Fuel deliveries

Three times a week, a tanker pulls onto Northfield's lot and drops tens of thousands of litres of fuel into the underground tanks. A delivery is the moment of greatest risk on an ordinary day at a fuel station. A large, heavy truck manoeuvres among customers' cars. Hoses connect the truck's compartments to open fill ports on the forecourt, and fuel flows by gravity at a high rate. If the hose is connected to the wrong tank, gasoline ends up in the diesel tank. If the tank is fuller than the driver thinks, it overfills. If a hose fitting leaks or someone drives over a hose, fuel spills across the lot. And all the while customers keep fuelling a few metres away.

The fuel hauler's driver carries out the delivery and is responsible for doing it safely. The station's job is to make the site ready, keep customers and traffic away, check that the right product goes into the right tank, watch for problems, and respond to them. This lesson covers both sides, so the cashier knows what a good delivery looks like and when to step in. Lesson 9 covers the tanks themselves and overfill prevention in more detail.

How a delivery works

Northfield's fuel comes from a terminal in a tanker with several compartments, typically carrying different products, for example two compartments of regular gasoline, one of premium and one of diesel. Each underground tank has a fill port on the forecourt: a pipe with a cap inside a spill bucket, a small sealed container around the fill pipe that catches drips when the hose is disconnected. Fill ports are grouped in a delivery area away from the dispensers, with room for the truck to park clear of traffic.

• Arrival: the driver checks in with the cashier, confirms the order and which products and volumes are being delivered, and asks about anything unusual on site.
• Site check: the driver looks for hazards: parked cars, customers in the delivery area, ignition sources, open drains, damaged fill ports.
• Positioning: the truck parks in the delivery area, ideally facing the exit so it can drive straight out in an emergency, with the engine off unless the truck uses it to power pumps.
• Grounding (bonding): the driver connects a bonding cable from the truck to the station's grounding point or the fill pipe before opening anything, so static charge from the flowing fuel drains away.
• Tank levels: the driver and cashier check how much room is in each tank (the ullage) using the tank gauge or a stick reading, to make sure the delivery will fit (Lesson 9).
• Connecting: the driver opens the fill port cap, checks the colour code and label, connects the delivery hose to the right fill port and the right truck compartment, and connects the vapour recovery hose where required.
• Unloading: fuel flows by gravity. The driver stays at the truck and watches the hoses and fill ports for the whole delivery.
• Finishing: the driver closes the compartment valves, drains the hose into the tank, disconnects, closes and locks the fill port caps, cleans up any drips in the spill buckets, removes the bonding cable last, and records the delivery.

Getting the right product into the right tank

Delivering the wrong product into a tank, called a crossdrop, is one of the costliest mistakes at a fuel station. Gasoline in a diesel tank, or diesel in a gasoline tank, contaminates the whole tank and every vehicle that fills from it before the mistake is noticed. Gasoline in diesel lowers the flash point of the diesel, so it becomes a fire hazard, and destroys diesel engines; diesel in gasoline causes engines to run badly or stop. The tank must be pumped out and cleaned, and customers' vehicles repaired.

To prevent crossdrops, fill ports are marked with a colour and symbol system so the driver can match each truck compartment to the right tank. In North America the common system follows the American Petroleum Institute's recommended practice for identifying fuel equipment: each grade has a colour and shape on the fill cap and on a matching tag or label, and the truck's compartments are labelled to match. Stations add their own safeguards, such as locks on fill caps that only the cashier opens, a printed delivery ticket matched against the fill port labels, and a second person checking the connection before the valve is opened.

At Northfield, the cashier unlocks each fill cap for the driver only after checking the product on the delivery ticket against the label at the port, and watches the hose connection. When Mike started to connect regular gasoline to the diesel fill port last spring, it was Ben who noticed the yellow diesel cap and stopped him. The near miss led to a new rule: the cashier says the product name out loud at each port, and the driver repeats it before connecting.

Keeping customers and traffic away

A tanker on a busy forecourt is a hazard to customers and customers are a hazard to the delivery. Drivers park in the delivery area and set out traffic cones or a barrier around the truck and the fill ports. The cashier helps by keeping customers from parking or walking in the delivery area, closing nearby fuelling positions if the fill ports are close to them, and stopping anyone from smoking nearby. At Northfield, pumps 1 and 4, the ones nearest the fill ports, are closed during deliveries.

Many companies schedule deliveries outside the busiest hours to reduce traffic, but this can mean deliveries at night with a single cashier. If that is the case, the cashier must still be able to see the delivery, and the driver must be able to reach the cashier quickly. HSE-352 covers working alone at night.

