External Floating-Roof Tank Inspection: From Deck Observations to a Traceable Visual and UT Evidence Plan

Inspect the roof as one buoyant system

An external floating roof rises and falls with the stored liquid. A single-deck roof usually combines a centre deck with perimeter pontoons, while a double-deck roof relies on interconnected structural spaces. The seal manages the rim vapour space, drains remove rainwater, and hatches, vents, sumps, ladders and gauge poles interrupt the deck. Trouble in one component can shift loads or conditions elsewhere. A few isolated thickness readings therefore say little about the health of the complete roof.

The UK Health and Safety Executive's HID 3-2014 alert links floating-roof failure with loss of containment, hydrocarbon evaporation or ignition, and pollution through open roof drains. It tells operators to watch excessive deck corrosion, standing water, roof listing, seals and fittings, pontoon integrity, tank distortion, access ways and ladders. The alert describes regulator guidance, not a PetroBot project. Its central point is practical: log thickness data alongside the condition and behaviour of the whole roof.

Start with the tank and the decision

Begin with a reliable asset record: tank ID and service, roof type, design and repair history, materials, operating-level envelope, coating history, previous ponding or listing, leaks, repairs and inspection results. Record the standards, addenda, procedures and jurisdiction adopted by the owner. Fixed roofs, internal floating roofs, tank floors and shells present different geometry, hazards and acceptance questions; each needs its own scope.

Then write the decision in one sentence. Is the team performing a routine condition check, characterizing corrosion, following up ponding, planning a repair, preparing an out-of-service campaign or gathering evidence for an integrity assessment? The answer determines coverage, location control and review. Name the tank inspector or assessor, NDT authority, structural or process-safety owner, operations contact and escalation path. The field team gathers evidence. The named owner roles decide acceptance, repair, inspection interval, continued service and further assessment.

API 653 and API RP 575 often sit within owner inspection programs, with EEMUA 159 providing complementary tank-integrity guidance. Confirm the editions adopted for the site and their legal relevance before work begins. These standards guide the program; publication names alone do not establish compliance.

Build a component-and-failure hypothesis map

Overlay the roof drawing with inspection history, operator logs, coating breakdown, repairs and known water-retaining areas. Mark centre-deck fields, laps, welds, low points, sumps, drains, patches, seals, foam dams, pontoon or double-deck compartments, hatches, vents, roof legs, gauge poles and the rolling-ladder route. Add reported ponding, listing, buckling, damaged fittings, loose covers and repeated wet-dry areas. This map turns scattered history into inspection questions; it does not prove a damage mechanism or make an area safe to approach.

Likely concerns include atmospheric corrosion, local pitting or perforation, coating failure, distortion, damaged drains, leaking or flooded pontoons, seal deterioration and corrosion around attachments or past repairs. Cracking, weld defects, underside loss, pontoon bulkhead condition, drain hydraulics, structural instability and vapour hazards call for different combinations of NDT, calculations, functional checks or out-of-service access. Match every hypothesis to a method that can answer it and to a person authorized to act on the result.

Keep observations, measurements, coverage and decisions separate

A trustworthy record answers four distinct questions. What condition was visible at a known time and place? What thickness did qualified UT measure at the stated point or scan path? Where did the team obtain valid data, and where did it not? What did the responsible inspector or engineer decide? A sentence such as ‘the robot confirmed roof integrity’ collapses all four layers into a claim the data cannot support.

Match the method to the question

Choose the method from the integrity question, consequence, geometry, surface, access and evidence required. Routine operator checks reveal changes in ponding, roof level or fittings. Close visual inspection adds detail. Manual or robotic UT provides local or scanned thickness data on suitable accessible surfaces. Leak testing, weld-focused NDT, drain checks, structural assessment and out-of-service pontoon examination answer different questions. Together they form a scope; none is a complete floating-roof inspection by itself.

A magnetic crawler earns its place when it reduces difficult access or makes a defined visual and UT route more repeatable. It carries sensors; it does not define the inspection strategy. Drains, curbs, welds, hatches, foam dams, seals and ladders can interrupt travel or probe contact. Assign those areas another method, record them as exclusions or move them into a controlled future scope.

