The Buncefield Oil Storage Terminal, situated outside the town of Hemel Hempstead just off the M1 motorway, handled around 2.37 million metric tonnes of oil products a year – mainly petrol, diesel and aviation fuel, delivered by tankers and pipeline. When disaster struck in the early hours of Sunday 11 December 2005, it unleashed what was to become the UK's biggest peacetime blaze.
Unleaded motor fuel was being pumped into storage tank 912 in the north-west corner of the Buncefield site. When capacity was reached, safeguards on the tank failed – automatic shutdown did not happen and fuel continued to be pumped in, unbeknownst to staff on duty. The overflow from the tank led to the rapid formation of a rich fuel and air vapour that thickened to about 2m and spread in all directions. After a series of explosions, a fire took hold, engulfing 20 large storage tanks. A massive firefighting effort got underway that lasted five days, with more than 40 people injured.
Five firms were ordered to pay almost £10m between them in combined fines and costs, with the vast majority falling on co-owner Total, £6.2m (for failing to protect workers and the public); Hertfordshire Oil Storage Limited (HOSL), £2.4m; and British Pipeline Agency Ltd, £780,000. When passing sentence on the defendants at St Albans Crown Court on 16 July 2010, the judge, the Hon Justice Calvert-Smith, pointed to a culture of “slackness, inefficiency and a more-or-less complacent approach to matters of safety”.
Tank 912 had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) that was meant to close down operations automatically if the tank was overfilled, according to the findings of the competent authority (primarily the Health and Safety Executive (HSE) and Environment Agency), following investigations into the incident. “The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels,” states the CA. “Eventually large quantities of petrol overflowed from the top of the tank.”
Apart from the switch and gauge issues, multiple failures in site management were also identified. HSE has pointed out that there was no adequate framework to set process safety indicators. “Had such a framework been in place, the measurement of a number of relatively simple indicators would have alerted management to the underlying problems that led to the incident.” Further, it comments, the safety management system in place focused too closely on personal safety and lacked any real depth about the control of major hazards, particularly in relation to primary containment.
Image credit: stock.adobe.com/Mark Robertson |
LESSONS & CHANGES
Almost 15 years on, what lessons have been learned and changes introduced? In the wake of Buncefield, the Major Incident Investigation Board (MIIB) released its report, ‘Recommendations on the design and operation of fuel storage sites’. This contained 25 proposals aimed at improving the design and operation of fuel storage sites, setting goals MIIB believed needed to be achieved to prevent another Buncefield-type incident from occurring. These guidelines still hold true, it points out, and include:
- There should be a clear understanding of major accident risks and the safety-critical equipment and systems designed to control them. This understanding should exist within organisations from the senior management down to the shopfloor, and it needs to exist between all organisations involved in supplying, installing, maintaining and operating these controls
- There should be systems and a culture in place to detect signals of failure in safety critical equipment and to respond to them quickly and effectively. In this case, there were clear signs that the equipment was not fit for purpose, but no one questioned why or what should be done about it, other than ensure a series of temporary fixes
- Time and resources for process safety should be made available. The pressures on staff and managers should be understood and managed, so that they have the capacity to apply procedures and systems essential for safe operation
- Once the above have been established: there should be effective auditing systems in place that test the quality of management systems and ensure these systems are actually being used on the ground and are effective.
An essential part of ensuring these 25 recommendations are absorbed and acted upon has been the emergence of the Process Safety Leadership Group (PSLG), a joint industry and regulators group whose mission has been to provide an effective framework for interaction between industry, trade unions and the CA, in which to jointly develop, progress and implement effective recommendations and practices that improve safety across industry.
HIGH STANDARDS ENSHRINED
Peter Davidson, executive director of the Tank Storage Association (TSA), points to how the set of core principles established by the PSLG has enshrined the high standards of leadership essential to ensure the effective control of major hazard risks. He also refers to the great deal of research since Buncefield that has focused on flammable vapour clouds, the way in which they can be formed and the substances that can form them.
Such investigations are ongoing, with the TSA (and its members) continually looking to review and refresh how it measures its safety performance and actively share lessons within its membership and with other sectors. “Leadership certainly continues to be a key focus, as it is vital for successful process safety,” says Davidson. “Accordingly, last year, The Year of Safety Leadership initiative was launched by the CA. Through the COMAH [Control of Major Accident Hazards Regulations 2015] Strategic Forum, the TSA has led on the publication of several key documents, including ‘Managing risk: the hazards that can destroy your business’, Good Safety Leadership [poster] and the soon to be released ‘Charter for Good Safety Leadership’.”
The TSA and other European bulk liquid storage sector trade associations are also working through the Federation of European Tank Storage Associations (FETSA) to help promote sharing and learning of knowledge and best practice more widely. For its part, FETSA works with regulators in what its executive director Ravi Bhatiani describes as “a constructive, evidence-based and collaborative spirit to ensure that safety and environmental measures are developed that best reflect the specificities and hazards present within our operations”. It also works with regulators to minimise product movements, as each movement has a risk attached. This means, for example, having efficient customs rules.
 “Testament to the priority we give to safety issues and the legacy of incidents, such as Buncefield, is a project our board has recently endorsed and that we are implementing dedicated to safety. This includes the collection of data, based on API RP 754 statistics, a standard model for reporting hydrocarbon ‘losses’, based on a T1-T4 scale of severity of the loss. We are developing a reporting format and template to be used across our membership – for example, across geographic Europe. The reporting will be done on an annual basis and it can be used internally by tank storage companies and associations to benchmark against other jurisdictions, for example,” Ravi Bhatiani, executive director, FETSA |
Finally, returning to the CA, its overriding message to come out of the Buncefield incident is this: “At the core of managing a major hazard should be clear and positive process safety leadership, with board-level involvement and competence to ensure that major hazard risks are being properly managed.”
It would be disingenuous to suggest similar occurrences to Buncefield might never happen again. Sadly, experience tells us there is every chance they will. The crucial factor is that all possible precautions have been taken, at every level, to try to prevent these events – and, should something go wrong, having the right systems and processes in place to contain and mitigate their impact.