HSE-RM SOLUTIONS | Technical Review | 3 November 2026
A tank fire is an outcome. Hazard identification must
explain the paths that can lead to it.
Where could material escape? When could an ignitable
atmosphere form? Which activity could introduce ignition? What could disable
the safeguards?
For a pitch intermediate storage tank, these questions
extend to the heating system, pumps, piping, vents, instruments, maintenance
work and people operating the installation. The most useful assessment follows
those connections before selecting controls.
This article presents 40 sample hazard scenarios
under four headings: Physical, Activities, Process and Operations. It is
a starting point for a multidisciplinary assessment, not an exhaustive
inventory or an investigation finding about HPCL or any other facility. No
control listed below should be treated as installed or effective without site
evidence.
Define the material and assessment boundary
The working example is a heated, above-ground tank holding a
petroleum-derived pitch or heavy refinery intermediate, with connected
transfer and heating equipment. Tank type, pressure rating, heating medium and
inerting arrangements must be confirmed.
“Pitch” is not a sufficient material specification.
Petroleum pitch, coal-tar pitch and commercial bitumen can have materially
different properties. Bitumen guidance identifies useful mechanisms, but its
temperature limits and product assumptions cannot automatically be transferred
to an unknown refinery stream.
Before the workshop, assemble the following:
- Material
information: representative composition and variability, safety data,
flash point and test method, volatility, thermal stability, water content,
sulphur and H2S potential, viscosity and relevant occupational exposures.
- Equipment
information: drawings, tank design temperature and pressure, normal
and emergency venting, heating arrangement, connected pressure sources,
isolation points and containment.
- Operating
information: permitted inventory, temperature and flow ranges, startup
and shutdown sequences, transfer routes and abnormal operating modes.
- Performance
evidence: inspection reports, trends, leak history, alarm and trip
tests, temporary overrides, maintenance records and emergency-system
tests.
The safe operating envelope must come from the actual
process and equipment. A generic safety data sheet alone may leave important
process conditions unresolved.
Separate ignition from release and escalation
A strong hazard statement distinguishes three events:
- Initiation:
a seal leaks, a vent blocks, a heater control fails or an unsafe activity
begins.
- Ignition
or other harm: released fuel meets an effective ignition source, or
hot material, pressure or a toxic atmosphere injures someone without fire.
- Escalation:
continued feeding, ineffective isolation, inadequate containment or fire
exposure increases the consequences.
Water entering hot pitch can cause steam expansion and
ejection without initiating combustion. A blocked vent can damage a tank
without an explosion caused by burning vapour. These mechanisms need different
controls.
A high bulk flash point does not exclude every fire
scenario: suitable oil mists can be ignitable below the liquid flash point.
Whether pitch or an associated thermal fluid can form such a mist depends on
the actual fluid and release conditions.
How to use the sample hazard register
Physical covers equipment, layout and condition. Activities
covers the tasks people perform. Process covers material behaviour and
deviations. Operations covers how the installation is controlled through
normal service, changes and emergencies.
The categories deliberately overlap: a failed seal is a
physical condition; opening that pump is an activity; its pressure and
temperature define the process hazard; maintenance and isolation practices
influence the operational risk.
The tables are an illustrative engineering synthesis.
For each applicable row, distinguish:
- Existing
and verified: supported by current inspection, testing and field
checks.
- Existing
but unverified or impaired: an open gap, not a safeguard to assume
effective.
- Recommended:
an additional measure requiring technical review and implementation.
“Prevent or detect” addresses the initiating event or
developing deviation. “Limit consequences” addresses what happens if control is
lost. Neither column is a universal equipment specification.
