A petroleum terminal concentrates flammable liquids, marine operations, road and rail traffic and industrial machinery on one site. That it does so, worldwide, with remarkable routine is not luck — it is the product of layered safety frameworks refined over decades, frequently in response to hard lessons. This guide maps the main layers so non-specialists can navigate a terminal's safety story.
The ship–shore layer: ISGOTT
Where tankers meet terminals, the governing reference is ISGOTT — the International Safety Guide for Oil Tankers and Terminals. It standardizes the pre-transfer conference, the jointly signed ship/shore safety checklist, closed cargo operations, control of ignition sources, and agreed emergency shutdown arrangements. Its authority comes from adoption: charterers' vetting desks and port authorities expect it as baseline behavior.
The steel layer: design and integrity codes
Tanks are built and kept honest by engineering codes — API 650 for design and construction of welded storage tanks, API 653 for in-service inspection, repair and alteration, alongside national equivalents. These codes translate into inspection cycles: routine external inspections while in service and planned internal inspections with the tank out of service, tracking floors, shells, roofs and foundations across a tank's decades of life.
The overfill layer: lessons written in fire
The Buncefield explosion (UK, 2005) began with a tank overfilled while its level gauge failed silently. The industry's answer, codified in guidance such as API 2350: independent high-level alarms separate from the working gauge, automatic overfill prevention where risk assessment requires, defined maximum filling heights, and tested response procedures when alarms sound. Overfill philosophy is now among the first questions any competent auditor asks a tank farm.
The work-control layer: permits and change
Most terminal incidents involve non-routine work. Two systems control it:
- Permit-to-work — hot work, confined-space entry, line breaking and similar tasks proceed only under a permit that verifies isolation, atmosphere testing, standby arrangements and authority to proceed.
- Management of change (MOC) — any modification to plant, procedure or organization passes a documented review of its safety consequences before implementation. The principle: no informal changes to a facility whose hazards were assessed as-built.
The human layer: culture
Frameworks fail without behaviors. Mature terminals run universal stop-work authority (anyone can halt an operation, without retribution), contractor induction and competence verification, toolbox talks before non-routine tasks, and near-miss reporting treated as free intelligence. Leading indicators — near-misses reported, actions closed on time — are reviewed by management with the same seriousness as financial results.
The emergency layer: planned, resourced, rehearsed
Response plans cover the credible scenarios — tank or bund fires, spills to ground or water, medical and security events — with trained teams on shift, firefighting and containment resources matched to the site's risk profile, and coordination agreements with port authorities and mutual-aid partners. The differentiator is rehearsal: plans exercised on a real cadence, with lessons folded back in, rather than binders that age on shelves.
Reading a terminal's safety story
Cargo owners and agencies rarely audit tank floors themselves. What they can do is test coherence: Does the operator name the frameworks it works to? Can it describe its overfill philosophy, its permit system, its last exercise? Are answers specific and written? Safety systems leave paperwork the way glaciers leave moraines — a terminal that cannot show the paperwork is asking you to take geology on faith.