This article appeared in a journal published by Elsevier. The attached copy is furnished to the author for internal non-commercial research and

Transcription

1 This article appeared in a journal published by Elsevier. The attached copy is furnished to the author for internal non-commercial research and education use, including for instruction at the authors institution and sharing with colleagues. Other uses, including reproduction and distribution, or selling or licensing copies, or posting to personal, institutional or third party websites are prohibited. In most cases authors are permitted to post their version of the article (e.g. in Word or Tex form) to their personal website or institutional repository. Authors requiring further information regarding Elsevier s archiving and manuscript policies are encouraged to visit:

2 Journal of Loss Prevention in the Process Industries 23 (2010) 913e920 Contents lists available at ScienceDirect Journal of Loss Prevention in the Process Industries journal homepage: The UK Buncefield incident e The view from a UK risk assessment engineer Ian Herbert * ABB Engineering Services, 1st Floor Nautilus House, Lime Street, Waterloo Quay, Aberdeen AB11 5BS, United Kingdom article info abstract Article history: Received 4 March 2010 Received in revised form 6 September 2010 Accepted 6 September 2010 Keywords: Buncefield VCE Multi Energy Method Detonation Wind Hazard identification The large release of petrol from a storage tank at the Buncefield storage site in December 2005 and subsequent explosion of the extensive vapour cloud formed has resulted in significant learning for operators of large flammable liquid storage systems. This paper presents the personal views of the key aspects of this learning that are pertinent to those who undertake hazard identification and risk assessment studies of such sites, either as part of the safe design of a new installation or as part of a periodic review of the safety of an existing installation. These views have arisen from involvement as an expert witness in the legal action brought against the fuel storage operators at Buncefield in December 2005 under UK Civil Law and also from the experience of providing consultancy support to operators of similar storage systems pre and post the Buncefield incident. The view is from an engineer typically being asked to support operations using recognized assessment methods and practices to develop safety cases and design safety reviews. This paper is aimed at those who would need to identify and assess the fire and explosion hazards and risks from Buncefield-type installations, i.e. any large flammable liquid storage systems at or near atmospheric pressure. The paper covers: - the lack of awareness, prior to the Buncefield incident, of previous incidents at similar installations involving explosions and fires from loss of containment of significant quantities of petrol and its implications - important factors to consider in identifying and assessing fire and explosion risks - important aspects of design and operation for risk mitigation. Ó 2010 Elsevier Ltd. All rights reserved. 1. Introduction On the morning of the 11th December 2005 a release of petrol from a storage tank at the HOSL (Hertfordshire Oil Storage Limited) West Buncefield site was ignited. This resulted in a significant explosion and damage to adjacent properties. The scale of this damage was reported (BMIIB, 21st Feb 2006) as being greater than could have been foreseen based on knowledge at the time. The UK Health and Safety Commission directed an investigation into the incident at Buncefield, carried out by the Health and Safety Executive (HSE) and the Environment Agency (EA) and supervised by an independent investigation board (the Buncefield Major Incident Investigation Board, or BMIIB). In July 2006 the independent Board reported that the overpressures generated at Buncefield * Tel.: þ44 (0) ; cell: þ44 (0) address: ian.herbert@gb.abb.com. were of a magnitude much greater than current understanding of vapour cloud explosions would predict (BMIIB Initial Report, paragraph 29) (BMIIB, 21st Feb 2006). The BMIIB invited a team of explosion experts to form a working group to advise on the work that would be required to explain the severity of the Buncefield explosion. This group stated that the severity of the explosion would not have been anticipated in any major hazard assessment of the oil storage depot before the incident (Explosion Mechanism Advisory Group report, paragraph 2) (BMIIB, 2007). In addition to the investigation in to the incident, two legal cases have been initiated and considerable discussion has ensued within the UK risk assessment community. The significant part of this discussion has been concern with the fact that the scale of the Buncefield incident was beyond expectations. And, as a result are there errors in the way in which hazard identification and risk assessments are being undertaken within the UK /$ e see front matter Ó 2010 Elsevier Ltd. All rights reserved. doi: /j.jlp

