Energy Practice

RISK ENGINEERING POSITION PAPER – 01 ATMOSPHERIC STORAGE TANKS ii • Atmospheric Storage Tanks CONTENTS

Section Title ...... Page

1. Background ...... 1

2. Objective ...... 1

3. Scope ...... 1

4. Selection of Atmospheric Storage Tanks ...... 2

5. Layout and Spacing ...... 3 5.1 Bunds (Dykes) ...... 4

6. Primary Containment ...... 5 6.1 Tank Design and Operation ...... 5

7. Secondary Containment ...... 8 7.1 Bund Integrity (leak tightness) ...... 8 7.2 Tertiary Containment ...... 9

8. Overfill Protection ...... 10

9. Maintenance and Inspection ...... 11

10. Leakage and Fire Detection ...... 12 10.1 Leak Detection ...... 12 10.2 Fire Prevention and Protection ...... 12

11. Fire Fighting Systems ...... 14 11.1 Water Systems ...... 14 11.2 Foam Fire Fighting Systems ...... 14 11.3 Application Rates ...... 16

12. References to Industry Losses ...... 17

13. References to Industry Standards ...... 17

14. Appendices ...... 19 Appendix A - Assessment Checklist ...... 19 Appendix B - Mechanical Component Checklist for Floating Roof Tank Inspections ...... 20 Appendix C - Loss Incidents ...... 21

Marsh • iii 1. BACKGROUND

There have been numerous incidents in the , gas, and petrochemical industry involving atmospheric storage tanks. Data has been compiled by a reputable operator in the USA that indicates that overfilling of atmospheric storage tanks occurs once in every 3300 filling operations. In 2009 there were two separate incidents just days apart, one in Jaipur, India (October 29), and one in San Juan, Puerto Rico (October 23) that demonstrated the destructive capabilities of incidents at terminals and tank farms.

The Buncefield incident in the UK in December 2005 resulted in an independent investigation commissioned by the Health and Safety Commission in the UK. As a result of this, more guidance has been provided to designers and operators of facilities. Such guidance has been included within this position paper. 2. OBJECTIVE

The objective of this position paper is to define the standards that would be expected of a very good atmospheric storage facility in the oil, gas, and petrochemical industry. These standards are also reflected in the Marsh Energy Risk Ranking criteria. They can be used to determine risk improvement opportunities and also to provide detailed advice to clients seeking to improve their atmospheric storage facilities. 3. SCOPE

The scope of this position paper includes:

• Guidance on the appropriate selection of atmospheric tank design for class of product to be stored.

• Guidance on layout and spacing.

• Guidance on appropriate means of ensuring primary containment.

• Suitable design of secondary containment.

• Detection arrangements for loss of primary containment and fires.

• Fire protection arrangements.

• Examples of loss incidents involving atmospheric storage tanks.

1 • Atmospheric Storage Tanks 4. SELECTION OF ATMOSPHERIC STORAGE TANKS

The layout and general design of a storage facility should be based upon considerations of safety, operational efficiency, and environmental protection. A primary consideration is ensuring that the design of the storage tanks themselves is suitable for the classification of the being stored.

The table below summarises the design of tank suitable for each class of hydrocarbon:

CRUDE OIL DEFINITION RECOMMENDED DERIVATIVE STORAGE TANK DESIGN CLASS Floating Fixed Roof Roof Class 0 Liquefied gases (LPG) 88 Class I which have flash points below 98 21°C Class II (1) Liquids which have flash points from 21°C 99 up to and including 55°C, handled below Class II (2) Liquids which have flash points from 21°C 98 up to and including 55°C, handled at or above flash point Class III (1) Liquids which have flash points above 89 55°C up to and including 100°C, handled below flash point Class III (2) which have flash points above 55°C 89 up to and including 100°C, handled at or above flash point Unclassified Liquids which have flash points above 89 100°C

Marsh • 2 5. LAYOUT AND SPACING

Ideally, tank layout should be optimised to ensure that there is sufficient access to tanks for fire fighting and to minimise the risk of escalation in the event of a tank fire.

Minimum spacing for tanks is specified in the table below, although Marsh would advocate a minimum separation distance of 1x the diameter of the largest tank with an absolute minimum of 15 metres, as such a distance provides sufficient access for fire fighters.

FACTOR MINIMUM SEPERATION FROM ANY PART OF THE TANK Between adjacent fixed-roof tanks Equal to the smaller of the following: (a) The diameter of the smaller tank. (b) Half the diameter of the larger tank. (c) Not less than 10m (Marsh advocate 15m). Between adjacent floating-roof tanks 10m for tanks up to and including 45m diameter. 15m for tanks over 45m diameter. (The spacing is determined by the size of the larger tank). Between a floating-roof tank and a fixed- Equal to the smaller of the following: roof tank (a) The diameter of the smaller tank. (b) Half the diameter of the larger tank. (c) Not less than 10m (Marsh advocate 15m). Between a group of small tanks and any 15m tank outside the group Between a tank and the site boundary, 15m any designated non-hazardous area, process area or any fixed source of ignition

Source: HSG 176. The storage of flammable liquids in tanks.

One notable exception is the separation between crude tanks, where the destructive effects of a boil over can extend from 5 to 10 diameters. Therefore consideration should be given to locating crude tanks at the edge of tank farm installations and with the largest practical separation from adjacent tanks.

These distances should only be used in conjunction with appropriate levels of fire protection (see below). In the event that tanks are existing and do not conform to the above spacing, then additional fire protection should be considered.

Floating roof tanks, with external metal domed roofs extending over the entire roof area (i.e. internal floating roof tanks or tanks fitted with geodesic domes), may be considered as fixed roof tanks for the purpose of tank location and spacing.

