Underground tanks and their equipment

Northfield's fuel is stored underground in three tanks: 13,200 gallons of regular gasoline, 6,600 gallons of premium and 10,600 gallons of diesel. Together they hold 30,400 gallons, enough to fill more than six thousand of the 5-gallon gas cans sold in the store, and they sit a few feet below the forecourt for decades. If one leaks, the fuel goes straight into the soil and groundwater, out of sight. This lesson explains how an underground storage tank (UST) system is built, what each piece of equipment does to prevent or detect leaks, and what workers on shift can see and check.

Workers do not install, test or repair tank equipment; that is work for certified contractors. But the worker on shift is often the one who hears the alarm, sees the full spill bucket or smells fuel in a sump, so knowing what the equipment is for makes those warnings mean something.

The parts of a tank system

A modern station tank system has these main parts:

• The tank: a large steel or fiberglass cylinder buried in sand or pea gravel. Newer tanks are double-walled: an inner tank holds the fuel and an outer wall catches anything that leaks through it. The gap between them, the interstitial space, is monitored by a sensor.
• Piping: pipes carry fuel from the tank to the dispensers. At most stations a submersible turbine pump (STP) inside the tank pushes fuel through pressurized piping. Newer piping is also double-walled, with any leak draining back to a sump.
• Sumps: watertight boxes around the pump on top of the tank (the turbine sump) and under each dispenser (the dispenser sump or under-dispenser containment). They catch leaks from fittings and have sensors that alarm if liquid collects.
• The fill pipe and spill bucket: the delivery hose connects to the fill pipe, which has a spill bucket around it at the surface to catch drips when the hose is disconnected.
• Overfill prevention: a device that stops or warns of a delivery before the tank is too full, such as a valve in the fill pipe that closes when the tank reaches about 95% full, or an alarm that sounds at about 90% full.
• Vents: pipes that let air in and vapor out as the tank is filled and emptied, ending high above the ground.
• The tank gauge: a probe in each tank, linked to a console in the store, that measures fuel and water levels, runs leak tests and shows alarms from all the sensors.
• Corrosion protection: steel tanks and piping are coated and may have cathodic protection, an electrical system that stops the steel from rusting.

Rules for tank systems

In the United States, underground tank systems at stations are regulated by EPA's UST rules (40 CFR Part 280) and the state program, which in Montana is run by DEQ. Under the 2015 revisions, tanks and piping installed or replaced after April 11, 2016 must have secondary containment (double walls) with interstitial monitoring, and under-dispenser containment is required for new dispenser systems. Owners must register tanks, run release detection, test spill and overfill equipment, keep records and show financial responsibility for cleanup. Installation and repair must be done by certified contractors. Older single-walled steel tanks without corrosion protection are the most likely to leak, and most were upgraded or replaced after the original 1988 rules.

Routine checks

EPA's 2015 rule sets minimum inspection and test frequencies for UST systems, which Montana DEQ enforces (checked in 2026; the state program may add to them). At Northfield, the schedule is:

The tank gauge and its leak tests

The automatic tank gauge (ATG) is the station's main early warning system. Its probe measures the height of the fuel and of any water at the bottom of the tank very precisely, and the console turns that into volume using the tank's shape. Most of the time it is simply keeping inventory. But when the tank is quiet, with no sales and no delivery, usually overnight, the gauge can run a leak test: it watches the fuel level for a few hours and works out whether fuel is being lost.

The test has to allow for temperature. Fuel expands as it warms and shrinks as it cools, so a tank of fuel that is cooling overnight will seem to lose volume even if it is tight. The probe has temperature sensors along its length, and the gauge corrects for the change. What is left after the correction is the apparent leak rate. If that rate is above the test threshold, the tank fails the test and the gauge raises an alarm.

