Buncefield five years on. EuropeÆs largest peactime explosion
Buncefield five years on. EuropeÆs largest peactime explosion
(OP)
Buncefield five years on htt p://www.pr ofeng.com/ archive/20 10/2310/23 100052.htm
The autopsy of Europe's largest peactime explosion is still going on. What bones can the investigators still be picking over? By Ben Sampson
The essentials are well-known: the explosion at Buncefield fuel storage depot in Hemel Hempstead on 11 December 2005 measured 2.5 on the Richter scale. It was the largest explosion in peacetime Europe. The fire raged for five days and firefighters used virtually all the foam in the UK to extinguish it. The incident was caused by an overflowing petrol storage tank. Escaped petrol formed a mist-like petroleum vapour cloud which enveloped the site and ignited – with catastrophic consequences. The estimated cost of the damage is around £700 million.
Almost five years on and after numerous reports from a major investigations board, investigators are still unsure about some aspects of the explosion. Bob Woodward, HSE principal investigation lead for Buncefield, says: "The first question is why we got such a huge explosion. It's a big question that still hasn't been answered. The second question, that has been answered, is why did the tank overfill?"
Speaking at an IMechE lecture on the incident, Woodward's most obvious emotion is still relief. Had the accident taken place at almost any other time apart from 6am on a Sunday morning, there would have been multiple deaths. Tank explosions are rare but they're not uncommon. In a way, Hemel Hempstead was lucky.
The timetable of events that Sunday morning is straightforward. The fuel depot closed its gates at midnight on 10 December so the operators could take stock. The gates reopened at 4.30am to let the first petrol tankers through. The early morning is a busy period: tankers queue to fill up and leave before the motorways get busy. At 5.50am tanker drivers saw and smelled the petrol "mist" around the site. At 6.01am the explosion occurred.
Tank 912 was overflowing from 5.35am. It was one of three petrol tanks in a row, south of a larger tank containing aviation fuel. CCTV footage of the site has been recovered but the camera focused on tank 912 was not working at the time of the explosion.
Woodward describes the tank as "a typical design". It had a still well with temperature probes, a servo-level gauge, and a high-level alarm. The first fault was that the gauge stuck and said the tank was 85% full when it wasn't. The second fault was that the independent high-level alarm should have gone off between 5am and 5.20am but failed to operate and cut off the incoming petrol flow.
"The reason why the servo-gauge and high-level alarm and cut-off didn't come on aren't simple," says Woodward. "There are issues to do with the installation and maintenance. We issued a safety alert on the high-level alarm, where after it
is tested it can be put back into an inoperable position.
"None of the underlying issues is unique," he adds. "Around the engineering control and design and management there is nothing fundamentally new. You've heard it all before."
The servo-gauge failed on the day of the explosion and had failed before. Also just as crucial, Woodward says, is why the management systems behind that failed to alert the people that they had problems. Following the Buncefield explosion a number of precursors for major incidents have been identified – for example, minor losses of containment and missed inspections of safety-critical plant, deferred inspections, failures to conform to procedures, and the diminution of skilled or experienced staff.
At around 5.30am petrol began to flow out of eight vents on the conical top of tank 912. Around 250 tonnes of petrol flowed into the bund, a walled area around the tanks designed to trap escaped fuel. The top of the tank was designed to disperse water to cool it more effectively in the event of a fire. But this design characteristic actually caused petrol to flow over the edge of the tank at an angle and hit a girder on the way down. "Because of the design of the tank and the still morning you get a very good mixture of fuel and air, like a waterfall effect," says Woodward.
The combination of the waterfall effect mixing the petrol with the air, the temperature and the stillness allowed the petrol to form the vapour cloud
which dispersed around the site and eventually exploded.
For a long time there was confusion over where the primary point of ignition was. Investigators narrowed it down to an emergency generator in a hut or the fire pump house. But the HSE is now confident it was the latter. Woodward says: "When
he pushed the fire alarm, I think the operator unwittingly created a spark in the alarm's motor which started the explosion. But why we had such a severe explosion is still unanswered."
Engineers would normally not expect an explosion of this type to cause over-pressure of more than 50mbars. At Buncefield the over-pressure is estimated to have been between 1000 and 2000mbars. The complexities of the explosion mechanism are still not fully understood. There are theories and computer simulations have been carried out but none are entirely satisfactory, says Woodward.
The expectation was that any explosion at Buncefield would be confined and would certainly not be on the massive scale that was caused by the vapour cloud. This aspect of the explosion has had an impact on the advice HSE provides for land use planning around Comah (control of major accident hazards) sites. Radiating out from a Comah site are zones of hazard. Normally, if an explosion occurs where there is confinement, such as petrol storage tanks in a fuel depot, the outer consultation zone is where there is a risk of a fire spreading. Low-density industrial developments are allowed to be built in the consultation zone, the thinking being that such places can train workforces to respond correctly to a hazard such as a spreading fire.
