The Buncefield Incident – 7 Years on: A Review

I. Introduction

Shortly after 06:00 a.m. on Sunday 11 December 2005, reputedly, the largest peacetime explosion in Europe took place at the Buncefield Oil Storage and Distribution Terminal near Hemel Hempstead in South East England. The explosion was initiated from a large cloud of vapour generated when gasoline overflowed from the top vents of a storage tank while it was being filled. The root causes of the explosion had not occurred suddenly but had built up over a number of hours, weeks, months and years. While the immediate causes were technical ones, related to the sticking of a tank level gauge monitoring the transfer to the tank and to an inoperable independent high-level switch intended to shut off the flow to the tank, underlying these and at the root of the incident were a number of management failures.

Fortunately, no one was killed as a result of the explosion and fire, and the injuries were relatively minor and low in number. Property damage and business disruption in the immediate vicinity were severe, and some companies were put out of business. There was also consequent severe environmental damage. Buncefield was a strategic site for the distribution of fuels to London and the South East of England and a major source of aviation gasoline for Heathrow and Gatwick airports. Closure of Buncefield as a result of the explosion had a major impact on the availability of key fuels.

This paper outlines the key features of the Buncefield incident; the investigation work that followed by the Health and Safety Executive (HSE) and the Environmental Agency (EA), and the Major Incident Investigation Board (MIIB) that was set up by the Government; the development by Buncefield Standards Task Group (BSTG) and the Process Safety Leadership Group (PSLG) of ways to implement the recommendations from the MIIB; and the outcome of the subsequent court cases. It provides references to the important reports and documents that should be available to all who work in the high-hazard industries. While the transfer and storage of gasoline have been the focus of much of the work that arose from the Buncefield incident, the lessons that can be learnt have a much wider application across the process industries. Buncefield was not a unique incident, as was initially thought by many, but was similar to at least seven other incidents worldwide in the preceding 43 years.

II. The Buncefield Site

The Buncefield site was originally established in the late 1960s as a strategic storage and distribution terminal for fuels for London and the South East of England. It is close to the M1 motorway and at that time was in open country to the north-east of the New Town of Hemel Hempstead. The terminal was linked to the nearby United Kingdom Oil Pipeline (UKOP) linking the (then) Shell refineries on the rivers Thames and Mersey. The terminal was operated by the British Pipelines Agency (BPA), the owner and operator of the UKOP. The Buncefield site was developed in the 1980s into a multi-company site, and the UKOP network developed into the UKOP South line (UKOP(S)) from Coryton on the Thames via Buncefield to Kingsbury near Tamworth in the Midlands and the UKOP North line (UKOP(N)) from Shell’s Stanlow Refinery on the Mersey via Kingsbury to Buncefield, with associated spurs and links to other terminal locations. A third pipeline was added from the (then) FINA refinery on the river Humber in the 1990s directly into the Hertfordshire Oil Storage Ltd (HOSL) (West) site. Each pipeline could provide batches of gasoline, kerosene, diesel and gas oil to Buncefield in an agreed sequence and quantity to meet the distribution demand. By 2005, Shell had withdrawn from the Buncefield terminal, and their part of the site had been cleared for redevelopment; the major operator was HOSL with British Petroleum (BP) also occupying part of the terminal site. BPA was the operator for the receipt and distribution of fuels from the UKOP to the HOSL- and BP-operated storage tanks. In addition, BPA stored aviation kerosene for onward transfer by pipeline to Heathrow and Gatwick airports.

The layout of the Buncefield terminal in December 2005 can best be described approximately as an ‘H’ on its side, with the central bar occupied by the BPA facility and the sides occupied by HOSL and BP/Shell ( Figure 1 ). The original site was bounded to the north by Cherry Tree Lane, and the large BPA tank for aviation kerosene had been built on the opposite side of the lane to the main part of the terminal. The main area of the HOSL part of the terminal was to the north west, including the large tanks 910 through 915 and the loading gantry (HOSL(West)). The control building was located close to the south boundary of the HOSL(West) area looking out across the tanker manoeuvring area to the loading gantry. At night, the main tanks 910 through 915 were largely hidden from direct view from the control room; security closed-circuit television (CCTV) provided some means of overview. Also, although the terminal was essentially flat, there was a falling gradient from the tanker-loading gantry towards Cherry Tree Lane.

