01 June 2006
Lucie Ponting

At 5.20 AM on 11 December last year, an oil storage tank at the Buncefield depot in Hertfordshire started to overflow, cascading hundreds of litres of unleaded petrol down the tank's sides. Some 40 minutes later Buncefield was rocked by an explosion heard up to 40 miles away which led, ultimately, to the destruction of the whole depot by what is reckoned to be the largest fire in peacetime Europe.

The latest report by the disaster's investigators, published on 9 May, has traced the cause of the explosion to the overflowing tank, the result of faulty gauges and safety devices failing to cut off the fuel supply once it was full.

Investigators describe how overfilling the tank led to an escape of fuel, which formed a cloud of flammable vapour that later ignited, causing a series of explosions and a massive fire that burned for three days. It's still not clear what sparked the vapour cloud; candidates include a nearby emergency generator, a fire pump-house or even a spark from a passing car.

The report is the third update from the joint Health and Safety Executive (HSE) and Environment Agency (EA) investigation. The investigators' first report on 21 February described how a visible flammable cloud moved across the site just before the explosions. A second report in April focused on environmental impacts and highlighted the failure of some of the protective bunds to contain the fuel, foam and fire run-off water.

The February findings prompted the HSE to issue a safety alert to all fuel storage sites that fall under the Control of Major Accident Hazards (COMAH) Regulations 1999, asking them to review their operations and report back by Easter 2006. Results from these reviews and from spot-check visits to the 128 relevant sites should be available later this month. The HSE will use this information, alongside the investigation team's conclusions, to identify any new control measures needed.

Destructive power

Before 11 December, Buncefield was the UK's fifth largest storage/distribution terminal, handling 8% of the UK's bulk oil supplies and meeting around 40% of Heathrow's demand for aviation fuel. The complex, which contains three "top-tier" sites under the COMAH Regulations (see box below), held over 35 million litres of petrol, diesel and aviation fuel on the day of the blasts.

Tank 912, now at the centre of the investigation, is in bund A on the HOSL West site managed by Hertfordshire Oil Storage Limited (HOSL) - a joint venture between TOTAL UK (which owns 60%) and Texaco (40%). Other companies at the depot include BP, Shell and the British Pipeline Agency (BPA).

The HSE says the 11 December blasts showed destructive power beyond the "typical worst case" normally used for planning purposes. Seismological data shows the main explosion happened at 6.01 am. Witnesses then saw a series of smaller explosions. Flames rose 60 metres into the sky, engulfing more than 20 large fuel storage tanks on the site, and sending a dense plume of black smoke across south-east England.

Emergency services evacuated a huge area around the site (including around 2,000 people), and closed surrounding roads and part of the M1 motorway. At lunchtime on 12 December, the peak of the blaze, there were 26 pumps and 180 firefighters struggling to control the flames. The fire services used more than 250 000 litres of foam concentrate and around 25 million litres of water.

The first report detailed how, in the early hours of Sunday morning, eyewitnesses on the HOSL site saw a mist pour slowly across the site and smelled what they thought was petrol or aviation gasoline. In a scene reminiscent of science fiction, bystanders saw a thick wall of fog "between 15 and 20 feet high" and described their car engines "revving uncontrollably", "running rough" and "stalling" as the cloud rolled over.

Despite the ferocity of the blasts, no one died or suffered major injury - probably partly because of the incident's early Sunday morning timing. But 43 people had minor injuries and the explosions disrupted all 630 businesses on the nearby Maylands Industrial Estate, affecting 16,500 employees and destroying 20 firms' premises. Houses close to the site also suffered significant structural damage, and some residents have still not returned home.

On 20 December, the Health and Safety Commission (HSC) formally asked the HSE and the EA to investigate the incident, to appoint an inquiry board with an independent chair - the Major Incident Investigation Board (MIIB), and to produce a formal report. The MIIB - chaired by Lord Newton of Braintree - got down to work four days later.

System failure

The latest progress report describes how records from the automatic tank gauging (ATG) system for Tank 912 suggest "an anomaly". Like other tanks on site, Tank 912 included instruments to monitor the liquid inside. These were connected to the ATG system, which operators used to check levels, temperatures and tank valve positions, and to operate the valves remotely from the control room.

Just after 3 am, the ATG showed that the level remained static at about two-thirds full - below the level at which it would trigger alarms - but the tank continued to fill. Calculations suggest it would have been completely full at approximately 5.20 am, when it would have started to overflow. By 6 am, the overflow would have been an estimated 300 tonnes.

Environmental conditions (especially the high humidity on 11 December), the flow rate of fuel, and the configuration of the tank top and wall, encouraged the rapid formation of a fuel-rich vapour, which then began flowing off the site.

The tank also had an independent safety switch to provide the operator with a visual and audible alarm when the level of liquid reached its specified maximum level (the "ultimate" high level) if all the other alarms and controls failed. This alarm would also trigger a valve shut-off on incoming pipelines by sending an alarm/trip signal to the BPA site, where the computer control system should have closed the pipeline's manifold valve.

Simulation of the ultimate high-level tank alarms and tests on the alarm annunciator panel and on the link to BPA prove that they worked normally. But evidence shows the BPA site never received an ultimate high-level alarm. Investigators have only recently found the ultimate high-level safety switch, and will examine it thoroughly once they can recover it.

The HOSL West control room also contained an override keyswitch to inhibit the alarm/trip signal to BPA. Tests on this found that it had no effect on the audible and visual alarms from the annunciator but, when switched to override, it inhibited the signals being sent to BPA.

A new approach?

The main fuel operators' trade associations are continuing to work with the HSE to share the investigation's findings with their members. Steve Elliott, chief executive of the Chemical Industries Association, said, "There is plenty for members to consider regarding the protection of their own storage tanks against overfilling."

