Hazard Identification for Pitch Intermediate Storage Tanks

 HSE-RM SOLUTIONS | Technical Review | 3 November 2026

 

A tank fire is an outcome. Hazard identification must explain the paths that can lead to it.

 

Where could material escape? When could an ignitable atmosphere form? Which activity could introduce ignition? What could disable the safeguards?

 

For a pitch intermediate storage tank, these questions extend to the heating system, pumps, piping, vents, instruments, maintenance work and people operating the installation. The most useful assessment follows those connections before selecting controls.

 

This article presents 40 sample hazard scenarios under four headings: Physical, Activities, Process and Operations. It is a starting point for a multidisciplinary assessment, not an exhaustive inventory or an investigation finding about HPCL or any other facility. No control listed below should be treated as installed or effective without site evidence.

 

Define the material and assessment boundary

The working example is a heated, above-ground tank holding a petroleum-derived pitch or heavy refinery intermediate, with connected transfer and heating equipment. Tank type, pressure rating, heating medium and inerting arrangements must be confirmed.

 

“Pitch” is not a sufficient material specification. Petroleum pitch, coal-tar pitch and commercial bitumen can have materially different properties. Bitumen guidance identifies useful mechanisms, but its temperature limits and product assumptions cannot automatically be transferred to an unknown refinery stream.

 

Before the workshop, assemble the following:

• Material information: representative composition and variability, safety data, flash point and test method, volatility, thermal stability, water content, sulphur and H2S potential, viscosity and relevant occupational exposures.
• Equipment information: drawings, tank design temperature and pressure, normal and emergency venting, heating arrangement, connected pressure sources, isolation points and containment.
• Operating information: permitted inventory, temperature and flow ranges, startup and shutdown sequences, transfer routes and abnormal operating modes.
• Performance evidence: inspection reports, trends, leak history, alarm and trip tests, temporary overrides, maintenance records and emergency-system tests.

 

The safe operating envelope must come from the actual process and equipment. A generic safety data sheet alone may leave important process conditions unresolved.

 

Separate ignition from release and escalation

A strong hazard statement distinguishes three events:

1. Initiation: a seal leaks, a vent blocks, a heater control fails or an unsafe activity begins.
2. Ignition or other harm: released fuel meets an effective ignition source, or hot material, pressure or a toxic atmosphere injures someone without fire.
3. Escalation: continued feeding, ineffective isolation, inadequate containment or fire exposure increases the consequences.

 

Water entering hot pitch can cause steam expansion and ejection without initiating combustion. A blocked vent can damage a tank without an explosion caused by burning vapour. These mechanisms need different controls.

 

A high bulk flash point does not exclude every fire scenario: suitable oil mists can be ignitable below the liquid flash point. Whether pitch or an associated thermal fluid can form such a mist depends on the actual fluid and release conditions.

How to use the sample hazard register

Physical covers equipment, layout and condition. Activities covers the tasks people perform. Process covers material behaviour and deviations. Operations covers how the installation is controlled through normal service, changes and emergencies.

 

The categories deliberately overlap: a failed seal is a physical condition; opening that pump is an activity; its pressure and temperature define the process hazard; maintenance and isolation practices influence the operational risk.

 

The tables are an illustrative engineering synthesis. For each applicable row, distinguish:

• Existing and verified: supported by current inspection, testing and field checks.
• Existing but unverified or impaired: an open gap, not a safeguard to assume effective.
• Recommended: an additional measure requiring technical review and implementation.

 

“Prevent or detect” addresses the initiating event or developing deviation. “Limit consequences” addresses what happens if control is lost. Neither column is a universal equipment specification.

 

Physical hazards

 

