out of service for inspection at any one time.
Colonial Pipeline consists of 5,519 miles of pipeline, extending from Houston and other Gulf Coast refining centers to markets throughout the South and East Coast. The pipeline's northern terminus is Linden, NJ, at the New York harbor.
Colonial transports gasoline, heating oil, jet fuel, defense fuels, and other liquid petroleum products. Founded in 1962, Colonial today transports 2.3 million b/d of product, representing about 20% of all liquid fuel delivered in the US.
Tank-integrity program
Colonial owns and operates 500 breakout, relief, and utility tanks that temporarily store refined petroleum products. These tanks have a combined storage capacity of about 28.4 million bbl (Fig. 1).
In the late 1980s, Colonial instituted a 10-year breakout tank inspection and repair program. Under this program, each tank would be removed from service, inspected, and repaired on a 10-year reinspection interval.
On May 3, 1999, Colonial formally adopted API Standard 653 "Tank Inspection, Repair, Alteration, and Reconstruction" (OGJ, June 3, 2002, p. 54) as the standard by which breakout, utility, and surge tanks are inspected and repaired.
The program covers tanks at all breakout tank farms, as well as smaller tanks at booster stations and delivery facilities. Tank inspection intervals were established in accordance with API Standard 653 by calculating tank floor and shell corrosion rates.
Previous tank inspection and repair activities were completed within a 2-4 year time frame, creating tank inspection dates that were clustered around a few specific years. Having a high number of out-of-service inspections in a single year presents significant challenges in obtaining financial, operational, and labor resources and reduces the overall efficiency of the tank integrity program. These challenges may be met by "level-loading" the number of out-of-service inspections to a comparatively even number of inspections each year. This presents an obvious question: "How should a tank inspection program be level-loaded to maximize the efficiency of the tank integrity program and still meet API Standard 653 requirements?"
Colonial began by collecting employees' knowledge of the design and conditions of each tank and prioritizing it. This attempt helped identify characteristics of the design, operating history, or maintenance of each tank that represent risks. This attempt did not, however, satisfy Colonial's desire to understand the consequences of these risk characteristics.
To have a more effective inspection program, Colonial wanted to consider the consequence risks associated with each tank. In January 2000, the company began examining methods for using formal risk assessment to level-load the tank schedule.
Inspection program
A Microsoft Excel-based program generates risk scores for each tank. In this program, each tank's API 653 out-of-service inspection due date serves as the last allowable inspection date.
The peaks and valleys in the number of tank inspection due dates each year are level-loaded using the risk scores generated from the program. The tanks with lower scores (indicating a greater risk) have their out-of-service inspection dates advanced to even out the number of tanks that must be inspected each year.
Every year the tank risk-assessment model is updated and the results of any tank inspections conducted in that year are included. During this update, the risk scores are recalculated for all tanks and any adjustments in the level loading of the inspection dates are made.
An additional methodology for level loading the program considered is whether a potential release from each tank would affect a high consequence area (HCA) as defined by the US Office of Pipeline Safety. These include "high populated areas," "other populated areas," ecological and drinking water "unusually sensitive areas," and "commercially navigable waterways."
If the facility with a tank lies adjacent to or intersects any of these HCAs, it is assumed that a failure of any tank would affect the HCA. Tanks that can affect HCAs are given additional priority for earlier inspection.
Risk-assessment model
Colonial's tank risk-assessment model examines the factors that affect the cause, size, or severity of an accident involving a tank failure. These factors can affect either the likelihood (probability) or the impact (consequence) of an accident. Overall risk is the combination of these two types of risk factors.
Probability risk factors include physical attributes of the tank such as design, operational history, or maintenance history. Consequence risk factors, on the other hand, are largely made up of the characteristics of the tank location such as nearby urban or environmental areas.
The tank risk-assessment model is based on Colonial's risk-assessment model for pipelines and uses many of the same risk factors when determining the consequence part of the model.