Prove MagRover and sensor suitability on the actual roof

PetroBot publishes MagRover, also known as MagBot, as a magnetic platform for suitable ferrous surfaces, including general shell and roof applications. Its supported tools include a camera, UT spot readings and UT scans. That product description is not a blanket qualification for every external floating roof. In-service use, named-feature traversal, automatic coordinate mapping, through-coating UT, numerical coverage or detection performance and hazardous-area configuration all require separate project evidence and approval.

Screen the actual roof for material, magnetic adhesion, plate flexibility, coating and surface condition, debris, temperature, slope, local geometry, route continuity, proximity to edges and fittings, probe seating, couplant behaviour, tether path, access and recovery. Run a representative trial to show that the chosen visual or UT setup produces procedure-valid evidence on the intended surface. Reaching a location does not earn coverage credit; valid data does.

For UT, define the probe and instrument, reference or verification method, material and velocity basis, surface preparation, couplant, temperature controls, setup checks, repeat rules and rejection criteria. Unless a qualified project procedure proves otherwise, plan around a prepared compatible surface rather than assuming through-coating performance. Select the sensor for the question: lighting and context for condition evidence, stable acoustic response and location control for thickness evidence.

Make access, stop conditions and recovery non-negotiable

No inspection scope can make a questionable roof safe. Before people or equipment approach it, the owner must approve a site-specific risk, access and recovery plan. Cover structural condition and loading, abnormal listing or ponding, product and vapour hazards, atmosphere monitoring, ignition and static control, weather and lightning, falls and openings, dropped objects, tether management, communications, recovery, operating changes and every permission required by the site and jurisdiction.

Stop when structural capacity or access becomes uncertain; listing, deformation or water load appears abnormal; atmosphere or weather moves outside approved controls; adhesion or probe coupling is lost; the route becomes obstructed; the tether or recovery path is compromised; or the field team cannot recover the system safely. The project risk assessment may add further stop conditions.

Robotic acquisition can reduce where people need to stand, but it does not remove the need for trained personnel, permits, fall controls, exclusion zones, confirmation checks or recovery planning. In the United States, OSHA walking-working-surface rules form part of that review; every other market must apply its own law and site rules. Use equipment in a classified area only after verifying the certification and conditions for the complete deployment configuration.

Map every route and every gap

Choose a fixed datum and orientation that a reviewer can reproduce. Use radial and circumferential coordinates tied to cardinal direction, or named plate, weld and feature references backed by a drawing. Record the viewing direction and the start of every route. Derive priority zones from the component map, then show visual and UT work separately. Location correlation belongs in the scope; use only the positioning method and accuracy that the project has verified.

Coverage is a collection of states, not a flattering percentage. Keep the original plan, then record what the team attempted, what produced valid evidence and what failed validation. Mark inaccessible, deferred and uninspected zones around seals, hatches, drains, ladders, curbs, patches and unsafe surfaces. When a route changes, retain the planned and as-run versions so the final map cannot imply data where none exists.

Protect data quality in the field

Capture the as-found condition before approved cleaning or preparation removes useful evidence. Record the component, exact location, orientation, scale where needed, lighting, coating and surface condition, water or debris, time and operating context. Link every prepared-surface image and UT record back to that same location. A dramatic close-up without roof context is hard to relocate and easy to misread.

For every UT point or scan segment, preserve the setup, checks, probe, couplant, material or velocity basis, surface condition, operator, time, route and validity state. Repeat low, abrupt or unstable responses as the procedure requires, keeping the original response, repeat result and surrounding context. If the system cannot establish a stable back-wall response, record rejected or no-data—never substitute a nominal or nearby value.

Roughness, pitting, coating, debris, curvature, flexible plate, weld profile, temperature and couplant behaviour all affect probe contact or acoustic response. The NDT authority decides whether the setup remains valid, needs adjustment or calls for another technique. Interpolation can help visualize accepted points, but it must never fill an unmeasured gap or turn an attempted zone into valid coverage.