Figure 1.

Buncefield terminal layout

The proximity of buildings along the western side of the site should also be noted. These were predominantly office or warehouse buildings that had been built as part of the development of the Maylands Business Park since the Buncefield Terminal had first been built. There was also a new large warehouse-type building nearly complete on the southern area of the former Shell part of the terminal (not shown). The inner zone boundary for the HSE consultation distance largely ran through the car parks of these buildings.

III. Incident Timeline

The immediate sequence of events that led to the Buncefield explosion started on Saturday 10 December 2005 when tank 915 on HOSL was set up to receive a parcel of unleaded gasoline directly from the FINA pipeline, while also exporting to road tankers. Tank 915 was nearly empty when the import started at a net import rate of ~140 m³/h, controlled by the team in the HOSL(W) control room. At this filling rate, there was sufficient space in tank 915 to allow filling to continue well into daytime on 11 December.

Later that day, the isolation valves on tank 912 were opened, and the route was set up by the HOSL team to receive an 8400 m³ parcel of unleaded gasoline from BPA via the UKOP(S). The transfer was started by BPA shortly before the evening shift change at HOSL on 10 December.

The pumping rate was around 500–550 m³/h, set by the BPA control room at Kingsbury, with the parcel scheduled to take about 14 hours to deliver into HOSL. At the start of the transfer, tank 912 had an available ullage of just less than 5000 m³, necessitating a change of delivery tank to accommodate the remainder of the parcel, at some time during the night around 03:00–04:00 a.m.

During this same time frame, HOSL was also receiving a parcel of diesel fuel from the UKOP(N) into tank 908.

The automatic tank gauging (ATG) system only had a single display screen. To be able to show detailed information about individual tanks, separate screen windows were required to be nested one on top of the other. On the night of the explosion, four displays were nested in this way; it is not clear how visible tank 912 had been, but it is believed that it was not the top display in the nest.

Operations on the terminal proceeded normally during the evening, including normal stock-taking activity around midnight.

At around 01:00 a.m. on 11 December, the rate of gasoline from the FINA pipeline to tank 915 was increased by the HOSL staff to a net rate of ~240 m³/h; there remained sufficient ullage to continue at this rate until after the end of the night shift.

At around 03:15 a.m., the tank gauge on tank 912 became stuck, and from then on the ATG system recorded a static reading of 12,188 mm (96.4% of the working tank capacity), but the tank continued to fill at a rate of ~550 m³/h. The HOSL operating team had no indication of the flow coming from the UKOP(S) into tank 912 ( Figure 2 ).

Figure 2.

A typical storage tank

It is estimated that the level in tank 912 went past the ATG high-level alarm at 03:29 a.m. and past the high-high-level alarm at 03:34 a.m. As these alarms were to be triggered from the ATG tank transmitter that was now giving a static signal below the alarm point, no alarms were generated. Neither of the HOSL staff on duty recognised that the level in tank 912 was flatlining or that the time to change to another tank had been reached.

Shortly after this time, the HOSL staff were distracted by a problem with the new road tanker–loading system that was proving to not be fully reliable. This necessitated the control room supervisor leaving the control room to reboot the loading system computer and liaising with staff at the loading gantry until tankers were again being satisfactorily loaded.

The level in tank 912 continued to rise, and the floating roof made contact with the weight for the independent high-level switch, but this switch failed to operate, raise the alarm and shut down all the transfers.

