buncefield report hse

8/11/2019 Buncefield Report HSE

1/36

Control of Major Accident Hazards

Buncefield: Why did it happen?Theunderlyingcausesoftheexplosionandfireatthe

Buncefieldoilstoragedepot,HemelHempstead,Hertfordshireon

11December2005

the Competent Authority


2/36

ContentsForeword 3

Executivesummary 4

Introduction 6

TheBuncefieldoilstoragedepot 7

Theincidentand itsaftermath 10

Rootcausesofthelossofcontainment 13

Theindependenthighlevelswitch 13

Theautomatictankgaugingsystem 14

Othershortcomings 14

Widerunderlyingcauses 16

Controlofincomingfuel 16

Increaseinthroughput 16

Tankfillingprocedures 17

Pressureofwork 18

Inadequatefaultlogging 19

MotherwellControlSystems 19

Lossofsecondarycontainment 21

Bundjoints 21

Tiebarholes 22

Pipepenetrations 22Tertiarycontainment 24

Emergencyarrangements 26

Safetymanagementsystems,managerialoversightandleadership 27

ManagementoftheHOSLsite 28

Conclusions 30

Appendix1Howtheindependenthighlevelswitch(IHLS)worked 32

Appendix2Outcomeofcriminalproceedings 34

Glossary 35

References 36

Buncefield:Whydidithappen? 2of36pages


3/36

ForewordTheMajorIncidentInvestigationBoard(MIIB)setuptoinvestigatetheBuncefield

explosionandfirecompleteditsworkin2008andpublisheditsfinalreport.

1

Atthattimeitwasnotpossibletodisclosealltheinformationabouttheunderlyingcausationupon

whichmanyofitsrecommendationswerebasedascriminallegalproceedingswere

stillinprogress.However,nowthattheseproceedingshaveconcluded,thisinformation

canbebroughttogethersothateveryoneinmajorhazardindustriesnotjustthose

involvedinfuelstoragecanlearnfromthisincident, understandwhatwentwrong,and

takeawaylessonsthatarerelevanttothem.Althoughfiveyearshavepassedsincethe

incident,theinformationandadviceinthisreportisstillhighlyrelevanttoday.

TheexplosionandfireattheBuncefieldoilstoragedepotin2005wasasignificantevent.

AspartoftheworkoftheMIIB,theHealthandSafetyExecutiveandtheEnvironment

Agency,astheCompetentAuthorityinEnglandandWalesfortheregulationofmajor

accidenthazards,carriedoutajointinvestigationintothecauseoftheincident.

TheCompetentAuthoritytookactiontoensurethatthoseresponsiblefortheincident

wereheldtoaccountinthecriminalcourts,andIemphasiseourdeterminationthat,

wherewethinkitappropriate,theCompetentAuthoritywillcontinuetotakethenecessary

actiontoensureoperatorsofmajorhazardsitesmanagethemproperly.Whenpassing

sentenceonthedefendantsatStAlbansCrownCourton16July2010,theJudge,the

HonMrJusticeCalvertSmith,commentedthatcostcuttingper se wasnotputforward

asamajorfeatureoftheprosecutioncase,butthefailingshadmoretodowithslackness,

inefficiencyandamoreorlesscomplacentapproachtomattersofsafety.

Ithereforeaskallinthemajorhazardindustriestolookcarefullyatyourownoperations

inthelightofthemanagementandtechnicalfailingsthatlaybehindthisincident,andthe

importantdevelopmentsinthemeantime.

Sincetheincident,theCompetentAuthority,industryandtradeunionshaveworked

togethertodriveforwardhighstandardsatfuelstoragesites.Thishasresultedin

agreementonimprovedstandardsofsafetyandenvironmentalprotectionforallUK

sitesstoringlargevolumesofgasolineandtosystematicallyupgradesitestomeetthese

standards,withprogressmonitoredbytheCompetentAuthorityaspartofitsregulatory

programmes.Thisworkhasalsoestablishedasetofprocesssafetyleadershipprinciples

fortoplevelengagementinallbusinessesinvolvedwithsignificantriskstopeopleand

theenvironmentseewww.hse.gov.uk/comah/buncefield/response.htm .

TheCompetentAuthorityhasalsoimproveditsapproachtoregulatingonshoremajor

hazardsinthelightoftenyearsofoperatingtheCOMAHregimeincludingincidentssuch

asBuncefield.MoreinformationontheCompetentAuthoritysremodellingprogrammeis

atwww.hse.gov.uk/comah/remodelling/index.htm .

MajorindustrialincidentsarethankfullyrareandItrustthisreportwillcontributeto

makingthemevenrarer.

Gordon MacDonald

ChairmanCompetent Authority Strategic Management Group

http://www.hse.gov.uk/comah/buncefield/response.htmhttp://www.hse.gov.uk/comah/remodelling/index.htmhttp://www.hse.gov.uk/comah/buncefield/response.htmhttp://www.hse.gov.uk/comah/remodelling/index.htm


4/36

Executive summaryOnthenightofSaturday10December2005,Tank912attheHertfordshireOil

StorageLimited(HOSL)partoftheBuncefieldoilstoragedepotwasfillingwithpetrol.Thetankhadtwoformsoflevelcontrol:agaugethatenabledtheemployeesto

monitorthefillingoperation;andanindependenthighlevelswitch(IHLS)whichwas

meanttoclosedownoperationsautomaticallyifthetankwasoverfilled.Thefirst

gaugestuckandtheIHLSwasinoperabletherewasthereforenomeanstoalert

thecontrolroomstaffthatthetankwasfillingtodangerouslevels.Eventuallylarge

quantitiesofpetroloverflowedfromthetopofthetank.Avapourcloudformedwhich

ignitedcausingamassiveexplosionandafirethatlastedfivedays.

ThegaugehadstuckintermittentlyafterthetankhadbeenservicedinAugust2005.

However,neithersitemanagementnorthecontractorswhomaintainedthesystems

respondedeffectivelytoitsobviousunreliability.TheIHLSneededapadlockto

retainitscheckleverinaworkingposition.However,theswitchsupplierdidnot

communicatethiscriticalpointtotheinstallerandmaintenancecontractororthesiteoperator.Becauseofthislackofunderstanding,thepadlockwasnotfitted.

Havingfailedtocontainthepetrol,therewasrelianceonabundretainingwall

aroundthetank(secondarycontainment)andasystemofdrainsandcatchment

areas(tertiarycontainment)toensurethatliquidscouldnotbereleasedtothe

environment.Bothformsofcontainmentfailed.Pollutantsfromfuelandfirefighting

liquidsleakedfromthebund,flowedoffsiteandenteredthegroundwater.These

containmentsystemswereinadequatelydesignedandmaintained.

Failuresofdesignandmaintenanceinbothoverfillprotectionsystemsandliquid

containmentsystemswerethetechnicalcausesoftheinitialexplosionandthe

seepageofpollutantstotheenvironmentinitsaftermath.However,underlyingtheseimmediatefailingslayrootcausesbasedinbroadermanagementfailings:

ManagementsystemsinplaceatHOSLrelatingtotankfillingwerebothdeficient

andnotproperlyfollowed,despitethefactthatthesystemswereindependently

audited.

Pressuresonstaffhadbeenincreasingbeforetheincident.Thesitewasfedby

threepipelines,twoofwhichcontrolroomstaffhadlittlecontroloverinterms

offlowratesandtimingofreceipt.Thismeantthatstaffdidnothavesufficient

informationeasilyavailabletothemtomanagepreciselythestorageofincoming

fuel.

Throughputhadincreasedatthesite.Thisputmorepressureonsite

managementandstaffandfurtherdegradedtheirabilitytomonitorthereceipt

andstorageoffuel.Thepressureonstaffwasmadeworsebyalackof

engineeringsupportfromHeadOffice.

Cumulatively,thesepressurescreatedaculturewherekeepingtheprocess

operatingwastheprimaryfocusandprocesssafetydidnotgettheattention,

resourcesorprioritythatitrequired.



5/36

Thisreportdoesnotidentifyanynewlearningaboutmajoraccidentprevention.

Ratheritservestoreinforcesomeimportantprocesssafetymanagementprinciples

thathavebeenknownforsometime:

There should be a clear understanding of major accident risks and thesafety critical equipment and systems designed to control them.

Thisunderstandingshouldexistwithinorganisationsfromtheseniormanagement

downtotheshopfloor,anditneedstoexistbetweenallorganisationsinvolvedin

supplying,installing,maintainingandoperatingthesecontrols.

There should be systems and a culture in place to detect signals of failure

in safety critical equipment and to respond to them quickly and effectively.

Inthiscase,therewereclearsignsthattheequipmentwasnotfitforpurposebut

noonequestionedwhy,orwhatshouldbedoneaboutitotherthanensureaseries

oftemporaryfixes.

Time and resources for process safety should be made available.

Thepressuresonstaffandmanagersshouldbeunderstoodandmanagedsothattheyhavethecapacitytoapplyproceduresandsystemsessentialforsafeoperation.

Oncealltheaboveareinplace:

There should be effective auditing systems in place which test the quality

of management systems and ensure that these systems are actually being

used on the ground and are effective.

At the core of managing a major hazard business should be clear and

positive process safety leadership with board-level involvement and

competence to ensure that major hazard risks are being properly managed.



