Underground tanks and their equipment

Northfield's fuel is stored underground in three tanks: 50,000 L of regular gasoline, 25,000 L of premium and 40,000 L of diesel. Together they hold 115,000 L, enough to fill more than five thousand of the 20 L jerry cans sold in the store, and they sit a metre or so below the forecourt for decades. If one leaks, the fuel goes straight into the soil and groundwater, out of sight. This lesson explains how an underground storage tank system is built, what each piece of equipment does to prevent or detect leaks, and what workers on shift can see and check.

Workers do not install, test or repair tank equipment; that is work for certified contractors. But the worker on shift is often the one who hears the alarm, sees the full spill bucket or smells fuel in a sump, so knowing what the equipment is for makes those warnings mean something.

The parts of a tank system

A modern station tank system has these main parts:

• The tank: a large steel or fibreglass cylinder buried in sand or pea gravel. Newer tanks are double-walled: an inner tank holds the fuel and an outer wall catches anything that leaks through it. The gap between them, the interstitial space, is monitored by a sensor.
• Piping: pipes carry fuel from the tank to the dispensers. At most stations a submersible turbine pump (STP) inside the tank pushes fuel through pressurized piping. Newer piping is also double-walled, with any leak draining back to a sump.
• Sumps: watertight boxes around the pump on top of the tank (the turbine sump) and under each dispenser (the dispenser sump or under-dispenser containment). They catch leaks from fittings and have sensors that alarm if liquid collects.
• The fill pipe and spill bucket: the delivery hose connects to the fill pipe, which has a spill bucket around it at the surface to catch drips when the hose is disconnected.
• Overfill prevention: a device that stops or warns of a delivery before the tank is too full, such as a valve in the fill pipe that closes when the tank reaches about 95% full, or an alarm that sounds at about 90% full.
• Vents: pipes that let air in and vapour out as the tank is filled and emptied, ending high above the ground.
• The tank gauge: a probe in each tank, linked to a console in the store, that measures fuel and water levels, runs leak tests and shows alarms from all the sensors.
• Corrosion protection: steel tanks and piping are coated and may have cathodic protection, an electrical system that stops the steel from rusting.

Rules for tank systems

In Alberta, underground tank systems at retail stations must meet the Alberta Fire Code, which sets requirements for design, installation, leak detection, record keeping and removal, and must be registered with the Petroleum Tank Management Association of Alberta. Tanks and components are built to Canadian standards from ULC (such as standards for steel and fibreglass underground tanks), and installation, upgrades and removal must be done by certified contractors and are recorded with the registry. The Canadian Council of Ministers of the Environment publishes a national environmental code of practice for storage tank systems that many provinces draw on. Older single-walled steel tanks without corrosion protection are the most likely to leak, and many have been replaced over the past few decades.

Routine checks

Tank equipment is checked by the station on a routine schedule and tested by contractors less often. The station procedure, based on the fire code and the tank registry's requirements, sets the station's own schedule. At Northfield, the routine checks are:

The tank gauge and its leak tests

The automatic tank gauge (ATG) is the station's main early warning system. Its probe measures the height of the fuel and of any water at the bottom of the tank very precisely, and the console turns that into volume using the tank's shape. Most of the time it is simply keeping inventory. But when the tank is quiet, with no sales and no delivery, usually overnight, the gauge can run a leak test: it watches the fuel level for a few hours and works out whether fuel is being lost.

The test has to allow for temperature. Fuel expands as it warms and shrinks as it cools, so a tank of fuel that is cooling overnight will seem to lose volume even if it is tight. The probe has temperature sensors along its length, and the gauge corrects for the change. What is left after the correction is the apparent leak rate. If that rate is above the test threshold, the tank fails the test and the gauge raises an alarm.

