The Buncefield oil storage and transfer depot is a fuel storage site (a tank farm) in Hemel Hempstead, 25 miles northwest of London. It stores fuels and other products before they are transported to other facilities such as gasoline (petrol) stations or airports. Buncefield was the fifth largest of 108 oil storage sites across the UK.
In December 2005, the depot contained three sites with a total permitted storage capacity of about 200,000 tonnes of fuel.
At around 6:00 AM Sunday, 11 December 2005, explosions shook the area and were heard 125 miles away. Widespread damage occurred to neighboring properties. About 2,000 people were evacuated from their homes in a 1/2-mile radius from the site, 43 people were injured, but, miraculously, no one was killed. Sections of the M1 motorway were closed. The fire, resulting from an initial overspill of 300 tonnes of petrol from one of the storage tanks, burned for five days and destroyed most of Buncefield—22 tanks and 7 bunds were involved in the fire.
The overall cost of the Buncefield incident was estimated to be close to �1 billion ($1.5 billion), which is predominantly compensation claims against the site operators (over �600 million, $900 million). An estimated �200 million ($300 million) worth of fuel went up in flames. Although these seem like large numbers, they are not unusual compared with other major accidents.
Hertfordshire's Fire and Rescue Service was supported by 31 other Fire and Rescue Services. They used 68 million litres of water plus 786,000 litres of foam concentrate to bring the fire under control. Each minute 32,000 litres of foam mix was sprayed to "blanket" the fire.
Initial Events
Late on Saturday (10 December 2005) a delivery of unleaded petrol from a pipeline started to arrive at a tank located inside a large concrete bund. At about 5:30 the following morning, the safety systems that were to automatically shut off the supply of petrol to the tank to prevent overfilling failed to operate. Petrol overflowed and collected in the bund. As overfilling continued, the vapor cloud that formed by the mixture of petrol and air flowed over the bund wall, dispersed, and flowed west and offsite.
Although petrol will not easily explode, at about 6 am that Sunday the first of a series of explosions occurred, causing a huge fire that engulfed more than 20 large storage tanks. The main explosion at Buncefield was unusual because it generated much higher overpressure than would usually have been expected from a vapor cloud
explosion. The mechanism of the violent explosion is not fully understood.
Lack of Procedures
An important finding from the subsequent court case was the failure of head office staff to have an adequate system to prevent tank overfilling. No written tank-filling procedures were available for use in the control room even after a 2003 near miss when a tank gauge stuck. There also was a lack of careful monitoring of filling operations and over-reliance on alarms. To increase the effectiveness of preventing a hazard, facilities should employ multiple and independent controls such as alarms, monitoring, and procedures.
Similarities to Texas City Explosion
At the time that the UK HSE was writing the Buncefield report, the U.S. Chemical Safety Board (CSB) and the James Baker Panel were analyzing the Texas City, refinery explosion, which occurred nine months before Buncefield. Both incidents had loss of primary containment by overfilling of a vessel resulting in the formation of a large flammable vapor cloud that subsequently ignited.
Practical Lessons
- Prevent leaks
It is essential to ensure primary containment of the hazard—in this case gasoline (petrol). A good method to achieve this is to determine the criticality of protection systems then assess and improve the design against that criticality as needed (using SIL approach).
SIL (safety integrity level) is a measure of the safety system performance, in terms of the probability of failure on demand. There are four discrete integrity levels, SIL 1–4. The higher the SIL level, the higher the associated safety level and the lower the probability that a system will fail to perform properly.
- Don't rely on what WAS done; focus on how it SHOULD BE done
Use sound engineering design. Ensure that controls and alarms are installed, working, and properly maintained and calibrated. Institute written procedures. Reinforce written procedures with training, re-training, and regular safety meetings. Conduct risk assessments as needed (facility design, modifications, etc.) and institute recommendations.
As the Panel said in the Texas City report: “When people lose an appreciation of how their safety systems were intended to work, safety systems and controls can deteriorate, lessons can be forgotten, and hazards and deviations from safe operating procedures can be accepted. Workers and supervisors can increasingly rely on how things were done before, rather than rely on sound engineering principles and other controls.”
- Implement good procedures and use checklists
Implement robust procedures and policies for operation and maintenance. This includes identifying safety-critical equipment and systems, developing performance standards, and implementing a system to verify that they work as intended. The airline industry has been using checklists for years with good effect. We at IRC think hazardous facilities would benefit from checklists as well.
References
- BS EN 61511- Functional safety. Safety instrumented systems for the process industry sector. British Standards Institution
- Great Britain: Hertfordshire Fire and Rescue Service, Stationery Office. (2006) Buncefield: Hertfordshire Fire and Rescue Service's Review of the Fire Response. Hertfordshire, UK: The Stationery Office.
- All Buncefield tank fires extinguished. (13 December 2005) The Guardian. Online at http://www.guardian.co.uk/uk/2005/dec/13/buncefield Accessed 16 April 2009.