3 • Atmospheric Storage Tanks 5.1 BUNDS (DYKES) should be fitted with a water resistant liner and whilst grass growth is Above-ground tanks should be acceptable, it should be regularly completely surrounded by bund walls maintained and kept short. (see also Secondary Containment). These should be designed to offer Tanks should ideally be located alone protection to fire fighters. Therefore the within their own bunds, although bund wall should be located so that a whenever tanks share a common bund, reasonably close approach can be made intermediate walls up to half the height to a tank fire. of the main bund walls and no more than 0.5 metres high should be Fire fighting screens and steps should provided to control small spillages from be located at various points around the one tank affecting another. bund wall to assist the positioning and protection of fire fighting personnel and Bund floors should drain to a single equipment. location complete with sump for the regular removal of water from rainfall or Bunds would normally be constructed firewater testing. Drains should from earth or preferably concrete and normally be kept closed, with the drain should be largely impervious to liquid isolation valve situated outside the and capable of withstanding hydrostatic bund. and hydrodynamic pressures to which they could be subjected. Earthen bunds

Marsh • 4 6. PRIMARY CONTAINMENT

It is essential that the risk of loss of tanks, refer to the UK Health and • High level alarm and independent containment is properly managed. Safety Executive’s review of back-up high level instrument (with This can be achieved by the proper standards, Mechanical integrity executive action only if design, operation, maintenance, and management of bulk storage tanks, appropriate). inspection of tanks. Ideal practice is which can be found at the following outlined below. website address: • Continuous automatic monitoring of tank contents, including “rate of change” during filling/emptying. The most effective way to prevent a http://www.hse.gov.uk/research/rrpdf/ major accident at any site is the rr760.pdf • Anti-rotation devices on floating continued provision of suitable roof tanks. primary containment of the Outlined below is a summary of the flammable materials. This is achieved features considered to be the most • Closed water drains. through the suitable design, appropriate for a modern facility: • Single skin floors. construction, and maintenance of the storage systems in accordance with • Double seals on floating roof tanks • Tank floor leak detection on double- standards. (NB foam dam heights should be floor tanks. This is normally above the height of the upper rim comprised of an instrument to For guidance on the most appropriate seal to provide suitable protection detect loss of vacuum in the inter- standards to use for the design and against a rim seal fire). floor space. construction of atmospheric storage

6.1 TANK DESIGN AND accordance with a relevant standard Whenever valves are left normally OPERATION such as EEMUA 183 or BS EN 14015. open, then the following measures Leak detection should also be should be put in place: Tanks should be designed to a provided on double-bottomed tanks. relevant standard, such as API 650 or • Hydrocarbon detection in drained BS EN 14015. water with automatic isolation. TANK ROOFS • Testing of operability of isolation In some instances single skin bottom Double deck roofs on floating roof valves and detection systems (see tanks are a better option than double- tanks are preferred to single deck overleaf). bottomed tanks as these provide the roofs with external pontoons as they optimum conditions for ensuring are more stable and less likely to lose integrity of the tank floor by the buoyancy. VENTS inspection of tank floor plates. Tanks should be provided with a weak Disadvantages of double-bottom For floating roof tanks, the water seam/frangible roof construction, or designs include settlement, product drains to remove rainwater from the with an emergency vent suitably sized entrapment, and modification to roof should be normally closed. To for the worst case relieving scenario, nozzle compensating plates. ensure roofs are emptied of rainwater, to prevent overpressure under all procedures should be in place and relief conditions. Emergency vents Where double-bottomed tanks are followed for the opening and should comply with relevant provided, additional inspection re-closure of valves. standards, such as API 2000. measures should be provided in

5 • Atmospheric Storage Tanks Wherever a fixed roof tank is used for RIM SEALS & FOAM DAMS the storage of materials with a flash point below 21°C (generally on day Double rim seals (of fire-resistant tanks, not recommended for large construction) are preferable to single bulk storage tanks), then flame seals. Due to irregularities during the arresters should be provided on the construction phase of large floating vents to prevent ignition of the roof tanks, it is likely that a single seal flammable vapours burning back into will not maintain a 100% seal the tank. In warmer climates, where between the tank roof and tank wall product surface temperatures could along the entire height of the tank exceed 21°C, flame arresters should wall. Therefore, a second seal will be used wherever maximum surface improve the likelihood of achieving a temperatures could be within 10°C of tight seal, will reduce emissions, and the flash point. minimise the risk of rim seal fire.

Flame arresters should be included in When installing double rim seals, the preventative maintenance routines to height of the second, upper rim seal ensure they do not become blocked should be below the height of the by scale, paint, ice or other materials. foam dam to ensure coverage Flame arresters are not whenever rim seal pourers are recommended for use when the activated. material being stored is liable to Foam dams should be provided with polymerise or foul the arrester. Due to are specifically designed to maximise intermittently-spaced gaps to allow the potential for blockage, spread of fluids over a tank’s surface. conservation vents (vacuum and the drainage of rainwater. However, if pressure relief) should not be fitted the gaps are too large or too For existing tanks, consideration with flame arresters. numerous, they may affect the ability to form a single continuous foam should be given to modifications of barrier in the event of a fire. tank top design and to the safe-re- Fixed roof tanks can be fitted with a routing of overflowing liquids. gas blanket (normally nitrogen) to maintain an inert atmosphere in the OVERFLOW vapour space. Nitrogen supply VALVES pressure should be just above Consideration should be given to All important valves on atmospheric atmospheric, but sufficient to providing suitable overflow systems tanks should be labelled and their displace any liquid pumped out. As a to ensure that in the event of a tank function indicated. back up, a vacuum breaker should be overfilling, the tank contents are provided in the event that nitrogen safely routed into suitable secondary supply is lost. containment. Additionally, the Fire-safe shut off valves should be overflow route should be designed to provided, preferably automatic and remotely operated shut off/isolation Vents or vapour recovery systems minimise turbulent flow, reduce the valves (ROSOV/ROIV). They must be (often venting back to the source surface area of flammable fitted close to the tank on both the vessel) are required. These should be hydrocarbon, and reduce the inlet and outlet connections. Valves designed to relieve pressure slightly generation of flammable vapours, must either conform to an above that of the nitrogen and at a such as through splashing. Particular appropriate standard, such as BS EN suitable margin below the design care needs to be taken with ISO 10497 or equivalent international pressure of the storage tank. strengthening rings and firewater dispersion rails around tanks which design, or should be of intrinsically

Marsh • 6 fire-safe design. Such features • Designed to minimise pressure HOUSEKEEPING include: surges on system pipework and couplings, particularly ship to shore Debris within bunds should be kept at • Metal-to-metal seats (secondary flexible pipes. an absolute minimum. In addition to metal seats on soft-seated valves the checks within formalised are acceptable). Tank drainage valves should be inspection and maintenance routines, blanked off when not in use. operators should also conduct • Must not be of cast-iron Whenever operations to remove frequent checks of tanks and their construction. accumulations of water from components as part of their routines to ensure that the tanks are kept in a • Should not be wafer-bolted underneath the product are to be reasonable condition. A sample of (sometimes referred to as long bolt conducted, isolation of the drain items to check is included in flanges). should be achieved by the use of two valves in series. The second valve can Appendix B. In regions subject to a high risk of be a temporary installation. earthquake and/or rapid ground- acceleration, the isolation valves and PIPING actuators should also be secured directly to the tank wall and not to the In areas where earthquake is a ground. Anchoring the valve to significant exposure, all associated surrounding structures or the ground piping on storage tanks should have could result in the valve separating step geometry to allow flexing in the from the tank during excessive piping and prevent puncturing of the vibrations. tank during an earthquake.