Hazard and initiating reasons	Ignition or other harm mechanism	Prevent or detect	Limit consequences
PH01 Tank shell roof and bottom deterioration. Corrosion, defective welds or unsuitable materials allow leakage.	Hot product causes burns; released hydrocarbons may ignite at nearby hot surfaces or electrical equipment.	Use a defined integrity programme, thickness measurements and inspection of credible damage locations.	Provide suitable containment, isolation and restricted access.
PH02 Nozzles flanges valves and pipe supports. Thermal cycling, pipe strain, vibration or unsuitable gaskets cause joint failure.	A hot release can reach an ignition source; pressure can project material toward personnel.	Check material ratings, flexibility, supports, bolting practice and leak history.	Provide safe isolation and drainage; protect occupied positions.
PH03 Pumps seals and bearings. Seal wear, misalignment, lubrication failure or loss of required seal services.	Product leakage supplies fuel; an overheated bearing or motor can supply ignition.	Verify pump suitability, seal arrangements, alignment and condition monitoring.	Provide remotely accessible shutdown and suitable local containment.
PH04 Contaminated insulation. Pitch or thermal oil enters porous insulation and remains hot.	Oxidation and retained heat can cause self-heating and ignition without an external spark.	Eliminate leaks, inspect beneath stained cladding and replace contaminated insulation using a suitable design.	Detect abnormal heating and provide safe isolation and fire access.
PH05 Electrical equipment and heat tracing. Damaged cables, loose terminals, failed tracing controls or unsuitable equipment.	Arcing or excessive surface temperature may ignite nearby combustible material or an ignitable atmosphere.	Assess hazardous areas; verify equipment suitability, installation, protection and inspection.	Provide safe electrical isolation and suitable detection.
PH06 Exposed hot surfaces. Damaged insulation or unguarded heated lines, valves and sampling points.	Contact causes burns. A surface ignites a release only when the relevant ignition conditions are met.	Guard accessible hot surfaces and arrange work to avoid contact.	Provide appropriate thermal protection, emergency washing and burn-response arrangements.
PH07 Foundations supports and external damage. Settlement, vehicle impact or site-relevant flood, wind or seismic loads.	Structural movement can break connections and release inventory; ignition is secondary.	Review design loads, settlement trends and impact protection for exposed equipment.	Protect isolation access and assess the consequences of a large release.
PH08 Bunds drains and accumulated water. Damaged containment, open drain valves, blocked drainage or standing water.	Spills spread toward other equipment; hot product contacting water can eject material.	Inspect containment and control rainwater removal without leaving an uncontrolled discharge route.	Plan compatible spill and firewater retention to limit off-site spread.
PH09 Layout and neighbouring exposures. Nearby fuel sources, congested access, unsuitable vent discharge locations or blocked escape routes.	An external fire exposes the tank; smoke or vapour can affect occupied areas.	Review separation, vent discharge, access and escape against credible scenarios.	Protect critical equipment and provide alternative evacuation routes.
PH10 Platforms access and moving equipment. Corroded stairs, slippery surfaces, missing guards or unsafe access to instruments.	Falls, entanglement and delayed escape can occur without any fire.	Provide inspected platforms, guards, lighting and accessible ground-level checks where practicable.	Maintain rescue access and task-appropriate fall protection.

 

 

Activity hazards

Hazard and initiating reasons	Ignition or other harm mechanism	Prevent or detect	Limit consequences
AC01 Connecting transferring and disconnecting. Wrong connection, damaged hose, movement during transfer or inadequate receiving capacity.	Hot release; static discharge may ignite a suitable atmosphere where charging is credible.	Verify product, route, capacity and hose ratings; control vehicle movement and applicable bonding.	Provide accessible transfer shutdown, spill control and thermal PPE.
AC02 Sampling and manual gauging. Opening hatches or sample points releases vapour, gas or hot liquid.	Inhalation, oxygen deficiency or burns; released flammable vapour can encounter ignition.	Prefer suitable closed sampling and remote gauging; assess exposure and detector needs.	Provide exclusion arrangements and a trained emergency response.
AC03 Welding cutting and grinding. Sparks or heat reach residues, vents or connected equipment.	Ignition can occur in the tank or an adjacent space outside the immediate work area.	Consider cold methods; use permits, verified isolation and gas testing before and during work.	Provide a trained fire watch and a defined alarm and evacuation response.
AC04 Opening lines and maintaining pumps. Residual pressure, passing valves or solidified plugs defeat an assumed isolation.	Unexpected discharge causes burns, exposure or a fire if ignition follows.	Use a task-specific isolation scheme; lock out energy and verify depressurisation and safe condition.	Use barriers, controlled collection and suitable protection from the line of fire.
AC05 Opening tanks and removing deposits. Air enters equipment containing potentially pyrophoric deposits or hazardous residues.	Suitable sulphide or carbonaceous deposits may heat and ignite on air exposure.	Characterise residues and use a specialist opening, cleaning and deposit-management procedure.	Control access and monitor the work area; plan residue-specific emergency measures.
AC06 Confined space entry. Residual gases, nitrogen, heat, incoming material or inadequate isolation.	Asphyxiation, poisoning, burns or engulfment; rescue attempts can create further casualties.	Avoid entry where feasible; use verified isolation, an entry permit, suitable atmospheric testing and ventilation.	Provide an attendant, communications and a rehearsed specialist rescue capability.
AC07 Washing testing and recommissioning. Water or cleaning chemicals remain after cleaning or hydrostatic testing.	Hot filling or reheating can cause steam expansion and ejection; incompatible cleaners can react.	Verify cleanliness, compatibility, drainage and dryness before authorising service.	Use a controlled restart and restrict personnel exposure during initial filling.
AC08 Lifting scaffolding and inspection. Dropped loads, overloaded roofs or temporary supports strike live equipment.	Mechanical damage releases product; workers can fall or suffer crush injuries.	Plan lifts and temporary works; verify load paths and protect operating equipment.	Establish exclusion zones and preserve emergency access.
AC09 Simultaneous work. Transfer, venting, hot work and electrical work overlap without coordination.	One task introduces fuel or defeats isolation while another supplies ignition.	Use one coordinated work plan, interacting permits and clear stop-work authority.	Suspend incompatible activities and maintain a shared emergency communication route.
AC10 Handling residues and waste. Hot residues, oily rags or deposits are collected in unsuitable containers; dry material is disturbed.	Self-heating or exposure may occur; assess dust fire or explosion potential if combustible fines are generated.	Characterise waste, control temperature and use compatible containment and disposal methods.	Segregate waste from ignition sources and occupied areas; plan a suitable response.

