DOI: 10.3303/CET2291033

Paper Received: 3 January 2022; Revised: 20 April 2022; Accepted: 28 April 2022
Please cite this article as: Salimbeni M., De Angelis M., Ciucci M., 2022, Earthquake Natech Risk Assessment in Major-hazard Industrial Plants,
a Case Study: Cylindrical Liquid Storage Tank with Floating Roof, Chemical Engineering Transactions, 91, 193-198 DOI:10.3303/CET2291033

CHEMICAL ENGINEERING TRANSACTIONS

VOL. 91, 2022

A publication of

The Italian Association
of Chemical Engineering
Online at www.cetjournal.it

Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers

ISBN 978-88-95608-89-1; ISSN 2283-9216

Earthquake NaTech Risk Assessment in Major-Hazard

Industrial Plants, a Case Study: Cylindrical Liquid Storage

Tank with Floating Roof

Michela Salimbenia,*, Maurizio De Angelisa, Mariano Ciuccib

a Sapienza University of Rome, Department of Structural and Geotechnical Engineering, via Eudossiana 18, Rome, Italy
b INAIL, Department of Technological Innovations and Safety of Plants, via del Torraccio di Torrenova; Italy

michela.salimbeni@uniroma1.it

The experience of several failures of equipment in industrial plants due to earthquake has shown that incidental

scenarios like explosion, fire or hazardous release can occur. In Italy, industrial plants that operate with

hazardous substances are subject to Italian standard D.Lgs. 105/2015, that requires to carry out a risk analysis,

also considering the seismic risk. Earthquake is one of the natural events which is part of NaTech events

(Natural Hazard Triggering Technological Disasters). The aim of this paper is to discuss a critical aspect about

methodology for assessment of the earthquake NaTech risk in major-hazard industrial plants. Particularly, to

evaluate the seismic vulnerability of equipment, both data from a structural safety verification and fragility curves

can be used. At the end of the seismic vulnerability analysis, it should be identified the possible incidental

scenarios involving one or more industrial components and, for each scenario, to evaluate the frequency of

occurrence. The attention is focused on a typical industrial equipment, a cylindrical liquid storage tanks with

floating roof. Not only failure of structural elements can cause hazardous release, but also the non-structural

elements must be considered. Particularly, the presence of floating roof and the seal rim is often neglected in

seismic analysis and, consequently, in risk analysis.

1. Introduction

Past earthquakes like Long Beach in 1933, Kern County in 1952, Alaska in 1964, Niigata in 1964, San Fernando

in 1971, Managua in 1972, Miyagi-Ken-Oki in 1978, Imperial County in 1979, Greenville in 1980, Central Greece

in 1981, Coalinga in 1983 (Kiremidjian et al., 1985), Northridge in 1994, Kobe in 1995, Izmit in 1999, Wenchuan

2008, Chile in 2010, Tohoku-Japan in 2011 (Erdik & Eren, 2014) highlighted that natural disasters can cause

significant damage to industrial plants, often causing the release of dangerous substances. These disasters are

called NaTech events (Natural Hazard Triggering Technological Disasters) (Campedel, 2008), arise from the

interaction between natural hazards and industrial risk and can produce major accidents when dangerous

substances are involved. Among the NaTech events, the earthquake is one of the most significant, it

simultaneously affects the entire plant, and it can cause simultaneous damages to equipment. The vulnerability

of industrial plants derives, above all, from the complexity of the layout and from the possibility of accidental

chains forming, with a possible domino effect, which can cause explosions, fires and releases of dangerous

substances stored and used in industrial processes (Paolacci et al., 2009).
In terms of safety, in Italy industrial plants that operate with hazardous substances are called “major hazard

industrial plants” and are subject to Italian standard D.Lgs. 105/2015, transposition of Directive 2012/18/EC –