Physical hazards
|
Hazard and initiating reasons |
Ignition or other harm mechanism |
Prevent or detect |
Limit consequences |
|
PH01 Tank shell roof and bottom
deterioration. Corrosion, defective welds or
unsuitable materials allow leakage. |
Hot product causes burns; released hydrocarbons
may ignite at nearby hot surfaces or electrical equipment. |
Use a defined integrity programme, thickness
measurements and inspection of credible damage locations. |
Provide suitable containment, isolation and
restricted access. |
|
PH02 Nozzles flanges valves and
pipe supports. Thermal cycling, pipe strain,
vibration or unsuitable gaskets cause joint failure. |
A hot release can reach an ignition source;
pressure can project material toward personnel. |
Check material ratings, flexibility, supports,
bolting practice and leak history. |
Provide safe isolation and drainage; protect
occupied positions. |
|
PH03 Pumps seals and bearings. Seal wear, misalignment, lubrication failure or loss of required seal
services. |
Product leakage supplies fuel; an overheated
bearing or motor can supply ignition. |
Verify pump suitability, seal arrangements,
alignment and condition monitoring. |
Provide remotely accessible shutdown and suitable
local containment. |
|
PH04 Contaminated insulation. Pitch or thermal oil enters porous insulation and remains hot. |
Oxidation and retained heat can cause self-heating
and ignition without an external spark. |
Eliminate leaks, inspect beneath stained cladding
and replace contaminated insulation using a suitable design. |
Detect abnormal heating and provide safe isolation
and fire access. |
|
PH05 Electrical equipment and
heat tracing. Damaged cables, loose
terminals, failed tracing controls or unsuitable equipment. |
Arcing or excessive surface temperature may ignite
nearby combustible material or an ignitable atmosphere. |
Assess hazardous areas; verify equipment
suitability, installation, protection and inspection. |
Provide safe electrical isolation and suitable
detection. |
|
PH06 Exposed hot surfaces. Damaged insulation or unguarded heated lines, valves and sampling
points. |
Contact causes burns. A surface ignites a release
only when the relevant ignition conditions are met. |
Guard accessible hot surfaces and arrange work to
avoid contact. |
Provide appropriate thermal protection, emergency
washing and burn-response arrangements. |
|
PH07 Foundations supports and
external damage. Settlement, vehicle impact or
site-relevant flood, wind or seismic loads. |
Structural movement can break connections and
release inventory; ignition is secondary. |
Review design loads, settlement trends and impact
protection for exposed equipment. |
Protect isolation access and assess the
consequences of a large release. |
|
PH08 Bunds drains and
accumulated water. Damaged containment, open
drain valves, blocked drainage or standing water. |
Spills spread toward other equipment; hot product
contacting water can eject material. |
Inspect containment and control rainwater removal
without leaving an uncontrolled discharge route. |
Plan compatible spill and firewater retention to
limit off-site spread. |
|
PH09 Layout and neighbouring
exposures. Nearby fuel sources, congested
access, unsuitable vent discharge locations or blocked escape routes. |
An external fire exposes the tank; smoke or vapour
can affect occupied areas. |
Review separation, vent discharge, access and
escape against credible scenarios. |
Protect critical equipment and provide alternative
evacuation routes. |
|
PH10 Platforms access and moving
equipment. Corroded stairs, slippery
surfaces, missing guards or unsafe access to instruments. |
Falls, entanglement and delayed escape can occur
without any fire. |
Provide inspected platforms, guards, lighting and
accessible ground-level checks where practicable. |
Maintain rescue access and task-appropriate fall
protection. |
Activity hazards
|
Hazard and initiating reasons |
Ignition or other harm mechanism |
Prevent or detect |
Limit consequences |
|
AC01 Connecting transferring and
disconnecting. Wrong connection, damaged