At around 05:30 a.m., tank 912 was completely full, and gasoline started to come out of the roof vents, flowed across the roof and cascaded down the tank sides into the bund. Deflector plates on the top of the tank and wind girders on the tank wall provided a dam effect and helped to create turbulence as the liquid flowed over them and entrained air as a proportion vaporised.

At this time, the weather was calm with a light westerly breeze, but it was cold at about 0 °C and humid (relative humidity (RH) of 99%). The gasoline would have been at around the normal ground temperature through which the pipeline ran of about 10 °C. The combination of the flashing of the lighter components in the gasoline plus vaporisation through turbulence and aeration produced a rich fuel/air mixture containing some ice crystals that collected in the tank bund A and that became visible as a white cloud on the CCTV at around 05:38 a.m. By 05:46 a.m., the vapour cloud had thickened to about 2-m depth flowing out of the bund in all directions and by 05:50 a.m. had started to flow off-site to the north and west following the ground topography.

Between 05:50 and 06:00 a.m., the flowrate out of tank 912 increased to nearly 900 m³/h as a result of BPA ending a transfer from UKOP(S) into the Kingsbury terminal. This resulted in an increased pressure in the pipeline at the Buncefield off-take and hence an increase in the delivered flow to tank 912.

The vapour cloud did not come towards the loading gantry and HOSL control room; it was only when tanker drivers reported smelling gasoline that it was realised something was wrong. Initially, there was some confusion as to which tank was involved, with tank 915 thought to be the source of the leak.

At 06:01 a.m., the first of a number of explosions occurred, followed by a large fire that engulfed more than 20 storage tanks on both the HOSL and BPA parts of the terminal. The main explosion was centred on the western side of the site and the adjacent car parks. The source of ignition was subsequently determined, on the balance of probability as a spark from starting the HOSL fire pumps when the fire alarm was initiated. The fire pumps were not in a designated explosive atmospheres zone, but would have been within the vapour cloud.

The resultant fires took more than 4 days to put out.

The magnitude of the explosion exceeded 1000 mbar in the immediate vicinity of the terminal, rapidly decaying once away from the terminal surroundings to 7–10 mbar at some 2 km distance. An explosion of this size was not consistent with the understanding of vapour cloud explosions; an overpressure of 20–50 mbar would have been predicted from the available methods and the relatively uncongested environment of the terminal and car park areas.

IV. The Investigation and the MIIB

Investigation teams from the HSE and the EA were established immediately followed by the MIIB appointed by the government. A forensic examination of the remains of the Buncefield terminal was done to establish the root causes of the incident and to gather relevant evidence. It became clear early on that documentary evidence and what was found on the site did not always match.

There was wide interest in what had happened and concern to understand whether similar incidents could occur elsewhere on fuel terminals. Over 60 sites storing gasoline were identified as having similarities to Buncefield. Prior to the Buncefield incident, fuel storage sites were generally not considered to be particularly high risk and to present an explosion hazard on the scale that had occurred. Fuels were stored at ambient temperature and pressure, and the only processing that was done was pumping them into and out of tanks. Buncefield changed this worldwide perception. During the investigation, it emerged that rather than being unique, Buncefield was only the latest of seven similar incidents identified in the previous 43 years (and there have been two others since). The investigation and subsequent work have focussed on the transfer and storage of gasoline, but many of the recommendations and outcomes can be applied more widely.

The MIIB published a series of progress reports as the investigation proceeded, ¹ and in the summer of 2006, a series of teams with regulator and industry representatives working together were established as the BSTG. This was to be a task and finish group with six key task groups working in parallel with the MIIB to explore remedial actions that would be required. The aim was to develop improved safety and environment standards and good practice for fuel storage sites, reinforcing as appropriate the use of established national and international standards and to meet the outcomes from the MIIB.

In an initial report in the autumn of 2006, the BSTG generated guidance in the following areas:

• Safe management of product transfers;

• Tank overfill protection, including tank operating practices and staffing levels and safety margins;

• Effective shift handover arrangements;

• Safety integrity and independence of overfill systems;

• The use of fire safe valves and Remote Operated Safety Shut-off Valves (ROSOVs);

• Containment measures.

