Tanks, flares and vapour hazards

Tanks and flares look like the simplest equipment in a facility. A tank is a steel can that holds oil or water; a flare is a pipe that burns gas. Yet tanks and flares are involved in a large share of the deaths, fires and explosions at oil and gas facilities, because they are where hydrocarbon vapours meet air and where pressure meets equipment that cannot hold much of it. Workers gauge tanks, load trucks, change hatches, light pilots and work near flare stacks every day. This lesson explains how tanks and flares work, how they fail and how to work around them safely. HSE-330 introduced flammable atmospheres, vapour density and the tank gauging deaths investigated by NIOSH; this lesson builds on that foundation with the equipment itself.

Atmospheric and low-pressure tanks

Most oil, condensate and produced water at field facilities is stored in vertical steel or fibreglass tanks designed for pressures of only a few kilopascals, often less than 7 kPa (1 psi). Larger terminals use bigger atmospheric tanks, some with floating roofs that ride on the liquid to reduce vapour space. Because these tanks can hold so little pressure, both overpressure and vacuum can damage them. Pumping liquid in pushes vapour out; pumping liquid out or a sudden cooling rainstorm draws air in; gas blowby from upstream, described in Lesson 3, can split a tank in seconds; and a blocked vent during pump-out can suck a tank in on itself.

Tanks are protected by several fittings, each with a safety role:

• Thief hatch: a lid on the roof used for manual gauging and sampling, which also acts as an emergency pressure and vacuum relief on many tanks. It must seal properly and be closed except when in use.
• Pressure-vacuum relief valve: lets vapour out when pressure rises and air in when it falls, within set limits.
• Emergency vent or manway relief: a large hatch that lifts under severe overpressure, for example in a fire.
• Vent line to vapour recovery or flare: collects tank vapours to reduce emissions and odour.
• Flame arrestor: a mesh or plate element on vents that stops a flame travelling back into the tank.
• Level gauges and high-level alarms: prevent overfilling, which can spill oil and push liquid into vent and flare lines.
• Grounding and bonding connections: control static electricity during loading.

When these fittings are missing, stuck or left open, tanks emit vapour, draw in air or fail. A thief hatch left open allows vapour to vent at head height on the tank roof; a corroded flame arrestor may not stop a flash-back; a plugged pressure-vacuum valve may let the tank collapse during pump-out. Hatches and vents should be part of every round.

Tank vapours and gauging

The vapour space above crude oil and condensate is often rich in light hydrocarbons, well above their upper explosive limit inside the tank, and it may contain H2S and benzene. When a thief hatch is opened, especially just after the tank has been filled from a separator, a burst of concentrated vapour can rise out at the worker's face. Hydrocarbon vapours at high concentration displace oxygen and act as anaesthetics, and they can cause sudden cardiac arrhythmia; NIOSH and OSHA linked several deaths of workers found on or near tank hatches to this exposure. HSE-330 described those deaths and the 2016 hazard alert. The main controls are to eliminate manual gauging where possible with remote level gauges and sample systems, to avoid opening hatches when tanks are being filled, to stand upwind and back from the hatch, to wear and watch a four-gas monitor, to use respiratory protection as assessed and never to work on a tank roof alone.

Vapour also spreads at ground level. Heavier-than-air hydrocarbon vapours released from a hatch or vent can flow down the tank wall and collect in low areas, ditches and the inside of firewalls and berms, as HSE-330 explained. A truck idling near a tank battery during loading can be an ignition source for vapours that have flowed to it. Loading areas are designed with ignition source controls, and drivers and operators follow loading procedures that keep engines and phones away from vapour zones.

Static electricity and lightning

Flowing hydrocarbons generate static charge, especially when liquids are pumped fast, splash-filled into a tank or flow through filters. A charged liquid or a charged person or truck can discharge as a spark into a flammable vapour space. Controls include bonding the truck to the tank and grounding both before loading, starting flow slowly until the fill pipe is submerged, using bottom loading or submerged fill pipes, avoiding plastic buckets and synthetic clothing in vapour zones, and allowing charge to relax before gauging or sampling after filling. Fibreglass tanks need special grounding arrangements because the tank itself does not conduct.

Lightning is a major cause of tank fires. A strike near or on a tank can ignite vapours at vents and hatches, especially on tanks with open hatches or failed seals. Tank batteries are grounded and some have lightning protection, and many companies stop loading, gauging and roof work when lightning is within a set distance.