Vapour recovery

When fuel flows into an underground tank, it pushes out an equal volume of vapour. Stage I vapour recovery captures this vapour through a second hose and returns it to the tanker, which takes it back to the terminal, instead of letting it escape through the tank vent. Some provinces and regions require Stage I vapour recovery at gasoline stations, and many fuel companies use it everywhere. Stage II vapour recovery, which captures vapour from vehicles at the nozzle, has been required in some places in the past; modern vehicles now have their own onboard vapour recovery systems, which has reduced the need for it.

For the cashier, vapour recovery means two things during a delivery: the vapour hose must be connected before the fuel hose is opened, and the strong smell of fuel at the tank vent pipe during a delivery may mean the vapour recovery is not connected or not working. Report it to the driver.

When to stop a delivery

The driver is in charge of the delivery, but anyone who sees a dangerous condition should speak up, and the cashier can press the station's emergency shut-off. Tankers also have their own emergency stop, usually a button or valve control on the truck, which stops the flow from the compartments. The cashier should know where it is on the trucks that serve the station, and the driver should show them.

• Fuel spilling from a fill port, hose or fitting.
• A vehicle driving over or toward a hose.
• A fire or a source of ignition near the delivery, such as a customer smoking or an idling vehicle near the fill ports.
• The driver leaves the truck during the delivery.
• An overfill alarm sounds, or the tank gauge shows the tank nearly full (Lesson 9).
• Lightning nearby.
• The wrong product appears to be connected.

Stopping a delivery is a safety decision, not an insult to the driver, and good drivers welcome it. If the cashier is unsure, they should ask the driver to pause while they check.

Delivery spills

Most delivery spills are small: a few litres from the hose when it is disconnected, caught by the spill bucket. Larger spills happen when hoses fail, fittings are not tightened, a tank overfills, or someone drives over a hose. The driver's truck carries a spill kit, and the station has its own. The response is the same as for any spill (HSE-351 covers it in depth): stop the flow, eliminate ignition sources, keep people away, contain the spill and keep it out of drains, absorb it, and report it.

The program below is the delivery checklist Marco uses to audit deliveries at Northfield. It scores each delivery observed during a month against the critical steps, so he can see which steps are most often missed. The data are invented.

# Audit fuel deliveries against critical steps (invented observations).
steps = ["bonding before opening", "ullage checked", "product read back at each port",
         "cones around truck", "driver stayed at truck", "return hose connected first", "caps locked after"]
observed = [  # 1 = done, 0 = missed, one row per delivery
    [1, 1, 1, 1, 1, 1, 1], [1, 1, 0, 1, 1, 1, 1], [1, 0, 1, 0, 1, 1, 1],
    [1, 1, 1, 1, 0, 1, 1], [1, 1, 1, 1, 1, 1, 0], [1, 1, 1, 0, 1, 1, 1],
    [1, 1, 0, 1, 1, 1, 1], [1, 1, 1, 1, 1, 1, 1], [1, 0, 1, 0, 1, 1, 1],
    [1, 1, 1, 1, 1, 1, 1], [1, 1, 1, 0, 1, 1, 1], [1, 1, 1, 1, 1, 1, 1],
]
n = len(observed)
for i, s in enumerate(steps):
    done = sum(row[i] for row in observed)
    print(f"{s:32}{done:>3}/{n}  {'CHECK' if done < n else ''}")
perfect = sum(1 for row in observed if all(row))
print(f"Deliveries with every critical step: {perfect}/{n} ({perfect / n:.0%})")

bonding before opening           12/12  
ullage checked                   10/12  CHECK
product read back at each port   10/12  CHECK
cones around truck                8/12  CHECK
driver stayed at truck           11/12  CHECK
return hose connected first      12/12  
caps locked after                11/12  CHECK
Deliveries with every critical step: 4/12 (33%)

Only four of twelve deliveries had every critical step done. Bonding and vapour hose order were always right, and the driver stayed with the truck in all but one delivery, which is reassuring because a missed bond or an unattended hose can cause a fire or a large spill; the one lapse still needs raising with the hauler, as does the one delivery where the caps were not locked afterwards. The weak points are the cones around the truck, missed four times, the ullage check, missed twice, and the new read-back of the product at each port, missed twice in its first month. Marco raises the cones with the hauler, since drivers set them out, and reminds cashiers about the ullage check and the read-back, since those are the station's steps.

For supervisors: build a working relationship with the hauler

The station and the fuel hauler share responsibility for every delivery. Meet the hauler's safety contact once a year. Agree on the delivery procedure, the station's rules (closed pumps, read-back at each port, cashier unlocks caps), and how near misses are reported both ways. Share the audit results. Drivers deliver to many stations; the ones where the cashier knows the procedure and speaks up are the ones where mistakes are caught.