Buncefield report root causes of incident
Buncefield report root causes of incident
2
LittleInch (Petroleum)
(OP)
I'm sure this has been reported on previously and there have been two voluminous reports issued.
However the root causes, both technical and in particular the serious safety management failings were not included due to ongoing criminal prosecutions in the UK. I think this was originally published in Feb 2011 after the cases concluded, but I didn't see it at that time. If this has been examined before, my apologies, but it's never too late to make a reminder for us all.
Whilst looking for something else, I came across the following http://www.hse.gov.uk/comah/buncefield/buncefield-...
Along with the Longford explosion in the Australia and Texas City, Buncefield showed yet again, that safety failings of management are a root cause of such incidents and still continue.
The report makes interesting reading both from a technical view and the management failings. The ultimate line of defence - the independent high level switch, needed a padlock to keep it in its operating condition and should only have been removed for test purposes. Unfortunately the manufacturers neglected to tell the installers and operators this and they thought it was the opposite or only for "security". Hence the padlock was never used and the switch was effectively disabled.
The tank gauges stuck on regular basis, but were just fixed as an ongoing issue which wasn't logged or reported, etc etc. Everyone was overworked, throughput was 4 times the original design and handover time from one supervisor to another was actually in their own time (!!). The supervisors had got used to big overtime cheques so resisted recruitment of another supervisor.
Most shocking for me was that the supervisors had no control over their incoming flow from other pipelines, no ESD button, no contact with the schedulers, no apparent contact with the upstream control rooms. One of my golden rules in design of pipeline systems is that the incoming recipient of product needs to have full independent control over the incoming systems not dependant on any other party.
The company officially operating the site was in essence a "shell" company which had a board (who met twice a year), but no employees and delegated all actions to the operating company.
All sounds too familiar?
Well worth 30 minutes reading IMHO.
LI
However the root causes, both technical and in particular the serious safety management failings were not included due to ongoing criminal prosecutions in the UK. I think this was originally published in Feb 2011 after the cases concluded, but I didn't see it at that time. If this has been examined before, my apologies, but it's never too late to make a reminder for us all.
Whilst looking for something else, I came across the following http://www.hse.gov.uk/comah/buncefield/buncefield-...
Along with the Longford explosion in the Australia and Texas City, Buncefield showed yet again, that safety failings of management are a root cause of such incidents and still continue.
The report makes interesting reading both from a technical view and the management failings. The ultimate line of defence - the independent high level switch, needed a padlock to keep it in its operating condition and should only have been removed for test purposes. Unfortunately the manufacturers neglected to tell the installers and operators this and they thought it was the opposite or only for "security". Hence the padlock was never used and the switch was effectively disabled.
The tank gauges stuck on regular basis, but were just fixed as an ongoing issue which wasn't logged or reported, etc etc. Everyone was overworked, throughput was 4 times the original design and handover time from one supervisor to another was actually in their own time (!!). The supervisors had got used to big overtime cheques so resisted recruitment of another supervisor.
Most shocking for me was that the supervisors had no control over their incoming flow from other pipelines, no ESD button, no contact with the schedulers, no apparent contact with the upstream control rooms. One of my golden rules in design of pipeline systems is that the incoming recipient of product needs to have full independent control over the incoming systems not dependant on any other party.
The company officially operating the site was in essence a "shell" company which had a board (who met twice a year), but no employees and delegated all actions to the operating company.
All sounds too familiar?
Well worth 30 minutes reading IMHO.
LI
Remember - More details = better answers
Also: If you get a response it's polite to respond to it.
Talk To Other Members
RE: Buncefield report root causes of incident
Lesson: you may be well down the contractual supply chain, if your procedures and instructions are found wanting then you will be liable.
RE: Buncefield report root causes of incident
No person went to jail.
Where is the incentive for people to change their future behavior?
Mike Halloran
Pembroke Pines, FL, USA
RE: Buncefield report root causes of incident
Mike, who do you think should have gone to jail?
Within Total/tank farm management, how far down the chain? Where the supervisors criminally neglectful in your opinion?
IMO someone in Total management had the duty of making sure the farm runs safely, this person neglected that duty.
Not sure about the supervisors, where they trained in all the safety aspects, should they have seen the things that went wrong? Is the pressure they operated under an excuse?
what about Moneywell and TAV?
I think within Moneywell someone knew that the tank farm had no real, reliable & redundant level gauging system. Did they inform Total of this fact? If not, is this criminal?
My thinking is this - for a criminal persecution there needs to be a specific deed (or rather a neglect) that you can tie to a person. In this case, whatever warrants criminal persecution had been going on for a long time before the fire and would be IMO ciminal regardless of an actual accident happeneing or not. IANAL, just trying to define what IMo would be 'fair' in such a case.
RE: Buncefield report root causes of incident
Dan - Owner
http://www.Hi-TecDesigns.com
RE: Buncefield report root causes of incident
The operations staff were simply concerned with keeping things running and not whether the process was correct, or safe.
The apparent reported lack of clear operating procedures and instructions is nothing short of criminal and I'm a little surprised they didn't find some senior person who should have been responsible for ensuring that these were in place. That might have promoted a bit more of a discussion about how the place was supposed to operate as to how they did it in practice and point out the shortfalls - in short a proper audit worth its proper name.
Lets not forget how big this fire was....
Remember - More details = better answers
Also: If you get a response it's polite to respond to it.