3 914 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e920 This report sets out what consequence assessment work was done prior to the incident, as part of legal compliance in the UK, assessment of other storage site large-scale events, a reapplication of typical consequence determination methods and finally learning from the event. 2. Event key details The Buncefield incident is well documented within the published reports of the Buncefield Major Incident Investigation Board (BMIIB) (BMIIB, 11th April 2006, 9th May 2006, 13th July 2006, 2008; BMIIB Report, 29th March 2007, 17th July 2007, 2008). A number of reports have been published which detail the events of the night of 11th December In summary the timeline of the Buncefield event is as follows: Prior to 05:19 e high level alarms known to be faulty on site and were set at maximum fill level. High reliance on ultimate high level trip. Deterioration in operating standards had also come into play and operator supervision was low. 05:19 on 11/12/05 overfill starts after failure of level gauge and high level trip. Initial pump rate at 550 m 3 /h. Overfill out of top roof hatches. 05:53 pump rate increased to 890 m 3 /h. 06:00 cloud identified and emergency response started, fire water pump started. 06:01 first major explosion. Subsequent minor explosions and multiple tank fires. Fires burn for three days before being finally extinguished. site was submitted to the UK HSE and EA for inspection and had been accepted. No overpressure event of the scale seen on the night of the incident was identified (Buncefield Site COMAH Safety Report, 2008). For compliance with the Planning (Hazardous Substances) Regulations, assessments for the determination of consultation distances are undertaken by the UK HSE. Several such assessments had been undertaken for the Buncefield site as a result of changes to the use of the site. The last assessment was done in Information on the assessments carried out and details of the assessment methods can be found both in the BMIIB reports (BMIIB, 21st Feb 2006, 11th April 2006, 9th May 2006, 13th July 2006, 2007, 2008; BMIIB Report, 29th March 2007, 17th July 2007, 2008) and in the HSE consultation document CD211 (UK HSE) Proposals for revised policies for HSE advice on development control around large-scale petrol storage sites. For cases where a potential for generation of a large vapour cloud is identified, HSE s technical policy (at the time) for assessing vapour cloud explosions is based on the following guiding principles. These principles were underpinned by the interpretation of available scientific understanding of VCEs at the time: Under test conditions it is known that some flammable vapour clouds can detonate, although in practice the risk of such a situation occurring is sufficiently remote that HSE does not consider vapour cloud detonation for land-use planning assessments. There are no clear cut rules for deciding whether a vapour cloud explosion should be considered in a particular assessment, but HSE has developed some guidance (originally for assessments involving liquefied petroleum gases), to assist in deciding whether or not to consider VCE in an assessment and this is reproduced below: 3. Pre Buncefield explosion assessment For process plants with the potential for Major Accident Hazards the determination of possible explosions has to be addressed in two major regulatory schemes e The Control of Major Accident Hazard Regulations 1999 as amended 2005 ( COMAH ) and Planning (Hazardous Substances) Regulations 1992 (Land-Use Planning Regs). The COMAH assessments are expected to be undertaken by the operators of the facility and relate to life safety risk management. A safety report with identification of site Major Accident Hazards (MAHs) and their associated risks is required for sites with significant inventories. The Land-Use Planning assessments are made by HSE assessors based on material and plant details supplied as part of Hazardous Substances Consent applications. These are used to determine consultation distances from a site and can affect both on site and off site developments. The regulatory schemes require the prediction of the potential overpressure consequences of hazardous events occurring on site, should such events be identified. The two regulatory schemes set out above make use of both the knowledge developed by industry standards and applicable plant and incident histories. Under COMAH the UK HSE are jointly (with EA) the Competent Authority and, amongst others, have a regulatory duty to consider submitted Safety Reports. In support of this they have published guidance on the assessment of flammable liquid storage (UK HSE, 2001). The Buncefield site was subject to the requirement to provide a Safety report under the COMAH Regulations and had been subject to several separate assessments in support of the Planning (HS) regulations. The hazard identification and risk assessment, required for COMAH compliance, for the Buncefield site was undertaken, on behalf of the site operator, by third party consultants in the UK. The resultant COMAH assessment and COMAH Safety Report for the HOSL Factors for excluding VCE hazards from the assessment Less reactive fuel e.g. saturated hydrocarbon Absence of (semi) confining structures at or near the release point Small mass of fuel i.e. less than 10 tonnes entering the vapour cloud No energetic release of fuel e.g. from atmospheric pressure storage Absence of strong ignition sources Factors against excluding VCE hazards from the assessment More reactive fuel e.g. unsaturated