6/36

Introduction1 FollowingtheexplosionandfireatBuncefieldinDecember2005theHealthand

SafetyCommissionsetupanindependentlychairedMajorIncidentInvestigationBoard(MIIB)ledbyLordNewtonofBraintree.TheBoardwasgivenawideranging

setofobjectiveswithinitstermsofreferenceandpublishedaseriesofeightreports

beforeitsfinalreportin2008.DetailsoftheBoardsworkanditsrecommendations

canbefoundatwww.buncefieldinvestigation.gov.uk.

2 LegalconstraintspreventedtheBoardfrompublishingcertaininformationabout

therootcausesoftheincidentwhilecriminalproceedingswereinprogress.These

proceedingshavenowconcludedandthisdocumentfillsthatgap.Itaddressesthe

rootcausesbehindthelossofcontainmentoffuelon11December2005.Itdraws

outthekeylessonsforthosemanaginghighhazardindustries.

3 ThispublicationisbasedontheworkoftheCOMAHCompetentAuthority

InvestigationTeamoverfouryearsofinvestigationandisasummaryoftheconclusions.Itwouldbeimpracticabletorepeatallthepainstakingworkupon

whichtheconclusionsarebased,muchofwhichformedtheevidenceinthe

criminaltrial.

http://www.buncefieldinvestigation.gov.uk/http://www.buncefieldinvestigation.gov.uk/


7/36

4

The Buncefield oil storage depotTheBuncefieldoilstorageandtransferdepotisatankfarminHemel

Hempstead,Hertfordshire,England,closetoJunction8oftheM1motorway.InDecember2005therewerethreeoperatingsitesatthedepot:

HertfordshireOilStorageLtd(HOSL),ajointventurebetweenTotalUKLtdand

ChevronLtdandunderthedaytodaymanagementofTotalUKLtd.HOSL(the

site)wasdividedintoEastandWestsites;

BritishPipelineAgencyLtd(BPA),ajointventurebetweenBPOilandShellOilUK,

thoughassetswereownedbyUKOilPipelinesLtd(UKOP).Thistankfarmwas

alsointwoparts,thenorthsectionandthemainsectionwhichwaslocated

betweenHOSLEastandWest;and

BPOilUKLtd,atthesouthernendofthedepot.

Figure 1AerialviewoftheBuncefielddepotbeforetheincidentChilternAirSupport

5 AllthreesitesweretoptiersitesundertheControlofMajorAccidentHazards

Regulations1999(COMAH).Intotalthedepothadhazardousplanningconsentto

store194000tonnesofhydrocarbonfuels.

6 Fuelwastransportedtothesesitesthroughthreepipelines:

theFinalinebetweenLindseyOilRefinery,HumbersideandtheHOSLWestsite;

UKOPNorthlinebetweenStanlowOilRefinery,MerseysideandBPA;and

UKOPSouthlinebetweenCorytonOilRefinery,EssexandBPA.



8/36

BoundaryWay

Three Cherry HOSL West Pumphouse Tank 12Trees Lane Lagoon Bund B

N

BoundaryWay

Cherry Tree Lane

Bund A12

915

MAYLANDS

912

910

913

914

911

Hogg EndLane

M1direction

INDUSTRIALESTATE Lagoons

loadinggantry

Bund C

BuncefieldLane

Hertfordshire OilStorage Ltd (West)

Hertfordshire OilStorage Ltd (East)

Shell UK Oil Ltduntil April 2003

BPOil UK Ltd

British PipelineAgency (South)

British PipelineAgency (North)

0 100 m 200 m

Figure 2ThelayoutoftheBuncefieldsite



9/36

7 Thepipelinesalltransportedfuelsinbatches.AtBuncefieldthevariousgrades

offuelwereseparatedintodedicatedtanksaccordingtothefueltype.Themajority

offuelwasthentakenfromthedepotbyroadtankers.JetaviationfuellefttheBPA

siteviatwopipelinestotheWestLondonWaltonGatwickpipelinesystemthen

distributedtoHeathrowandGatwickairports.

8 Thesitewasthereforeofstrategicimportanceforthedistributionoffuelsto

LondonandthesoutheastofEnglandandwasthefifthlargestfueldistributionsite

intheUK.

9 TheMaylandsIndustrialEstate,oneofthelargestinsoutheastEngland,is

immediatelytothewestoftheBuncefielddepot.

10 Thedepotissitedonavariablelayerofclaywithflints,2to10metresthick,

overtheUpperChalkstratum.TheUpperChalkisclassifiedasamajoraquifer

thatprovidesdrinkingwateraswellasotherusesincludingprivateabstractors,

agricultureandindustry.



10/36

The incident and its aftermath

HOSL West Lagoon Cherry Tree Farm Lagoon

Flow from site toHogg End Laneand M1

N

Pooled areas

Flowing

12

912

Bund A

Bund B

Figure 3 LayoutoftheBuncefieldsiteshowingflowofliquids

11 AparcelofunleadedpetrolwasbeingdeliveredthroughtheUKOPSouthlineinto

HOSLsTank912from1850hrsonSaturday10December2005.Thetank,which

hadacapacityof6millionlitres,wasfittedwithanautomatictankgaugingsystem

(ATG)whichmeasuredtherisingleveloffuelanddisplayedthisonascreeninthe

controlroom.At0305hrsonSunday11DecembertheATGdisplayflatlined,that

is,itstoppedregisteringtherisingleveloffuelinthetankalthoughthetankcontinued

tofill.ConsequentlythethreeATGalarms,theuserlevel,thehighlevelandthe

highhighlevel,couldnotoperateasthetankreadingwasalwaysbelowthesealarmlevels.Duetothepracticeofworkingtoalarmsinthecontrolroom,thecontrolroom

supervisorwasnotalertedtothefactthatthetankwasatriskofoverfilling.Thelevel

ofpetrolinthetankcontinuedtoriseunchecked.



11/36

12 Thetankwasalsofittedwithanindependenthighlevelswitch(IHLS)setat

ahigherlevelthantheATGalarms.Thiswasintendedtostopthefillingprocess

byautomaticallyclosingvalvesonanypipelinesimportingproduct,aswellas

soundinganaudiblealarmshouldthepetrolinthetankreachanunintendedhigh

level.TheIHLSalsofailedtoregistertherisinglevelofpetrol,sothefinalalarmdidnotsoundandtheautomaticshutdownwasnotactivated.By0537hrson

11December,thelevelwithinthetankexceededitsultimatecapacityandpetrol

startedtospilloutofventsinthetankroof.

13 CCTVevidenceshowedthatsoonafterthatawhitevapourwasseento

emanatefromthebundaroundthetank.Inthewindlessconditionsthisvapour

cloud,whichwaslikelytohavebeenamixtureofhydrocarbonsandicecrystals,

graduallyspreadtoadiameterofabout360metres,includingareasofftheHOSL

site.ThisincludedacarparkontheMaylandsEstate,andontotheBPAnorthsite

whereTank12,containingaviationkerosene,wassituated.

14 Thevapourcloudwasnoticedbymembersofthepublicoffsiteandbytanker

driversonsitewaitingtofilltheirvehicles.Theyalertedemployeesonsite.Thefirealarmbuttonwaspressedat0601hrs,whichsoundedthealarmandstartedthe

firewaterpump.Avapourcloudexplosionoccurredalmostimmediately,probably

ignitedbyasparkcausedbythefirewaterpumpstarting.Bythetimetheexplosion

occurred,over250000litresofpetrolhadescapedfromthetank.

Figure 4 FirefighterstackleablazingtankatBuncefieldHertfordshireCountyCouncil

15 Theseverityoftheexplosionwasfargreaterthancouldreasonablyhavebeen

anticipatedbasedonknowledgeatthetimeandtheconditionsatthesite.The

devastationwasenormous.Fortunatelytherewerenofatalitiesbutover40people

wereinjured.Theensuingfire,thelargestseeninpeacetimeUK,engulfedover

20fueltanksontheHOSLandadjacentsitesandburntforseveraldays.Fire

crewsattendedfrommanypartsofthecountry.Fuelandfirefightingchemicals

flowedfromleakingbundsdowndrainsandsoakaways,bothonandoffsite.The

environmental,socialandeconomictollwasconsiderable.Thehumantollshould

notbeunderestimated;whilenoonelosttheirlifesomehaveyettofullyrecover

fromtheeffectthattheexplosionhadontheirlives.Thehumaneffectsmayhave

beenevengreaterhadtheeventnotoccurredearlyonaSundaymorningwhenthe

adjacentindustrialareawasrelativelyquiet.



12/36

Figure 5 PartoftheBuncefielddepotaftertheincidentChilternAirSupport

Figure 6 Buncefieldaftertheincident:Tank912isinthecentreforegroundandTank12is

inthetopleftofthepictureChilternAirSupport

16 Thefirelastedfivedaysandlargequantitiesofwaterandfirefightingfoam

wereusedtobringtheblazeundercontrol.Fuel,waterandfoamspilledfrom

leakingbundsformedalargepoolofliquidtotheeastofBPATank12.Liquids

subsequentlyfloweddownCherryTreeLane,pasttheroundaboutintoHoggEnd

LaneandasfartheM1motorwaybridge,severalhundredmetresaway.

