Buncefield - Ten Years On

11 December 2015 | Updated 01 January 1970

Ten years ago today, on the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol.

The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled.

The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels. Eventually large quantities of petrol overflowed from the top of the tank. A vapour cloud formed which ignited causing a massive explosion and a fire that lasted five days.

Maintenance failure

The gauge had stuck intermittently after the tank had been serviced in August 2005. However, neither site management nor the contractors who maintained the systems responded effectively to its obvious unreliability. The IHLS needed a padlock to retain its check lever in a working position. However, the switch supplier did not communicate this critical point to the installer and maintenance contractor or the site operator. Because of this lack of understanding, the padlock was not fitted.

Secondary containment

Having failed to contain the petrol, there was reliance on a bund retaining wall around the tank (secondary containment) and a system of drains and catchment areas (tertiary containment) to ensure that liquids could not be released to the environment. Both forms of containment failed. Pollutants from fuel and firefighting liquids leaked from the bund, flowed off site and entered the groundwater.

These containment systems were inadequately designed and maintained. Failures of design and maintenance in both overfill protection systems and liquid containment systems were the technical causes of the initial explosion and the seepage of pollutants to the environment in its aftermath. However, underlying these immediate failings lay root causes based in broader management failings:

? Management systems in place at HOSL relating to tank filling were both deficient and not properly followed, despite the fact that the systems were independently audited.

? Pressures on staff had been increasing before the incident. The site was fed by three pipelines, two of which control room staff had little control over in terms of flow rates and timing of receipt. This meant that staff did not have sufficient information easily available to them to manage precisely the storage of incoming fuel.

? Throughput had increased at the site. This put more pressure on site management and staff and further degraded their ability to monitor the receipt and storage of fuel. The pressure on staff was made worse by a lack of engineering support from Head Office. Cumulatively, these pressures created a culture where keeping the process operating was the primary focus and process safety did not get the attention, resources or priority that it required.

Read the full report by Clicking Here

Article written by Brian Shillibeer | Published 11 December 2015