Part 2 Abstract The process failure and resulting explosion and fire at the Buncefield Site in Hemel Hemstead, UK was a landmark incident in process safety and explosion analysis in several ways. The explosion was fueled by a vapor/droplet cloud that formed when unleaded gasoline was overfilled from a large storage tank at the H.O.S.L. site on the Buncefield Depot complex. The overtopping of the tank was the result of a failed level indicating system and a lack of attention by the operators at the site. The resulting explosion rocked the area early on a Sunday morning, causing damage to the adjacent business and residential communities. The resulting investigation into this incident, which was driven by the legal actions and proceedings, was a test of the available methods and tools available to the engineering community to perform risk assessments, consequence analysis and forensic analysis. This paper details the comprehensive analysis performed to determine the extent of the explosion damage at the Buncefield Depot and the surrounding area. The paper details the unique perspective of several of the legal experts in the case and provides insight into how the facts of the incident, ranging from fundamental process safety failures to comprehensive explosion dynamics modeling, were impacted by the framework of the legal analysis. The paper details how the vapor cloud formation was explained including; how and to what extent the source term was handled, the effect of the vapor cloud spread rate and the effect of the site geometry, including various man made and artificial obstacles, on turbulence and the resulting explosion magnitude. The analysis presented in this paper compares the TNT Equivalence Method, the TNO Multi- Energy Method, the Baker Strehlow Model and the FLACS program. These explosion analysis tools were used in this evaluation from two perspectives: one was as a risk- assessing tool to help determine what the operators should have foreseen as an explosion hazard; the other perspective was as a forensic engineering tool in an attempt to explain the damage seen and relate it to what may have actually happened. The analysis was carried out with complete topographical information on the Buncefield Site and the surrounding area. A detailed, three dimensional grid was developed from GPS and survey data and used in the empirical models to define the obstruction areas and as a grid in the FDS and FLACS models directly. The comprehensive analysis of the Buncefield Site that was performed showed the variability and possible shortcomings of the current set of explosion analysis tools to a relatively straightforward, highly prevalent and recurring process safety problem. There was nothing unusual about the Buncefield Site with respect to complexity of the process or the surroundings. The weather conditions at the time of the explosion were somewhat cold, calm, with high relative humidity and were typical for the London area at that time of year. The depot was in an area similar to a large number of fuel depots today and the process failure was very straight forward, albeit highly preventable. In effect the fuel leak formed a vapor cloud that spread 337
from the site in a very predictable manner and direction. Given the time of the leak, the volume of fuel in the cloud was easy to attain. This makes this a fascinating case study to examine the quality and usefulness of the existing explosion analysis tools and can be used as a guideline for further development of these tools. It is hoped this paper will provide useful information and perspective to the debate that has taken place as a result of this incident. Introduction At approximately 06:00 on 11 December 2005 a number of explosions followed by large fires destroyed a large portion of the Buncefield Oil Storage Depot in Hemel Hempstead, UK. In addition significant damage occurred offsite to neighboring commercial and residential properties. The ensuing fires burned for several days prior to being extinguished. Background The explosion that occurred at the Buncefield facility was a vapour cloud explosion, typical of a release of flammable liquids followed by a delayed ignition. There have been many similar incidents of various scales that have occurred in the past and thus the generics of the event itself were not uncommon. On the day of the incident the weather was typical December London weather: the humidity was close to 100%, the temperature was hovering around freezing, and there was a slight breeze. The near still conditions meant that the vapour cloud spread and flowed largely due to the topography of the site and gravity slumping. The depot itself was typical of others throughout the world and even with others in the area. The incident occurred due to the overfilling of tank 910 and the subsequent formation and spread of a flammable vapour/droplet cloud. Witnesses and CCTV footage show the spreading of the vapour cloud throughout the site and off the site premises into the carpark area. At approximately 06:00 the explosion was initiated. Because of the scale of the loss a large amount of effort was driven to determine the cause and the explosion mechanisms and much of this was driven due to the pursuit of legal claims by offsite parties and by the government. Thus during the investigation the objective became not only to reconstruct the physics of the incident but also to evaluate the process and the tools that set- up the potential for the incident and the resulting damage to occur. From this perspective the investigation served as a test for the current methods that are used for risk assessments, consequence analysis, and forensic analysis. During the course of the analysis it became clear that there are some severe shortcomings to the methods used most commonly for consequence analysis and that these shortcomings can result in damage beyond what the methods indicate. In particular the TNT and MEM methods are often used for risk assessment and consequence analysis purposes, however these methods, as described in Part 1 of 338