17 Theadjacentareacontainedanumberofdrainsandsoakawaysthatthesite

operatorshadnotidentifiedandliquidswereabletopenetrateintothesoilbeneath

them.ThepollutantsinthisliquidrunoffconsistedofPFOS(perfluorooctane

sulphonate)fromthefoam,andhydrocarbonssuchasbenzeneandxylene.These

pollutantshaveenteredthechalkstratumbelowthesitewhichisanaquiferfrom

whichpotablewaterisextracted.Thecontaminationclosetothesitedidnot

affectdrinkingwatersuppliesbutthelongtermpossibilityofpollutionremains.

TheEnvironmentAgencyhasamonitoringprogrammetocheckonthe levelofpollutantsintheaquifer.



13/36

Root causes of the loss of containment18 TheimmediatecauseofthismajorincidentwasthefailureofboththeATG

andtheIHLStooperateasthefuellevelinTank912increased.Thiswasalossofprimarycontainment.

19 Duringandfollowingthefirethereweresubsequentfailuresofsecondaryand

tertiarycontainment.Sowhatlaybehindtheimmediatecauseandsubsequent

failuresofcontainment?Inotherwords,whatintermsoftheoverallmanagement

ofoperationsatthishighhazardsiteledtothesefailures?What,intheprocesses

andsystems,failedtodeliverthenecessaryhighlevelofcontrolofsiteoperations?

Understandingtheserootcauseswillallowthosemanaginghighhazardindustries

tolearnfromtheexperienceofBuncefield.

The independent high-level switch

20 Tank912wasfittedwithanewindependenthighlevelswitchon1July2004.

Thishadbeendesigned,manufacturedandsuppliedbyTAVEngineeringLtd.TAV

haddesignedtheswitchsothatsomeofitsfunctionalitycouldberoutinelytested.

Unfortunately,thewaytheswitchwasdesigned,installedandmaintainedgavea

falsesenseofsecurity.Becausethosewhoinstalledandoperatedtheswitchdidnot

fullyunderstandthewayitworked,orthecrucialroleplayedbyapadlock,theswitch

waslefteffectivelyinoperableafterthetest.(AfullerdescriptionisinAppendix1.)

Designers of equipment for use in high-hazard operations should have

systems in place to ensure that the equipment is safe so far as is

reasonably practicable.

21 Thedesignfaultcouldhavebeeneradicatedatanearlystageifthedesign

changeshadbeensubjectedtoarigorousreviewprocess.Inanyevent,clear

guidance,includinginstructionsaboutthesafetycriticalityofthepadlock,should

havebeenpassedontoinstallersandusers.

22 TAVwasawarethatitsswitcheswereusedinhighhazardinstallationsand

thereforewerelikelytobesafetycritical.

Designers and suppliers should have adequate knowledge of the

environments where their equipment will be used.

23 Theimpactofthesedefectsinswitchdesign,andthefailuretoinformusers

andsuppliersofthechangeincriticalityofthepadlock,couldhavebeenreduced

bythosefurtherdownthesupplychain.MotherwellControlSystems2003Ltd

orderedtheIHLSfromTAVbuttheorderingprocessbybothpartiesfellshortof

whatwouldbeexpectedforsafetycriticalequipmentintendedforsuchahighhazard

environment.TheinformationTAVprovideddidnotgivesufficientclarityaboutthe

keyaspectsoftheIHLSdesignanduse,andTAVshouldhaveenquiredastothe

intendedpurposeoftheswitchandformedaviewastoitssuitabilityinthiscase

forahighlevelonlyapplication.Motherwellstaffwerehighlyexperiencedinthisfield

althoughthecompanyitselfhadonlyrecentlycomeintoexistenceastheresultof

amanagementbuyout.However,theirsystemsforcheckingandunderstanding

equipmentagainfellshortofthemark.



14/36

24 ItappearsthatnobodywithinMotherwellknewthesafetycriticalsignificance

ofthepadlock.TheIHLSonTank912wasinstalledwithoutthepadlockbecause

itseemsthatMotherwellstaffthoughtitwasforsecurityantitamperpurposes

only.Aftertheperiodictests,theleverwasleftunsecuredeitherintheinoperable

positionorsothatitcouldfallintothatposition.WhiletheyoughttohavebeenabletorelyonTAVtotellthem,Motherwellstaffequallyshouldhaveknownbetter.The

elementsofMotherwellsfailurewere:

Theprocessforascertainingandthenspecifyingtherequirementsofswitches

theysuppliedand/orinstalledwasnotadequate.

Theydidnotobtainthenecessarydatafromthemanufactureranditfollowsthat

theydidnotprovidesuchdatatotheircustomers.

Theydidnotunderstandthevulnerabilitiesoftheswitchorthefunctionofthe

padlock.

TherewasarelianceonTAV,whichwasnotjustifiedgiventhelackofinformation

providedandthecriticalrolethatMotherwellhadininstallingsafetycritical

equipment.

25 InadditiontothefailuresofthemanufacturersandinstallersoftheIHLS,the

siteoperatordidnotexercisesufficientoversightoftheordering,installationand

testingprocedure.Whiletheswitchwasperiodicallytested,noneofthestaffatthe

HOSLsitewasawareoftheneedforthepadlocktobereplacedsothatthetest

leverwasheldinthecorrectposition.Thesiteoperatorshouldhavehadgreater

oversightofsafetycriticaloperationsandequipmentsothattheyunderstoodfully

howitworked,particularlygiventheexpertiseavailablewithinlargeoilcompanies.

The automatic tank gauging system

26 FailureoftheATGsystemwastheotherimmediatecauseoftheincident.Theservogaugehadstuck(causingthelevelgaugetoflatline)andnotforthe

firsttime.Infactithadstuck14timesbetween31August2005,whenthetank

wasreturnedtoserviceaftermaintenance,and11December2005.Sometimes

supervisorsrectifiedthesymptomsofstickingbyraisingthegaugetoitshighest

positionthenlettingitsettleagain,apracticeknownasstowing.Onother

occasionsMotherwellwascalledintorectifythematter,althoughthedefinitive

causeofthestickingwasneverproperlyidentified.Sometimesthestickingwas

loggedasafaultbysupervisorsandothertimesitwasnot.

27 Thefailuretohaveaneffectivefaultloggingprocessandthelackofamaintenance

regimethatcouldreliablyrespondtothosefaultsweretwoofthemostimportantroot

causemanagerialandorganisationalfailuresunderlyingtheincident.Further,Motherwell

staffneversawthattheunreliablegaugeshouldbeinvestigated.Theydidnotanalyse

whytheyhadbeencalledoutsofrequentlynorquestionedthereliabilityofthesystem.

Other shortcomings

28 Thesystemalsohadothershortcomingsthatcouldfairlyeasilyhavebeen

remedied:

Monitoring screen

29 TherewasonlyonevisualdisplayscreenforthedataprovidedbytheATG

systemonanumberoftankswhichmeantthatthestatusofonlyonetankcould

befullyviewedatatime.OnthenightoftheincidentthedisplayrelatingtoTank912wasatornearthebackofastackoffourothertankdisplaywindows.

Onlyonecomputerwasprovided,withnobackup,toruntheentireATGsystem.

ThesupervisorsreliedheavilyontheATGsystemtocontroltankfillingsohavingno

backupforthiscriticalcontrolprocesswasinadvisable.



15/36

Redundant emergency shutdown

30 Thetankmimicsonthescreenshowedaredstopemergencyshutdown

button.Useofthiswasmeanttoclosealltanksidevalves.Unbeknowntoa

numberofthesupervisorsthiswasnotworkingandhadneverbeenfittedintothesystem.Haditworkeditmayhaveprovidedausefulemergencyprocedure

althoughitmayhavetakenseveralminutesforthevalvestoclose.Thisissue

isindicativeofpoormanagementcontrolwheresupervisorsdidnotappreciate

theredundancyofthestopbuttonandMotherwellstaffnevertestedit.This

meantthattherewasnoproactivefacilityonthesitetoclosedowntwo(UKOP)

ofthethreeincomingpipelines.TheFinalinehadanemergencyshutdownbutton

accessibleinthesitecontrolroom.

System security

31 Whilethereisnoindicationthatithadanybearingontheincident,thesecurity

arrangementsontheATGsystemwerelacking.Ithaditsownbuiltinsecurity

systembutthishadbeensetsothatallcontrolroomstaffcouldmodifyany

parameterincludingbeingabletochangethealarmsettings.

Alarm function

32 LaterversionsoftheATGsystemhadtheabilitytobesettoalarmintheevent

ofinconsistenciesbetweentanklevelmeasurementsandfillingdata,whichwould

haveprovidedawayofalertingcontrolroomstafftoanunexpectedstaticreading.

Hadsuchamodificationbeenmadethensupervisorsmayhavebeenmadeaware

ofthestickinggaugebeforeanoverfillpositionwasreached.Amorestringent

monitoringschemecouldhaveidentifiedtheshortcomingsandallowedthesite

operatortoupgradetheATGsystem.



16/36

Wider underlying causes33 ThestickinggaugeandinoperativeIHLSwerethetechnicalcausesofthe

overfillingofTank912,andwereaconsequenceoftheunderlyingmanagementfailuressetoutbelow.

