Security Robots at Bulk Fuel Terminals: Safety First

What must operators verify before deployment?

A bulk fuel terminal should introduce a patrol robot only after verifying four controls: approval for every hazardous location it may enter, gas sensors suited to the products on site, behavior aligned with emergency procedures, and routes that exclude transfer hazards, containment structures, and emergency access. If any one of those controls is unresolved, the robot belongs outside the affected area.

A geofence does not make uncertified electrical equipment safe inside a classified location. Nor should a mobile detector replace the terminal's fixed gas detection, fire protection, operator rounds, or spill response program. The robot is a supplemental observation platform whose cameras, thermal instruments, gas readings, and location data can extend patrol coverage without becoming another ignition source.

Begin with the terminal's current electrical area-classification drawings, product inventory, safety data sheets, emergency plans, transfer procedures, and traffic map. Operations, electrical engineering, environmental health and safety, security, maintenance, and the authority having jurisdiction should approve the operating concept before a commercial robot pilot program reaches tanks or racks.

Is the robot approved for the exact hazardous location?

OSHA 29 CFR 1910.307 expressly identifies bulk storage plants for gasoline and other volatile flammable liquids as places where hazardous classified locations may exist. It requires each room, section, or area to be considered individually and requires documented classifications for areas established under the applicable class and zone or class and division systems.

The approval must match the location's class, division or zone, gas group, temperature code, and ambient-temperature range. OSHA also requires the marked operating temperature to remain below the ignition temperature of the gas or vapor encountered. A robot approved for an ordinary outdoor environment, or for a different gas group, does not pass that test.

For a US installation, verify the certification mark, the issuing OSHA-recognized Nationally Recognized Testing Laboratory, the applicable standards, and the exact configuration covered by the listing. IECEx explains that an Ex component is not intended for standalone use and requires additional certification when incorporated into equipment. Certified cameras or gas sensors therefore do not automatically certify the assembled robot, battery, motors, radios, connectors, accessories, and payload enclosure.

Keep charging and battery service in an unclassified location unless that equipment is separately approved. The route should also prevent an ordinary-location robot from entering a classified envelope after localization drift, a map error, a manually opened gate, or loss of communications.

What should mobile gas detection actually do?

Select sensors from the terminal's product hazards, not from a generic four-gas specification. The review should consider combustible vapor response, oxygen, hydrogen sulfide where applicable, toxic constituents identified by industrial hygiene, sensor cross-sensitivity, poisoning, humidity, temperature, wind, sampling height, response time, and the robot's travel speed.

OSHA's November 26, 2024 bulletin on direct-reading monitors recommends documented calibration and maintenance procedures. It cites verification of operational capability before each day's use, certified traceable test gas used before expiration, and testing under conditions similar to the workplace. A failed function or calibration check calls for full calibration before use, and a monitor that then fails should be removed from service.

Do not borrow an alarm threshold from another terminal or confuse an instrument alarm with a regulatory boundary. OSHA 1910.106 says ventilation intended to prevent fire and explosion is adequate when it prevents vapor-air accumulation above one-fourth of the lower flammable limit. Separately, OSHA's confined-space rule identifies oxygen below 19.5 percent or above 23.5 percent as a hazardous atmosphere criterion. Site engineers must set robot alarms from the actual products, exposure limits, detector limitations, fixed-system strategy, and emergency plan.

Every alarm needs a predetermined action: timestamp and locate the reading, notify the control room, stop or retreat along an approved path, and preserve sensor data. The robot should never continue toward a suspected release merely to obtain a better reading unless a written, engineered procedure specifically authorizes that mission.

How should the robot behave during an emergency?

Write robot behavior into the terminal's emergency action and response procedures. OSHA 1910.38 requires plans, when applicable, to address emergency reporting, evacuation and assigned exits, critical operations before evacuation, personnel accountability, rescue or medical duties, and responsible contacts. The robot must not block any of those activities.