Features of the ROIV should be: Suitably designed seismic hangers should be provided in earthquake • Fail safe (or if not fail safe have a zones, and pipe supports should have back-up power supply, especially if fire protection within fire hazard the emergency plan requires the zones, e.g. within the bunded area. tank to be drawn down in an emergency). TESTING • It should not be possible to auto- reset the ROIV. Before filling tanks with flammable liquids, leak testing of the installed • Adequate margin of safety for tank and associated pipework is shutting off the valve, with at least required. Hydraulic testing should 150% torque available from fully only be used (i.e. not pneumatic) as open to fully closed. stored energy in hydrotesting is substantially lower, and inherently • No manual operation or override safer. However, air may be used as a (e.g. hand wheels) which may means of applying pressure to water- inhibit the operation of the ROIV. filled tanks and piping. • Suitable integrity and performance to satisfy the safety integrity level Salt water should not be used to (SIL) requirements. hydraulically test systems containing stainless steel.

7 • Atmospheric Storage Tanks 7. SECONDARY CONTAINMENT Whilst priority should be given to preventing loss of primary containment, adequate secondary (and sometimes tertiary) containment is necessary for the protection of the environment and to contain any spillages. In atmospheric tank applications, secondary containment will be provided by bund walls.

Bund capacity should be sufficient to contain the largest predictable spillage. A bund capacity of 110% of the capacity of the largest storage vessel within the bund will normally be sufficient. When estimating bund capacity, the space occupied by other tanks should be taken into account.

7.1 BUND INTEGRITY augment non-fire resistant materials. Bund floor penetration joints are (LEAK TIGHTNESS) Similarly, joints to wall and floor inherently weak as failure of the penetrations need to be protected integrity is difficult to predict and Bund wall and floor construction against the effects of fire. detect and may continue for some should be leak tight. This includes the time unnoticed. Consequently, floor provision of leak tight expansion Whenever designing protection plate, penetrations should not be joints between different casts of consideration should be given to incorporated into new bund designs. concrete in bund walls and wherever avoiding weakening the wall structure Existing bund floor penetrations there are penetrations in the wall for in relation to resistance to fire, should be eliminated wherever pipes. Surfaces should be maintained hydrostatic, and hydrodynamic practicable. Where flexible sealants crack free, and without any forces. are used in floor penetration joints, discontinuities, and without any failed these should be replaced with fire- joints that may allow liquid migration. Bund penetrations should be avoided resistant sealants. unless alternative over-wall routings As observed in major incidents, such are not practical. On existing bunds, There have also been a number of as the Buncefield fire of 2005, the fitting steel collars or bellows to significant accidents resulting from joints in concrete bund walls are improve fire resistance at pipework leaks of from tanks particularly susceptible to the effects penetrations may introduce local through the base of storage tanks. of fire and/or subsequent cooling. corrosion initiation sites in the Therefore the provision of a suitable Therefore, to maintain integrity, joints pipework and is not recommended impervious base (ideally concrete should be capable of resisting fire. unless corrosion prevention can be with a membrane liner) or floor leak Ideally, steel plates (waterstops) assured. Where corrosion can not be detection on double floor should be fitted across the inner prevented, joints should be improved configurations should be provided. surface of bund joints and fire by replacing existing sealants with sealants should be used to replace or fire-resistant sealants.

Marsh • 8 7.2 TERTIARY • Of cellular configuration to allow CONTAINMENT segregation and limit the extent of spread of pollutants and/or fire. Tertiary containment need only be • Robust under emergency concerned if there is a significant risk conditions, e.g. loss of electrical of secondary containment being supply. insufficient to prevent an escalation to a major accident affecting • Capable of allowing the controlled personnel, assets, or the movement of contained liquids environment. Firewater containment under normal and emergency is one such example. Implementation conditions. of tertiary containment should therefore be a risk-based decision. • Capable of aiding the separation of However, tertiary containment should water from pollutants (e.g. oil/ be: water separator).

• Independent of secondary • Able to manage rainwater and containment. surface waters.

• Capable of fully containing More guidance on tertiary foreseeable firewater and liquid containment can be found in pollutant volumes on the failure of documentation including CIRIA 164 secondary containment. and PPG18.

• Impermeable to water and foreseeable entrained pollutants/ hydrocarbons.

9 • Atmospheric Storage Tanks 8. OVERFILL PROTECTION All tanks should be fitted with a suitably high integrity • The trip function should include an audible/visual alarm overfill protection system, which should be designed to SIL to prompt a check that the trip function has been 1 as a minimum, depending upon the risks associated with successful. failure. In some cases it may be necessary to terminate the transfer Overfill protection systems should be automatic and in a more gradual fashion, such as by limiting the closure physically and electronically separate from the tank rate of the isolation valve to avoid damaging overpressures gauging system, i.e. have an independent level gauging in upstream pipework. Due allowance must be given to the system and back-up level switch or duplicated level maximum filling rate between LAHH being activated and gauging system. the isolation valve finally closing.

However, justification for a single combined gauging and The site receiving any batch or delivery must have ultimate overfill protection device could be made if the integrity of control and responsibility for stopping the transfer and the instrument is sufficient for the risk of failure. should have local systems and valves to stop the operation. This should not therefore be under the sole control of an Tank gauging systems should have a high level alarm (LAH) automatic system or operators at a remote location. to alert operators to the status of the tank which gives sufficient time to interrupt the filling operation and the Tank level instrumentation and information display subsequent activation of the back-up overfill protection systems should be of sufficient accuracy and clarity to device high-high level alarm (LAHH). This should also take ensure safe planning and control of product transfer into into account any thermal expansion of the fluid within the tanks. tank. It is important that LAH should not be used to control routine filling. It is preferable for tanks to be continuously and automatically monitored for rate of level change during Analogue sensors are preferred to digital (switched) transfer operations to match the actual rate of transfer with sensors (i.e. there are two analogue sensing elements on expected rates. This would give an early indication that the the tank), as these are able to alert whenever there is a fault main level gauging system was not functioning correctly or in the primary level sensor before reaching high level. that the incorrect tank was being filled. During normal storage operations, such a tool could also notify operators Electro-mechanical servo gauges should be avoided for of a significant loss of containment. use with flammable materials as these are intricate devices considered to be vulnerable to a number of potential failure It is not within the scope of this document to detail the SIL modes. Modern electronic gauge sensors, such as radar determination or its implications. However the following gauges, should be used instead. points should be noted:

• It is the dutyholder’s responsibility to meet latest Where practical the LAHH should have an executive action international standards, IEC 61511 is a current good to interrupt the filling operation by closing the isolation standard. valve and/or stopping the pump. Features of a LAHH are: • The appropriate SIL required should be specified before • It should be set at or below the tank’s rated capacity. designing and installing overfill protection systems.