Chris Hunt, director general of UKPIA, the trade association representing the main oil refining and marketing companies in the UK, said his industry "is already taking action, and has been working with the HSE in its review of COMAH oil storage sites, looking at plant design and operations, management systems, staff training and incident response measures. We have also been working with the HSE to establish a pan-industry task group which will be examining further measures that can be taken to ensure that changes are incorporated into codes of good practice and operational guidance."

A spokesperson for the HSE emphasised that the HSE and EA will "work closely with this group to ensure that improvements are implemented as quickly as possible". But he added: "Of course, this does not change our formal role where we, as safety regulator, will set out the safety standards, require the industry to put in place plans to achieve them, and then monitor to ensure effective implementation."

The MIIB believes there is now enough information for the HSE to review the advice it gives to planning authorities about the location of sites like Buncefield, and wants it to "press on" with this "as a matter of urgency". In response, the HSE says it has commissioned further work to "map the consequences of the explosions to inform a revised means of setting land use planning control zones and providing advice to planning authorities". Ideally, a better understanding of why the Buncefield explosions were so severe should support any changes to the advice.

A report for the Department for the Environment, Food and Rural Affairs - also published on 9 May - concludes that the incident had minimal effects on air quality. It says "high plume buoyancy" and favourable weather conditions kept the smoke trapped high in the atmosphere, which kept ground-level concentrations of pollutants similar to normal for the time of year. Health surveillance by the Health Protection Agency and local primary care trusts confirms there was no lasting public health risk from exposure to the plume. Tests of groundwater and surface water for contamination are continuing.

No blame yet

The report deliberately skirts around issues of responsibility to avoid "prejudicing any future legal proceedings". But the MIIB emphasises that its investigation into the causes is feeding into the ongoing criminal investigation, and it will be up to HSE and the EA to decide whether there are grounds to launch criminal proceedings.

Dacorum Borough Council - the local authority for the Buncefield depot area - said it understood the board's caution in not wanting to assign responsibility at this stage. But Hemel Hempstead MP Mike Penning repeated his calls for a full public inquiry, saying, "So many questions remain unanswered." Criticising the investigation, he said: "It is clear from this report that a string of safety mechanisms failed and it is the HSE who are responsible for safety inspections at the site. It is astonishing that they can continue to lead up this inquiry when it seems a real possibility that their inspection procedures could have failed to highlight defects in the safety systems at the site."

Des Collins, a solicitor representing Buncefield residents, hit out at the oil industry's failure to accept responsibility or provide its own explanation. "It beggars belief that much of the information in today's report was not in the hands of the operators from day one," Collins said. "Against a background of appalling devastation for them then to have concealed the position from the residents for some five months is nothing short of scandalous."

Still to do

Investigators are continuing to examine computer records and the wiring and instrumentation circuits that survived the fire.

A particular priority is to establish exactly why the safety switch and associated trip instrumentation did not prevent the overfill. The team will also be looking at vapour cloud formation and dispersion, and trying to work out why the ignition and explosion produced such devastating damage to the surrounding area.

The MIIB is now working on the initial report required under the investigation's terms of reference. Latest updates, including copies of the three progress reports, are available at www.buncefieldinvestigation.co.uk. 

---

Buncefield explosion timeline

 

1900 GMT, 10/12/05: Tank 912 starts to receive unleaded motor fuel from a pipeline, pumping at about 550 cubic metres an hour.

0000 GMT, 11/12/05: the terminal closes to tankers and a product stock check reports "no abnormalities".

0300 GMT: the level gauge for Tank 912 records an unchanged reading, but filling continues at a rate of around 550 cubic metres an hour.

0520 GMT: Tank 912 is completely full and starting to overflow but continued pumping causes fuel to cascade down its sides, leading to the formation of a rich fuel/air mixture that collects in bund A.

0538 to 0546 GMT: CCTV footage shows vapour of escaped fuel starting to flow out of the north-west corner of the enclosure, towards the west.

0550 to 0600 GMT: the pumping rate down the pipeline to Tank 912 gradually rises to around 890 cubic metres an hour and the vapour cloud starts flowing off-site. Witnesses round the site describe a strong smell and report their cars "revving uncontrollably".

0601 GMT: the first explosion occurs, followed by several more and a fire, eventually engulfing more than 20 large storage tanks, injuring 43 people and destroying the premises of 20 businesses.

---

COMAH safety alert

The Control of Major Accident Hazards (COMAH) Regulations 1999 apply to sites that keep or use certain threshold quantities of dangerous substances (such as chlorine, liquefied petroleum gas and explosives).

The two thresholds are known as "lower-tier" and "top-tier". Operators of top-tier sites must submit written safety reports to the Competent Authority (the HSE and EA in England and Wales, and the HSE and the Scottish Environmental Protection Agency in Scotland), and prepare adequate emergency plans to deal with the on-site consequences of possible major accidents and assist with off-site mitigation. Local authorities in areas containing top-tier sites must prepare adequate plans to deal with the off-site consequences of possible major accidents.

On February 21, the HSE issued a formal safety alert to COMAH operators of oil/fuel storage sites, reminding them to "maintain the highest levels of plant integrity and operational capability". It advised operators of installations similar to Buncefield to:

• review the safety of their operations and plant to ensure that major accident hazards are being well managed
• ensure that staff are adequately trained and competent to manage these hazardous operations
• ensure that management systems are robust, and subject to effective review
• ensure that relevant good practice precautions are in place and fully operational
• ensure that there are appropriate measures in place for responding to, and dealing with, emergencies involving loss of containment.

---

Categories:
Chemicals, Chemicals (and COSHH), Fire, Retail and distribution, Risk assessment, Risk assessment, Article, Chemicals (and COSHH), Accident reporting / RIDDOR