hose, movement during transfer or inadequate receiving capacity. |
Hot release; static discharge may ignite a
suitable atmosphere where charging is credible. |
Verify product, route, capacity and hose ratings;
control vehicle movement and applicable bonding. |
Provide accessible transfer shutdown, spill
control and thermal PPE. |
|
AC02 Sampling and manual gauging. Opening hatches or sample points releases vapour, gas or hot liquid. |
Inhalation, oxygen deficiency or burns; released
flammable vapour can encounter ignition. |
Prefer suitable closed sampling and remote
gauging; assess exposure and detector needs. |
Provide exclusion arrangements and a trained
emergency response. |
|
AC03 Welding cutting and
grinding. Sparks or heat reach residues, vents or
connected equipment. |
Ignition can occur in the tank or an adjacent
space outside the immediate work area. |
Consider cold methods; use permits, verified
isolation and gas testing before and during work. |
Provide a trained fire watch and a defined alarm
and evacuation response. |
|
AC04 Opening lines and
maintaining pumps. Residual pressure, passing
valves or solidified plugs defeat an assumed isolation. |
Unexpected discharge causes burns, exposure or a
fire if ignition follows. |
Use a task-specific isolation scheme; lock out
energy and verify depressurisation and safe condition. |
Use barriers, controlled collection and suitable
protection from the line of fire. |
|
AC05 Opening tanks and removing
deposits. Air enters equipment containing potentially
pyrophoric deposits or hazardous residues. |
Suitable sulphide or carbonaceous deposits may
heat and ignite on air exposure. |
Characterise residues and use a specialist
opening, cleaning and deposit-management procedure. |
Control access and monitor the work area; plan
residue-specific emergency measures. |
|
AC06 Confined space entry. Residual gases, nitrogen, heat, incoming material or inadequate
isolation. |
Asphyxiation, poisoning, burns or engulfment;
rescue attempts can create further casualties. |
Avoid entry where feasible; use verified
isolation, an entry permit, suitable atmospheric testing and ventilation. |
Provide an attendant, communications and a
rehearsed specialist rescue capability. |
|
AC07 Washing testing and
recommissioning. Water or cleaning chemicals
remain after cleaning or hydrostatic testing. |
Hot filling or reheating can cause steam expansion
and ejection; incompatible cleaners can react. |
Verify cleanliness, compatibility, drainage and
dryness before authorising service. |
Use a controlled restart and restrict personnel
exposure during initial filling. |
|
AC08 Lifting scaffolding and
inspection. Dropped loads, overloaded
roofs or temporary supports strike live equipment. |
Mechanical damage releases product; workers can
fall or suffer crush injuries. |
Plan lifts and temporary works; verify load paths
and protect operating equipment. |
Establish exclusion zones and preserve emergency
access. |
|
AC09 Simultaneous work. Transfer, venting, hot work and electrical work overlap without
coordination. |
One task introduces fuel or defeats isolation
while another supplies ignition. |
Use one coordinated work plan, interacting permits
and clear stop-work authority. |
Suspend incompatible activities and maintain a
shared emergency communication route. |
|
AC10 Handling residues and waste. Hot residues, oily rags or deposits are collected in unsuitable
containers; dry material is disturbed. |
Self-heating or exposure may occur; assess dust
fire or explosion potential if combustible fines are generated. |
Characterise waste, control temperature and use
compatible containment and disposal methods. |
Segregate waste from ignition sources and occupied
areas; plan a suitable response. |
Opening a tank is a change in conditions. A tank that
was safe while closed may become hazardous when oxygen enters or residues are
disturbed. Conversely, an inert atmosphere suitable for process protection is
unsafe for breathing. Gas-freeing and entry require their own verified
procedures.