the paper, require inputs that are non- trivial to determine. The range then of expected outcomes can be difficult to determine unless the most conservative approach is taken. It is also worth noting the change in change in consultation distance, regulations, guidelines, and other incidents in relation to the Buncefield incident as these events provide information that should have been relevant to ongoing risk assessments at the facility. The timeline is portrayed in Figure 27. Risk Assessment vs. Forensic Analysis During the course of the investigation two approaches needed to be taken: the first was to approach the analysis as one would when performing a risk assessment and consequence analysis; the second was to try and recreate the incident using the best available tools to model the creation, dispersion, and subsequent ignition of the vapour cloud and to examine the overpressure profile that was generated using a variety of potential ignition sources. A risk analysis is the process by which potential event sequences and incidents are defined and the consequences are evaluated. The purpose is to capture all the possible failure modes that can occur for a given process and to examine all the consequences that can result so that safety decisions regarding site spacing, detection, and protection can be made. Detailed information about Chemical Process Quantitive Risk Analysis (CPQRA) may be found in the CCPS Guidelines for Chemical Process Quantitive Risk Analysis. A risk analysis is a joint effort but is primarily conducted by or on the behalf of the facility. During the course of a risk assessment there are conventional methods used for determining the consequences and potential impacts of an incident. The overall process for determining consequences per CCPS is outlined in Figure 15. The key is that the purpose is to attempt to define possible outcomes as a result of the analysis, thus using simplified methods that are conservative and ensure that the maximum consequences are captured can be used. 339
Figure 15 Logic diagram for consequence analysis using models (after CCPS) In industry there are two quite different views on conducting a risk analysis: the first is that any analysis may expose the company to additional litigation as it will identify and quantify the risks and in the vent that something happens it will be viewed as having prior knowledge and not taking adequate steps to prevent the incident. Thus these companies rely predominantly on industry standards and guidelines. The other perspective is that any level of analysis that results in an improvement in safety is good and that if an incident occurs that the additional analysis and protective measures will have a positive outcome. In either case the tools available for use in carrying out an investigation are the same tools and methods used for a risk analysis. The tools that are most frequently cited in literature for risk assessment are the MEM and TNT methodologies as detailed in Part 1 of the paper. These methods while nominally useful for risk analysis to broadly categorize a risk fall short from an investigative standpoint as this paper shows. The option of CFD for use as a risk analysis/investigation tool is also available but until recently has not been utilized extensively due to computational, knowledge, and cost demands. A forensic investigation/analysis is aimed at identifying, in as detailed a fashion as possible, the mechanisms and physical processes that led to the incident and accurate modeling of the outcome. The purpose of the investigation may be varied however typically they are done to improve on future safety or in support of litigation. From this perspective accurately capturing the physical phenomena is extremely important and the tools used must be able to capture the phenomena in sufficient detail. A team that is knowledgeable in performing investigations should perform a forensic investigation and analysis. A forensic analysis requires a team that is 340
familiar with the operations of the facility, has an understanding of process and logic control, is knowledgeable with the interpretation of physical evidence, and has the ability to adequately model the various steps involved in the incident. Collection of site information The proper analysis of the incident required that detailed topographical and spatial information about the site be collected. Detailed data was obtained using augmented GPS measurements. This data was used to create a 3- D CAD model that then was used as the basis for the dispersion model and the explosion model. Figure 17 3D topological CAD model generated from augmented GPS data Figure 16 Augmented GPS topology of the Buncefield site and surroundings Because of the extensive fires within the site it was difficult to assess the damage that resulted from the pressure wave, the information to estimate the overpressure was collected off- site. Trees, poles, buildings, vehicles and other objects