hydrocarbon Presence of (semi) confining structure at or near the release point Large mass of fuel i.e. greater than 10 tonnes entering the vapour cloud Energetic release of fuel e.g. from pressurised storage Presence of strong ignition sources e.g. bang box ignition Assessed overpressure hazards at the Buncefield site. The above principles and assumptions about overpressure hazards were used in the 2001 assessment of the Buncefield Oil Storage Depot. Hazards arising from a VCE centred on the road tanker loading area were carried out using MEM (Multi Energy Method). This applied the following experience has shown that non-flashing liquids such as gasoline (i.e. liquids not under pressure) usually represent a negligible hazard from VCE. To confirm this, MEM was used with n-butane as an exemplar substance for gasoline, and taking the semi-confined volume V to be the product of the whole plan area of the tanker loading bays, and an assumed vapour height H of 1 metre. Damage effect distances out to 185 m were determined from these assumptions. The resultant consultation distances and associated zones are shown in the following Fig. 1 which has been extracted from the Consultation document CD211 (UK HSE). From a review of the regulatory compliance assessments undertaken prior to the event only VCEs in the vapour spaces of tanks and in congested tanker loading bays were identified and assessed. Neither of these would result in VCE severities of the scale seen on the night.

4 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e Fig. 1. Land-use planning consultation zones for the Buncefield site. 4. Other previous events A major tool in the identification of potential factors that may induce higher explosion overpressures is a review of previous incidents and understanding of the factors associated with these previous events. However, knowledge was very limited of high overpressure explosions following large-scale spillage of petrol (gasoline) both with the operators of fuel storage locations, and in the UK risk assessment community. This is highlighted by a statement recorded in the final BMIIB report (BMIIB, 2008). Para 32 Immediately following the incident, the Board accepted what appeared to be the view commonly held by the industry and the relevant expert community in Britain: that this was an unprecedented event. However, it was soon revealed during the investigation that other incidents which had involved large clouds of petrol vapour had occurred elsewhere. Unfortunately, to our knowledge these events were not subjected to thorough investigation concerning the generation of high overpressures. Therefore conclusions relating to apparent similarities to Buncefield cannot be drawn. In the case of large petrol storage and distribution sites the principal hazard concern, from past incidents, had been related to the hazard presented by pool fires in large tanks. Up until the Buncefield incident this had been the primary and overriding concern in relation to storage depots. This concern had resulted in research on large-scale tank fires, such as the LASTFIRE (UK e LASTFIRE Project) project and preparation for the means to tackle such fires. However, the potential for high explosion overpressure events following large petrol (gasoline) releases at storage depots was not common knowledge in the UK. Following the Buncefield incident previous events with similarities to Buncefield were identified. Brief details on these are: Newark 1983 e Tank 67 overfilled during filling from an underground line. There were no tank alarms or trips. Approx 200 tonnes were spilt over a prolonged period (no timescales given). 1 death and 24 injured, with windows damaged to 5.6 km. Weather conditions at the time were still. The epicenter (ignition source) of the cloud is reported (Anonymous, 1983) as being in an adjacent drum refinishing facility. Recommendations on tank filling

5 916 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e920 arrangements were made following this event. However, no assessment of the reasons why the event generated so large an overpressure was made. Information on the terrain into which the vapour cloud formed is also lacking. In general it was scrub land, but could have included congestion factors such as the drum storage operations. Naples 1985 e Tank 17 overfilled during a ship transfer operation. Overflowed for 1.5 h and approx 700 tonnes spilt. Weather was 8 C and <2 m/s wind. 5 local casualties with damage up to 5 km. In this case the BMIIB Initial Report (BMIIB, 21st Feb 2006) refers to a relatively congested area, and a case study paper (Russo, Maremonti, Salzano, Tufano, & Ditali, 1999) quotes the following the relatively high level of congestion in the area possibly limited the dispersion of vapours. This level of congestion could be the cause for the overpressure generation in this case. St Herblain 1991 e 20 min release before ignition generating a cloud estimated at 23,000 m 3. Damage to windows at 2 km. Weather was 5 C with <1 m/s wind speed. Presence of tankers will have added to confinement/congestion. This is also repeated in an assessment of the incident reported (Lechaudet, 1995). The parked tankers are assessed as the centre for the explosion and would have presented a volume of high confinement and congestion. Laem