Seveso III, that requires to carry out a risk analysis, also considering the seismic risk. However, at present,

regulatory codes and guidelines are not adequate for conducting a complete vulnerability analysis of equipment,

nor for seismic risk analysis. In fact, safety checks mostly focus on the structural aspects of equipment,

neglecting the possibility of failure of non-structural elements, that may also be involved in major accidents. For

this reason, the case of cylindrical liquid storage tanks with floating roof, a typical vessel for storage of hazardous

substances, is shown. Particularly, the presence of the floating roof and the seal rim is often neglected in seismic

analysis and, consequently, in risk analysis. Furthermore, codes do not specify methodologies to carry out a

193

risk analysis, which consists of several steps: identification of possible incidental scenarios, estimation of their

frequency of occurrence, assessment of consequences and introduction of mitigation strategies. Thus, a

methodology is presented in a preliminary assessment of frequency of occurrence of incidental scenarios

involving hazardous substances. The focus is on assessing the seismic vulnerability of the equipment as part

of the seismic risk analysis, taking into account the security requirements of the codes. Fragility curves, a

commonly used tool for the assessment of vulnerability in probabilistic terms, can be constructed using different

approaches, but they should always take into account the real conditions of the structure.

2. Cylindrical liquid storage tanks with floating roof

2.1 Basic operation

Liquid products that produce a lot of gas or vapor are stored in vertical cylindrical tanks with floating roof: the

roof is located on the surface of the product and can slide vertically along the shell for product inlet / outlet. So,

the floating roof reduces the product losses and the potential for explosions in the vapor space and eliminates

the possibility of boilover. The floating roof is a circular steel structure equipped with floating caissons that allow

it to float above the product stored in a closed or open tank. Generally, the overall diameter of the floating roof

is about 400 mm smaller than the inside diameter of the tank. The space between the outer edge of the roof

and the inside of the tank shell is closed by means of a flexible sealing system, which also allows the position

of the roof in the tank to be centralized. There are two main types of a floating roof, single pontoon, and double

pontoon. The single pontoon roof is the most common type of floating roof, owing its buoyancy to an outer

annular pontoon divided radially into compartments. The central part is formed by a membrane of steel plates

welded together and connected to the inner edge of the caissons. The double pontoon roof consists of an upper

and lower steel membrane separated by a series of radially divided circumferential stiffeners. The single pontoon

roof is considerably more deformable than the double pontoon. Also, some elements are required for the

functionality of the tank, such as flexible piping systems, edge vents, rain drainage system, roof supports, guide

pipe, stilling pipe and floating roof sealing system (Long & Gardner, 2004).

2.2 Dynamic behavior

The dynamic behavior of an atmospheric tank is essentially related to earthquake-induced dynamics of the fluid.

Given a cylindrical tank with a vertical axis subject to horizontal acceleration at the base, the fluid in motion

exerts a hydrodynamic pressure on the tank that can be conveniently divided into three components

(Rammerstorfer et al., 1990):

• Hydrodynamic pressure due to the acceleration of the ground considering the rigid tank, called "impulsive"

• Hydrodynamic pressure due to the oscillatory motion of the fluid surface, known as "sloshing" or "convective"

• Hydrodynamic pressure due to the flexibility of the tank walls, called "flexible".

Tanks are geometrically characterized by the aspect ratio 𝑠 = 𝐻/𝑅, where 𝐻 is the filling height and 𝑅 the radius

of the tank; in particular, the convective modes depend exclusively on the geometry of the tank. Tanks with

floating roofs are considered as squat structures, with 𝑠 between 0.3 and 1.5. For such values of 𝑠, the flexible

component of the hydrodynamic pressure is not significant, while the convective component cannot be

neglected (Fischer & Rammerstorfer, 1999).

2.3 Typical seismic damages

Several failures to tanks with floating roof are caused by an earthquake and they depend on the impulsive and

convective components of the fluid motion. Damage due to the impulsive component mainly involves the

structural elements:

• Elephant’s foot buckling. The deformation is a consequence of the phenomenon of elasto-plastic instability,

which occurs when the stress state of the wall is such that the steel is close to yield stress; the circumferential

stresses, together with the vertical compression stresses, increase due to the combined action of hydrostatic

force and overpressures caused by the earthquake, until, at the bottom, local instability is produced, which

manifests itself through the bulge of the wall itself.