• Activation of the LAHH is to initiate a shutdown. • Layer of protection analysis (LOPA) is a suitable • LAHH may be limited to an audible/visual alarm to alert methodology to determine SIL. a human operator to rake the required action. Actions • As overfill protection systems normally function required must be specified and well documented. NB – infrequently, they should be periodically tested in their such options are not suitable for SIL 1 systems. entirety to ensure they will operate when required.

Marsh • 10 9. MAINTENANCE AND INSPECTION All tanks must undergo regular • Full floor scan. external and internal (out-of-service) inspections to ensure their integrity, • Internal examination of shell to and as such a written scheme of annular floor weld. examination should be provided. • Non destructive examination (NDE) Overall guidance on the suitable of annular plate and shell nozzles. methods and frequency of such inspections are detailed in EEMUA • Visual inspection. 159 and API 653. Deferral of internal inspections should Individuals responsible for the be risk assessed and approved by a formulation of schemes of inspection suitably competent person. Particular and for the inspection of tanks should attention should be given to tanks be competent and have the that have had no previous internal appropriate qualification for tank inspection, as the probability of floor inspection and for the grade of failure will increase with every year materials used in construction. As a that the recommended interval is minimum, personnel should be exceeded. In such cases, it is unlikely competent to The Welding Institute’s that a deferral could be justified. (TWI’s) certification scheme for Pontoons should be included in welding and inspection, or Failure of either a top or bottom floor formal maintenance and inspection equivalent. in double-bottomed tanks (as regimes as loss of pontoons (as a detected through the failure of result of corrosion or long-term External inspections should be vacuum between plates) should be removal of pontoon cap) will affect conducted on a higher frequency rectified within one year. Continued the stability and buoyancy of the than internal inspections based upon operation in the interim period deck. The presence of flammable risk based inspection (RBI) pending repair should be supported vapours within a pontoon also requirements, or as stated in the by a technical justification supporting increases the risk of vapour cloud relevant codes. If active degradation its fitness for purpose. explosion (VCE) within a pontoon. mechanisms are found, then more frequent inspections should be Tank repairs and modifications are The functional integrity of overfill conducted. specialist activities and should only protection systems is critical to be conducted by suitably qualified ensuring primary containment. Particular attention should be given personnel with appropriate Overfill protection systems may be in to insulated storage tanks, as qualification (as specified above). a normally dormant state without corrosion under insulation, and the being required to operate for many quality of external coatings applied Water drains on floating roof tanks years. For this reason, periodic testing prior to insulation, can have a should also be formally included in is an essential element in assuring significant effect upon tank integrity. routine maintenance if normally left their continuing integrity. open, including a check that isolation Thorough internal inspection can only valves can be closed. The detection be achieved by removing a tank from systems for hydrocarbons should also service, cleaning it, and then be tested on a regular basis. All tests conducting, as a minimum: should be formally documented.

11 • Atmospheric Storage Tanks 10. LEAKAGE AND FIRE DETECTION

It should be noted that leakage, overflow, and top of the seal, and not on the foam dam, where fire detection are mitigation layers and not they are less effective in detecting fires. preventative layers, and are therefore of secondary priority to overflow and leak Point heat detectors are generally of less use for protection. large storage tanks, other than in the vicinity of vents, given the large areas that need to be covered. Therefore, optical flame detectors, 10.1 LEAK DETECTION providing a large zone of detection, should be Whilst flammable gas detection in storage areas used for bunded areas. is considered to be a good measure (for highly flammable materials), the dispersion of flammable vapours is complicated to predict, so 10.2 FIRE PREVENTION AND effective gas detection may not always be PROTECTION practical. BONDING AND EARTHING More effective detection of leaks is likely to be By nature of the storage of flammable liquids, provided by liquid hydrocarbon detectors. flammable atmospheres are to be expected in Typical locations would be in the bund drain, the vicinity of vents, rim seals, and within the gutter or sump, where hydrocarbons would tanks themselves. To minimise the risk of accumulate. Such systems may be subject to ignition the tank and ancillary equipment should failures or spurious alarms (e.g. due to water be fully bonded and earthed (grounded). A collecting in the bund), therefore consideration maximum resistance of 10 ohms to earth is should be given to using multiple detectors at recommended. more than one location. Initiation of such alarms should also initiate an interruption of any Special attention should be made to the transfer operation. This is of particular earthing connection between the tank wall and importance at terminals that are normally the roof of a floating roof tank. Sliding shunts unmanned. (contactors) between the wall and roof often do not maintain a good contact, thus overloading Ideally closed circuit television (CCTV) should be those shunts which are maintaining a provided, with suitable resolution and lighting in connection. Therefore, an adequate number of tank and bund areas to give operators assistance shunts should be provided and checked to in detecting tank overflows. Operators should ensure that contacts are maintained. not be expected to monitor these constantly, therefore CCTV should be provided with Due to the rising and falling of the floating roof, systems that detect and respond to changes in excess lengths of earthing cable are required in conditions and then alert operators to those the vicinity of the walkway providing access to changes. the floating roof. The earthing cable can often be severed when it is trapped between the wheels FIRE DETECTION of the access walkway and the rails upon which it rolls, as in example shown overleaf. For floating roof tanks, rim seals should be Retractable grounding systems on modern constantly monitored by the use of linear heat tanks would address this. detection. These should be located close to the