Chabang 1999 e petrol tank overfill, but spillage data is very limited. There were 8 fatalities all of which were in a vehicle investigating spill, which likely acted as the ignition source. There is limited information on the surrounding terrain, but there are reports of trucks parked near the tank (including fire trucks) (Anonymous, 1999). Although very limited data is available, the presence of trucks means that confinement and congestion cannot be ruled out, which may explain the overpressure generation. However, in reviewing the available information on these events, the general lack of any detailed review and determination of the explosion generation mechanisms reduces their benefit in providing identification of factors that could explain the Buncefield event. In most of these cases factors such as lorry parking and other local congestion factors could help to explain the scale of their associated event. These previous incident histories cannot on their own be used to provide a determination of the scale of the Buncefield consequences. However, the lack of general awareness of significant incidents lowered (UK) perception of petrol blasts and more pessimistic explosion assessments of large-scale petrol spills were not identified for such sites. From the review of previous incidents and the Buncefield case itself some common factors can be established. In all cases there was a prolonged spillage of petrol, no detection of the spill was made before ignition, and the weather in all cases was with still, either very low or no, wind conditions, allowing the vapour cloud to spread with little dispersion. 5. Re-application of models to event The potential for explosion on the scale seen on the night requires a review of the site and a pessimistic assessment of the scale of confinement and congestion that may generate explosion overpressures. The standard approach to modeling vapour cloud explosions (VCEs) is to first define the extent of the vapour cloud and then to identify confined and congested volumes in the cloud, which could generate overpressures. There are several methods available for the determination of overpressures from vapour cloud explosions (VCEs). These can range from empirical models that are relatively straightforward to apply, through to highly complex Computational Fluid Dynamics (CFD) methods. CFD requires computer modeling and a significant level of knowledge and experience. Prior to the Buncefield incident, it is considered that tank farm operators would probably not have carried out such CFD modeling. However, CFD modeling has been used in the incident investigation and this has aided in the identification and determination of the factors applicable to generating the severity of overpressure seen in the Buncefield event. Several empirical explosion methods are available for determination of overpressure consequences. The two most used methods (in the UK) are TNT equivalence and the Multi Energy Method (MEM). The Multi Energy Method has gained a higher degree of use and is broadly accepted as an improvement on the TNT method for determining overpressure. The BakereStrehloweTang method is another energy-based method which generates more or less identical results to MEM. Both these methods involve relatively straightforward calculations and do not require complex computer programmes (although they are often packaged in consequence programs). As such, prior to the Buncefield incident it is likely that tank farm operators would have carried out such calculations. The acceptance of MEM in the UK can be seen in the HSE Safety Report Assessment Guide for Highly Flammable Liquids (UK HSE, 2001). The MEM is also quoted in the CIA (UK Chemical Industries Association) guidance for occupied buildings (UK Chemical Industries Association, 2003), stating that this is the best technology currently available for VCE assessment. It is my opinion that the MEM is the correct method to be applied in determination for the explosion consequences associated with the Buncefield site. MEM is also used worldwide, as can be seen by the fact that it is one of the main methods included in the AIChE (American Institute of Chemical Engineers e Centre for Chemical Process Safety) book on Flash Fires, VCEs and BLEVEs (USA AIChemE e CCPS, 1994). The formation of the flammable vapour cloud at Buncefield was as a result of the prolonged overfill from Tank 912. The vapour was formed by the falling liquid, its splashing and consequent evaporation of the lighter petrol fractions notably Butane. Work has and is still ongoing into the formation of this cloud. What is clear is that this vapour cloud formation occurred under still wind conditions (near zero wind speed). Such low wind speeds are below that of the validated range for dispersion models, such as those in DNV s Phast consequence programme. CFD modeling has again been required in the incident investigation to model the dispersion. However, from burn damage and visual evidence of the associated mist cloud it is possible to determine that the un-ignited vapour cloud covered an area of between 60,000 and 80,000 m 2. The depth of the cloud varied depending on the topography of the land, being up to 5 m at cherry tree lane to 1e2 m in the car parks associated with the off site buildings. It should be noted that