were documented in an attempt to determine the extent and shape of the pressure contours. We performed a comparitive damage assessment using experience and documented damage from previous events to compare with the extent of damage in this case. MEM and Application to Buncefield The guidance that was detailed in Part 1 above would indicate that an ST10 should be chosen as the initial blast strength of the Buncefield site when conducting a risk assessment. During the investigation however, a range of blast curves were suggested by various parties for different areas of the site, ranging from an initial blast strength of 2 to 7. The main focus was at what distance from ignition (which by default is the middle of the cloud) would windows break. Literature indicates that windows will break at approximately 7mbar, thus this was the lower bound for damage while 63mbar was chosen as the lower bound for damage to tanks and equipment. Different cloud sizes were chosen based on the volume of several 341
congested areas. The areas primarily examined were the car park, tank 910, the area of Cherry Tree and Buncefield Lane, and the pump pad area. The main difference that came up during the investigation was the difference between what a tank farm operator should assume for the sake of a risk assessment versus the actual conditions on the day of the event. These two perspectives created a range of outcomes as the cloud size, level of congestion, and ignition scenarios are significantly broader when conducting a risk assessment. As stated before the failure mode was not atypical and thus the actual cloud size determined by HSE in the official inquiry is reasonable. This cloud size was used to determine the congested cloud sizes of the areas of interest. On the day of the incident there were few persons on the site, the neighboring buildings were largely unoccupied with few cars parked nearby, and the car park adjacent to the site was empty. This is important, as while this condition existed at the time of the incident, it would not have been prudent to view the car park as a non- congested site from a risk analysis. When conducting the forensic investigation however the car park would be treated as an uncongested area. The approximate volume of the congested areas that was used in the analysis is provided in Table 4. Table 4 Volume of congested areas of interest Area Volume (m 3 ) Energy of Cloud (MJ) Pump pad area 460 1,610 Buncefield Lane tree area 1,800 6,300 Cherry Tree lane tree area 1,500 5,250 Tank 910 980 3,430 Car Park 80,000 280,000 As can be observed from Figure 3 in Part 1 of the paper, the curves for initial blast strengths 6-10 collapse at an energy scaled distance of approximately 2. In other words it is only when the energy scaled distance is less than 2 (i.e. in the near field) that the overpressure between the initial blast curves will vary. Depending on the size of the cloud, this radius will vary, however for the largest cloud involving the car park, at any distance less than approximately 280m the choice of the initial blast strength will make a difference. The differences in the choice of the initial blast strength can be clearly seen in Figure 18 and Figure 19. If one were to assume from a risk analysis viewpoint that the car park would be full then the pressure contours would extend as below. 342
Figure 18 Distance to minimum of 7mbar pressure vs. initial blast strength with full car park assumption Figure 19 Distance to minimum of 63mbar pressure vs. initial blast strength with full car park assumption A full carpark filled with vapour would most likely be the worst- case scenario, as it would constitute the largest area of congestion. The above figures show that by choosing an initial blast strength of 10 as recommended, the predicted damage extends far beyond the confines of the site and well into the commercial and residential areas. In particular, serious structural damage (63 mbar) would occur up to approximately 730m from the source of the ignition, larger than the dimensions of the HOSL site. Even at the lower initial blast strengths that were proposed the blast wave would extend off site. Using the estimated congested volumes and what little guidance is provided, along with information from the investigation reports you can determine what the pressure contours should have looked like for this event using the MEM. Table 5 provides the volumes, distances, and the initial blast strengths for the areas as they were on the day of the incident (i.e. empty carpark). 343
Table 5 Congested areas and distance to critical overpressures Area ST value Volume (m 3 ) Distance to 7 mbar (m) Distance to 63 mbar (m) Pump Pad 5 460 451 50 Firewater 4 141 151 19 Pump house Tank 910 4 735 263 32 Emergency 4 45 105 13 Generator Carpark 2 80,000 279 NA When the information from above is overlaid with the estimated damage from the Buncefield Explosion Mechanism Advisory Group Report xxxiv it can be seen that the both the general shape of the actual pressure contours as well as the estimated values do not correspond with those predicted by the MEM. While the pressures outlined in the EMA report may be overly high the MEM significantly under predicts the pressures that would be produced and thus the extent of damage, using existing guidelines. Figure 20 MEM 7mbar (Red) & 63mbar (Yellow) contours (circles) for each of the congested areas using Table 5 data overlaid with overpressure estimates from Explosion Advisory Group Report If a more conservative approach is taken and the initial blast strength is 6-10 while keeping the carpark a ST 2, as shown in Table 6, then the contours appear as in Figure 21. What becomes clear is that none of the MEM blast predictions match with the damage that was observed, regardless of what the ignition source was or the extent of the cloud. It cannot be applied in a forensic setting because it doesn t model the phenomena of an explosion. As such no matter what the assumptions of the risk analysis were they will not translate into a post incident use of the MEM. 344