Marsh • 12 Damaged Earthing Cable

One of the most common sources of ignition for Often, foam is applied to provide a blanket to large tanks is lightning. Therefore, the provision suppress vapour emissions and prevent ignition. of suitable lightning protection with bonding However, if this occurs on tanks storing and earthing would help to minimise this. NFPA materials, such as , that are susceptible 780 Standard for the Installation of Lightning to ignition from splash-filling, careful Protection Systems provides more details on the consideration should be given prior to the specification of lightning protection systems. application of foam. If foam is to be applied, for example in the event that electrical storms are Some installations are provided with lightning expected, then this should be gently applied masts intended to act as preferential routes for along the shell wall and not by splash-filling to lightning to discharge itself, as opposed to via the surface of the material. the storage tank. This concept is not proven and some parties suggest that such masts act to attract lightning to the vicinity of the storage ZONING tanks. Therefore, these are not currently A detailed assessment of the hazardous area considered to be a robust mitigation against the classification (HAC) of the storage tank, ancillary effects of lightning. equipment, and bunded area must be conducted. This should take into account the Some materials are susceptible to the effects of class of material being stored. static during splash-filling. Therefore, measures should be taken in such instances to prevent the The specification of spark-inducing equipment generation of electrostatic charges. should be suitable for the HAC zones location and should be made in accordance with relevant It is possible that floating roofs can become electrical standards, such as IP (Institute of unstable and sink, maybe as a result of rainwater Petroleum) Model Code of Safe Practice Part 15, accumulation, or failure of flotation devices. ATEX 95, ATEX 137 or BS 5345.

13 • Atmospheric Storage Tanks 11. FIRE FIGHTING SYSTEMS Protection systems and fixed fire this position paper to detail may result in the destabilisation and fighting installations should be emergency plans, but API 2021, sinking of the roof. provided and comprise fixed/semi- Management of Atmospheric Storage fixed foam systems and cooling Fires, provides some guidance in sprays. Additionally, access to the this matter. 11.2 FOAM FIRE tanks for mobile fire fighting FIGHTING SYSTEMS appliances, equipment, and materials Emergency response personnel Whilst being a good cooling medium should be provided giving multiple should receive training on the fire for tanks, water is not a suitable fire points of attack with no dead-ends. preplans, and regular exercises extinguishing medium for should be conducted to assess the hydrocarbon fires. Therefore, foam is In many cases it is safer and more suitability of the preplan. used for such applications. The practical to allow a tank fire to burn design of foam fire-fighting systems, itself out; for instance, when there is be they fixed or mobile, should be no chance of escalation to other 11.1 WATER SYSTEMS suitable for the types of fires they tanks, little environmental exposure Provision should be made for the would be required to extinguish (or or where the risks of fighting the tank application of cooling water to fixed suitable for the cooling of adjacent fire are greater than not fighting it. roof tanks containing products equipment/tanks). Therefore each Two notable exceptions are: adjacent to those containing Class I or facility needs to have its own tailored II (petroleum) or wherever there is • Rim seal fires – these will take a fire fighting system. Important issues less than 1 x diameter of the largest long time to burn out. to consider when designing and tank between adjacent tanks. In installing a fire fighting system • Crude tank fires – these are particular, there should be cooling include: susceptible to boilovers due to the wherever there is less than 15 metres presence of water. access between tanks. • Foam and the foam injection/ proportioning systems must be Broad principles of water and foam Where water is to be applied to tanks, compatible (also important if the application are given below. More water application rates should be: supplier of foam is changed). details are given in the Energy Institute’s Model Code of Safe • 2 lpm/m2 for exposed tanks. • Hydraulic design of foam systems Practice Part 19: Fire precautions at must be specified. petroleum and bulk storage • 10 lpm/m2 for engulfed tanks (to vertical and inclined surfaces). • Foam selection must be installations. Alternatively, NFPA 11 appropriate for the type of fire likely Standard for Low-, Medium-, and Source: IP 19. Model Code of Safe Practice e.g. aqueous film forming foam High-Expansion Foam can be used as Part 19. (AFFF), should not be selected for a reference. polar solvents. Water application should be provided As for process plant, dedicated fire- • Correct proportioning of foam that by either fixed or semi-fixed systems. preplans should also be compiled for may otherwise result in foam that It is unlikely that mobile tenders storage installations. These should does not flow (too little water) or would have sufficient capacity for specify type of attack, firewater and that quickly goes back to solution water storage to mount a prolonged foam application rates, location of (too much water). cooling water attack on a storage hydrants, semi-fixed installations and tank. • Provision of facilities to aid the mobile apparatus, firewater maintenance or testing of containment, and worst case firefighting systems. scenarios. It is not within the remit of Water should not be applied to the roof area of floating roof tanks as this

Marsh • 14 • Location of equipment, e.g. Additionally, remote monitors are correctly, although if there are monitors not too far from tanks for wasteful of foam and cannot direct changes to the foam type, foam foam application to tank surface. the jet so accurately as the objective proportion or even water supply, is to apply foam to the rim seal as then the flow characteristics could • Attention to any faults in the quickly and gently as possible be affected so that a foam seal is fabrication and installation of (irrespective of the roof level) and to not possible. hardware, e.g. check valves retain a complete foam seal for as installed the wrong way round, long as possible. • Forced/irregular addition of foam. transport packing still present The intention is to apply foam around air inductors. gently down the side of the tank The most common and (arguably) shell so that it forms an even most effective method to control a Once a system has been designed blanket within the rim seal area. If rim seal fire is the application of foam and installed, it is critical that it is the pourer has been incorrectly via fixed rim seal pourers on the top of tested. Whilst this may be expensive, positioned it may not apply the the shell wall. Even with simple, fixed it is critical to ensure that the system foam in such a way, e.g. catching purpose-built systems, such as rim actually completes the job it is on the top edge of the seal, seal pourers, there is the danger that intended to do. Ideally, systems resulting in splashing and loss of basic errors can be made so that the should be tested at the manufacturers foam to the roof. system does not operate as intended. as it is then cheaper, quicker and Such examples that should be easier to rectify any mistakes. • Foam pourers located too high on avoided are: the tank, exposing them to wind and impairing their passage to the FLOATING ROOF TANK FIRES • Top of foam dam below the top of rim seal itself. the rim seal – this is especially an Rim seal fires are the most common issue where secondary rim seals To overcome these issues, tests type of fire on floating roof tanks. have been added to the tank to should be conducted on the system There is little chance of these reduce tank emissions. The top of to ensure it operates correctly. escalating to other tanks or turning to the foam dam should be at least 50 Depending upon the number of tanks full surface tank fires if the design, mm above the top of the rim seal, being protected, annual testing maintenance, and layout of the tanks but ideally about 150 mm. frequency would be appropriate. is suitable. This should not be considered a rule, however, as a • Too many or too large gaps at the Inspections should be conducted poorly maintained tank could lose its bottom of the foam dam. The regularly to ensure air inlets to foam integrity or be vulnerable to purpose of the dam is to hold the generators are clear and that foam subsequent explosions, perhaps as a foam in position around the pourers are not blocked by, for result of vapour ingress into one of circumference of the tank to reduce example, birds’ nests. Other good the pontoons. the amount of foam needed. This ensures efficient application to the features to aid inspection or fire fighting in the event of a system Rim seal protection should only be rim seal and prevents unnecessary failure are: used on certain types of roofs (i.e. loads being placed on the tank roof. With large gaps at the bottom of double deck, steel pontoon, etc). Pan • Walkway around the top of the the dam, a significant quantity of roofs for example, should have full floating roof tank – this can be the foam could leak to the roof. surface protection. wind girder with a handrail around However, small, intermittently the circumference. This allows for spaced drains should be provided The application of foam from a remote the pourers to be accessed for to allow rainwater to drain away. monitor (i.e. one outside the bund) maintenance or for fire fighters to would not represent best practice as • Incorrect spacing of the foam access the roof with manual hoses. it can create roof instability and pourers. Modern foams can flow in potentially escalate the incident. excess of 30 metres if proportioned