• Diamond buckling. The phenomenon of elastic buckling occurs when the vertical stress exceeds the critical

value of the vertical membrane stress, depending on the axial compressive forces developed at the generic

meridian line, due to the weight of the tank walls and the roof, in addition to the increase given by the seismic

action.

• Uplifting of the bottom and its consequences, such as failure of welded connection between bottom and shell

in non-anchored tanks, failure of the anchorage system if present, breakage at the inlet / outlet pipes.

The convective component, on the other hand, is responsible for damage to the upper part of the shell and the

roof of the tank, such as excessive deformation, buckling of inner and outer rim of the pontoon (Yamauchi et al.,

194

2006), tilting and sinking of the roof. In particular, the failure of the floating roof and, above all, of the non-

structural elements connected to it (e.g.: roof sealing system, rainwater drainage systems, safety systems), can

lead to the leakage of hazardous substances, pollutants and flammable substances, with the possible triggering

of fires and explosions; in addition to the combustion of spilled substances, a fire can be triggered by repeated

impacts between the floating roof and the shell (Hatayama, 2008), due to the failure of seal system.

Therefore, damage related to the convective component of fluid motion is the most involved in accidents that

can become major.

a) b) c)

Figure 1: a) tilting of floating roof and burned tank (Hatayama, 2008), b) buckling of inner pontoon, c) buckling

of outer pontoon (Yamauchi et al., 2006)

3. Seismic risk analysis

Risk analysis is the process by which all internal and external hazards associated with industrial activity and

conditions that may lead to accidental events with harmful consequences for people, the environment and

property are identified. Plants where dangerous substances are involved in industrial processes are defined as

“major hazard industrial plant”.

Figure 2: Methodology for seismic risk analysis for major hazard industrial plants

Risk analysis is based on a probabilistic approach, since the random variables involved in the assessment of

major accidents; risk is generally defined as the probability of a given event occurring in a given period and

under specific circumstances. At present, standards and guidelines do not specify clear methodologies to carry

out a risk analysis related to hazardous substance release, due to the occurrence of a leak/break/failure of an

equipment. A common methodology for the seismic risk assessment in major hazard industrial plants is shown

in Figure 2. The first step is to characterize both the seismic event, in terms of site hazard, and the behavior of

equipment, to evaluate the seismic vulnerability, both by the safety checks from the regulatory codes and by

fragility analysis. Once the critical structural and non-structural elements have been identified, possible accident

scenarios involving hazardous substances can be identified. This can be carried out using various

195

complementary techniques, such as historical analysis, checklists, what-if analysis, HazOp analysis, failure

modes and effects analysis or random failure analysis. Then, two analyses are required to identify the expected

frequency of an incidental scenario:

• Fault Trees Analysis (FTA) aims to assess the expected frequency of the incidental scenario starting from

the causes and prevention interventions. FTA involves the construction of a logical decision tree using

initiator events, enabler events and logical gates linking the various events. The values to be assigned to

the causes must be expressed in occasions/year.

• Event Trees Analysis (ETA) aims to assess and assign an expected frequency to all possible event

evolutions, also considering protection interventions.

Subsequently, the calculation of consequences is carried out from a set of boundary conditions, some defined

by the codes and others to be identified for each individual industrial site or at the level of an individual scenario.

The final objective of a risk analysis is to quantify the risk and, if this is not considered acceptable, to reduce it

through some improvements.

4. Fragility curves

4.1 Definition

The fragility function represents the probability that the seismic demand (𝐷EDP – demand in term of an

Engineering Demand Parameter) on a building exceeds the Limit State (𝐿𝑆) as an undesirable condition for a

specific Intensity Measure (𝐼𝑀). There are three methods for deriving fragility curves (Porter, 2021):

• The empirical / observational approach allows to derive fragility curves through statistical procedures that

describe the probability of experiencing or exceeding a particular level of damage as a function of

earthquake intensity (Lallemant et al., 2015). In the past, fragility curves have been developed using

relatively small data sets. However, the number of samples is known to affect the reliability of the fragility

estimate. In the case of empirical data, this problem is much more emphasized due to measurement errors,

the indirect nature of the observations and various uncertainties affecting the information.