The probability risk factors are divided into four categories, each with a weighting toward total probability: design (19%), operation (11%), inspection (28%), and corrosion (42%).
Each of these categories contains a number of individual risk factors, each of which is worth a variable number of points, depending on the characteristics of each tank.
The scores for each variable are rolled into these four categories. For these probability factors, higher scores reflect lower risk. The sum of these four categories represents the total probability risk.
The consequence scores reflect the presence of any HCAs or any other sensitive receptors that are near the tank. For the consequence score, higher numbers reflect higher amounts of consequence (more risk).
The relationship is opposite of that for the probability scores; so that when the probability score is divided by the consequence score, the overall score is lower when the risk is higher.
In summary, the overall risk for each tank is higher when the overall score is lower.
Probability factors-design
The tank design variable category consists of design features that may or may not have been included when the tank was constructed or repaired or modified. There are nine of these factors: annular ring, first-course shell penetrations, the tank's foundation, the roof, the contractor who constructed the tank, venting, design standards, secondary containment, and the tank's external liner.
"Annular ring" refers to the design of the floor plates under the tank wall. Colonial's tankage was constructed in the early 1960s and during a subsequent expansion in early 1970s. The tank floors were designed with 5/16 in. thick floor with sketch sheets around the perimeter extending underneath the shell.
In the early 1990s, Colonial began experiencing fatigue cracking in heavily cycled tanks. This cracking occurs in the interior corner weld heat-affected zone where the sketch plates were fillet welded to the shell plates.
To mitigate cracking potential of the fillet weld, Colonial incorporated a 3/8 in. thick butt-welded annular ring in its floor-replacement specification. The presence of an annular ring reduces the risk level of the tank.
"First-course shell penetrations" re fers to the design of the tank's first shell course. Past Colonial experience, along with API RP 581, indicate a correlation between the number of first-course shell penetrations and higher risk.
For this reason, a Colonial replacement specification for first courses reflects a minimal amount of penetrations, two 36-in. manways. Tanks with more than two first-course penetrations receive the greater attention.
Approximately 85% of Colonial tankage rests on concrete ringwalls, 12% on earthen foundations, and the remaining 3% on concrete slabs. Greater risk is associated with tanks built on earthen foundations. These erode and wash over time leaving air and water corrosion cells underneath the tank floor.
Colonial's original construction specifications required all distillate tanks to be equipped with cone roofs and all gasoline tankage to be equipped with external floating roofs.
Due to heavy cycling, Colonial experienced some maintenance problems with external floating roofs. The deck sheeting and pontoons experience accelerated corrosion and weld cracking while the external-floating-roof drain piping experienced fatigue cracking.
For these reasons, Colonial began an external-floating-roof replacement program. More than 150 external-floating-roof tanks were retrofitted with geodesic domes and aluminum full-contact or skin and pontoon decks. Twenty-one uncovered external-floating-roof tanks remain on Colonial's system and receive closer evaluation than tanks retrofitted with domes.
Through first-round tank inspections and repairs, tanks constructed by certain vendors during specific time frames have proven to have more construction defects. Colonial has identified these tank-construction vendors and all tanks built by them. A higher risk is associated with tanks built by these vendors.
Risk increases proportionally with the amount of venting space. Vents must be inspected and cleaned regularly to ensure they do not become clogged with debris or covered by painting contractors.
Most Colonial tanks were constructed in 1962 and designed to API Standard 650. Colonial has purchased a few tanks that were designed and built to API 12C, and the company's inspection and repair experience has shown tanks built to API 12C require a different type of scrutiny to ensure their integrity.
Secondary containment is the ability to contain any potential releases from the tank. Colonial uses different varieties of secondary containment, earthen or concrete dike walls, silt traps, oil or water separators, and facility collection ponds with underflow outlets.
Colonial specifically chose not to install double-bottom tank modifications for concern of the design considerations related to the cone-down center drain dry sumps. Tanks without any secondary containment system are considered higher risk.