RE: Buncefield report root causes of incident
http://press.hse.gov.uk/2016/bulgarian-firm-fined-...
RE: Buncefield report root causes of incident
I was thinking that once I read the report and realized just how bad the safety management of the site was.
I suppose this reflects a little the miracle that no one was actually killed or, I believe, seriously injured, though many living locally still suffer mentally and I think they ended up with a big fight for adequate compensation.
Also perhaps some recognition that the companies had lost a significant amount of profit and lost a lot of capital equipment.
However a fine for the main companies of £50M wouldn't have been incorrect IMHO. Would make others look very seriously at doing things properly.
In the end unfortunately, only a serious dip in share price has any big impact - BP is still under the cosh now from the result of deepwater horizon and it is now appreciated in oil companies that a serious incident can impact company reputation and share price.
Remember - More details = better answers
Also: If you get a response it's polite to respond to it.
RE: Buncefield report root causes of incident
I passed the report link on to a client in the chemical industry - not a major hazard facility, but a growing chemical manufacturing business - and they have taken it seriously enough to initiate a wide-ranging review of their entire operations/procedures/communications/engineering set-up.
The links to the Longford incident were also extremely relevant, seeing as I & the client are located in Victoria, Australia, where this occurred (though I was actually living/working overseas when it happened.)
The major conclusion I think is that we engineers need somehow to convince the dollar-shufflers that we do actually know more about safety than they do.
RE: Buncefield report root causes of incident
The people running a plant will concentrate on getting their work done, not on safety. A few years back I saw an short article by some sociologists on industrial accidents to that effect, can't seem to find it now. I observe this sometimes in field staff but not always. So maybe in desiging plants we should make sure that there's at least one safety layer that does not get in the way of the actual work (or is impossible to circumvent).
I think it's clear from the report that the supervisors concentrated more on doing their job than ensuring plant safety, though it seems that they not so much circumvented/ignored safety features when they got in the way as that the safety was not working or designed rather badly.
RE: Buncefield report root causes of incident
Cameron paid 250MM in fines for Macondo, even though that all they did was supply the valve that failed ... due to the operator's improper maintenance.
Eventually every operating procedure breaks down due to one reason or another and it never astounds me that it is usually due to management's lack of general oversight, poor or outright incorrect maintenance, or operating procedures that were ignored, if not all the above. Relying on operating procedures and pseudo-engineered gimmick substitutes as a work around for failsafe design loses every time. If you can't engineer it failsafe ligitimately, change the design. If you can't do that, change the process (Bophal). If you can't do that, then don't do it in the first place.
I've removed more than my fair share of locked-closed relief valves in my time. Reason: "Makes too much noise when they're flowing."
RE: Buncefield report root causes of incident
My view has always been that Operators are great people and often do great work in trying situations, but in many places don't really understand the process or the whole aim of the system and often find "work arounds" for various situations or remove levels of safety without realizing it or just operate the plant in a different way than was envisaged, along with gradual changes in fluids, throughputs etc.
I've often felt every plant or terminal should have a re HAZOP every 5-10 years to get the operating practices understood and to see the global impact of all the little changes, even if these were the result of an MOC, you only tend to HAZOP the immediate bit which changes, not the entire plant.
Another one which comes to mind is where to reduce wastage, the process changed from rapid emptying of a knock out drum to a slops tank to a much slower pump out back into the vessels from which it has emerged.
As ever a series of events, but this caused the KO pot to overflow, liquid hit some corroded bends on the flare system and blew a huge hole in it. Consequential vapour cloud and the whole plant blew up. Point being that the change was managed, but because the review was limited to the immediate vessel, no one really saw the potential on the entire plant.
Remember - More details = better answers
Also: If you get a response it's polite to respond to it.
RE: Buncefield report root causes of incident
However, I couldn't quite get how in the world these outfits / companies / boards of mgrs. could run such a facility on their own, seemingly w/o any external supervision as from the gov. or regulation authority side, and also offside stringent standards.
In todays businesses, ISO 9001 or BS OHSAS 18001 and related certifications are something like the base chore to do if one wants to do any business at all (and to get a relevant insurance coverage). Or should be?
Any ISO / OHSAS certificate would imply audits and periodic re-audits, from people who are not "connected" to the business itself. Or should be.
If "parents" are liable for their "children", then it's ultimately strange that the "judgement" would appear rather as a containment,fading out the systematic violation of rules and rather blaming quote "slackness, inefficiency and a more-or-less complacent approach to matters of safety" unquote which seems a soft wording in the face of +100k t of fuel going boooom.
Does anyone know whether findings led to improvements, in this industry or others?
Roland Heilmann
Lpz FRG
RE: Buncefield report root causes of incident
Now whether any of this has permeated beyond the UK isn't know - hence my small attempt to bring it to a wider audience before we all forget.
Also some timelines and other data
http://www.hse.gov.uk/comah/buncefield/oneyear.htm
http://www.hse.gov.uk/comah/buncefield/bstg1.htm
http://ioshblog.tumblr.com/post/134974934955/bunce...
Remember - More details = better answers
Also: If you get a response it's polite to respond to it.
RE: Buncefield report root causes of incident
There's a pervasive view been stalking the corridors of Westminster for the last thirty years or so that Government regulation of anything is an evil to be rooted out with all the passion of the Spanish Inquisition.
Sometimes, that view promotes innovation. Sometimes there are tears before bedtime.
A.
RE: Buncefield report root causes of incident