 

Opening a tank is a change in conditions. A tank that was safe while closed may become hazardous when oxygen enters or residues are disturbed. Conversely, an inert atmosphere suitable for process protection is unsafe for breathing. Gas-freeing and entry require their own verified procedures.

 

 

Process hazards

Hazard and initiating reasons	Ignition or other harm mechanism	Prevent or detect	Limit consequences
PR01 Unexpected composition or contamination. A different feed, lighter hydrocarbons or incompatible material enters the tank.	Volatility and flash point may change; incompatible mixing may generate heat or gas.	Define an approved feed envelope, acceptance checks and segregation; review chemistry before accepting change.	Assess resulting vent demand, release consequences and protection needs.
PR02 Excess heat or insufficient inventory. Heating continues with low level, poor circulation, fouling or a failed temperature controller.	Local overheating may degrade product, generate vapour or expose hot heating surfaces.	Establish bulk and local temperature limits, minimum inventory and independent protective shutdown where required.	Provide a defined safe shutdown and suitable fire detection.
PR03 Water ingress. Condensation, wet transfer equipment, residual test water or a leaking water-bearing heating circuit.	Rapid steam generation can cause frothing, pressure rise and hot-material ejection; water is not an ignition source.	Identify every water path; verify dryness and relevant coil integrity.	Limit exposure and provide containment compatible with hot releases.
PR04 Cooling solidification and reheating. Loss of heating or prolonged shutdown creates cold plugs and uneven temperatures.	Blocked lines or vents and local overheating can develop during restart.	Use an engineered storage and reheating procedure; verify flow paths and representative temperatures.	Define stop conditions and maintain isolation and pressure protection.
PR05 Overpressure. A blocked vent, excessive incoming flow, upstream gas breakthrough or blanketing-regulator failure.	The roof or shell can fail and release material; vapour ignition is a separate event.	Calculate credible vent and relief loads, including connected systems; manage fouling and discharge location.	Provide engineered pressure protection and emergency isolation.
PR06 Vacuum during withdrawal or cooling. Pump-out or vapour condensation exceeds the available inbreathing capacity.	Tank collapse or connection damage can release hot product.	Verify vacuum design limits, inbreathing capacity and applicable blanketing response.	Provide suitable vacuum protection and a defined response to abnormal pressure.
PR07 Overfill and foaming. Wrong inventory information, excessive filling, simultaneous receipts or unexpected foaming.	Hot material escapes through openings; a flammable release may ignite nearby.	Verify usable capacity and transfer rates; assess independent overfill protection and automatic feed isolation.	Provide effective containment and safe transfer stopping arrangements.
PR08 Deposits and oxygen ingress. Sulphur-bearing service permits iron sulphide formation; other deposits accumulate during service.	Where present, pyrophoric material may ignite on air exposure. Deposit presence must be established.	Review chemistry, inspection and cleaning history; control opening and deposit removal.	Plan for concealed hot spots and potential re-ignition.
PR09 Toxic gases fumes and oxygen displacement. H2S or other hazardous constituents evolve; nitrogen or vapour displaces air.	Poisoning, irritation or asphyxiation can occur without ignition or a high flammable-gas reading.	Assess actual composition and exposure; favour closed handling and appropriate gas-specific monitoring.	Provide exclusion, suitable respiratory arrangements and trained rescue.
PR10 Heating medium and heater failure. A steam coil, thermal-oil circuit or direct-fired heater fails, if that system is fitted.	Steam leakage may introduce water; thermal oil can supply fuel; burner faults can introduce flame or unburned fuel.	Assess the actual heating design, pressure differences, integrity and applicable burner or flow safeguards.	Isolate heat and fuel through a designed safe sequence; address heater-area fire exposure.