Define a safe state for gas alarms, fire alarms, spill notifications, emergency shutdown activation, loss of network, low battery, localization uncertainty, collision, and remote-control failure. Depending on the event and wind direction, the correct action may be an immediate stop, a retreat to an unclassified refuge, or abandonment in place. That choice must be made during hazard analysis, not improvised by a remote operator during an incident.

Give the control room a clearly labeled remote stop and a reliable way to identify the robot's last position. Establish who may command it during an incident and when incident command supersedes normal security operations. A robot should not operate valves, trigger an emergency shutdown, cross a hot zone, or conduct post-release reconnaissance unless those functions have undergone separate engineering, approval, training, and drills.

EPA states that certain facilities with at least 42,000 gallons of oil storage and over-water transfers, or at least 1 million gallons plus specified risk conditions, may require a Facility Response Plan. Where an FRP applies, robot notifications, recordings, shutdown behavior, and recovery rules should support that plan without creating a competing alarm chain.

Which routes should always be restricted?

OSHA 1910.106 identifies open flames, hot surfaces, frictional heat, and static, electrical, or mechanical sparks among potential ignition sources. The route assessment must therefore consider damaged wheels, dragging hardware, motor or brake temperatures, impact energy, and static control, not merely the robot's electronics.

Measure stopping distance on the actual pavement when dry and when exposed to rain, residue, gravel, or minor grade changes. Confirm that an autonomous patrol robot can detect hoses and low obstacles, yield to emergency vehicles, remain outside vehicle swing paths, and preserve the capacity and function of secondary containment.

• Loading racks while hoses, arms, bonding equipment, or vapor-recovery connections are in use
• Tank dikes, containment walls, drainage channels, sumps, pits, and soft shoulders that can trap or overturn the robot
• Tank vents, relief outlets, sampling points, pump seals, manifolds, and other likely vapor-release points
• Fire lanes, hydrants, monitors, emergency shutdown stations, exits, muster areas, and responder staging zones
• Tank-truck maneuvering areas, rail crossings, wheel-chock zones, scales, and blind corners
• Spill scenes, barricaded maintenance areas, open excavations, hot-work boundaries, and temporary hose or cable runs

What should a terminal pilot prove?

A pilot should test a bounded, unclassified route first. Acceptance criteria should cover localization accuracy, obstacle detection, stopping distance, communications loss, alarm delivery, camera usefulness, thermal false alarms, gas-sensor response, safe-state behavior, manual recovery, and the time required to remove a disabled unit without exposing personnel.

Use certified challenge gas to test sensor response. Do not create a fuel-vapor release for demonstration purposes. Run drills for a fixed gas alarm, an evacuation, an unexpected tank truck, a blocked route, a network outage, and a robot stranded near a restricted boundary.

Review patrol records with operators instead of judging the pilot by distance traveled. Useful evidence includes correctly located anomalies, alarm latency, missed observations, nuisance alarms, route interventions, failed missions, detector test records, and recovery events. The terminal should approve expansion one route state at a time.

How should operators buy and support the system?

Procurement should require the certification file, configuration control, detector specifications, calibration procedure, cybersecurity and communications architecture, emergency behavior matrix, route-control method, maintenance restrictions, change-management process, and evidence that replacement parts preserve the approved configuration. A security patrol robot rental or robot as a service agreement does not transfer the operator's responsibility for workplace safety.

Service Robot Co. acts as an OEM-neutral, full-service commercial robot integrator for US businesses. The team can compare equipment across manufacturers, conduct site assessment mapping, arrange financing or monthly payment programs, handle robot deployment and integration, train terminal personnel, and service deployed units through a nationwide US engineer network.

That one-vendor lifecycle is especially useful at hazardous sites, where an undocumented payload swap or field repair can affect certification. Service terms should define remote triage, on-site dispatch, detector support, spare-unit configuration, software change control, go-live support, and who authorizes a robot's return to service. The operating principle is simple: one partner, one number, and no ambiguity about ownership.