Tank fires

Tank fires range from a small flame at a vent to a full-surface fire on a large tank. Small fires at vents can sometimes be extinguished by closing the vent or snuffing the flame, but only by trained responders under the emergency plan. Full-surface fires on crude oil tanks can lead to a boilover, where water at the bottom of the tank is heated by a hot zone travelling down through the oil, turns to steam and ejects burning oil high into the air and well beyond the tank. Boilovers have killed firefighters at large tank fires. Field workers should never approach a burning tank; they should raise the alarm, shut in what they can from a safe place and evacuate as the emergency plan directs.

Flares and combustors

Flares safely burn gas that cannot be conserved or that must be released in an emergency. An elevated flare carries gas up a stack to a tip where pilot flames ignite it. Enclosed combustors burn gas inside an insulated chamber, which hides the flame and can improve combustion. Every flare system has the same main parts:

A flare that goes out is a serious hazard at a sour facility. Unburned sour gas released at the tip may not disperse safely and can reach the ground at toxic concentrations, especially in calm or stable weather. Flares at sour facilities have pilot monitoring and alarms, and some have automatic re-ignition. When an operator sees a flare out, the response is to treat the area downwind as a possible H2S zone, alert the control centre and follow the procedure for relighting, which normally requires the gas flow to be reduced and the area checked before ignition is attempted.

Burning liquid falling from a flare, sometimes called flaming rain, happens when the knockout drum overfills or liquid slugs enter the flare header. It can start grass fires around the stack and burn anyone below. High-level alarms and shutdowns on knockout drums, and keeping liquids out of flare systems, prevent it.

Flare radiation

Flames radiate heat. Near a large flare during an emergency blowdown, radiation can be intense enough to burn exposed skin in seconds. Engineers locate flares and set sterile areas so that radiation at places where people may be stays below limits that depend on how long a person would be exposed. API 521 gives commonly used guidance values, for example around 1.6 kW/m² (about 500 Btu/h·ft²) for continuous exposure of personnel with appropriate clothing and higher values for brief exposures with escape routes. The program below uses the simple point-source model to estimate radiation at different distances from an invented flare. It is a teaching approximation only; real flare studies use more detailed models.

# Point-source flare radiation estimate (teaching approximation only).
# q = tau * F * Q / (4 * pi * D^2)
import math

gas_rate_kg_s = 25.0          # emergency blowdown rate, invented
lhv_kj_kg = 46_000           # lower heating value of the gas, approximate
F = 0.2                      # fraction of heat radiated, assumed
tau = 0.9                    # atmospheric transmissivity, assumed
flame_height_m = 30.0        # height of flame midpoint above grade, assumed

Q = gas_rate_kg_s * lhv_kj_kg                # kW released
for x in (30, 50, 75, 100, 150):
    D = math.hypot(x, flame_height_m)        # slant distance to flame midpoint
    q = tau * F * Q / (4 * math.pi * D ** 2)
    print(f"{x:>4} m from base: about {q:5.2f} kW/m2  ({q*317:6.0f} Btu/h ft2)")
print(f"Total heat release: {Q/1000:.0f} MW")

  30 m from base: about  9.15 kW/m2  (  2901 Btu/h ft2)
  50 m from base: about  4.84 kW/m2  (  1536 Btu/h ft2)
  75 m from base: about  2.52 kW/m2  (   800 Btu/h ft2)
 100 m from base: about  1.51 kW/m2  (   479 Btu/h ft2)
 150 m from base: about  0.70 kW/m2  (   223 Btu/h ft2)
Total heat release: 1150 MW

In this invented case, radiation falls quickly with distance. Near the base during a large release it is high enough to cause pain on exposed skin within seconds, and only at about 100 m does it fall to the level commonly used for continuous exposure of people with appropriate clothing. That is why flare areas are fenced, why work near flares is scheduled when the flare is lightly loaded or isolated, and why maintenance on flare stacks and tips requires the flare to be taken out of service under a permit.

Venting and vapour recovery

Some facilities still vent gas directly from tanks, pneumatic devices, compressor seals and dehydrators. Vented gas is a fire and toxic hazard near the vent and a large source of methane emissions. Regulators in both countries have tightened rules on venting and flaring over the past decade, requiring vapour recovery, low-bleed or air-driven pneumatics, leak detection and repair programs and limits on routine flaring. For workers, the safety consequences are mostly good: fewer vents mean fewer vapour clouds. But vapour recovery units add compressors, piping and control systems that can fail, and a vapour recovery system that draws too hard can pull a vacuum on tanks. Operators should know how their tanks are connected and what happens to tank pressure when a vapour recovery unit trips or restarts.