 

Heating-system failure is not automatically an ignition mechanism. Establish what fails, what is released, where heat is transferred and whether fuel, oxygen and an effective ignition source coexist. Likewise, water-driven frothing or ejection should not automatically be labelled a classic tank-fire boilover; the underlying physical sequence must be established.

 

 

Operational hazards

Hazard and initiating reasons	Ignition or other harm mechanism	Prevent or detect	Limit consequences
OP01 Misleading instruments. Fouled level connections, coated sensors, calibration drift or unrepresentative temperature measurement.	Operators may overfill, overheat or empty below the permitted level without recognising the condition.	Select service-compatible instruments; compare trends and test the complete measurement path.	Use appropriately independent protection and clear abnormal-condition actions.
OP02 Defeated protective functions. Trips are bypassed, setpoints changed or final elements fail to operate.	A deviation continues because the assumed safeguard is unavailable.	Control overrides and setpoints; proof-test sensors, logic and final elements with recorded acceptance criteria.	Restrict or stop affected operations until required protection is restored.
OP03 Incorrect valve alignment. A closed discharge, trapped heated liquid or unintended reverse-flow route.	Deadheading or thermal expansion can rupture equipment; reverse flow may contaminate a tank.	Verify line-up; provide appropriate flow, pressure and thermal-relief protection and assess backflow prevention.	Enable safe isolation without trapping an unprotected liquid volume.
OP04 Loss of power or utilities. Electricity, instrument air, circulation, nitrogen or other essential services fail.	Control, heating, venting or isolation behaviour may change; air ingress or overheating may follow.	Assess simultaneous failures and actual fail positions; define necessary backup and recovery sequences.	Maintain essential alarms, shutdown functions and emergency communications.
OP05 Startup shutdown and standby. Normal operating instructions are applied to an abnormal inventory or temperature condition.	Residual water, blocked paths or nonuniform heating can produce release or loss of control.	Use mode-specific procedures and checks for readiness, permissives and safe restart.	Define hold points, exposure restrictions and escalation to competent support.
OP06 Handover workload and response. An abnormal trend, maintenance status or operating restriction is not communicated.	A developing leak or deviation persists until the opportunity to intervene is lost.	Use two-way written and verbal handover, cross-checking and practical response training.	Ensure clear authority to stop transfer or heating safely.
OP07 Unreviewed changes. Feed composition, temperature, throughput, heating duty or tank connections change.	Existing venting, instruments or protection may no longer match the operating envelope.	Use management of change and a review before startup; update drawings, procedures and training.	Reassess emergency arrangements and neighbouring exposures before implementation.
OP08 Deferred maintenance or unsuitable repairs. Leaks recur, inspection findings remain open or replacement parts do not suit the duty.	Containment deteriorates or an ignition source develops despite routine rounds.	Prioritise defects by consequence, verify material suitability and confirm repairs remove the failure mechanism.	Apply explicit operating restrictions while safety-critical defects remain unresolved.
OP09 Fire protection unavailable. Detectors, pumps, valves or suppression systems are impaired or unsuitable for the scenario.	A small event escalates because detection or mitigation does not perform as assumed.	Test relevant performance, control impairments and confirm emergency resources match the design basis.	Use approved compensating measures or suspend affected operations.
OP10 Unsafe or delayed emergency actions. Access is blocked, isolation requires entering danger or responders use an unsuitable method.	Exposure, fire spread or violent splashing increases during intervention.	Pre-plan safe isolation, withdrawal, specialist response and product-compatible tactics.	Evacuate, account for personnel, control runoff and coordinate with emergency services.

 

Identify credible ignition sources

An ignition-source list becomes useful when it is linked to a specific release or deposit scenario. Check:

• Electrical arcs and faults: motors, junction boxes, damaged connections, temporary equipment and heat tracing.
• Hot surfaces: heater components, exhausts and overheated bearings, assessed against the material and exposure conditions.
• Hot work and open flames: welding, cutting, grinding, smoking and burners.
• Mechanical sparks or friction: damaged rotating equipment, impact or unsuitable tools.
• Electrostatic discharge: charging during relevant transfer, spraying or sampling, considering conductivity and bonding.
• Lightning: the installation’s exposure and protection arrangements.
• Self-heating deposits or contaminated insulation: oxidation can provide heat without a separate spark.