still calm conditions are typically modeled applying 2 m/s wind speeds. Lower still and zero wind speed conditions are not typically modeled. At 2 m/s wind speed the dispersion of the cloud would have been significantly greater, with a much smaller hazardous cloud generated. The range of weather conditions typically employed in UK assessments range from 2 m/s F conditions to 15 m/s D conditions. The typical UK weather condition is 5 m/s D category conditions. This weather condition factor is important and is discussed again later. With still wind conditions it is possible to estimate the cloud as a gravitational flow filling the site with a vapour cloud of approximately 2 m in depth. The area covered would follow the topography of the site. Using this it is then possible to identify those areas of possible overpressure generation within the cloud. These are shown in the following Google Earth Ó image, Fig. 2, of the site taken prior to the event. From this it can be seen that within the cloud there are three potential confined volumes, namely the empty Tank 910, the fire

6 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e Fig. 2. Aerial image of the site prior to the explosion locations of interest highlighted. water pump house and the emergency generator enclosure. There is also a congested area presented by the adjacent pump pad to the east of tank 912. All of these could generate overpressures upon ignition of the cloud covering them. The tank and enclosures were taken to fail at 100 mbar and using MEM methodology (TNO Yellow Book, 1997) this is equivalent to an explosion strength ST4. The pump pad is not significantly congested, and using estimating tools could pessimistically produce an ST5 explosion strength using MEM. In taking into account the volume in each of these areas the explosion severity is still not as great as that seen on the night. It also does not match that calculated for the Planning (Hazardous Substances) Regulations, due to the fact that the loading bay was outside of the cloud at the time of the ignition. It is also noted that although the cloud covered the car park associated with the Northgate and Fuji buildings, these were empty at the time of the incident. Parked vehicles were not present and therefore were not a factor in the strength of the explosion. The one area of uncertainty is the vegetation alongside the edges of both Buncefield lane (north/south) and Cherry Tree lane (east/west). This was composed of approx 2e3 m strips on either side of the road with spaced trees along this line. Between the trees were bushes and general shrubs. I and the majority of those I have talked to in the UK risk assessment community would not have taken this vegetation into consideration as a significant explosion factor. Such vegetation would have been considered as a means for fire spread. The vegetation was also not considered in either the COMAH or Land-Use Planning assessments. Areas identified in the above figure: 1 e Emergency generator cabinet 2 e Fire water pump house 3 e Tank 912 e overflow source 4 e Tank 910 e empty and open manways at time 5 e Pump pad 6 e Tanker load bays 7 e Contour of cloud following site contours and obstructions to an approximate 2 m depth. From this review of potential overpressure generating locations and the assessments carried out previously, the scale of the overpressure generation is still unexplained. Either there is some factor that now needs to be taken into consideration or there is some new mechanism that is now present. This has been the task of the Explosion Mechanism Group. The findings from research in to the explosion mechanism have just been published in an HSE research paper (HSE RR 718) (UK HSE, 2009). This has identified that flame acceleration in the undergrowth and trees along Cherry Tree and Buncefield Lanes as being the most likely factor in the Buncefield explosion overpressure generation. As this mechanism is detailed in papers elsewhere I am not going to go into this further, other than to note that this vegetation factor has not been part of risk assessments to date, except where large wooded areas have been present. 6. Consequence learning From the above reviews of the explosion and the new research evidence three important learning points can be derived to improve future hazard identification and risk assessments. These are: 1) Explosion mechanisms. The need to identify a wider range of possible overpressure generating factors on and importantly also those off site. This should include vegetation, but also other possible factors such as car parks it is noted that this potential was not considered in either the COMAH or Land-Use Planning assessments. In addition temporary congestion factors such as large amounts of scaffolding, temporary fabrications, etc should be taken into consideration, depending on the duration of their presence, as I have visited many sites where he presence of scaffolding, etc has become an almost permanent fixture. Improved knowledge of explosion factors is also required in order to enhance the ability to identify overpressure generating factors that have come to the fore from the Buncefield case. These include greater potential deflagration strengths from interactions between potential overpressure generating zones for example possible bang boxes, where a deflagration in an enclosed space vents into an adjoining vapour cloud acting as a high strength ignition source for this cloud. Another explosion factor is that moderately reactive materials, such as Butane, Propane and Pentane, have the potential for transition from deflagration to detonation given sufficiently