• The analytical approach allows to develop case specific fragility curves based on the results of structural

analyses carried out on an appropriate model of the structure. The analysis may be carried out by different

methods. The behavior of the structure is a function of certain vectors of basic variables. These variables

determine both the seismic demand and the capacity of the structure. Once the limit function, or limit state,

has been defined, the probability of exceeding the limit states is calculated (Singhal & Kiremidjian, 1996).

• The approach based on expert opinions or judgements, whereby fragility curves of structures are created

by experts judging the probability of failure as a function of seismic intensity.

4.2 Literature fragility curves for storage tanks

O'Rourke and So (O’Rourke & So, 2000) characterized the seismic behavior of cylindrical steel storage tanks

by developing fragility curves using a logistic regression analysis of the performance of 397 tanks in 9

earthquakes. The damage states adopted to characterize the damage were in agreement with the damage state

description of the HAZUS methodology (FEMA, 2003). Fragility relationships were obtained as a function of

aspect ratio and fill percentage. The American Lifeline Alliance (ALA, 2001) obtained the fragility curves using

a larger data collection, including 532 tanks exposed to 21 earthquakes. Least squares regression was used to

estimate the median acceleration to reach a particular damage state and the associated lognormal dispersion

parameter. The influence of the fill level and the anchorage was also studied. Berahman (Berahman &

Behnamfar, 2007) analyzed steel storage tanks with a fill level greater than 50% from the ALA database and

calculated the seismic fragility of unanchored tanks by adopting a Bayesian approach, adopting ALA damage

states. In (Salzano et al., 2003) empirical fragilities in terms of content release intensity, adopting Probit Analysis,

is presented. In this case, the authors divided the tanks of the same database of the previous works into release

states, depending on the loss of contents caused by damage. Although the various works agree that the higher

the fill level, the lower the median acceleration required to reach a certain damage state, and that anchored

tanks perform better overall than non-anchored tanks, past databases have contained relatively small numbers

of samples. Furthermore, the development of the fragility curves was based on the use of damage matrices, in

which the tanks were divided into PGA ranges and the value of the dispersion parameter was defined a priori.

The advantages of using the empirical/observational approach are the immediate applicability, so they don’t

need to build a structural model or carry out heavy analysis, and they are based on a few macroscopic

parameters; on the other hand, there are the limited availability of meaningful data, the subjectivity for the

assignment of damage state, the impossibility to distinguish the influence of different damage mode (for

structural or non-structural element), the difficulty in assessing the influence on damage of actual building

conditions and boundary conditions and also it’s not easy to deduce the influence of dimensional or structural

196

parameters. In the light of these considerations, the empirical/observational approach clashes with a high

degree of dispersion, which leads to poor interpretability and usability of the results. Finally, fragility curves are

not available in the literature for all types of industrial equipment.

4.3 Analytical fragility curves

For analytical fragility curves, the following aspects should be taken into account:

• Real structural state. The real condition of the structural and non-structural elements of equipment must be

considered. Fabrication defects, inadequate maintenance, ageing and degradation of materials may lead to

structural performances that can be significantly different from those of newly built structures. A meaningful

indication is provided by results of assessment of safety requirements according to the regulatory codes.

• Structural model.

• Types of structural analysis and related seismic input

• Damage or limit state. The effects of seismic actions are often correlated to damage, according to HAZUS

damage categories (FEMA, 2003) or damage states are determined on the basis of the ranges of EDP values

adopted for the description of a particular damage mode (Paolacci et al., 2015).

• Damage-related EDP. If damage states are determined based on value ranges of an EDP, the EDP that best

describes the specific damage mode must be identified.

• Input intensity measure

• Probability distribution for the random variables of interest. The most common form of a seismic fragility

function (but not universal, best, or always correct) is the lognormal cumulative distribution function (CDF).