Process hazards
|
Hazard and initiating reasons |
Ignition or other harm mechanism |
Prevent or detect |
Limit consequences |
|
PR01 Unexpected composition or
contamination. A different feed, lighter
hydrocarbons or incompatible material enters the tank. |
Volatility and flash point may change;
incompatible mixing may generate heat or gas. |
Define an approved feed envelope, acceptance
checks and segregation; review chemistry before accepting change. |
Assess resulting vent demand, release consequences
and protection needs. |
|
PR02 Excess heat or insufficient
inventory. Heating continues with low
level, poor circulation, fouling or a failed temperature controller. |
Local overheating may degrade product, generate
vapour or expose hot heating surfaces. |
Establish bulk and local temperature limits,
minimum inventory and independent protective shutdown where required. |
Provide a defined safe shutdown and suitable fire
detection. |
|
PR03 Water ingress. Condensation, wet transfer equipment, residual test water or a leaking
water-bearing heating circuit. |
Rapid steam generation can cause frothing,
pressure rise and hot-material ejection; water is not an ignition source. |
Identify every water path; verify dryness and
relevant coil integrity. |
Limit exposure and provide containment compatible
with hot releases. |
|
PR04 Cooling solidification and
reheating. Loss of heating or prolonged
shutdown creates cold plugs and uneven temperatures. |
Blocked lines or vents and local overheating can
develop during restart. |
Use an engineered storage and reheating procedure;
verify flow paths and representative temperatures. |
Define stop conditions and maintain isolation and
pressure protection. |
|
PR05 Overpressure. A blocked vent, excessive incoming flow, upstream gas breakthrough or
blanketing-regulator failure. |
The roof or shell can fail and release material;
vapour ignition is a separate event. |
Calculate credible vent and relief loads,
including connected systems; manage fouling and discharge location. |
Provide engineered pressure protection and
emergency isolation. |
|
PR06 Vacuum during withdrawal or
cooling. Pump-out or vapour condensation exceeds the
available inbreathing capacity. |
Tank collapse or connection damage can release hot
product. |
Verify vacuum design limits, inbreathing capacity
and applicable blanketing response. |
Provide suitable vacuum protection and a defined
response to abnormal pressure. |
|
PR07 Overfill and foaming. Wrong inventory information, excessive filling, simultaneous receipts
or unexpected foaming. |
Hot material escapes through openings; a flammable
release may ignite nearby. |
Verify usable capacity and transfer rates; assess
independent overfill protection and automatic feed isolation. |
Provide effective containment and safe transfer
stopping arrangements. |
|
PR08 Deposits and oxygen ingress. Sulphur-bearing service permits iron sulphide formation; other deposits
accumulate during service. |
Where present, pyrophoric material may ignite on
air exposure. Deposit presence must be established. |
Review chemistry, inspection and cleaning history;
control opening and deposit removal. |
Plan for concealed hot spots and potential
re-ignition. |
|
PR09 Toxic gases fumes and
oxygen displacement. H2S or other hazardous
constituents evolve; nitrogen or vapour displaces air. |
Poisoning, irritation or asphyxiation can occur
without ignition or a high flammable-gas reading. |
Assess actual composition and exposure; favour
closed handling and appropriate gas-specific monitoring. |
Provide exclusion, suitable respiratory
arrangements and trained rescue. |
|
PR10 Heating medium and heater
failure. A steam coil, thermal-oil circuit or
direct-fired heater fails, if that system is fitted. |
Steam leakage may introduce water; thermal oil can
supply fuel; burner faults can introduce flame or unburned fuel. |
Assess the actual heating design, pressure
differences, integrity and applicable burner or flow safeguards. |
Isolate heat and fuel through a designed safe
sequence; address heater-area fire exposure. |
Heating-system failure is not automatically an ignition
mechanism. Establish what fails, what is released, where heat is
transferred and whether fuel, oxygen and an effective ignition source coexist.
Likewise, water-driven frothing or ejection should not automatically be
labelled a classic tank-fire boilover; the underlying physical sequence must be
established.