Control of incoming fuel

34 Itisessentialtounderstandthesignificantdifferenceforthesupervisorsinthe

waytheycontrolledreceiptoffuelbatchesfromtheFinalineandthetwoUKOP

lines.TheFinalinewascontrolledbythesupervisors,whileforhistoricalreasonsthe

UKOPlineswerecontrolledfromelsewhere.

35 Therewasalsoastarkcontrastintheinformationavailabletothemaboutthe

threepipelines.ForthetwoUKOPlinestheHOSLsupervisorsdidnothaveaccess

totheSCADAmonitoringsystemstotellthem,independentlyoftheATGsystem:

whethertheUKOPlineswereonoroffline;and

ifonline,theflowrate.

36 IntheorytheUKOPflowratescouldbedeterminedfromthespeedatwhich

thetankwasfilling.Thiswasnotaneasytaskbecausetankscouldbefilling

fromthepipelinewhilesimultaneouslyfeedingthetankerbays.Morethanone

tankcouldbefillingatanyonetimeandflowrateswerelikelytovaryaccording

toexternalfactors.AdvanceplanningofdeliveriesfromtheUKOPlineswould

havebeendifficultandsometimeswellnighimpossible.Significantly,nosuitable

advanceplanningsystemwasinplace.Changesinflowratesweresignificantand

sometimestheHOSLsupervisorswerenotinformed.Forexample,shortlybeforetheexplosion,theflowrateintheUKOPSouthlinechangedfrom550m 3/hrto

900m3/hrwithouttheknowledgeofthesupervisors.

37 Thislackofinformationunderminedtheabilityofsupervisorstoplanand

controlthemanagementoffuel.Thiswasexacerbatedbyanunderstandingamong

staffthattheUKOPlineshadtobegivenpriorityovertheFinalineforfearofthesite

operatorincurringafinancialpenaltyiftheUKOPlineswereslowedorstopped.

38 AfurtherexampleoflackofcontrolovertheUKOPlineswasthattheonlyway

anemergencyshutdowncouldbeachievedwasby:

atelephonecalltoanotherterminal;

operationofanIHLS;or

activationofamanualcallpointontheadjacentBPAsite.

39 UnsurprisinglythislackofcontrolovertheUKOPlineswasunpopularwiththe

supervisors.Itcontributedtothepressureunderwhichsomeofthemfelttheyhad

tooperate.

40 Importantly,ControlRoomoperationsshouldhavebeensubjecttoarisk

assessmentbutnonehadbeencarriedout.

Increase in throughput

41 Sincetheearlydaysoftheterminalsoperationinthelate1960s,therehad

beenafourfoldincreaseinthroughputofproduct.Asignificantproportionofthis

increasehadoccurredwhentheadjacentShellterminalclosedin2002andits

throughputwasabsorbedintotheHOSLterminal.Thisledtoaninevitableincrease



17/36

inthenumberoftankerdriversandcontractorsonsite,whichclearlyaffectedthe

workloadofsupervisors.Theresultwasconsiderablepressureonullagespacewith

batchesdivertedbetweentankstopreventoverfilling.Thenecessaryullagewould

becomeavailablebyvirtueoftanksbeingemptiedthroughtankersattheloading

bays.

42 Thereisevidencetosuggestthatonthenightoftheincidentthesupervisors

wereconfusedastowhichpipelinewasfillingwhichtank.Largebatchesof

unleadedfuelwerebeingreceivedatsitefromboththeFinalineandtheUKOP

Southline.Thisconfusionarosebecauseofdeficienciesintheshifthandover

proceduresandtheoverlappingscreensontheATGsystem.Giventheincreased

pressurethatstaffwereunder,andlackofsufficientdatainthecontrolroom,such

confusioniseasilyunderstood.

43 Tomanagethepressures,staffwereworkingaconsiderableamountof

overtimewhichwascostly.Toovercomethismanagementtriedtorecruitafurther

supervisor.However,whenanewmemberofstaffwasrecruiteditwasimmediately

counterbalancedbytheresignationofanother.

Tank filling procedures

44 Thesupervisorsmaindutywasoperatingandmonitoringthecontrolsystems

relatingtomovementandstorageoffuel,includingcontroloftheFinaline.Akey

rolewasthefillingandemptyingoftanksatHOSL.TheATGsystemwascapable

ofprovidingsupervisorswithreadingsofanumberofparameters.Supervisors

viewedtheATGdataononescreenandcouldcallupscreenimages,oneontop

ofanother.Asnotedearlier,itwasnotpossibletoseethestatusofmorethan

onetankatanyonetime.Often,threeorfourwindowswouldbestackedon

thecomputerscreen,onebehindanother,sothatthesupervisorhadtomakeaconsciousdecisiontobringahiddenscreenintoview.Forlevelmeasurement

thesystemwasdesignedwithaseriesofaudibleandvisualalarmstoalertthe

supervisortotheneedtotakeactionatvariousproductlevelswithinthetank.

45 Essentiallytherewerethreehighlevelalarms.Thesewere:

theuserhighwhichcouldbesetbythesupervisortoindicatethatintervention

wasrequired;

thehighlevelsetatalevelinthetankbelowitsmaximumworkinglevel;and

thehighhighlevelsetbelowthelevelatwhichtheIHLSwasintendedto

operate.

46 Eachoftheeightsupervisorsusedthesealarmlevelsintheirownway.For

example,sometimesthelevelwasallowedtopassthehighlevelalarm.Less

frequently,pressureonstoragespacemeantthatthelevelwasallowedtoriseto

thehighhighalarmandonoccasionsbeyondeventhat.Thesupervisorsreliedon

thealarmstocontrolthefillingprocess.

47 Suchwrittenworkproceduresastherewererelatingtothefillingprocesswere

shortondetail.Theygavenoguidanceastohowtochoosethetankswhichhad

tobefilledorinwhatcircumstances,ifany,itwasappropriatetodeliberatelyfill

atankabovethehighorthehighhighlevel.Ifsuchaprocedurewasdeemedby

managementtobeappropriate,therewasnoguidancetosupportthis,iethere

wasnodescriptionof:

extrasafeguards;

reportingsuchevents;and

aneffectiveinvestigationofthecauseoftheevent.



18/36

48 Insummary,therewasnotankfillingsystemworthitsname.Considering

thatthiswasthesinglemostimportantprocesscontrolsystemtopreventlossof

containmentoffuel,thiswasaseriousmanagementfailureinthecontrolofamajor

accidenthazard.

49 Arobustsafesystemofworkshouldhavebeeninplacetoensurethatall

supervisorscontrolledtankfillinginaconsistent,safeway,andthatwhensituations

arosewhichrequiredthemtoworkoutsidethenormaloperatingenvelope,thiswas

recordedandreviewedbymanagement.

When situations arise requiring staff to work outside the normal operating

envelope they should be recorded and reviewed by management.

Pressure of work

50 Thetankfillingsystem,illdefinedasitwas,wasfurtherunderminedbytheunreliabilityofthewholeATGsystemasexemplifiedbythegaugessticking.

Supervisorsalsohadtodealwiththeirinabilitytopredicttheworkingparameters

oftheUKOPlinesandtheresultingunpredictablenatureoffueldeliveriesthrough

thoselines.Thesefactorswereinadditiontothepressureonthestoragecapacity

causedbyincreasedthroughputattheterminal.

51 Allthisaddeduptoasystemthatputsupervisorsunderconsiderablepressure.

Supervisorsdevelopedtheirownsystemstoovercomethis.Forexample,they

introducedasmallalarmclockintothecontrolroomandusedthistotrackproduct

interfacesontheFinalineandonoccasionsasanadditionalreminderthattanks

weregettingclosetotheirfullcapacity.Thelackofconfidenceinthesystemwas

alsodemonstratedwhenonesupervisoraskedforabackupIHLS,astheATGsystemwasbecomingunreliable.

52 Thispressurewasnothelpedbyworkingpatterns.Supervisorsworked

12hourshiftsandhadotherdutiesaswellastheconstantmonitoringofthefilling

andemptyingoftanks.Supervisorswereblockedtoworkfiveshiftsinarow,

whichwithovertimeworkingsometimesledto84hoursofworkinginaseven

dayperiod.Nofixedbreakswerescheduled;theytookabreakwhenoperating

conditionsallowed.Supervisorsworkedlargeamountsofovertimeandresistedthe

employmentofanadditionalsupervisorasthiswouldresultinalossofincome.

53 Managementfailedtorecognisetheseunacceptableworkingpressures,

althoughwhentheOperationsManagerofferedhisresignationshortlybeforethe

incidentbecauseofthepressurisedenvironmentthisshouldhaveconfirmedthatall

wasnotwell.

Management has a duty to monitor working pressures on staff and

take action to keep workloads to acceptable levels so far as reasonably

practicable.



19/36

Inadequate fault logging

54 TheinvestigationrevealedthatfaultloggingatHOSL,inrelationtokey

equipmentandworkingpractices,wasinadequate.Theshiftsystemofworking

ledtoshorttermapparentfixingofproblemswithnoproperoverviewofwhatwasgoingwrongandwhy.