The lognormal distribution is usually used because of the simple and parametric form, so for the distribution

of a random variable the mean and standard deviation must be estimated, also it has been widely used for

several decades in earthquake engineering and it is often a reasonable fit to the observed distributions of the

quantities of interest. It is of the form

𝑃[𝐷𝐸𝐷𝑃 ≥ 𝐿𝑆|𝐼𝑀] = 1 − Φ[(𝑙𝑛(𝐿𝑆𝑚) − 𝑙𝑛(𝐷𝑚 )) 𝛽𝑑⁄ ] (1)

where 𝑃[𝐴|𝐵] is the probability that A is true given that B is true, 𝐷𝐸𝐷𝑃 is the damage state of a particular

component, 𝐿𝑆𝑚 is the estimated mean of the parameter 𝐷 that results in the damage state or boundary

state, 𝐼𝑀 is the random seismic intensity, referred to as EDP, 𝑥 is a particular value of 𝑋, therefore free of

uncertainty, 𝛷 is the standard cumulative normal distribution function, 𝑙𝑛 is the natural logarithm, 𝐷𝑚 is the

average structural capacity to resist damage state 𝑑, 𝛽𝑑 is the standard deviation of the natural logarithm of

the structural capacity to resist damage state 𝑑.

4.4 Simplified analytical fragility curves

In order to reduce computational burden, only for a preliminary evaluation of the seismic fragility, it is possible

to make specific fragility curves for a construction considering the current geometric-mechanical conditions (e.g.:

variation of resistant area, mechanical quality of the material, etc...), by performing linear static analyses. In fact,

subjecting the model of the structure into equivalent static action with increasing seismic acceleration in a

sufficiently wide range of values, one obtains the pairs of points (𝐼𝑀𝑖 , 𝐷𝑖 ), to be intended 𝐼𝑀 as the spectral

acceleration associated with the first period of vibration of the structure. If seismic capacity and seismic demand

acting on the structure follow a lognormal probability distribution, the pairs of points (𝐼𝑀𝑖 , 𝐷𝑖 ) are arranged, on

the bilogarithmic plane, along a straight line with slope 𝑚 and intercept 𝑞. Performing, then, a linear regression

operation, we obtain the average demand on the structure as

𝐷𝑚 = 𝑎(𝐼𝑀)
𝑏 (2)

where 𝑎 and 𝑏 are the linear regression coefficients on the logarithmic plane of the pairs of points (𝐼𝑀𝑖 , 𝐷𝑖 )

𝑎 = 𝑒𝑞 (3)
𝑏 = 𝑚 (4)

Defining the EDP value associated with the 𝐿𝑆, we obtain 𝐿𝑆𝑚, i.e., the threshold limit for the EDP beyond which

the undesired condition occurs. Having performed linear static analyses and having defined 𝐿𝑆𝑚 in a

"deterministic" way, no uncertainties were introduced in the model, i.e., neither the randomness of the seismic

demand nor that of the structural capacity was considered. As a first step, a total uncertainty 𝛽𝑑 can be

introduced such that It’s respected the principle that, because of the use of static analysis in a linear field for the

definition of the average demand on the structure conditional on the seismic intensity measurement, the total

uncertainty will be larger the more severe the damage condition considered. In addition, in order to consider the

real geometrical and mechanical conditions of the structure, it is appropriate to realize several fragility curves,

197

each considering different conditions that differ from the design (e.g.: construction defects, inadequate

maintenance, ageing and degradation of materials, ...).

5. Conclusions

For the earthquake NaTech risk assessment in major-hazard industrial plants, no complete methodologies are

available that allow risk reduction. This is outlined by the consequences of past earthquakes on major hazard

industrial plants. Furthermore, regulation and codes do not provide complete indications about the same issue.

There are some main aspects related to seismic risk assessment to be considered:

• For that concerns industrial plants, damages related either to structural and non-structural elements are

equally relevant when discussing about the release of hazardous substances: cylindrical liquid storage tanks

with floating roof are an evident example.