As the investigation proceeded, it became clear that the primary technical causes of the incident were that the output from the ATG level transmitter on tank 912 had stuck in one position and the output had flatlined below the alarm settings, and that the independent high alarm switch was inoperable because the testing lever had not been padlocked in the horizontal position. The investigation also identified that the tank 912 level transmitter had similarly flatlined on at least 14 occasions in the previous 3 months, but no effective action had been taken to find the root cause or repair the fault completely. Further investigations were required to understand the underlying reasons for these failures.

At this stage of the investigation, it not only became clear that there were a number of issues around the safety management practices within HOSL in particular but also in relation to the parent company Total and their suppliers. These had, in different ways, contributed to the immediate technical causes of the incident. Fault reporting, management of change, safety critical systems identification and the use of procedures of various types were all the subject of further study.

Another important area of the MIIB work centred on the loss of containment issues arising from the failures of the bunds to contain the gasoline and firefighting materials, and the failure of the tertiary containment to retain any leakage within the Buncefield site. A particular concern that emerged was the existence of a number of soakaways that had permitted potentially toxic firefighting chemicals to percolate down into the underlying subsoil and ultimately to an underground aquifer.

Other aspects arising from the Buncefield incident that required more detailed investigation were set up as separate studies by the MIIB. These included the following:

• Land-use planning and why the inner and outer consultation distances around the Buncefield site only effectively included the car parks and some of the closest buildings, respectively. These studies have resulted in recommendations on land-use planning and the control of societal risk on major hazard sites. ¹

• Investigations into the explosion mechanism. This was a very detailed study, ¹ looking at a mass of evidence, including the wreckage of cars, buildings, lamp posts, vegetation and any artefact where the impact of the explosion pressure could be assessed ( Figure 3 ). The team was unable to identify a single scenario that could explain all aspects of the explosion. There was only limited congestion in the terminal area, and the vapour cloud was essentially unconfined. It was considered possible that the trees and vegetation along Buncefield Lane could have provided congestion similar to process pipework. Recent work reported by the New Scientist demonstrates that a row of deciduous trees can provide the conditions to produce a deflagration, while coniferous trees do not, possibly because they are more supple. ²

• Emergency preparedness for, response to and recovery from incidents. A total of 32 recommendations about the enhanced involvement of local authorities and emergency services of all kinds in the emergency planning at Control of Major Accident Hazards (COMAH) sites, and also the role of central government and other agencies in the aftermath of a major incident. One aspect developed from this is the enhanced requirement for water for firefighting, how and where water should come from and how it should be recovered once it has been used on the fire, with implications for secondary and tertiary containment requirements.

Figure 3.

Explosion overpressure contours

The MIIB published its recommendations for the design and operation of fuel storage sites in March 2007. ¹ These formed the primary recommendations of the MIIB report, was complementary to the work done by the BSTG and established the basis of the further work that was to come through the PSLG. The recommendations reinforced the application of established standards, in particular BS EN IEC 61511. ³ The 25 recommendations covered the following six areas:

1. Systematic assessment of Safety Integrity Level (SIL) requirements (recommendation 1);

2. Protecting against loss of primary containment using high-integrity systems (recommendations 2–10);

3. Engineering against escalation of loss of primary containment (recommendations 11–16);

4. Engineering against loss of secondary and tertiary containment (recommendations 17 and 18);

5. Operating with high-reliability organisations (recommendations 19–22);

6. Delivering high performance through culture and leadership (recommendations 23–25).

A compilation of all the work of the MIIB is contained in the Final report of the Major Incident Investigation Board ¹ and should be accessed as a key reference document.