If the sudden and severe Buncefield explosion had occurred while people were at work in the neighbouring buildings, there would have been multiple injuries. As a result of investigations, the HSE's guidelines for large-scale petrol sites there is now an additional consultation zone, 150m from the bunds of the storage tanks. The general policy for other Comah sites remains unchanged.
The HSE says there has also been an "enormous" amount of change at the 50 large-scale petroleum storage depots in the UK, with changes for fuel storage sites and clearer standards and guidance coming mainly from the recommendations of the major investigations board. Woodward says: "The HSE's advice beforehand was ambivalent. It left it very much to operators as to what system they use to keep the contents in. Now the gauging and containment system have to meet specific levels of integrity. Certainly that wasn't the way written advice from HSE was at the time."
A programme on how to move to those standards has been put in place. Overfill protection now has to be high integrity. All storage tanks have to meet SIL level 1 retrospectively. The integrity of the protective system, not the control system, has to be improved so the two systems cannot overlap. In other words operators cannot depend on level gauges to both control the tank and shut down the feed-in. The change is intended to avoid the kind of double failure that happened at Buncefield.
Large-scale petrol depots now have to have flammable gas detection systems and better engineering in the second and third containment systems (the bunds), which, at Buncefield, could not cope with the high temperature of the fire. The new standards also cover shift patterns, inspection and maintenance of systems, and a requirement to document the inspection and maintenance regime.
The guidelines have been published and operators are reviewing their sites and sending appraisals about how they meet the guidelines to the HSE. The deadline for those appraisals is in a few weeks and analysis of the information will let the HSE know the extent of the work that remains to be done, although it believes quite a few companies have already completed it.
HSE has also tried to up the profile of process safety and the significance of major hazard events since Buncefield. Awareness-raising initiatives such as "leading from the top" and "process safety leadership" have targeted senior management and business leaders. The main industry players have signed up but, the HSE admits, "there is a limit to what we can do".
Despite new regulations, guidelines and advice, the overriding lesson from Buncefield is that safety in organisations that deal with hazardous sites has to be paramount. Woodward says: "You need to ensure the softer side of the safety commitment is there in terms of reliability. It's not just the reliability of equipment, it's the reliability of human and organisational factors."
The autopsy of Europe's largest peactime explosion is still going on. What bones can the investigators still be picking over? By Ben Sampson
The essentials are well-known: the explosion at Buncefield fuel storage depot in Hemel Hempstead on 11 December 2005 measured 2.5 on the Richter scale. It was the largest explosion in peacetime Europe. The fire raged for five days and firefighters used virtually all the foam in the UK to extinguish it. The incident was caused by an overflowing petrol storage tank. Escaped petrol formed a mist-like petroleum vapour cloud which enveloped the site and ignited – with catastrophic consequences. The estimated cost of the damage is around £700 million.
Almost five years on and after numerous reports from a major investigations board, investigators are still unsure about some aspects of the explosion. Bob Woodward, HSE principal investigation lead for Buncefield, says: "The first question is why we got such a huge explosion. It's a big question that still hasn't been answered. The second question, that has been answered, is why did the tank overfill?"
Speaking at an IMechE lecture on the incident, Woodward's most obvious emotion is still relief. Had the accident taken place at almost any other time apart from 6am on a Sunday morning, there would have been multiple deaths. Tank explosions are rare but they're not uncommon. In a way, Hemel Hempstead was lucky.
The timetable of events that Sunday morning is straightforward. The fuel depot closed its gates at midnight on 10 December so the operators could take stock. The gates reopened at 4.30am to let the first petrol tankers through. The early morning is a busy period: tankers queue to fill up and leave before the motorways get busy. At 5.50am tanker drivers saw and smelled the petrol "mist" around the site. At 6.01am the explosion occurred.
Tank 912 was overflowing from 5.35am. It was one of three petrol tanks in a row, south of a larger tank containing aviation fuel. CCTV footage of the site has been recovered but the camera focused on tank 912 was not working at the time of the explosion.
Woodward describes the tank as "a typical design". It had a still well with temperature probes, a servo-level gauge, and a high-level alarm. The first fault was that the gauge stuck and said the tank was 85% full when it wasn't. The second fault was that the independent high-level alarm should have gone off between 5am and 5.20am but failed to operate and cut off the incoming petrol flow.
"The reason why the servo-gauge and high-level alarm and cut-off didn't come on aren't simple," says Woodward. "There are issues to do with the installation and maintenance. We issued a safety alert on the high-level alarm, where after it
is tested it can be put back into an inoperable position.
"None of the underlying issues is unique," he adds. "Around the engineering control and design and management there is nothing fundamentally new. You've heard it all before."