Under EPA's rule, a tank gauge used for monthly monitoring must be able to detect a leak of 0.2 gallons per hour (and an annual tightness test, 0.1 gallons per hour). The program below simulates a test with made-up readings: it corrects each reading for temperature, fits a straight line to the corrected volumes and compares the slope with the 0.2 gph threshold.

import random
random.seed(351)
# Simulated 4-hour overnight test on a 13,200 gal tank (made-up readings).
expansion = 0.00053        # gasoline volume change per gallon per degree F (typical)
threshold = 0.2            # gallons per hour

def run_test(true_leak_gph):
    hours, corrected = [], []
    volume, temp = 8200.0, 54.0
    for i in range(17):                       # a reading every 15 minutes
        t = i * 0.25
        temp_now = temp - 0.27 * t             # fuel cooling slowly overnight
        raw = volume * (1 + expansion * (temp_now - temp)) - true_leak_gph * t
        raw += random.gauss(0, 0.04)           # small measurement noise
        corrected.append(raw / (1 + expansion * (temp_now - temp)))
        hours.append(t)
    n = len(hours); mh = sum(hours) / n; mv = sum(corrected) / n
    slope = sum((h - mh) * (v - mv) for h, v in zip(hours, corrected)) / sum((h - mh) ** 2 for h in hours)
    rate = -slope
    return rate, ("FAIL" if rate > threshold else "PASS")

for leak in (0.0, 0.08, 0.4):
    rate, result = run_test(leak)
    print(f"True leak {leak:.2f} gal/h -> measured {rate:5.2f} gal/h -> {result}")

True leak 0.00 gal/h -> measured  0.01 gal/h -> PASS
True leak 0.08 gal/h -> measured  0.10 gal/h -> PASS
True leak 0.40 gal/h -> measured  0.40 gal/h -> FAIL

The simulation shows two things. A tight tank passes even though the raw fuel level dropped as the fuel cooled, because the gauge corrects for temperature. And a leak below the threshold passes the test too: a tank gauge test is designed to catch leaks above a certain size, not every drop. That is why stations also use inventory reconciliation (Lesson 8), sump sensors and line leak detectors, so that a small leak is caught by one method if another misses it.

Line leak detectors and sump sensors

Pressurized piping can leak much faster than a tank, because the pump is pushing fuel through it. A mechanical or electronic line leak detector sits on the pump and checks the line each time the pump starts. Under EPA's rule it must detect a leak of 3 gallons per hour at 10 psi within an hour, and slow the flow, shut off the pump or sound an alarm. A customer who says the pump is very slow, or the console showing a line alarm, may be the first sign of a piping leak.

Sump sensors sit at the bottom of the turbine and dispenser sumps. They alarm if liquid collects, which may be fuel from a leaking fitting or rainwater that has got in. Either way, the sump needs attention: fuel is a leak, and water can hide a leak and corrode the equipment. Some sump sensors are set to shut down the pump if they detect liquid.

What an alarm means at the counter

When the tank gauge console beeps and shows an alarm, the worker on shift should read the message, not just silence the beeper. The station procedure lists the alarms and the first response to each. At Northfield, the card beside the console says:

• Fuel or liquid alarm in a sump, interstitial space or line: stop the affected dispensers (or all of them, if unsure), tell the manager at once and record the alarm. Do not reset it.
• Leak test failure or line leak alarm: tell the manager at once; the manager calls the contractor and decides on reporting (Lesson 9).
• High level or overfill alarm during a delivery: tell the driver to stop the delivery at once.
• Low level, delivery needed, or high water alarm: tell the manager; high water in a tank can mean a leak that lets groundwater in.
• Sensor or probe out of order: tell the manager; the system is not watching that part of the tank.

Resetting or silencing an alarm without finding the cause is one of the most serious mistakes at a station. An alarm that keeps coming back is telling someone something.

For supervisors: walkthroughs that find problems

A walkthrough should be done with the lids open, not from the window. Open the spill buckets and look: they should be dry and clean, with no cracks. Look at the fill caps, vents and monitoring well caps for damage or missing pieces. Open dispenser doors and look at the sumps with a flashlight. Check the console for alarms and that the last leak tests passed. Record what was found and what was done, with the date and initials. Spill buckets full of fuel and water, cracked bucket walls and sumps with liquid in them are the most common problems found by inspectors, and all are easy to see on a careful walkthrough.