The BSTG published a final report ⁴ in July 2007 in four parts:

1. Actions required of operators, including timescales;

2. Detailed guidance produced by BSTG, including completeness of the guidance from the initial report;

3. Work remaining in progress;

4. Comparison with the work of BSTG and the MIIB report.

V. PSLG

The PSLG was established in 2007 to progress the recommendations of the MIIB and the work done by the BSTG. In response to the MIIB’s recommendation for greater cooperation between the different stakeholders, the PSLG was a joint industry, COMAH Competent Authority (CA) and trade union group. It had as its main purpose to specify the minimum standards of control, which not only should be in place at all establishments storing large volumes of gasoline but should also be included in its remit to address the MIIB’s criticism that process safety leadership failures contributed to Buncefield, by raising the profile of process safety leadership in the petrochemicals and chemicals industries and including the following:

• Developing organisational and technical solutions;

• Sharing and learning from incidents and good practice;

• Establishing excellence in operations and maintenance;

• Monitoring compliance with the Buncefield MIIB’s and BSTG’s recommendations;

• Taking effective account of the outcome of the studies into the explosion mechanism.

To support its work, the PSLG developed a set of ‘Principles of Process Safety Leadership’, signed by the trade associations, the COMAH CA and trade unions, which set out the commitment of all to the enhancement of process safety.

The PSLG followed the six-part structure of the MIIB report in its own final report ⁵ published on 11 December 2009 (4 years to the day after the Buncefield incident) to provide clear and practical guidance on how the 25 MIIB recommendations should be interpreted and the actions necessary to satisfy the CA that an organisation had understood and implemented the requirements so far as is reasonably practicable. The CA will be using the PSLG report as the basis for their intervention and enforcement strategies.

VI. Court Proceedings

There were two primary court cases as a result of the Buncefield explosion, one in the Commercial Court to determine responsibility for the financial losses and another in the Criminal Court to establish culpability under health and safety and environmental protection laws. It is the criminal case that is of more interest as all five companies charged either pleaded guilty or were found guilty, and significant fines were levied where this could be done. No individuals were prosecuted.

Total UK Limited pleaded guilty to charges that it (1) failed to ensure the safety of its employees so far as was reasonably practicable in breach of Section 2(i) of the Health and Safety at Work etc. Act 1974 and (2) failed to ensure the safety of persons not in its employment so far as was reasonably practicable in breach of Section 3(i) of the Health and Safety at Work etc. Act 1974, and a charge causing pollution of controlled waters, contrary to Section 85(1) and (6) of the Water Resources Act 1991. Total UK Ltd was fined £2,600,000 in all.

HOSL was found guilty of failing to take all measures necessary to prevent major accidents and limit their consequences to persons and the environment, contrary to regulation 4 of the COMAH Regulations 1999 and also of causing pollution of controlled waters, contrary to Section 85(1) and (6) of the Water Resources Act 1991. HOSL was fined a total of £1,450,000.

The BPA pleaded guilty to the same charges as those laid against HOSL and was fined a total of £300,000. Although BPA was not directly involved in the initial explosion, their facilities, particularly tank 12, the largest on the Buncefield site, containing aviation kerosene was set on fire as a consequence of the fire on the HOSL site, and subsequently, the tank bunds, tertiary containment and drainage systems were found to have deficiencies that led to damage to the ground water and environment. This is a good example of a ‘domino’ effect drawing an otherwise uninvolved organisation into the overall consequences of a major incident.

The other charges and prosecutions were further down the supply chain, on two suppliers of instrumentation and associated services: Motherwell Control Systems 2003 Ltd was found guilty of failing to ensure the safety of persons not in its employment so far as was reasonably practicable in breach of Section 3 of the Health and Safety at Work etc. Act 1974 and was fined £1000. TAV Engineering Ltd was also found guilty of this same offence and fined £1000. Both these fines were limited by the circumstances of the companies and their ability to pay.

It is believed to be the first time that the HSE and the EA have successfully prosecuted companies throughout the supply chain in relation to a single incident.