7 918 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e920 long flame paths in external environments. Prior to the Buncefield incident it is likely that the potential flame acceleration to detonation would have only been considered for highly reactive materials such as acetylene, ethylene oxide and hydrogen. The potential for detonation of combustible vapour clouds in open environments has until now been generally discounted (HSE guidance (UK HSE), CCPS guidance (USA AIChemE e CCPS, 1994) and TNO yellow book (TNO Yellow Book, 1997)). Even though it may still be highly unlikely, the learning from the Buncefield event should mean that factors such as very large cloud formation, moderately reactive materials and potential long turbulent flame paths are identified as potentials for greater overpressure generation. 2) Release and generation of a massive vapour cloud. Future risk assessments (consequence modeling) should consider still weather conditions with very low or zero wind conditions. These should be modeled for heavy/neutral buoyant vapour clouds where there is the potential for a prolonged release. In previous assessments the calmest weather condition has been taken as 2 m/s (4.5 mph) F stability. Even these low wind speeds will still have had significant dispersion of the vapour cloud and resulted in smaller flammable vapour clouds compared to that under calm/zero wind speed conditions. The weather data from a UK met office weather station (UK Met Office) close to the Buncefield site is shown in the following Figs. 3 and 4. This shows that wind speeds less than 1.5 mph (0.67 m/s) had been present for almost 11% of the time (10.86% in total of the table in Fig. 4). Fig. 5 shows weather data extracted from the 2nd edition of Loss Prevention in the Process Industries (Lees, 1996) for the Watnall location, another UK weather station. This again shows that wind speeds below 1 mph (0.45 m/s) had been present for 11% of the time. Therefore, calm/zero wind speed conditions are likely for Fig. 3. Windrose data from the UK met office. Fig. 4. Supporting weather data for the Bedford station. periods significant enough for this weather condition case to be considered where prolonged releases could occur. The modeling for still weather conditions probably requires further research and development of some practical empirical dispersion models as this weather condition is outside of the valid range of current empirical dispersion models. The potential vapour cloud can be estimated as a radial spreading cloud at stoichiometric concentration following the site topography over a depth of 2e3 m above the pool/release point. The volume and hence spread of the vapour cloud will be that of the vapour generation from the liquid release. This is only a simple estimate but it does allow for the identification of overpressure generating locations that may otherwise have been missed from worst case determinations based on 2 m/s F stability conditions. 3) The other factor in all the large-scale explosion cases is the prolonged nature of the release. Detection was absent in all of the cases prior to ignition. This delay in detection is being made worse on current sites as a result of two site improvements namely better control over potential ignition sources and increased automation and reduced site manning. In the UK improved control over ignition sources has resulted from the application of the Dangerous Substances Explosion Atmosphere Regulations (DSEAR). This has looked at better identification of potential flammable atmosphere generation and the use of appropriately protected equipment in potentially hazardous areas. In addition to electrical equipment this now covers the range of potential equipment failures including static and mechanical ignition source generation. As a result the potential likelihood for small and medium releases finding an ignition source on site has reduced. In the absence of any detection this leads to a greater potential for a longer period to delayed ignition, most likely now by sources outside of standard hazardous zones. Reductions to manning, on sites, also reduce the potential for direct visual detection of leaks and spills. Sites handling large inventories where hazardous vapour clouds could form, and in particular where large neutrally or dense vapour clouds could form, must have means for leak detection in place and the means to remotely isolate flows. It is interesting to note for Buncefield that DSEAR assessments had been undertaken, that the ignition source was possibly from a unit outside hazardous area determinations and that leak detection, in the tank bunds, had been recommended but not installed. The requirement for improved detection has also been highlighted in the recommendations of the BMIIB (2008). This should be a consideration on any process site that increases remote automated control and reduces site manning levels and should be considered in any organizational change/de-manning studies.