55 Thehandovertime(overlap)forsupervisorsbetweenshiftswasshort.Itwasan

importanttimewhenoutgoingsupervisorscouldpassoninformationaboutevents

duringtheirshift.Theytriedtoallow15minutesforhandoverbutwereconscious

thattheywerenotbeingpaidfortheirtime.Thehandoverdocumentationwas

designedtocaptureinformationfortheFinalineonlyandinformationontheUKOP

lines,ifcapturedatall,wasonanadhocbasis.Italsoonlycapturedinformationat

theendoftheshiftratherthanrecordedincidentsthathappenedduringtheshift.

56 TheOperationsCoordinatorhaddevisedanelectronicdefectlogbutthe

supervisorsdidnotuseitproperly.WhiletheATGgaugeonTank912hadstuck

14timesduringthethreemonthsbeforetheincident,thiswasnotrecordedonthedefectslogandtheOperationsManagerwasunawareofthefrequencyoffailure.It

appearsthatthedefectloggingsystemwasnotconsistentlyused,especiallywhere

thesymptomsofadefectwereapparentlyremediedquickly,by,forexample,

stowingthegaugeoranearlyvisitfromMotherwell.Staffonsitewereunawareof

theextentoftheunreliabilityofsafetycriticalequipment,andtherewasnosystem

inplaceforseniormanagementtomonitorkeysafetyparameters.

57 TherewasasimilarsituationwiththeIHLS.Faultyproceduresandpractices

werenotproperlydealtwith.ThefailingsoftheATGsystemmeantthattherewas

greaterdependenceontheIHLS;astheIHLSwasfrequentlyleftinaninoperable

state,therewasgreaterrelianceontheATG.Thefactthatbothsystemscouldnot

berelieduponmeantthattheoverallcontrolofthetankfillingprocesswasseriouslyweakened.ManagementfailedtoscrutinisethecombinedunreliabilityoftheATG

systemandinoperableIHLS.

58 Forexample,bythefirstweekofApril2004itwasknownthattheIHLSon

Tank912wasnotworkingbutthetankremainedinuseandanewswitchwasnot

fitteduntil1July2004.Similarly,itwasfoundthatbeforethisTank911,averybusy

unleadedpetroltank,wasoperatingwithoutanIHLSforatleastninemonths.A

thoroughdefectloggingsystem,properlyscrutinisedbyseniormanagement,would

haverevealedtheseriousvulnerabilityoftheoverallsystem.

Management should have in place systems to monitor the reliability of

safety critical equipment.

Motherwell Control Systems

59 MotherwellControlSystemswasusedtosupplyandinstalltheIHLSandto

maintaintheATGsystem.Thiswasavitalcontractualrelationship.Itsimportancewas

underlinedinanindependentauditofthesite.Theauditreportin2004statedthat:

Contractcoordinatorsshouldbecompetenttoperformthefunction,and

theircompetencerequirementsshouldbelinkedtothecontractrisklevel.At

thelowerlevel,terminalstaffshouldbegiventrainingtobecomecompetent,

whereasitmaybenecessarytohireinspecialistsforhighriskcontracts.



20/36

60 ThecontractwithMotherwellwasclearlyasafetycriticalarrangementand

thecompetenceandtrainingofMotherwellstaffworkingwithcriticalequipment

shouldhavebeenevaluated.Thereappearstohavebeenlittleifanythingdonein

responsetothiscommentfromtheauditors.SomeinformationaboutMotherwell

wasobtainedbefore2000butthiswasbeforetheformationofanewcompanyMotherwellControlServices2003Ltd.WhileTotalhadacontractorsite

performanceevaluation,thiswasaboutpersonalprotectiononsiteandnotan

assessmentoftechnicalability.

61 Wherecontractorsareengagedtocarryoutworkuponwhichthesafety

ofmanyandmuchdepends,somethingmorerigorousthantheevidentcasual

relationshipwithMotherwellwascalledfor:

Thereshouldhavebeenaformalcontractinplaceclarifyingtheexpectations

inherentinsafetycriticalwork.

Thereshouldhavebeenaneffectivesystemofreportingandrecordingall

significantfaultsandtheirresolution.Thissystemshouldhavebeenunderstood

andimplementedbybothcontractualpartners. Reliableanduptodatespecificationsofwhatwasinplaceandwhatwas

requiredshouldhavebeenprovided.

Critically,inrespectofthereplacementoftheIHLSswitchesin2004,

thereshouldhavebeenaformalmanagementofchangeprocess.This

typicallywouldhaveincludedanengineeringassessmentofthebenefitsand

disadvantagesofanysuchchange,andaconsiderationofwhatchangesin

procedures(egintesting)wouldbenecessaryasaresult.

For high-hazard risks dutyholders should have formal arrangements that

specify the roles of all parties involved to ensure so far as is reasonably

practicable that the highest standards are provided for safety critical

equipment.



21/36

Loss of secondary containment62 ThebundingatBuncefieldhadmanyflaws,whichcausedlargevolumesoffuel,

foamandfirefightingwatertoleakoutofthebunds.Bundswerenotimpermeableandnotfireresistant.Thebundingwasunabletohandlethelargevolumesof

firewaterinvolvedintheincident.

63 Generally,theconcreteperformedwellinresistingtheburningfuelsbutthe

bundsfailedbadlyatthejointsandwallswherepipespenetratedthem.

Bund joints

Any concrete structure for retention of liquids should be designed to

minimise the risk of cracks forming. If cracks do form they should be

adequately repaired.

64 GuidanceonlimitingcrackingisgiveninBS81102 andBS80073 andoften

involvesincludingmovementjointsbetweenconcreteslabstoallowforexpansion

andcontraction.Jointdesigniscriticaltoensureliquidretentionwaterstops

inbundexpansionjointsarekeytotheirintegrityandperformanceincontaining

liquidsfollowingamajoraccident.Thejointsshouldalsobefireresistant,which

canbeachievedbyametalwaterstopandfireresistantsealants.TheBuncefield

incidentalsodemonstratedthatplacingmetalplatesovermovementjointswasan

effectivemeansofimprovingthefireresistanceofthejoint.Part4oftheProcess

SafetyLeadershipGroups(PSLGs)finalreport 4 providesfurtherdetailonthese

issues.

65 OneofthebundsatBuncefieldcontainedmetalwaterstopswithinjoints.

Eventhoughthisbundwasexposedtoabundpoolfireandtankfires,thejoints

performedwellanddidnotleaksignificantly.Otherbundshadplasticwaterstops

withmetalplatesovertheinsidefaceofthejoint.Thesejointsalsomaintainedtheir

integrityastheplasticwaterstopandotherjointmaterialwasprotectedfromthermal

impactbythemetalcoverplate.Onebund,whichwasnotexposedtofirebutused

tostoreliquidsduringtheresponse,leakedslightlyatjointswheretherewereno

waterstops,thoughithadbeenfittedwithmetalcoverplates.

66 WithintheHOSLsite,threebundsbundsA,BandCperformedparticularly

badly.Thejoints(floorandwalljoints)didnotcontainwaterstops.Duringthefire

thesealantandotherjointmaterials(whichwerenotfireresistant)werebadly

damaged.Manyofthejointsleakedallowingfuel,foamandfirewatertoflowonto

thesiteroadways.

67 HOSLcouldandshouldhaveidentified,beforetheincident,thatthebundswere

notfitforpurpose.AsatoptierCOMAHoperatorHOSLprovidedasafetyreport

inwhichcompliancewithindustrycodeswasasserted.IfHOSLhadreviewedthe

detaileddesignoftheirbundsduringthepreparationofthisreporttheywouldhave

identifiedthatthebundjointswerenotimpermeableandfireresistantasrequired

bythosecodes.Moreover,onoccasions,jointleakswereseenbystaffonsite.

LeakagesnotedbystaffinbundAhadnotbeenrepairedbythetimeoftheincident

andHOSLhadnotinvestigatedtherootcauseoftheseleaks.



22/36

68 TheBPATank12bundalsoleakedextensivelyatjoints.Thisbundwasbuilt

in2002,andtheoriginalspecificationsrequiredaliquidretainingstructure,citing

BS8007andthecivilengineeringspecificationforthewaterindustry. 5 However,

BPAfailedtomanagetheprojecttoensurethatchangesduringthedesignand

buildwereproperlyassessed.Waterstopswerenotfittedintothebundjoints.Asaresult(andaswithHOSLbundsAC)firedamagetothejointsallowedfuel,foam

andfirewatertoleakoutofthebund.Thisbundsufferedfurtherlossofintegritydue

topositioningofmovementjointsatshallow(obtuse)wallcorners.

Tie bar holes

69 AnotherfailuremodeoftheBPAbundwasintroducedattheconstruction

phase.Theshuttering(orformwork)usedtoholdtheconcreteinplacebeforeit

setwasheldinplaceusingtiebars(ortiebolts).Goodpracticerequireseitheruse

offormworktechniquesavoidingtieboltsoruseoftiebarwaterstops.TheBPA

bundwasconstructedwithtiebarspenetratingthroughthebundand,although

theywerepluggedandgrouted,theywereunabletoresisttheimpactofthefire.Holesopenedup,whichwerefurtherpathwaysforleakageoffuel,foamand

firewaterfromthebund.