Finally, there is the external liner and the use of geosynthetic and high-density polyethylene (HDPE) liners beneath tank floors. Since 1990 Colonial has installed external liners on all tanks receiving floor replacements.
The external liner is designed to contain any release from the floor or sump. The addition of external liners significantly reduces any consequence of a release. Tanks without external liners are considered higher risk.
Probability factors-operation
The tank operation-variable category consists of five variables that reflect risk associated with how the tank is operated: tank diameter, radar gauging, operational cycling, product factor, and end of the pipeline interface tanks.
Colonial has experienced significant fatigue cracking in the heat-affected zone of the interior corner weld on larger diameter tanks (70 ft and larger). Larger tanks also have more area that is susceptible to corrosion or construction defects. These two factors cause larger tanks to be inherently riskier than smaller tanks.
Past experience has shown the radar-gauging systems tend to be more precise on Colonial's tanks. The company has two set levels programmed into the radar gauge, a "High Level" and "Maximum Fill" set point. In addition to those settings, the "Maximum Fill" set level is backed up with a mechanical gauge.
The use of radar gauging has decreased the number of operator errors and represents a reduction in risk for those tanks in which it is installed.
"Operational cycling" refers to the number of times a tank is filled and emptied within a specified time frame. A number of Colonial tanks are very heavily cycled, which has contributed to floor and internal floating deck maintenance problems such as fatigue cracking. Tanks in Colonial's system that receive heavy operational cycling are subject to the most intense scrutiny.
Since the company moves refined petroleum products, gasoline, home heating oil, aviation fuel, and other liquid petroleum products are stored in various tanks.
Past tank inspections have revealed substantially more internal corrosion problems with tanks that routinely store gasoline and were constructed with external floating roofs. Tanks that store gasoline require closer scrutiny than those storing distillates due to water intrusion problems.
Because Colonial does not use product batch-segregation tools such as spheres, interface products accumulate in tanks at the end of some pipelines. Interface product is a mixture of the two product batches that were being transported.
Tanks that store interface product may do so for long periods before emptying. In addition, side-entry fill lines were installed during the original construction of these tanks. Side-entry fill lines prevent these tanks from being completely emptied when the interface product is removed.
Longer interface product storage times coupled with the inability completely to empty these tanks requires closer observation to ensure against failure of these tanks.
Probability factors-inspection
The tank-inspection-variable category consists of four variables that reflect risk associated with how often and recently a tank is inspected. These are the frequency of out-of-service inspection, the most recent out-of-service inspection, and the in-service inspection record and leak detection.
Tanks with multiple out-of-service inspections have less risk because corrosion rates are more precisely known and construction defects have been identified and repaired. Conversely, as the time since the last inspection increases, the level of risk in the tank also increases.
In-service inspection frequency represents the number of times a tank has received 5-year "In-Service Inspections." More in-service inspections result in greater knowledge of the tank and lowers risk factors.
Leak detection represents the type and frequency of visual inspections performed on the tank in a given time period.
Early visual detection of a leak results in less consequence of a given release. Leak-detection systems on a tank lower the risk for that tank.
Probability factors-corrosion
The corrosion-variable category consists of five variables: the corrosion rate, the tank's floor thickness, cathodic protection, design of the fill line and sump, and coating of the tank's internal floor.
Corrosion rates document the rate at which the tank floor and shell metal corrode over time. This rate is determined from previous out-of-service inspections and is altered with the addition of tank cathodic protection and internal coatings.
A high corrosion rate would require shorter inspection intervals because of the tank's increased risk. These corrosion rates are calculated in accordance with API 653.
Thicker tank floors can sustain more corrosion before the floor must be repaired or replaced. API 653 defines minimum floor-thickness values, which are used in Colonial's repair standards. Colonial installs floor steel with a minimum thickness of 5/16 in. Tanks with thicker repaired or replaced floors have lower levels of risk.