15 • Atmospheric Storage Tanks • Provide a foam hydrant at the top from low level through the tank itself of the tank (preferably at the top of via a “coflexip” flexible pipe. the stairs) for fire fighters in the event of rim seal pourers becoming “One shot” systems – an blocked. This also requires less extinguishing agent (such as obsolete equipment to be carried up the Halon) is applied at the rim seal in a tank in the event of a rim seal fire. single burst extinguishing the flames. Careful consideration needs to be Whilst potentially effective as an given as to the safety of personnel initial extinguisher, these do not when attempting such a tactic. prevent re-ignition and require all the parts, including cylinders, being • It is important that foam can be placed on the roof. For that reason, applied equally well when the Marsh does not recommend such an floating roof is at high level and approach. when it is at low level.

Other foam delivery systems that are FIXED ROOF TANKS more complex to varying degrees are: Similar systems can be applied to Catenary systems – foam applied to fixed roof tanks, with foam the rim seal by local generators application to the surface of the located directly within the foam dam product through a fixed or semi-fixed through a supply line attached to the system, or even sub-surface allowing for the foam to float to the surface of Example of sub-surface foam application roof via the rolling ladder. apparatus the product. NFPA 11 standard for low, medium, and high-expansion Coflexip system – foam solution is foam provides a guide as to which applied in the same way as a catenary, products and materials can be although the supply pipe runs up protected by such systems.

11.3 APPLICATION TYPE RATE Source: Energy Institute’s Model Code RATES (l/min/m2) of Safe Practice Part 19: Fire APPLIED WITH MOBILE precautions at petroleum refineries and A minimum of 40 minutes’ attack EQUIPMENT bulk storage installations Pool fires 5-10* should be envisaged in order to have *The higher rate may be applied to Class I a reasonable chance of success in Fixed roof tanks, Class I 5-10* products, including containing up to product extinguishing a fire, and foam stocks 10% of oxygenates. Fixed roof tanks, Class II/III 5 should be sufficient for this duration; product a duration of 60 minutes is preferred APPLIED WITH FIXED OR for crude oil tank fires. SEMI-FIXED EQUIPMENT NFPA 11, standard for low, medium, Fixed roof tank with pourer 4 and high-expansion foam also Typical application rates for foam outlet provides similar application rates, solution are shown below, although Base injection ( only) 4 although there are some minor foam manufacturer’s advice on the Floating roof rim seal fires 12 differences. type of foam and application should Floating roof tanks (roof area), 6.5 projected foam always be sought: Floating roof tanks (roof area), 4 fixed pourers

Marsh • 16 12. REFERENCES TO INDUSTRY LOSSES

Examples of Industry losses have been included in Appendix C.

13. REFERENCES TO INDUSTRY STANDARDS

Model Code of Safe Practice Part 19: PPG 18. Planning Policy Guidance 18: Safety and environmental standards Fire precautions at petroleum Enforcing Planning Control. for fuel storage sites. December 2009. refineries and bulk storage December 1991. ISBN Process Safety Leadership Group. installations. Energy Institute, 9780117525542. February 2007. ISBN 978-0-85293- http://www.hse.gov.uk/comah/ 437-1. HSG 244. Remotely Operated Shutoff buncefield/fuel-storage-sites.pdf Valves (ROSOVs) for Emergency BS EN 14015. Specification for the Isolation of Hazardous Substances - EEMUA PUB N° 159 - User’s guide to design and manufacture of site built, Guidance on Good Practice. October the inspection, maintenance, and vertical, cylindrical, flat-bottomed, 2004. ISBN 0717628035. repair of above ground vertical above ground, welded, steel tanks for cylindrical steel storage tanks. the storage of liquids at ambient API 650. Addendum 3 - Welded Steel January 2003. Engineering temperature and above. February Tanks for Oil Storage. October 2003. Equipment and Materials Users’ 2005. American Petroleum Institute. Association.

BS EN 61511-1:2004/IEC 61511- API 653. Tank Inspection, Repair, EEMUA PUB N° 183 - Guide for the 1:2003 Functional safety. Safety Alteration, and Reconstruction, Third Prevention of Bottom Leakage from instrumented systems for the process Edition. December 2001. American Vertical, Cylindrical, Steel Storage industry sector. Petroleum Institute. Tanks. January 2004. Engineering Equipment and Materials Users’ BS EN ISO 10497:2004. Testing of API 2000. Venting Atmospheric and Association. valves. Fire type-testing Low-pressure Storage Tanks, Sixth requirements. British Standard/ Edition. November 2009. American RR760 - Mechanical integrity European Standard/International Petroleum Institute. management of bulk storage tanks. Organisation for Standardisation. HSE. API RP 2350. Overfill Protection for HSG 176. The storage of flammable Storage Tanks in Petroleum Facilities, http://www.hse.gov.uk/research/ liquids in tanks. HSE. ISBN 0 7176 Third Edition. January 2005. rrpdf/rr760.pdf 1470 0. NFPA 11 Standard for Low-, Medium-, Note: RR760 provides a summary of CIRIA Report 164: Design of and High-Expansion Foam, 2010 relevant codes and standards for the Containment Systems for the Edition. assurance of mechanical integrity in Prevention of Water Pollution from storage tanks. These provide an Industrial Accidents. January 1997. Buncefield. The Final Report of the assessment of the most appropriate Construction Industry Research and Final Investigation Board. December standards for different elements of Information Association. ISBN 2008. Buncefield Major Incident maintenance and design of facilities. 086017476X. Investigation Board. http://www. buncefieldinvestigation.gov.uk/ reports/index.htm#final

17 • Atmospheric Storage Tanks Marsh • 18 14. APPENDICES

APPENDIX A - ASSESSMENT CHECKLIST The following checklist is based on a very good rated atmospheric storage tank facility and can be used to assess the quality of that facility and identify any gaps or areas for improvement.