Leak through tie bar hole

Figure 7Tank12aftertheincidentshowingliquidleakingthroughtiebarhole

Pipe penetrations

70 Goodpractice(Storage of flammable liquids in tanks HSG1766)states:

Theintegrityofthebundwallmaybeputatriskifpipeworkandother

equipmentareallowedtopenetrateit.Ifitisnecessarytopasspipes

throughthebundwall,forexampletothepump,thentheeffectonthe

structuralstrengthshouldbeassessed.Additionalmeasuresmaybe

neededtoensurethatthebundwallremainsliquidtight.

71 ManyoftheHOSLbundshadpipespenetratingthroughwallsandfloors,and

failuresatthesepointsmeantthebundscouldnolongerretainliquids.Broadly,

therewerethreewayslossofintegrityoccurred:

catastrophicfailureofthewallsatpipepenetrations,likelyduetothermal

expansionofthepipework;



23/36

Figure 8 Catastrophicbundwallfailureatpipepenetrations

someoftheproductpipesleadingfromthetanksrupturedandleakedsothat

therewasanescapeoffuelviadamagedpipesthroughthewallsandoutof

pipesinunbundedareas;and

lossofsealbetweenpipesandwalls.

Figure 9 Lossofsealantbetweenpenetratingpipeandbundwall

72 Buncefieldalsohighlightedseriousconcernsaboutbundingarrangementsfor

managingfirewater.Ifbundsfilltothepointofoverflowingthenburningfuel(which

floatsonwater)canescapeoverthetopofabund.AtBuncefieldremovalofwater

fromthebundswasdifficultbecausedrainagevalveswereinaccessibleandthere

wasnopumpingfrominterceptorsduetothesitewidelossofpower.Intheevent

onlyonebundovertoppedbecausethefailuressetoutabovemeantotherbunds

leakedratherthanfilled.Thisleadstoconsiderationoftertiarycontainment.



24/36

Tertiary containment

73 AtBuncefieldtherewasvirtuallynotertiarycontainmentinplace.Containment

systemsoutsidethebundingamountedonlytothesitesdrainagesystems,

designedforrainwaterandminorspillsandlossesofproduct,whichwouldflowtointerceptorsandthesiteseffluenttreatmentplant.Thedrainagewasnotdesigned

foranylargescalereleasesfrombunds,suchasthosethatoccurred.

74 Specificflawsincluded:

Therewasnokerbingorboundarywall/moundtokeepliquidsonsiteanddirect

themintodrainagesystems.Oncereleased,liquidscouldflowanywhere.

Figure 10 Fuelandfirefightingliquidsflowedoffsite

Thecapacityofthedrainsandthelagoonwastoosmall.

Someofthedrainswereperforatedsothatabackupofliquidswouldcause

theirreleasethroughundergroundperforations.

Thelinerofthefirewaterlagoonwassusceptibletofiredamageandtodamage

fromdebrisfromtheexplosion.

Figure 11ThefirewaterlagoonontheHOSLsiteaftertheincident



25/36

TheHOSLWestlagoonwasintendedasafirewatersupply,butwasrendered

uselessasitreceivedfueldrainingfromthesite.Itfloodedthefiresystempump

housewhenitoverflowed.

Therewasadependenceonpumpingliquids,whichasaprocessisvulnerable

to,forexample:inadequatepumpingcapacity;

failureofpumpsonlossofpower;and

inabilitytousepumpsfollowingreleaseofflammablevapour.

Someareasofunmadegroundwerenotprotectedfromliquidsandonesuch

areaofthesiteincludedasoakaway.

Theeffluenttreatmentplantincludedsoakawaysthatwerenotidentifiedinthe

safetyreportsoremergencyplans.

75 Collectivelytheseflawsallowedlargevolumesoffuel,foamandfirewaterto

leavethesite.

Where appropriate tertiary containment should be provided to ensure that

in the event of a spillage of hazardous liquids, such as fuel or fire run-off

water, these are contained and pollution is prevented.



26/36

Emergency arrangements76 OneofthefundamentalobjectivesoftheCOMAHRegulationsistoensure

adequateemergencyarrangementsareinplacebeforeanincidentoccurs.

The assessment of risks posed by a site should provide the necessary

foresight to develop response plans. For environmental protection, risk

assessments should identify, for credible accident scenarios, all on- and

off-site pathways to environmental receptors so that measures to reduce

environmental impact can be planned, implemented, maintained and

exercised.

77 ManylessonshavebeenhighlightedfollowingBuncefieldincluding:

Riskassessmentsshouldadequatelyreflectpotentialworstcasescenarios

involvingmultipletank/bundfireandlargevolumesoffirewaterrunoff.Toinformincidentresponsestrategy,operatorsshouldassesstheconsequences

ofvariousfirefightingdecisions(egcontrolledburnversusextinguishment).

Uptodatedrainageplansforareasonandoffsiteshouldbereadily

availabletoemergencyrespondersbeforeandduringanincident(toinclude

topographicaldetailforsurfaceflowsandsubsurfacedrainagefeatures).The

HOSLWestsitehaddrainageandasoakawaythatwerenotfeaturedon

currentplansbutwereshownonoldercompanyplans.NeitherHOSLnorBPA

hadidentifiedthepresenceoftwosoakawaysinadipinCherryTreeLane,

locatedbetweenHOSLWestandtheBPATank12site.Thesewerediscovered

duringtheinvestigationandwerefoundtocontaincontaminatedliquids

drainingintothegroundandtheunderlyingaquifer.Hadtheybeenidentified

beforetheincidentthenmeasurescouldhavebeentakentoremoveorprotectthesepathways.

Contractsforspillresponseneedtobeinplacebeforeincidentsoccur.As

highlightedinguidanceonemergencyplanningforCOMAH(Emergency

planning for major accidentsHSG1917)theadministrativestructuresand

arrangementsneedtobeinplacetofacilitaterapidcleanupincaseitisneeded

afteranincident.Foroilspills,thisincludesuseofoilspillrespondersaccredited

undertheUKSpillscheme.Thoserespondersshouldbeinvolvedinplanning

andexercisingarrangementsforspillresponse.TheUKSpillContractors

AccreditationSchemehasreplacedtheBritishOilSpillControlAgency

accreditation(seewww.spillonline.org/).

Procedures(egriskassessmentsandmethodstatements)shouldbeprepared,

agreedandtestedbeforeanincident.Thiswillenabletheappropriate

emergencyresponseactionstoberesourcedandavailable.Measurestoprotect

theenvironmentshouldnotconflictwithmeasurestoprotecthumanhealth.

Lackofadvanceplanningmaydelaymitigationofenvironmentalimpact(see

HSG191).

78 MoreguidanceontheseissuescanbefoundinthePSLGfinalreport.

http:///reader/full/www.spillonline.orghttp:///reader/full/www.spillonline.org


27/36

Safety management systems, managerialoversight and leadership

79 SafetymanagementsystemsattheHOSLsitewereembeddedinthesafety

reportthatisrequiredtobeproducedforatoptierCOMAHsite.Thesafety

reportwasthereforeavehicleinwhichHOSLcould,andindeeddid,setouttheir

principlesformanagingthemajorhazardaspectsoftheiroperations.However,

whatwassetoutinthedocumentandthesafetymanagementsystemsdidnot

reflectwhatactuallywentonatthesite.Forexample,acriticalpartslistwas

requiredformaintenanceandwasstatedtohavebeencriticallyreviewedasaresult

ofriskassessment.Inrealitythelistwasputtogetherwithoutanyfundamental

rationale.Thesafetyreportrequiredamanagementofchangeexerciseforreplacing

criticalequipmentbutnosuchprocedurewasconsideredwhentheIHLSon

Tank912wasreplacedin2004.

80 ThelossofsecondaryandtertiarycontainmentatboththeHOSLandBPA

sitescanalsobetracedbacktofailingsintherespectivesafetymanagement

systems.ThebundingfailuresfoundatBuncefieldresultedfromseveralunderlying

rootcauseswithinthesafetymanagementsystem.

Bunds should be treated as safety critical equipment. They should be

designed, built, operated, inspected and maintained to ensure that they

remain fit for their containment purpose.

81 AtBuncefield,theoperatorsmanagementsystemswereinadequateinseveral

respects:

Riskassessmentsdidnotconsidertheimplicationsofmorethanonetankbeing

onfire.Theydidnotassessreleaseoflargevolumesoffuelandfirewateras

mightoccurfollowingexplosionand/orescalationscenariosknowntothesite

operatorbeforetheincident.Theriskassessmentsalsofailedtoconsiderthat

bundsmightfailstructurally(egduetoimpactoffire)aswellastheircapacity

beingexceeded.

Systemsforcontrolofcontractors(includingthosedesigningandconstructing

bunds)didnotensurebundingworkwasinaccordancewithgoodpractice.

Managementofchangeprocedureswerenotadequatelyappliedtobund

projects.Changesduringdesignandconstructionwerenotreviewedintermsof

impactontheabilityofthebundtoretainliquidsduringanincident.

Bundswerenotsubjecttoanadequateinspectionandmaintenanceregime.

Therewasnoperiodicreviewofthebundscharacteristicscomparedtoupto-

datestandardsandguidance.(Thisisonepurposeofsafetyreports.)

Bundfailureswerenottreatedasnearmisses.Thiswouldhavetriggeredan

investigationoftherootcauseofthosefailuresandenabledcorrectiveactionsto

beimplemented.