Interpret the pattern without overstating the evidence

A repeatable local low area calls for tighter characterization. Broad, consistent change may support a different corrosion hypothesis. An unstable response often points first to surface, coupling or geometry limits. Welds, laps, attachments and repairs can change both the real profile and the ultrasonic response. The NDT reviewer must separate accepted measurements from indications that require another technique. Thickness alone cannot show whether loss is topside or underside, general or pitted, active or historic.

Correlate thickness with as-found visuals, coating condition, ponding history, roof-level trends, repairs and operating records. Correlation is not causation: standing water beside a low reading does not prove why metal was lost, and a uniform accessible deck says nothing conclusive about pontoon interiors. Crack-like responses, leakage, severe deformation, abnormal listing or questionable structural behaviour need the owner's defined specialist escalation.

The responsible tank-integrity team sets acceptance limits and decides minimum required thickness, corrosion rate, remaining life, drain adequacy, seal performance, pontoon tightness, buoyancy, structural capacity, repair and fitness for service. Robotic data informs those decisions; it does not make them.

Build a decision-ready evidence package

A reviewer should be able to reconstruct the asset, purpose, method, achieved coverage and uncertainty from the report alone. Keep four types of statement distinct. ‘Coating loss and standing water were visible near the named drain zone’ is an observation. ‘A repeatable qualified thickness was recorded at coordinate X’ is a measurement. ‘The local pattern warrants expanded characterization’ is an NDT interpretation. ‘Use another method before the next decision point’ is the owner's disposition.

• Tank and roof identity, service and operating context, drawings, inspection objective and governing owner documents.
• Responsible roles, approved access and risk controls, method and procedure, equipment configuration and setup-verification record.
• Coordinate convention, planned and as-run coverage, linked as-found and prepared-surface visuals, valid readings or scans and repeat results.
• Rejected or no-data entries, inaccessible and deferred areas, deviations, sensor and method limits, complementary work and unresolved questions.
• A follow-up register separating NDT review, engineering assessment, maintenance action, out-of-service scope and formally accepted residual uncertainty.

Use five gates for a practical go, change or no-go decision

Gate one is decision clarity: can visual evidence or contact UT answer the owner's question? Gate two is safe access: has the site team approved roof condition, loading, atmosphere, weather, fall controls, route and recovery? Gate three is technical fit: did the carrier and sensor produce procedure-valid evidence on representative material, surface and geometry? Gate four is coverage honesty: does every planned zone have a traceable state, including exclusions? Gate five is decision ownership: are the right reviewers ready to interpret the evidence and assign follow-up?

• Go only with a defined question, approved site controls, a demonstrated valid setup, honest coverage states and named decision owners.
• Change the method or access plan when geometry, surface, coupling, route or required evidence does not fit the initial approach.
• Do not deploy onto a roof with unresolved structural or access uncertainty, and do not promise in-service access or complete coverage by default.

Give hidden areas a real follow-up scope

HSE separates routine and in-service checks from the internal and external pontoon examination performed during out-of-service inspection. Keep that boundary visible. Upper-deck visuals and UT do not reach pontoon bulkheads, the deck underside, hidden drain components or every seal boundary. Nor do they prove liquid or vapour tightness, drain capacity or whole-roof structural behaviour. Assign every unanswered question to a named complementary method or out-of-service scope instead of letting silence pass as satisfactory condition.

Frequently asked questions

Technical references

• UK HSE HID 3-2014 — External floating-roof inspection and maintenance safety alert
• API standards plan — API 653 and API RP 575 publication status
• API 653 Body of Knowledge — Public tank and roof inspection scope
• EEMUA Publication 159, sixth edition — Aboveground storage-tank integrity guidance
• ISO 16809:2025 — Non-destructive testing: ultrasonic thickness determination
• ASTM E797/E797M-21 — Manual ultrasonic pulse-echo contact thickness measurement
• US OSHA 29 CFR 1910.28 — Walking-working-surface fall protection duties