When a lower tank is damaged, the incoming sea water pushes the oil in the damaged tank up into the ballast tank. Because of the hydrostatic pressure, there is an automatic transfer out of the damaged tank. The double-hull design is aimed at the probability of zero outflow.