82 Collectively,thesefailingsrepresentmanymissedopportunitiesforthe

operatorstoensurebetterbundingarrangements.



28/36

Management of the HOSL site

83 DaytodayoperationsoftheHOSLsitewereundertakenandmanaged

byTotalthroughTotalemployees.Therefore,itwasincumbentuponTotal

managementtoprovidethedaytodaysupportforitsstaff.TheoverallresponsibilityformanagerialoversightoftheHOSLsiteremainedwithHOSLthe

companyastheoperatorundertheCOMAHRegulations.AlthoughHOSLcould

choosehowitdischargeditsCOMAHfunction,itcouldnotdelegateitsobligations

asoperator.

84 TotalHeadOfficeinWatfordhadconsiderableinfluenceoversystemsofwork

oftheHOSLsiteandwassupposedtoprovidethenecessaryengineeringsupport

andotherexpertise.Inrealitythatsupportwaslacking.BoththeOperations

ManagerandtheTerminalCoordinatorhadtoomuchtodo.Thelatterwas

giveninsufficientdirectiononhowtoprioritiseandhadinsufficientexpertiseand

resourcestocopewiththedutiesplaceduponhim.Inparticular,hewasgivenlittle

helpinimplementingthesafetymanagementsystem.

85 TheLossControlManualwashandeddowntothesitebyWatfordHeadOffice.

HadthesystemswithintheLossControlManualactuallybeenimplemented,the

Buncefieldincidentmaywellhavenotoccurred.Amorethoroughscrutinyofactual

practiceswouldhaveuncoveredthisdiscrepancyandindeedsuchanapproachis

vitalfortherigorousmanagementofmajorhazards.

86 Forexample,therewasarequirementwithintheManualtoprovidealistof

safetycriticalparts.Norealguidanceandresourceswereprovidedtoachievethis

objective.Theresultinglistwasinaccurateandcouldnotbeusedasaneffective

toolformaintainingvitalsafetyrelatedequipment.

87 Thelackofacriticalpartslistwasanexampleofthepoorfocusonmajorhazardsystemsandplant.AttheHOSLsitetherewasnoadequateframework

tosetprocesssafetyindicators.Hadsuchaframeworkbeeninplace,the

measurementofanumberofrelativelysimpleindicatorswouldhavealerted

managementtotheunderlyingproblemsthatledtotheincident.

88 Further,thesafetymanagementsystemfocusedtoocloselyonpersonalsafety

andlackedanyrealdepthaboutthecontrolofmajorhazards,particularlyinrelation

toprimarycontainment.

Good process safety management does not happen by chance and

requires constant active engagement. Safety management systems at

COMAH sites should specifically focus on major hazard risks and ensurethat appropriate process safety indicators are used and maintained.

89 ForthepurposesoftheCOMAHRegulations,HertfordshireOilStorageLtd

wastheoperatoroftheHOSLsites.HOSLwasresponsibleforthepreparationand

submissionoftheCOMAHsafetyreport.HOSLhadaboardofdirectorsbutno

employees,achallengingsetupforacompanywhoseresponsibilitiesincludedthe

controlofamajorhazardsite.

90 Thesafetyreportwaspreparedbyacontractor,butneverscrutinisedby

theHOSLBoard.InfacttheHOSLBoardmetonlytwiceayearandwerekept

informedofhealth,safetyandenvironmentalissuesbytheTerminalManager.Such

ahandsoffapproachwasclearlyinsufficientoversighttoachievethestringentmanagerialframeworkrequiredforthecontrolofamajorhazardsite.AswithTotal,

itresultedinanunjustifiedconfidenceinthesafetyandenvironmentalperformance

ofthesite.Amongotherthings,itledtothedelayinemployinganinthsupervisor



29/36

andthefailuretoprovidefinancefortertiarybunding.HadtheBoardtakena

moredetailedinterestinoperationalsafety,theymaywellhaverealisedthesafety

implicationsofsanctioninganadditionalsupervisor.Similarly,agreaterinterestin

thesafetyreportwouldhaveallowedthemtoseethatsomeaspectsofthereport

wereaspirational,ratherthanatruereflectionofconditionsonsite.

91 Insummary:

theBoardofHOSLdidnotgraspitsCOMAHresponsibilities;and

theHOSLjointventuredidnoteffectivelymanagemajorhazards.Itappeared

moreofaconvenienceforthefinancialmanagementoftheventure.

Clear and positive process safety leadership is at the core of a major

hazard business and is vital to ensure that risks are effectively managed.

It requires board-level involvement and competence. Board-level visibility

and promotion of process safety leadership is also essential to set a

positive safety culture throughout an organisation.



30/36

Conclusion92 Adetailedinvestigationintoamajorincidentprovidesauniqueopportunityfor

theregulatortoassessthefullmanagerialprocessesinvolvedataparticularsite.Itisthereforeimportant,whensuchopportunitiesarise,thatthelessonsarelearnt.

IntheBuncefieldincident,thestoryofthestickinggaugesandtheinoperable

highlevelswitchtellsusabouttheimmediate(technical)causesoftheincident.

However,theunderlyingmanagerialfailuresbyotherswereequallyimportantand

havewiderimplicationsacrossallmajorhazardindustries.Thesemanagerialfailures

encompassthecauseofanincidentandthemitigationprocesses.Astudyofthese

underlyingcausesandmanagementfailingsreinforcestherecommendationsmade

bytheMIIBbutitisworthaddingemphasistocertainissues.

93 InrelationtotheBuncefieldincident:

theprocesssafetycontrolsonsafetycriticaloperationswerenotmaintainedto

thehigheststandard; seniormanagersdidnotapplyeffectivecontrol;

effectiveauditingsystemswerenotinplace.Auditingandmonitoring

arrangementsfocusedonwhetherasystemwasinplace;theauditsdidnottest

thequalityofthesystemsand,mostimportantly,didnotcheckwhetherthey

werebeingusedorwereeffective.

94 Secondly,theBuncefieldincidenthasshownthatthehighstandardsexpected

ofoperatorsofsafetycriticalequipmentapplyequallytoallthoseinvolvedinthe

supplyofthatequipment.AtBuncefieldthedesigners,manufacturers,installers

andthoseinvolvedinmaintenancedidnothaveanadequateknowledgeofthe

environmentinwhichtheequipmentwastobeused.Theywereunabletomake

therightdecisionsaboutthestandardstheyneededtoapplytotheirwork.Tosummarise,thedesign,installationandmaintenanceofsafetycriticalequipment

wasjustasimportantastheoperationalprocesscontrols.

95 Giventhattherelationshipbetweentheoperatoranditscontractorsinthis

contextissoimportant,itfollowsthattheoperatorshouldnothavetakenthework

oftheircontractorsforgranted.HOSLdidnotactasanintelligentcustomerand

couldnotbeassuredoftheservicetheywereobtainingfromtheircontractors.

Theydidnotprovidethenecessaryexpertiseoradequateresourcestoachieve

this.Asafetyreportisnotachoretosatisfytheregulator.Inpreparingitssafety

reportHOSLmissedanidealopportunitytolookcriticallyatitsownsystemsand

managerialarrangementsintendedtopreventmajoraccidentsandlimittheir

consequencestopersonsandtheenvironment(COMAHregulation4).

96 Allmajorhazardsitesareunique,buttherearemanycommonthreadstothe

managementofthem.Manyoftheimportantfactorsarediscussedinthisdocument.

Theywarrantcarefulconsiderationbythewholeofthemajorhazardsector.

97 ThetypesofmanagerialfailingsrevealedduringtheBuncefieldinvestigation

wereoftenfoundatothermajorincidents.Thereportonthegasexplosion

atLongford,Australiain1998( Lessons from Longford: The Esso Gas Plant

Explosion8)identifiedfactorsassociatedwiththeincidentwhichwerealsopresent

atBuncefield.Forexample:

poorcommunicationsatshifthandover;

lackofengineeringexpertiseonsite;and failuretoimplementmanagementofchangeprocesses.



31/36

98 Equally,someofthefailingsidentifiedatBuncefieldwerealsoidentified

byBaker9 inhisreportontheexplosionandfireattheTexasCityRefineryin

March2005.Bakersreportdrewoutfindingsofasimilarnature.Inbothcases

managementfailedtoaddresssafetycriticalprocesscontrols.

99 TheBakerreportemphasisedthatprocesssafetyprotectionsystemsshould

notrelyonoperatorresponsetoalarmsandthatoverfillprotectionshouldbe

independentofnormaloperationalmonitoring.Thatlessonagainmustbedrawn

fromtheBuncefieldincident.Further,bothBakerandtheMIIBsuggestthat

leadershipandtoplevelengagementindealingwithsignificantriskstopeopleand

theenvironmentinthisindustrialsectorwaslacking.

100 TheBuncefieldexplosionwasthereforefurtherevidencethatthemajor

hazardindustrieshadstillnottakenonboardvitallessons.Thisdocumentaims

toreinforcepreviousfindingsandservesasafurtherstimulustoimprovements

inprocesssafetyleadership;health,safetyandenvironmentalmanagement;and

controlofmajoraccidenthazards.