Operational hazards
|
Hazard and initiating reasons |
Ignition or other harm mechanism |
Prevent or detect |
Limit consequences |
|
OP01 Misleading instruments. Fouled level connections, coated sensors, calibration drift or
unrepresentative temperature measurement. |
Operators may overfill, overheat or empty below
the permitted level without recognising the condition. |
Select service-compatible instruments; compare
trends and test the complete measurement path. |
Use appropriately independent protection and clear
abnormal-condition actions. |
|
OP02 Defeated protective
functions. Trips are bypassed, setpoints
changed or final elements fail to operate. |
A deviation continues because the assumed
safeguard is unavailable. |
Control overrides and setpoints; proof-test
sensors, logic and final elements with recorded acceptance criteria. |
Restrict or stop affected operations until
required protection is restored. |
|
OP03 Incorrect valve alignment. A closed discharge, trapped heated liquid or unintended reverse-flow
route. |
Deadheading or thermal expansion can rupture
equipment; reverse flow may contaminate a tank. |
Verify line-up; provide appropriate flow, pressure
and thermal-relief protection and assess backflow prevention. |
Enable safe isolation without trapping an
unprotected liquid volume. |
|
OP04 Loss of power or utilities. Electricity, instrument air, circulation, nitrogen or other essential
services fail. |
Control, heating, venting or isolation behaviour
may change; air ingress or overheating may follow. |
Assess simultaneous failures and actual fail
positions; define necessary backup and recovery sequences. |
Maintain essential alarms, shutdown functions and
emergency communications. |
|
OP05 Startup shutdown and
standby. Normal operating instructions are applied to an
abnormal inventory or temperature condition. |
Residual water, blocked paths or nonuniform
heating can produce release or loss of control. |
Use mode-specific procedures and checks for
readiness, permissives and safe restart. |
Define hold points, exposure restrictions and
escalation to competent support. |
|
OP06 Handover workload and
response. An abnormal trend, maintenance status or
operating restriction is not communicated. |
A developing leak or deviation persists until the
opportunity to intervene is lost. |
Use two-way written and verbal handover,
cross-checking and practical response training. |
Ensure clear authority to stop transfer or heating
safely. |
|
OP07 Unreviewed changes. Feed composition, temperature, throughput, heating duty or tank
connections change. |
Existing venting, instruments or protection may no
longer match the operating envelope. |
Use management of change and a review before
startup; update drawings, procedures and training. |
Reassess emergency arrangements and neighbouring
exposures before implementation. |
|
OP08 Deferred maintenance or
unsuitable repairs. Leaks recur, inspection
findings remain open or replacement parts do not suit the duty. |
Containment deteriorates or an ignition source
develops despite routine rounds. |
Prioritise defects by consequence, verify material
suitability and confirm repairs remove the failure mechanism. |
Apply explicit operating restrictions while
safety-critical defects remain unresolved. |
|
OP09 Fire protection unavailable. Detectors, pumps, valves or suppression systems are impaired or
unsuitable for the scenario. |
A small event escalates because detection or
mitigation does not perform as assumed. |
Test relevant performance, control impairments and
confirm emergency resources match the design basis. |
Use approved compensating measures or suspend
affected operations. |
|
OP10 Unsafe or delayed emergency
actions. Access is blocked, isolation requires entering
danger or responders use an unsuitable method. |
Exposure, fire spread or violent splashing
increases during intervention. |
Pre-plan safe isolation, withdrawal, specialist
response and product-compatible tactics. |
Evacuate, account for personnel, control runoff
and coordinate with emergency services. |
Identify credible ignition sources
An ignition-source list becomes useful when it is linked to
a specific release or deposit scenario. Check:
- Electrical
arcs and faults: motors, junction boxes, damaged connections,
temporary equipment and heat tracing.
- Hot
surfaces: heater components, exhausts and overheated bearings,
assessed against the material and exposure conditions.
- Hot
work and open flames: welding, cutting, grinding, smoking and burners.
- Mechanical
sparks or friction: damaged rotating equipment, impact or unsuitable
tools.
- Electrostatic
discharge: charging during relevant transfer, spraying or sampling,
considering conductivity and bonding.
- Lightning:
the installation’s exposure and protection arrangements.
- Self-heating
deposits or contaminated insulation: oxidation can provide heat
without a separate spark.
Equipment selection, maintenance and work controls must
address the relevant source. A hazardous-area drawing alone does not cover
every abnormal release.
Bonding and earthing manage particular electrical and static
hazards; they do not make overheating, water ingress or toxic exposure safe.