Cathodic-protection equipment is installed on a tank to inhibit bottomside floor corrosion. The effectiveness of this equipment determines the amount of metal, if any, that will corrode. The presence of cathodic protection equipment lowers the risk of the tank.
Colonial installed cone-down floors with center drain dry sumps that enable the company's pipeline system to handle multiple product grades in the same tank. The tank can be completely evacuated before change of product grades.
On some smaller tanks, Colonial installed side-entry fill lines. These lines do not allow for the complete evacuation (drain dry) of a tank, thus requiring closer and more frequent inspection. Colonial considers side-entry fill line tanks to have a greater risk.
Original-construction tank floors were left uncoated, resulting in substantial topside floor-corrosion pitting. As tanks were inspected and repaired before 1999, inorganic zinc or thin-film epoxy coatings were applied.
From 1999 forward, Colonial used only thin-film epoxy as the tank floor coating. Internal tank floor coatings substantially reduce the chance of topside corrosion problems and thus risk of tank floor failure from topside corrosion. Thin-film epoxy liners represent the least amount of risk.
Consequence factors
Four factors comprise the consequence portion of the risk-assessment model: product hazard, spill volume, spill spread, and receptors. These variables assess the consequence of an incident in terms of impact to the environment and the public near the location of the potential release.
Product hazard represents the health hazards of the products stored in the tank. For tanks that store multiple types of product, the product with the most acute and chronic effects on the public and environment is used.
Spill volume is the potential volume of product that could be released from a tank in the event of a failure. This amount assumes that the tank is filled to its design storage capacity ("Maximum Fill" level) and that the tank is completely emptied during the incident.
The level of risk from spill volume is determined by comparing the volume of the tank in question against the volume of the largest tank on the system.
The spill spread is the spread of the product across the surface of the ground, a measure of the area of land covered by product.
Colonial's facilities are designed with tank dikes, oil-water separators, and containment ponds so that surface spread of product is contained within the property lines of the facility. As a result, the land area (determined by property lines) of the facility is used to determine this risk factor.
Receptors refer to the existence of HCAs, high-value areas (HVAs), or other sensitive areas near the tank in question.
HCAs are determined by the DOT's Office of Pipeline Safety and include areas of high population, drinking water resources, ecologically sensitive areas, and commercially navigable waterways.
HVAs represent other valuable and sensitive public areas such as schools, commercial districts, or public lands. Receptors also include any nearby wetlands, water intakes, or significant bodies of water.
Results of level loading
Level loading Colonial's tank inspection program has resulted in approximately 40 tanks/year to be inspected. These tanks will receive an out-of-service inspection or will be removed from service.
Colonial's schedules vary from approximately 35 to 47/year out-of-service tank inspections. Of the approximately 40 tanks, floors will be replaced in 6-10 tanks.
Comparison of the risk scores for each tank against Colonial's tank inspection and repair experience showed that the risk-assessment model appropriately reflects the risks and intuitive knowledge of each tank. To date, this program has proven successful in level loading a long-term out-of-service inspection schedule for Colonial's tanks.
The authors
Alan Geis is project manager for Colonial Pipeline's system integrity program and has worked for Colonial for 15 years in various tank-related assignments. Geis holds a BS (1985) in business management from Oklahoma State University, Stillwater, and is a member of the API subcommittee on pressure vessels and tanks, subgroup design.
Jake Haase is a metallurgical engineer working on Colonial's integrity management program and has worked for 3 years at Colonial Pipeline in system integrity positions. He holds a masters of materials science and engineering (1998) from the Georgia Institute of Technology, Atlanta, and is a member of the API subcommittee on tubular goods, task group on line pipe.
Caron Cone is risk-assessment coordinator for Colonial's system integrity team and has worked for 6 years for Colonial. She holds a BS (1996) in mechanical engineering from the University of Tennessee, Knoxville.