32/36

Appendix 1 How the independent high-levelswitch (IHLS) worked

Figure 12TheworkingprinciplesoftheIHLS

1 Theswitchworkedieactivatedthealarmcircuitwhenthefloatinginternal

deck(lid)contactedandraisedtheinternalsuspendedweight.Thisinturnraiseda

magnetwhichactivatedareedswitch.

2 Thecheckleverallowedtheswitchandthealarmcircuittobeactivated

independentlyofthemovementofthefloatinglid.Ineffectthecheckingaction

simulatedexactlywhatshouldhappenifthefloatinglidarrivedatthatpoint.

3 Therewerethreepositionsforthelever.Thehorizontalpositionwasthenormal

operatingposition.Inthispositiontheswitchoperatesasexpected,ieifthefloating

lidliftstheweight,sothatitisnolongerhangingfromtheswitch,thereedswitch

changesstateandthisinitiatesanemergencyshutdown.TheIHLSinstalledin

Tank912wasdesignedsothatapadlockshouldbeusedtosecuretheleverinthehorizontalposition.



33/36

4 Tocarryoutthetest,thepadlockwouldberemovedandtheleverraisedtothe

upperposition.Thealarmcircuitwouldbeactivatedeventhoughtheweighthad

notbeenliftedbythefloatinglid.Oncompletionofthetest,theleverwouldreturn

tothehorizontalpositionandthepadlockwouldbereplaced.

5 Becausetheswitchcouldalsobeinstalledtodetectlowlevelsoffuelinatank

itcouldalsoworkintheoppositemode.Ifinstalledinthatway,thetestwouldbe

carriedoutbyloweringthechecklever.Unfortunately,loweringthechecklever

whentheswitchwasintendedtooperateinthehighlevelmodeeffectivelydisabled

theswitch.Thepurposeofthepadlockwastoensurethatinnormaloperating

modethecheckleverremainedinthehorizontalpositionanditwasthereforeavital

safetyfeature.

6 Ifthepadlockwasnotreplaced,itwaspossibleforthechecklevertobeleftin

thelowerpositionortofallnaturally.Ineithercasetheswitchwouldbedisabled.

7 Therefore,forthefunctionsoughtonTank912thelowerpositionperformed

nousefulpurposeatall.Whileinotherconfigurationsitcouldhavebeenusedtodetectlowtanklevels,thiswasnotneededinthiscase.Itfollowsthatnotonly

didtheswitchfeatureapotentiallydangerousdisabledposition,whichcarried

ariskthatitwouldbeinadvertentlyinoperable,butitwasalsoariskthatwas

unnecessarytorun.

8 AftertheBuncefieldincident,TAVmodifiedthedesigntoincorporateapinthat

preventedthehandletravellingbelowthehorizontal.



34/36

Appendix 2 Outcome of criminal proceedings1 Fivecompanieswerechargedwithoffencesarisingoutoftheinvestigationof

theBuncefieldincident.ProceedingswerecompletedatStAlbansCrownCourton16July2010.Theoutcomewasasfollows:

2 TotalUKLimitedpleadedguiltytothreecharges:

failingtoensurethesafetyofitsemployeessofaraswasreasonablypracticable

inbreachofSection2(i)oftheHealthandSafetyatWorketcAct1974,contrary

toSection33ofthatAct.Fined 1 000 000;

failingtoensurethesafetyofpersonsnotinitsemploymentsofaraswas

reasonablypracticableinbreachofSection3(i)oftheHealthandSafetyatWork

etcAct1974,contrarytoSection33ofthatAct.Fined 1 000 000;and

causingpollutionofcontrolledwaters,contrarytoSection85(1)and(6)ofthe

WaterResourcesAct1991.Fined 600 000.

3 HertfordshireOilStorageLimitedwasfoundguiltyoffailingtotakeallmeasures

necessarytopreventmajoraccidentsandlimittheirconsequencestopersonsand

theenvironment,contrarytoregulation4oftheControlofMajorAccidentHazard

Regulations1999.Fined 1 000 000.

4 Theypleadedguiltytocausingpollutionofcontrolledwaters,contraryto

Section85(1)and(6)oftheWaterResourcesAct1991. Fined 450 000.

5 BritishPipelineAgencyLimitedpleadedguiltytotwocharges:

failingtotakeallmeasuresnecessarytopreventmajoraccidentsandlimittheir

consequencestopersonsandtheenvironment,contrarytoregulation4oftheControlofMajorAccidentHazardRegulations1999.Fined 150 000;and

causingpollutionofcontrolledwaters,contrarytoSection85(1)and(6)ofthe

WaterResourcesAct1991.Fined 150 000.

6 MotherwellControlSystems2003Limitedwasfoundguiltyoffailingtoensure

thesafetyofpersonsnotinitsemploymentsofaraswasreasonablypracticable

inbreachofSection3oftheHealthandSafetyatWorketcAct1974,contraryto

Section33ofthatAct. Fined 1000.

7 TAVEngineeringLimitedwasfoundguiltyoffailingtoensurethesafetyof

personsnotinitsemploymentsofaraswasreasonablypracticableinbreachof

Section3oftheHealthandSafetyatWorketcAct1974,contrarytoSection33of

thatAct.Fined 1000.

8 TheCourtorderedcostsagainstthedefendantstotalling4 081 000.



35/36

GlossaryATG automatictankgaugingsystem.

BPA BritishPipelineAgencyLtd.

bund usuallyawall,orearthembankment,intendedtocontainfuellostfromatank.

COMAH Competent Authority inEnglandandWales,theHealthandSafety

ExecutiveandtheEnvironmentAgency,workingjointly.

COMAH Regulations ControlofMajorAccidentHazardsRegulations1999(as

amended).

HOSL HertfordshireOilStorageLtd,ajointventurebetweenTotalUKLtdand

ChevronLtd.

IHLS independenthighlevelswitch.

PFOS perfluorooctanesulphonate.

primary containment thetankinwhichfuelisnormallystored.

PSLG ProcessSafetyLeadershipGroup.

SCADA supervisorycontrolanddataacquisition.Itgenerallyrefersto

computerisedsystemssuchasthosethatmonitorandcontrolindustrialprocesses.

secondary containment typicallyabund,surroundingatankorgroupoftanks.

soakaway permeableareaofground,orburiedstructure,designedtospeedthe

drainageofcleansurfacewaterintotheground.

tertiary containment themeansbywhichliquidscanbecontained/controlled

withinthesiteboundary.

UKOP UKOilPipelinesLtd.

ullage (or ullage space) theheadspaceinatankbetweenthesurfaceofthe

liquidandthetanksbrimfullcapacity.

waterstop preformedstripsofdurableimpermeablematerialembeddedinthe

concreteduringconstructionprovidingaliquidtightsealduringarangeofjoint

movements.



36/36

References1 BuncefieldMajorIncidentInvestigationBoardThe Buncefield Incident

11 December 2005: The final report of the Major Incident Investigation BoardVolume1HSEBooks2008ISBN9780717662708

www.buncefieldinvestigation.gov.uk

2 BS8110Structural use of concrete BritishStandardsInstitution

3 BS8007:1987Code of practice for design of concrete structures for retaining

aqueous liquids BritishStandardsInstitution

4 PSLGSafety and environmental standards for fuel storage sites: Process Safety

Leadership Group Final report HSEBooks2009ISBN9780717663866

www.hse.gov.uk/comah/buncefield/response.htm

5 Civil Engineering Specification for the Water Industry FiftheditionWRCplc19989781898920519(4.30Tieboltsforformwork)

6 The storage of flammable liquids in tanks HSG176HSEBooks1998

ISBN9780717614707www.hse.gov.uk/pubns/books/hsg176.htm

7 Emergency planning for major accidents: Control of Major Accident Hazards

Regulations 1999 (COMAH) HSG191HSEBooks1999ISBN9780717616954

www.hse.gov.uk/pubns/books/hsg191.htm

8 HopkinsALessons from Longford: The Esso Gas Plant Explosion CCH

AustraliaLimited2000ISBN9781864684223

9 The Report: The BP US Refineries Independent Safety Review Panel 2007(the

BakerReportintotheTexasCityincident)

Crown copyright 2011

Youmayreuse thisinformation(not includinglogos)freeofchargeinanyformat

ormedium,underthetermsoftheOpenGovernmentLicence.Toviewthelicence

visitwww.nationalarchives.gov.uk/doc/opengovernmentlicence/,writetothe

InformationPolicyTeam,TheNationalArchives,Kew,LondonTW94DU,oremail

[email protected].

SomeimagesandillustrationsmaynotbeownedbytheCrownsocannotbe

reproducedwithoutpermissionofthecopyrightowner.Enquiriesshouldbesentto

[email protected].
http://www.buncefieldinvestigation.gov.uk/http://www.hse.gov.uk/comah/buncefield/response.htmhttp://www.hse.gov.uk/pubns/books/hsg176.htmhttp://www.hse.gov.uk/pubns/books/hsg191.htmhttp://www.nationalarchives.gov.uk/doc/open-government-licencehttp://www.buncefieldinvestigation.gov.uk/http://www.hse.gov.uk/comah/buncefield/response.htmhttp://www.hse.gov.uk/pubns/books/hsg176.htmhttp://www.hse.gov.uk/pubns/books/hsg191.htmhttp://www.nationalarchives.gov.uk/doc/open-government-licence

buncefield report hse

Documents