A common threshold for a monthly tank gauge test is 0.2 US gallons per hour, about 0.76 L/h, which is the figure used in the US federal rules and in equipment certifications used in Canada as well; the code, the equipment's certification and the station procedure set the threshold that applies to each tank. The program below simulates a test with made-up readings: it corrects each reading for temperature, fits a straight line to the corrected volumes and compares the slope with the threshold.

import random
random.seed(351)
# Simulated 4-hour overnight test on a 50,000 L tank (made-up readings).
expansion = 0.00095        # gasoline volume change per litre per degree C (typical)
threshold = 0.76           # litres per hour (about 0.2 US gal/h)

def run_test(true_leak_lph):
    hours, corrected = [], []
    volume, temp = 31000.0, 12.0
    for i in range(17):                       # a reading every 15 minutes
        t = i * 0.25
        temp_now = temp - 0.15 * t             # fuel cooling slowly overnight
        raw = volume * (1 + expansion * (temp_now - temp)) - true_leak_lph * t
        raw += random.gauss(0, 0.15)           # small measurement noise
        corrected.append(raw / (1 + expansion * (temp_now - temp)))
        hours.append(t)
    n = len(hours); mh = sum(hours) / n; mv = sum(corrected) / n
    slope = sum((h - mh) * (v - mv) for h, v in zip(hours, corrected)) / sum((h - mh) ** 2 for h in hours)
    rate = -slope
    return rate, ("FAIL" if rate > threshold else "PASS")

for leak in (0.0, 0.3, 1.5):
    rate, result = run_test(leak)
    print(f"True leak {leak:.1f} L/h -> measured {rate:5.2f} L/h -> {result}")

True leak 0.0 L/h -> measured  0.02 L/h -> PASS
True leak 0.3 L/h -> measured  0.36 L/h -> PASS
True leak 1.5 L/h -> measured  1.51 L/h -> FAIL

The simulation shows two things. A tight tank passes even though the raw fuel level dropped as the fuel cooled, because the gauge corrects for temperature. And a leak below the threshold passes the test too: a tank gauge test is designed to catch leaks above a certain size, not every drop. That is why stations also use inventory reconciliation (Lesson 8), sump sensors and line leak detectors, so that a small leak is caught by one method if another misses it.

Line leak detectors and sump sensors

Pressurized piping can leak much faster than a tank, because the pump is pushing fuel through it. A mechanical or electronic line leak detector sits on the pump and checks the line each time the pump starts. If it detects a leak, it slows the flow to a trickle or shuts the pump off. A customer who says the pump is very slow, or the console showing a line alarm, may be the first sign of a piping leak.

Sump sensors sit at the bottom of the turbine and dispenser sumps. They alarm if liquid collects, which may be fuel from a leaking fitting or rainwater that has got in. Either way, the sump needs attention: fuel is a leak, and water can hide a leak and corrode the equipment. Some sump sensors are set to shut down the pump if they detect liquid.

What an alarm means at the counter

When the tank gauge console beeps and shows an alarm, the worker on shift should read the message, not just silence the beeper. The station procedure lists the alarms and the first response to each. At Northfield, the card beside the console says:

• Fuel or liquid alarm in a sump, interstitial space or line: stop the affected dispensers (or all of them, if unsure), tell the manager at once and record the alarm. Do not reset it.
• Leak test failure or line leak alarm: tell the manager at once; the manager calls the contractor and decides on reporting (Lesson 9).
• High level or overfill alarm during a delivery: tell the driver to stop the delivery at once.
• Low level, delivery needed, or high water alarm: tell the manager; high water in a tank can mean a leak that lets groundwater in.
• Sensor or probe out of order: tell the manager; the system is not watching that part of the tank.

Resetting or silencing an alarm without finding the cause is one of the most serious mistakes at a station. An alarm that keeps coming back is telling someone something.

For supervisors: walkthroughs that find problems

A walkthrough should be done with the lids open, not from the window. Open the spill buckets and look: they should be dry and clean, with no cracks. Look at the fill caps, vents and monitoring well caps for damage or missing pieces. Open dispenser doors and look at the sumps with a flashlight. Check the console for alarms and that the last leak tests passed. Record what was found and what was done, with the date and initials. Spill buckets full of fuel and water, cracked bucket walls and sumps with liquid in them are the most common problems found by inspectors, and all are easy to see on a careful walkthrough.