• Fragility curves formulated according to an empirical / observational approach presented in the literature for

cylindrical liquid storage tanks, that are not available for all industrial elements, don’t always represent a

reliable tool for the calculation of the frequencies of occurrence of accident scenarios.

• In order to better estimate the actual probability of occurrence of structural and non-structural damage, ad

hoc analytical fragility curves can be formulated, considering the real condition of considered element taking

into account the results of the safety verifications based on normative and codes.

• Only for a preliminary estimation of the structural vulnerability, a simplified analytical approach for the

realization of fragility curves is proposed, able to streamline the onerous structural analyses, by performing

linear static analyses.

As outlined in this paper, in order to evaluate the frequencies of occurrence of accident scenarios, it is necessary

to implement an appropriate use of fragility curves approach, that takes into account the actual conditions of the

industrial element considered in the analysis.

References

ALA. (2001). Seismic fragility formulations for water systems. Part 1- Guideline.

Berahman, F., Behnamfar, F., 2007, Seismic fragility curves for un-anchored on-grade steel storage tanks:

Bayesian approach, Journal of Earthquake Engineering, 11, 166–192.

Campedel, M., 2008, Analysis of major industrial accidents triggered by natural events reported in the principal

available chemical accident databases, JRC Scientific and Technical Reports.

Erdik, M., Eren, U., 2014, Earthquake damage and fragilities of industrial facilities. International Conference on

Seismic Design of Industrial Facilities, 3–13.

FEMA, 2003, HAZUS Multi-Hazard Loss Estimation Methodology – Earthquake Model, Federal Emergency

Management Agency, Washington.

Fischer, F. D., & Rammerstorfer, F. G., 1999, A refined analysis of sloshing effects in seismically excited tanks,

International Journal of Pressure Vessels and Piping, 76, 693–709.

Hatayama, K., 2008, Lessons from the 2003 Tokachi-oki, Japan, earthquake for prediction of long-period strong

ground motions and sloshing damage to oil storage tanks, Journal of Seismology, 12, 255–263.

Kiremidjian, A. S., Ortiz, K., Nielsen, R., Safavi, B., 1985, Seismic risk to major industrial facilities. Report -

Stanford University, 72.

Lallemant, D., Kiremidjian, A. S., Burton, H., 2015, Statistical procedures for developing earthquake damage

fragility curves, Earthquake Engineering & Structural Dynamics.

Long, B., & Gardner, B., 2004, Guide to Storage Tanks and Equipment, Wiley.

O’Rourke, M. J., So, P., 2000, Seismic fragility curves for on-grade steel tanks, Earthquake Spectra, 16, 801–

815.

Paolacci, F., Giannini, R., De Angelis, M., Ciucci, M., 2009, Seismic vulnerability of major-hazard industrial

plants and applicability of innovative seismic protection systems for its reduction, 11th World Conference on

Seismic Isolation, Energy Dissipation and Active Vibration Control of Structures, Guangzhou, China.

Paolacci, F., Phan, H. N., Corritore, D., Alessandri, S., Bursi, O. S., Reza, M. S.,2015, Seismic fragility analysis

of steel storage tanks, COMPDYN 2015.

Porter, K.,2021, A Beginner ’s Guide to Fragility, Vulnerability, and Risk. University of Colorado Boulder.

Rammerstorfer, F. G., Scharf, K., Fisher, F. D.,1990, Storage tanks under earthquake loading. Applied

Mechanics Reviews, 43, 261–282.

Singhal, A., Kiremidjian, A. S.,1996, Method for probabilistic evaluation of seismic structural damage, Journal

of Structural Engineering, 122, 1459–1467.

Yamauchi, Y., Kamei, A., Zama, S., Uchida, Y., 2006, Seismic design of floating roof of oil storage tanks under

liquid sloshing, Proceedings of ASME.

198

55salimbeni.pdf
Earthquake NaTech Risk Assessment in Major-Hazard Industrial Plants, a Case Study: Cylindrical Liquid Storage Tank with Floating Roof