 

Equipment selection, maintenance and work controls must address the relevant source. A hazardous-area drawing alone does not cover every abnormal release.

 

Bonding and earthing manage particular electrical and static hazards; they do not make overheating, water ingress or toxic exposure safe.

 

 

Select controls for the scenario

Start with opportunities to remove or reduce the hazard: unnecessary connections, open sampling, avoidable hot work, excessive inventory or heating beyond the justified operating need. Then establish dependable engineering protection and practical operating controls.

 

Venting and pressure protection need a documented basis for credible inflow, outflow, heating, cooling and connected-system failures. A normal pressure relief device must not be assumed to protect against an internal deflagration. Flame arresters, where justified, need suitable application and fouling assessment.

 

Inerting may be appropriate where the assessment requires it. Its design must address oxygen control, supply reliability, pressure and vacuum protection, monitoring and loss of supply. It also creates an asphyxiation hazard. Simply connecting nitrogen is not evidence that an effective inerting system exists.

 

Instrumented safeguards need adequate independence and a demonstrated response. Two alarms sharing a failed sensor do not provide two independent layers. Determine required reliability through the risk assessment; do not assign a Safety Integrity Level solely from the equipment name.

 

Containment and emergency protection must match release temperature, inventory, drainage and neighbouring exposures. Bund condition and retained rainwater affect performance. Firewater runoff also needs an identified destination.

Firefighting tactics must suit the actual product, temperature and scenario. Do not direct water jets into hot or burning pitch. Engineered external cooling and selected suppression methods require a competent, scenario-specific plan. These restrictions on product contact do not remove the need for emergency washing and burn-response facilities.

 

Prevention and mitigation serve different purposes. Effective prevention reduces the demand on emergency systems; dependable emergency protection remains necessary for credible residual risks.

 

Worked example of a useful hazard statement

Consider a hypothetical tank with internal heating that requires a minimum liquid covering level.

 

Weak entry: “Pitch tank fire — provide extinguishers.”

 

Useful entry: “During pump-out, the liquid level can fall below the heating system’s minimum requirement. If heat input continues and the level indication is unreliable, local overheating may occur. Depending on the material and heater conditions, this could generate ignitable vapour or damage equipment, with possible fire, burns and loss of containment.”

 

The assessment team should establish:

• Which operating step can create the low-inventory condition.
• Whether the indicated level remains reliable in this service.
• What stops heat input, how quickly it acts and what failures could defeat it.
• Whether withdrawal can continue after a protection failure.
• Which people and equipment are exposed if the scenario escalates.

 

The action is then specific: verify the heating and withdrawal limits, examine the protective function against the scenario, and close any identified design or performance gap. An instrument shown on a drawing is only the starting point for that verification.

 

Turn the register into an operating tool

For each site-specific scenario, record the equipment and operating mode, initiating causes, consequences, existing safeguards, evidence, gaps, recommended actions, accountable owner, due date and verification required for closure.

Assess severity and likelihood using the organisation’s defined criteria. Evaluate the risk with verified existing controls, then the expected residual risk after proposed actions. Do not reduce the current risk rating for a recommendation that has not been implemented.

 

A practical review should involve operations, maintenance, process engineering, instrumentation, electrical specialists and HSE, with contractors where their activities affect the scenario. Walk the installation and compare the drawings with the actual connections and work practices.

 

Use focused HAZOP for deviations requiring deeper examination. Where major consequences remain credible, further assessment may include protection-layer analysis, dispersion or fire modelling, and a review of emergency capability. The study should determine which additional analysis is needed.

 

HSE-RM SOLUTIONS perspective

Hazard identification should produce decisions that people can act on: a verified operating limit, a corrected leak mechanism, a reliable isolation, a tested protective function or a safer way to perform a task.

 

A report that says “fire is possible” has only named an outcome. A useful assessment explains how it could happen, what would prevent it and what evidence shows the controls will work.

 

HSE-RM SOLUTIONS supports storage-tank hazard identification, focused HAZOP, fire risk assessment, equipment-integrity review and practical emergency planning.

 

Does your assessment cover the complete connected system and every operating mode?

 

HSE-RM SOLUTIONS
Your Partner In Safety...