8 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e Fig. 5. Wind data from Loss Prevention in the Process Industries, 2nd ed., section Prevention learning Preventing loss of containment should always be the first priority. The BMIIB has made a number of recommendations (BMIIB, 2008) related to improvements to storage tank overfill prevention and reference should be made to the recommendations raised and which are summarized in the final BMIIB report. I am not going to repeat these, but there are some significant measures that I have been looking for at sites I have visited post Buncefield. These are: When handling large inventories, particularly by pipeline, that there is ultimate high-high level trip action and that this has been reviewed, designed, installed and tested in compliance with IEC In particular where there are such systems that the design of the tank isolation trip also takes into consideration the speed of isolation action. This should be such that under the worst case filling rate there is available ullage above the high-high set point to provide sufficient time for closure of the isolation valve. Such functional factors are of as much importance as the reliability (SIL level) of the instrument loop. That overfill protection is not solely on high and high-high levels with the tanks. There should also be some form of accountancy monitoring, i.e. checks against expectations for level change during transfer operations via a mass/volume balance. This can be through operator checks but could also be included into the logic of some of the newer control systems. 8. Containment and emergency system learning Recommendations have been made in the BMIIB reports relating to the design of post release mitigation measures. The principal improvements are those related to the design and operation of tank bunds (dykes). Too often the key design feature for bunds had simply been to ensure that the bunds were sufficiently sized to contain the contents of any tank e.g. 110% of largest tank. However, the Buncefield event has highlighted design features such as the sealing of bund walls, pipe penetrations from bunds and the emptying of bunds (BMIIB Report, 29th March 2007). I would also add that bunds should be designed to contain foam layers in fire fighting and that there should also be engineered overflow from bunds to safe locations, e.g. site drainage rather than adjacent roads, graveled areas, etc. The whole design of liquid containment is an area in which more focus should be given on the management of run off from incidents, particularly as environmental concerns over fire water run off can match or even exceed those of the initial fire event. In addition to it being the most likely source of ignition, the emergency fire water pump house was destroyed in the Buncefield explosion. This resulted in the site fire water system being unavailable to tackle the ensuing fires. The location of the pump house close to the tanks meant that it was vulnerable to damage from tank incidents. The positions of emergency systems should be reviewed in the light of the potential consequences of events on site. 9. Conclusions Significant learning has come from the Buncefield event. The typical methods and practices employed for the hazard identification and risk assessment of this site, at the time, were unlikely to have identified the high overpressure generated on the night. In part this is because of a lack of awareness of previous incidents of a similar scale and their implications. It is also because of a lack of understanding of how the local vegetation could generate the conditions for significant overpressure generation. The Buncefield incident has highlighted the potential for the formation of very large flammable vapour clouds following undetected prolonged releases of petrol. However, similar prolonged releases are equally possible from other equipment items such as pipelines and at other storage locations (not just petrol storage). The scale of potential consequences, from ignition of large vapour clouds, can be such that the likelihood of such events needs to be significantly low enough for the risk to be considered as low as is reasonably practicable. This requires good hazard identification, of potential large-scale vapour cloud formation events, and the measures being in place to reduce this cloud formation and ignition likelihood. Learning from Buncefield and previous events should be used to improve hazard identification and risk assessments for such sites. Focus should be on the prevention of loss of primary containment. This should follow the recommendations in the BMIIB reports (BMIIB, 2008). Factors such as better inventory management and overfill protection should be in place. It should also include design of liquid containment and means for leak detection and response.