ELEMENT/FEATURE CRITERIA

Containment All tanks separately bunded and sized for 110% of capacity. Bund walls sized and designed to contain and prevent bund overtopping (may include tertiary containment).

Layout/Spacing Meets risk-based tank spacing evaluation and risk evaluation available. Non-crude inter tank spacing equal to or greater than one diameter of largest tank and at least 15 metres. Crude oil tanks separated by five tank diameters to prevent risk from boilover.

Instrumentation HLA, HHLA (totally independent includes tappings, transmitters, etc.) linked to automatic shutdown of feed. Temperature indicator. LLA, LLLA (independent) linked to automatic shutdown of pump out and complete with on-line diagnostic capability (i.e. not simple switch). Shutdown system and components SIL rated in accordance with application and location. All indicators to control room. Continuous mass balance system for tank farm. Online blending.

Construction Double welded seals on floating roof. Weather shield. Concrete base with impervious membrane and sides sloped away from base weld. Anti rotation device on floaters. Earthing, lightning conductors. Good access to pontoons, and handrails on access walk way around periphery. Auto bottom water drain. Tank floor leak detection with double floor. Roof drainage: rainwater receptors and spill over connections to product (limits water level to 10”).

Selection As appropriate to class of product.

Drainage of Bunds Grading to pump pit sump. Impermeable bund material.

Equipment and Pipework Buried common inlet/outlet pipework and no equipment within bund area.

Bund Construction and Condition No penetrations or gaps in the walls. Any gaps in bund walls should be sealed appropriately with a fireproof material. Concrete faced earth wall. Consideration given to preventing bund overtopping.

Gas Detection Bunds fitted with flammable gas detectors for low flash point materials capable of sustaining a VCE. Detectors interlocked with tank filling system to interrupt transfer.

Fire Detection Linear Heat Detection or fusible-link/ tube (for rim seals only). Systems are self monitoring with status indication to HMI (Human/Machine Interface).

Fixed Fire Protection Multi-head foam pourers with foam dam for all tanks. Shell cooling water spray, or use of - Floating Roof multiple monitors with proof of response capability. Supply from two separate locations. Foam for bunded area. Fixed system supplies foam. Fixed radiant protection on exposed walls.

Fixed Fire Protection Subsurface foam injection (for non-polar compounds, otherwise foam chambers). Roof - Cone Roof and shell cooling. Foam for bunded area - dual supply. Fixed systems.

Fixed Fire Protection Foam pourers. Roof and shell cooling; bund protection with foam - dual supply. Fixed - Cone roof with internal floater system.

19 • Atmospheric Storage Tanks APPENDIX B - MECHANICAL COMPONENT CHECKLIST FOR FLOATING ROOF TANK INSPECTIONS

Cleanliness • Debris on roof? • Ponding or rainwater on roof?

Leakage • Signs of oil or holes on roof?

Roof Drains • Clogging of roof drain screen mesh?

PV Vent Mesh • Clogging of PV vent mesh?

Emergency Roof Drain • Clogging of emergency drain mesh?

Weather Shields/Seals • Damage or corrosion? • Excessive gaps between seal and shell?

Pontoon Compartments • Presence of water or oil? • Covers tight?

Earthing Cable • Damage on cable or connections?

Guide Poles • Damage on guide pole rollers?

Rolling Ladder • Damage on wheel?

Roof Drain Valves • Ease of movement?

Bottom of Shell • Water pooling? • Corrosion? • Vegetation?

Marsh • 20 APPENDIX C - LOSS INCIDENTS The application of the measures specified in this document should minimise the risk of a major accident occurring at a storage facility or individual storage tank.

The table below gives some examples of incidents that have resulted in loss of containment to illustrate that they should not be considered as rare events. Data has been compiled by a reputable operator in the USA that indicates that overfilling occurs once every 3,300 filling operations.

LOCATION DATE FUEL RELEASEDCONSEQUENCE Jacksonville, 1993 Unleaded petrol/ 190 m3 released. The spill ignited, leading to a Florida, USA gasoline major explosion and fire. Coryton, UK 1997 Unleaded petrol/ 81 m3 released. Spill contained within bund – gasoline no ignition. Belgium 2001 Hexene Approximately 90m3 released. Spill contained within bund – no ignition. Sour Lake, Texas, 2003 Crude oil 80 m3 released. Spill contained within bund – USA no ignition. Torrance, 2004 Approximately 10m3 released. Spill contained California, USA within bund – no fire or explosion. Bayonne, New 2004 Fuel oil 825 m3 released. Oil contained on tank farm. Jersey, USA – no fire or explosion. Casper, 2004 Unleaded petrol/ Up to 1270 m3 released. Spill contained within Wyoming, USA gasoline bund – no ignition. Rensselaer, NY, 2005 Unleaded petrol/ 0.4-4 m3 released. Spill contained within bund USA gasoline – no ignition.

LOCATION DATE FUEL RELEASEDCAUSE CONSEQUENCE Fawley, UK 1999 Crude oil (400 Corrosion of tank base No injuries or off-site effects. All tonnes) of the oil was recovered from primary containment. Milford 2005 (653 Leak from damaged No injuries, but nearby gardens, Haven, UK tonnes) sump escaped through farmland, and stream permeable floor of contaminated. All wildlife killed in bund stream. Antwerp, 2005 Crude oil Catastrophic failure of Overtopping of the bund wall Belgium (26,000 tonnes) storage tank as a result occurred due to sudden release. of corrosion Plymouth 2005 Kerosene Corrosion of the tank No injuries. Kerosene entered Harbour, (tonnage base and a permeable into the ground. UK uncertain) bund base Coryton, 2006 Gas oil (121 Tank overfilled, oil No injuries or harm to the UK tonnes) escaped from bund by environment. defective drain valve Poole 2006 Diesel oil (19 Diesel escaped through No injuries. Pollution of ground Harbour, tonnes) damaged base plate but not of the harbour. UK and through cracks in concrete bund floor

21 • Atmospheric Storage Tanks Incidents with similarities with the Buncefield incident of 2005 are summarised below.