Select controls for the scenario
Start with opportunities to remove or reduce the hazard:
unnecessary connections, open sampling, avoidable hot work, excessive inventory
or heating beyond the justified operating need. Then establish dependable
engineering protection and practical operating controls.
Venting and pressure protection need a documented
basis for credible inflow, outflow, heating, cooling and connected-system
failures. A normal pressure relief device must not be assumed to protect
against an internal deflagration. Flame arresters, where justified, need
suitable application and fouling assessment.
Inerting may be appropriate where the assessment
requires it. Its design must address oxygen control, supply reliability,
pressure and vacuum protection, monitoring and loss of supply. It also creates
an asphyxiation hazard. Simply connecting nitrogen is not evidence that an
effective inerting system exists.
Instrumented safeguards need adequate independence
and a demonstrated response. Two alarms sharing a failed sensor do not provide
two independent layers. Determine required reliability through the risk
assessment; do not assign a Safety Integrity Level solely from the equipment
name.
Containment and emergency protection must match
release temperature, inventory, drainage and neighbouring exposures. Bund
condition and retained rainwater affect performance. Firewater runoff also
needs an identified destination.
Firefighting tactics must suit the actual product,
temperature and scenario. Do not direct water jets into hot or burning pitch.
Engineered external cooling and selected suppression methods require a
competent, scenario-specific plan. These restrictions on product contact do not
remove the need for emergency washing and burn-response facilities.
Prevention and mitigation serve different purposes.
Effective prevention reduces the demand on emergency systems; dependable
emergency protection remains necessary for credible residual risks.
Worked example of a useful hazard statement
Consider a hypothetical tank with internal heating that
requires a minimum liquid covering level.
Weak entry: “Pitch tank fire — provide
extinguishers.”
Useful entry: “During pump-out, the liquid level can
fall below the heating system’s minimum requirement. If heat input continues
and the level indication is unreliable, local overheating may occur. Depending
on the material and heater conditions, this could generate ignitable vapour or
damage equipment, with possible fire, burns and loss of containment.”
The assessment team should establish:
- Which
operating step can create the low-inventory condition.
- Whether
the indicated level remains reliable in this service.
- What
stops heat input, how quickly it acts and what failures could defeat it.
- Whether
withdrawal can continue after a protection failure.
- Which
people and equipment are exposed if the scenario escalates.
The action is then specific: verify the heating and
withdrawal limits, examine the protective function against the scenario, and
close any identified design or performance gap. An instrument shown on a
drawing is only the starting point for that verification.
Turn the register into an operating tool
For each site-specific scenario, record the equipment and
operating mode, initiating causes, consequences, existing safeguards, evidence,
gaps, recommended actions, accountable owner, due date and verification
required for closure.
Assess severity and likelihood using the organisation’s
defined criteria. Evaluate the risk with verified existing controls,
then the expected residual risk after proposed actions. Do not reduce the
current risk rating for a recommendation that has not been implemented.
A practical review should involve operations, maintenance,
process engineering, instrumentation, electrical specialists and HSE, with
contractors where their activities affect the scenario. Walk the installation
and compare the drawings with the actual connections and work practices.
Use focused HAZOP for deviations requiring deeper
examination. Where major consequences remain credible, further assessment may
include protection-layer analysis, dispersion or fire modelling, and a review
of emergency capability. The study should determine which additional analysis
is needed.
HSE-RM SOLUTIONS perspective
Hazard identification should produce decisions that people
can act on: a verified operating limit, a corrected leak mechanism, a reliable
isolation, a tested protective function or a safer way to perform a task.
A report that says “fire is possible” has only named an
outcome. A useful assessment explains how it could happen, what would
prevent it and what evidence shows the controls will work.
HSE-RM SOLUTIONS supports storage-tank hazard
identification, focused HAZOP, fire risk assessment, equipment-integrity review
and practical emergency planning.
Does your assessment cover the complete connected system
and every operating mode?
HSE-RM SOLUTIONS
Your Partner In Safety...