The servo-gauge failed on the day of the explosion and had failed before. Also just as crucial, Woodward says, is why the management systems behind that failed to alert the people that they had problems. Following the Buncefield explosion a number of precursors for major incidents have been identified – for example, minor losses of containment and missed inspections of safety-critical plant, deferred inspections, failures to conform to procedures, and the diminution of skilled or experienced staff.
At around 5.30am petrol began to flow out of eight vents on the conical top of tank 912. Around 250 tonnes of petrol flowed into the bund, a walled area around the tanks designed to trap escaped fuel. The top of the tank was designed to disperse water to cool it more effectively in the event of a fire. But this design characteristic actually caused petrol to flow over the edge of the tank at an angle and hit a girder on the way down. "Because of the design of the tank and the still morning you get a very good mixture of fuel and air, like a waterfall effect," says Woodward.
The combination of the waterfall effect mixing the petrol with the air, the temperature and the stillness allowed the petrol to form the vapour cloud
which dispersed around the site and eventually exploded.
For a long time there was confusion over where the primary point of ignition was. Investigators narrowed it down to an emergency generator in a hut or the fire pump house. But the HSE is now confident it was the latter. Woodward says: "When
he pushed the fire alarm, I think the operator unwittingly created a spark in the alarm's motor which started the explosion. But why we had such a severe explosion is still unanswered."
Engineers would normally not expect an explosion of this type to cause over-pressure of more than 50mbars. At Buncefield the over-pressure is estimated to have been between 1000 and 2000mbars. The complexities of the explosion mechanism are still not fully understood. There are theories and computer simulations have been carried out but none are entirely satisfactory, says Woodward.
The expectation was that any explosion at Buncefield would be confined and would certainly not be on the massive scale that was caused by the vapour cloud. This aspect of the explosion has had an impact on the advice HSE provides for land use planning around Comah (control of major accident hazards) sites. Radiating out from a Comah site are zones of hazard. Normally, if an explosion occurs where there is confinement, such as petrol storage tanks in a fuel depot, the outer consultation zone is where there is a risk of a fire spreading. Low-density industrial developments are allowed to be built in the consultation zone, the thinking being that such places can train workforces to respond correctly to a hazard such as a spreading fire.
If the sudden and severe Buncefield explosion had occurred while people were at work in the neighbouring buildings, there would have been multiple injuries. As a result of investigations, the HSE's guidelines for large-scale petrol sites there is now an additional consultation zone, 150m from the bunds of the storage tanks. The general policy for other Comah sites remains unchanged.
The HSE says there has also been an "enormous" amount of change at the 50 large-scale petroleum storage depots in the UK, with changes for fuel storage sites and clearer standards and guidance coming mainly from the recommendations of the major investigations board. Woodward says: "The HSE's advice beforehand was ambivalent. It left it very much to operators as to what system they use to keep the contents in. Now the gauging and containment system have to meet specific levels of integrity. Certainly that wasn't the way written advice from HSE was at the time."
A programme on how to move to those standards has been put in place. Overfill protection now has to be high integrity. All storage tanks have to meet SIL level 1 retrospectively. The integrity of the protective system, not the control system, has to be improved so the two systems cannot overlap. In other words operators cannot depend on level gauges to both control the tank and shut down the feed-in. The change is intended to avoid the kind of double failure that happened at Buncefield.
Large-scale petrol depots now have to have flammable gas detection systems and better engineering in the second and third containment systems (the bunds), which, at Buncefield, could not cope with the high temperature of the fire. The new standards also cover shift patterns, inspection and maintenance of systems, and a requirement to document the inspection and maintenance regime.
The guidelines have been published and operators are reviewing their sites and sending appraisals about how they meet the guidelines to the HSE. The deadline for those appraisals is in a few weeks and analysis of the information will let the HSE know the extent of the work that remains to be done, although it believes quite a few companies have already completed it.
HSE has also tried to up the profile of process safety and the significance of major hazard events since Buncefield. Awareness-raising initiatives such as "leading from the top" and "process safety leadership" have targeted senior management and business leaders. The main industry players have signed up but, the HSE admits, "there is a limit to what we can do".
Despite new regulations, guidelines and advice, the overriding lesson from Buncefield is that safety in organisations that deal with hazardous sites has to be paramount. Woodward says: "You need to ensure the softer side of the safety commitment is there in terms of reliability. It's not just the reliability of equipment, it's the reliability of human and organisational factors."





RE: Buncefield five years on. EuropeÆs largest peactime explosion
Whay changes to US regulations have been made as a result of this disaster ?
In five years....has there been any US regulatory changes made ?
Could somebody answer this question ?
-MJC
RE: Buncefield five years on. EuropeÆs largest peactime explosion
----------------------------------
If we learn from our mistakes I'm getting a great education!
RE: Buncefield five years on. EuropeÆs largest peactime explosion
All universities should incude a what went wrong " subject in their courses. Learn by the mistakes of others.