9 920 I. Herbert / Journal of Loss Prevention in the Process Industries 23 (2010) 913e920 Modeling of the consequences of large vapour clouds should also be checked. The formation of large clouds should be covered taking into consideration those factors which increase cloud size for dense and neutrally buoyant vapour clouds. Consideration of still wind conditions, Delayed ignition potential increases due to better control over ignition sources, The ease/speed of detecting loss of containment. The lessons from Buncefield have similarities to some of the key parts of the Baker Report (Baker et al., 2007) such as Leadership, Process information, Process Hazard Analysis, Equipment Integrity and Fitness for purpose. Sites need to ensure that the learning from these events is incorporated into ongoing reviews of their Process Safety Management. In particular there should be regular reviews of the site risk assessments to ensure that learning from the Buncefield event and other incidents/guidance/standard changes are incorporated and that the Basis of Safety for a site is soundly maintained. Postscript. Since this paper was originally drafted two almost identical events, to the Buncefield incident, have occurred. These were the events in Puerto Rico at the Caribbean Petroleum Corporation (CAPECO) site on 23rd October 2009 (US Chemical Safety Board, 2009), and in Indian at the Indian Oil Corporation (IOC) depot in Jaipur on the 29th October 2009 (Indian Oil Industry Safety Directorate). Both sites had significant releases of petrol and blast effects were felt over considerable distances. Again it would appear that there were still weather conditions and a large petrol vapour cloud formation. These recent incidents should strengthen the consideration, in site hazard identification and risk assessments, for large petrol release events under still weather conditions. This report, including any opinions and/or conclusions expressed, are those of the author alone and do not necessarily reflect ABB policy. References Anonymous. (7th January 1983). Report on the incident at the Texaco Company s Newark storage facility. Loss prevention bulletin, no. 057, June 1984 (pp. 11e15). Reprinted in Loss prevention bulletin, no. 188, April 2006 (pp. 10e13). Anonymous. (5th Dec 1999). News report. A whiff of oil, then a thundering explosion. Bangkok Post. Baker, J., Bowan, F., Erwin, G., Gorton, S., Hendershot, D., Leveson, N. et al. (January 2007). The report of the BP U.S. Refineries Independent Safety Review Panel. BMIIB. (16th August 2007). Explosion Mechanism Advisory Group report. BMIIB. (11 Dec 2008). The final report of the Major Incident Investigation Board. BMIIB report. (29th March 2007). Recommendations on the design and operation of fuel storage sites. BMIIB report. (17th July 2007). Recommendations on the emergency preparedness for, response to and recovery from major incidents. BMIIB report. (15th July 2008). Recommendations on land use planning and control of societal risk around major hazard sites. Buncefield Major Incident Investigation Board (BMIIB). (21st Feb 2006). First progress report. Buncefield Major Incident Investigation Board (BMIIB). (11th April 2006). Second progress report. Buncefield Major Incident Investigation Board (BMIIB). (9th May 2006). Third progress report. Buncefield Major Incident Investigation Board (BMIIB). (13th July 2006). Initial report. Buncefield site COMAH safety report. Due to UK national security concerns COMAH safety reports are not published in the UK public domain. Summary findings were seen as part of the 2008/9 civil case. Indian Oil Industry Safety Directorate. Independent Inquiry Committee Report on IOC terminal fire at Jaipur e 29/01/10. Lechaudet, J. F. (1995). Assessment of an accidental vapour cloud explosion. Loss Prevention and Safety Promotion in the Process Industries, 314, 377e378. Lees, F. P. (1996). Loss prevention in the process industries. Section 15 (2nd ed.). Elsevier. Russo, G., Maremonti, M., Salzano, E., Tufano, V., & Ditali, S. (1999). Vapour cloud explosion in a fuel storage area; a case study. Process Safety and Environmental Protection, 77(B6), 310e365. TNO yellow book. (1997). CPR 14E parts 1 and 2. Methods for the calculation of physical effects e Due to releases of hazardous materials (3rd ed.). UK, Chemical Industries Association. (Nov 2003). Guidance for the location and design of occupied buildings on chemical manufacturing sites (2nd ed.). UK, HSE. Consultative document CD211. Proposal for revised policies for HSE advice on development control around large-scale petrol storage sites. UK, HSE. (09 July 2001). HID e safety report assessment guide: HFLs (highly flammable liquids). UK, HSE. (2009). Buncefield explosion mechanism phase 1, Vols. 1 and 2. HSE research report RR718. UK e LASTFIRE project e large atmospheric storage tank FIRE, consortium of 16 companies, research coordinated by Resource Protection International UK Ltd. Ten year statistical data from the UK met Office for the Bedford weather station between 1982 and USA, AIChemE, Centre For Chemical Process Safety (CCPS). (1994). Guidelines for evaluating the characteristics of vapour cloud explosions, flash fires, and BLEVEs. US Chemical Safety Board. (November 2009). Caribbean petroleum refinery tank explosion and fire.