LOCATION DATE AND TIME COMMENTS – BACKGROUND COMMENTS – EXPLOSION Houston, Texas, April 1962 ‘Severe leak’ from gasoline tank. Almost windless Described as a blast, but no details are available. USA conditions. Ignition near adjacent highway. Baytown, Texas, 27 January 1977 Overfilling of a ship with gasoline. Few details are available, but it is likely that there USA would have been congestion. Texaco, Newark, 7 January 1983 Overfilling of a tank containing unleaded gasoline. Relatively uncongested area. High overpressure New Jersey, USA After 00.00 hrs 114-379 m3 (80-265 tonnes) of gasoline released. reported but not quantified. Three minor explosions Slight wind, ignition source 300m away. preceded the main blast. Naples Harbour, 21 December Overfilling of a tank containing unleaded gasoline. Relatively congested area. The tank overtopped 1.5 Italy 1985 700 tonnes escaped. Low wind speed (2 m/s). hours before ignition. Various overpressures estimated from damage analysis but they are minimum values (e.g. 48 kPa). St Herblain, 7 October 1991 Leak of gasoline from a transfer line into a bund. Presence of parked petrol tankers may have been France 04:00 hours Wind <1 m/s. 20 minutes delay, ignition in car park sufficient to generate turbulence. High overpressures c. 50 m away. Volume of flammable cloud est produced but not quantified. 23,000m3. Jacksonville, 2 January 1993 Overfilling of a tank containing unleaded gasoline. High overpressure produced but not quantified. Florida, USA 03:15 hours 50,000 gallons (190m3, 132 tonnes) released. Laem Chabang, 2 December 1999 Overfilling of a gasoline tank. Few details. High overpressure produced but not quantified. Thailand 23:25 hours Relatively low congestions in the area.

Below are statistics on the frequency of incidents taken from the LASTFIRE project, a group of operating companies sharing information on the prevention and protection of fires in large atmospheric storage tanks. This data is valid up to 2006 and should not be seen as comprehensive.

SPILLS AND INITIAL FIRE EVENTS LOSS OF CONTAINMENT INITIAL FIRE EVENT ONTO ROOF SUNKEN INTO BUND RIM SEAL SMALL LARGE SPILL ON FULL ROOF BUND BUND ROOF SURFACE Nº of Incidents 55 37 96 55 3 2 1 1 Frequency (x10-3/ 1.6 1.1 2.8 1.6 0.09 0.06 0.03 0.03 tank year)

RIM SEAL FIRE FREQUENCY BY REGION COUNTRY/REGION NIGERIA SOUTHERN NORTHERN NORTH VENEZUELA THAILAND SINGAPORE SAUDI EUROPE EUROPE AMERICA ARABIA Nº of Fires 7 13 15 9 2 3 2 1 Tank Years 333 6,247 15,264 4,611 159 224 1,035 3,392 Frequency (x10-3/tank year) 21 2 1 2 13 13 2 0.3 Thunderstorm days/year 160 30 20 40 60 70 120 10

FULL SURFACE FIRE ANALYSIS • One escalation in 55 rim seal fires (roof pontoons contained flammable vapour and/or liquid).

• One escalation in two bund fires impinging on tank shell.

• One escalation from a spill fire on a roof.

• One full surface fire in 37 sunken roof incidents.

• Escalation to two downwind tanks in one full surface fire (volatile fuel).

• One boilover in six full surface fires. Note: of the six fires, one was a crude tank which resulted in a boilover. It should always be assumed that a crude tank full surface fire will boilover.

Marsh • 22 THE ENGINEERING SERVICES TEAM Marsh’s Risk Engineering Services comparative skills of the team team has been established for over permit a benchmarking system 25 years and is uniquely qualified which gives a global opinion of the to provide risk managers and risk, assessed against peer plants underwriters with the essential world-wide. information they need to determine the right limit and From the earliest planning stage to scope of cover and the right price. the last operational phase, the engineering services team is able Each member of the team is a to contribute practical and qualified engineer, with practical cost-effective advice, and experience in design, assistance. construction, operation, and maintenance across a broad range In addition to tailored of oil, gas, and petrochemical programmes, the team has a series risks. of core packages, covering everything from managing a major They have all been trained in emergency to risk reduction advanced insurance skills, in the design features, and safe working ability to assess and analyse risk, practices. and to communicate effectively and frequently in more than one The Engineering Services team language. uses its breadth of expertise, experience and its practical The goal is to build bridges knowledge and skills to between risk engineering, communicate a real understanding insurance and risk management, of physical risks, your insurance and between the client and the implications and the commercial underwriter. At the same time, the operating environment.

23 • Atmospheric Storage Tanks Marsh • 24 For further information, please contact your local Marsh office or visit our web site at: marsh.com

BEIJING LONDON OSLO Tel: +86 10 6533 4070 Tel: +44 (0)20 7357 1000 Tel: +47 22 01 10 00 Fax: +86 10 8529 8761 Fax: +44 (0)20 7929 2705 Fax: +47 22 01 10 90

CALGARY MADRID PERTH Tel: +1 403 290 7900 Tel: +34 914 569 400 Tel: +61 8 9289 3888 Fax: +1 403 261 9882 Fax: +34 913 025 500 Fax: +61 8 9289 3880

CAPE TOWN MOSCOW RIO DE JANEIRO Tel: +27 21 403 1940 Tel: +7 495 787 7070 Tel: +55 21 2141 1650 Fax: +27 21 419 3867 Fax: +7 495 787 7071 Fax: +55 21 2141 1604

DUBAI MUMBAI SAN FRANCISCO Tel: +971 4 223 7700 Tel: +91 226 651 2900 Tel: +1 415 743 8000 Fax: +971 4 227 2020 Fax: +91 225 651 2901 Fax: +1 415 743 8080

HOUSTON NEW YORK SINGAPORE Tel: +1 713 276 8000 Tel: +1 212 345 6000 Tel: +65 6327 3150 Fax: +1 713 276 8888 Fax: +1 212 345 4853 Fax: +65 6327 8845

Marsh is one of the Marsh & McLennan Companies, together with Guy Carpenter, Mercer, and Oliver Wyman. The information contained herein is based on sources we believe reliable and should be understood to be general risk management and insurance information only. The information is not intended to be taken as advice with respect to any individual situation and cannot be relied upon as such. In the United Kingdom, Marsh Ltd is authorised and regulated by the Financial Conduct Authority. Copyright © 2015 Marsh Ltd All rights reserved.