VII. Buncefield – Why Did It Happen?

Following completion of the criminal court case in July 2010, the HSE published a summary of the underlying causes of the explosion entitled ‘Buncefield – Why did it happen’, ⁶ including material that could only be reported after completion of the court proceedings. This 36-page report should be mandatory reading for everyone working in the Process Industries. It identifies underlying causes that are not solely specific to Buncefield but could apply elsewhere, and provides useful reference source to start exploring the effectiveness of the Process Safety Management regime at your own place of work. In particular, it reinforces important Process Safety Management principles that are not new as a result of Buncefield ⁶ (p. 5) but rather have been known for many years and underpin the PSLG report:

• The need for a clear understanding of major accident risks and the safety critical equipment and systems designed to control them.

• The need for systems and a culture, available to detect signs of failure in safety critical equipment and to respond to them quickly and effectively.

• The need for time and resources to be available for process safety.

These should be supported by the following:

• Effective auditing systems that test the quality of management systems and ensure that these systems are actually being used on the ground and are effective.

• Clear and positive process safety leadership at the core of managing a major hazard business with board-level involvement and competence to ensure that major hazard risks are being properly managed.

VIII. The Future

Embedding the principles above from ‘Buncefield – Why did it happen’ along with the actions required to implement the PSLG report in an organisation provides an extensive package of activities for the immediate future.

New gasoline storage facilities are expected to comply in full with the requirements of the PSLG report from project inception, but while the requirements are not to be immediately retrospectively applied on existing sites, under the COMAH regime, sites are expected to have an improvement programme that requires their application so far as is reasonably practicable.

In 2010 and 2011, a considerable amount of work went to provide a systematic assessment of the safety integrity level requirements (recommendation 1). The Layer of Protection Analysis (LOPA) technique has become the standard approach, but the methodology has both been extended and amended from that in the original book from the Center for Chemical Process Safety (CCPS)/American Institute of Chemical Engineers (AIChE) ⁷ and part 3 of BS EN 61511. Particular problems have been in validating data to be used in LOPA studies, including human factor reliabilities and operating performance data.

Overall, many of the fuels’ terminal applications are resulting in a SIL 2 requirement, generally governed by the frequency and parcel size of the transfers. Some lower risk applications particularly where the tank capacity is significantly larger than any transfer may be designated as SIL1.

Following from the SIL requirement assessments, attention has turned to the equipment installed to provide level measurement and control and for overfill protection, or the design of a new safety critical system to address recommendations 3, 4, 5 and 9 in the PSLG report and to comply with the requirements of BS EN 61511. ⁵

There are particular ongoing issues with the content and quality of documentation available for safety critical systems, the data available to support SIL capability assessments and the provision of appropriate and adequate proof testing methods and regimes. Equipment manufacturers have a key part to play in delivering responses to these aspects. The gathering and recording of maintenance data and validated data to support the SIL requirements assessment also require further work.

For many sites, implementation of recommendations 11 and 12 relating to the classification of potentially explosive atmospheres and protection of emergency response facilities was handled as one of the early activities; the implementation of additional gas detection and CCTV systems has been incorporated into capital programmes, but there is still work to be done in these areas.

The work to address the requirements for secondary and tertiary containment is possibly the most difficult and capital intensive on existing sites. There has been a lot of work in progress, particularly to address the highest risk installations, piping penetrations and fire protection of bund joints, but in many cases, the bunds have to be significantly redesigned and rebuilt to approach meeting the MIIB/PSLG requirements.

Along with the specific engineering and technology requirements in sections 1 through 4 (recommendations 1 through 18), the recommendations in sections 5 and 6 (recommendations 19 through 25) relating to high-reliability organisations and the delivery of high performance through culture and leadership have a strong thread of continuous improvement over a long time.

Buncefield was a high-impact event that should have been occurring at a very low frequency; we collectively need to ensure that in the future, the potential frequency is lowered and the impact of any event that does occur is also lowered.