Table 6 Congested areas and distance to critical overpressures using ST 7 values for congested areas Area ST value Volume (m 3 ) Distance to 7 mbar (m) Distance to 63 mbar (m) Pump Pad 7 460 760 132 Firewater 7 141 512 89 Pump house Tank 910 7 735 890 154 Emergency 7 45 350 61 Generator Carpark 2 80,000 279 NA Figure 21 MEM 7mbar (Red) & 63mbar (Yellow) contours (circles) for each of the congested areas using Table 6 data overlaid with overpressure estimates from Explosion Advisory Group Report CFD analysis of Buncefield To try and capture the physical phenomena that took place at Buncefield the detailed CAD information was used to form the basis of a Fire Dynamics Simulator (FDS) dispersion model. The FDS model incorporated the tanks, bund walls, trees along Buncefield and Cherry Tree lane and incorporated the changes in topography. Because the ambient conditions were near quiescent the topology and in particular Buncefield Lane played a key role in the gas dispersion. The vapour cloud was a heavier than air mixture that was interspersed with condensate, the gas flow was thus driven predominantly by the landscape and occasional air movement. What becomes clear from the CFD dispersion model is that turbulence is induced and increased mixing occurs as the gas flows, even with minimal to no contribution from wind effects. What can be seen in the CFD results is a tripping of the vapour cloud as a result of the sloping terrain and the treeline, Figure 22. 345
Figure 22 CFD showing the "tripping" effect of the trees and slope of Buncefield Lane This induced turbulence and mixing prior to ignition would generate well- mixed cloud in areas that already has turbulent energy. This will result in increased pressure after ignition occurs. The tripping effect can be represented on a small scale by examining Figure 23. As the vapour moves over a change in height small eddies are formed and this creates turbulence and enhanced mixing. Figure 23 Representation of vapour tripping over sloped terrain CFD modeling of the Buncefield incident has indicated that the repeated trees, even though they were not extensive, caused the pressure to rise beyond what would be normally anticipated in a relatively open space. While the exact pressures are unknown, what the CFD showed was that the shape of the contours and the estimated maximum pressures match well with the observations made during the investigation, Figure 24. Figur e 24 Pressure contour of possible ignition scenario at Buncefield, showing impact of tree lines Figure 25 Estimated pressure contours from EMA report, showing highest pressures along tree lines 346
Figure 26 3D view of Buncefield overpressure Conclusions Based on Part 1 and 2 of this paper it becomes clear that the use of empirical models must be limited to risk analysis and not for investigations or forensic use. Investigators must rely on tools that can simulate the physics of the incident in order to be able to determine what happened. If a tool cannot do this then it is inappropriate for reconstruction of the event. When empirical models are applied in a risk assessment great care needs to be taken to ensure that the hazard is adequately being accounted for and that the consequences are not under predicted. From the RIGOS experiments and the cfd modeling of those experiments it becomes very clear that even on relatively simple cases involving simple geometries that the methods can seriously under predict the consequences. The inability of the MEM to account for fuel reactivity can result in drastic differences between real world observations and the models predictions. The simplified empirical tools can be of some basic use if a knowledgeable person is applying them for rough estimates, as they are quick and simple to use, however for a risk assessment the ability to model the physical phenomena is necessary in at least a few areas in order to be able to capture the impact of obstructions and fuel reactivity. While cfd tools like FLACS can be more time consuming and slightly more expensive than the empirical models, the relative increase in cost when looking at the budgets for refinery or chemical process operations is negligible. o Did it require an incident like Buncefield to figure out that TNO might not be the best tool for risk assessment in all cases? 347
Figure 27 Buncefield timeline 348
References i Clive Dym, Principles of Mathematical Modeling, Second Edition ii The 100 Largest Losses 1972-2001. Large Property Damage Losses in the Hydrocarbon- Chemical Industries. 20th Edition: February 2003 A Publication of Marsh s Risk Consulting Practice iii Comparison of blast prediction models for overpressure iv Comparison of blast prediction models for overpressure v Methods for vapour cloud explosion blast modeling vi Guidelines for Evaluating the Characteristics of Vapor Cloud Explosions, Flash Fires, and BLEVEs vii A. Lannoy, Analyse des explosions accidentelles reelles. Evaluation de rendement d explosion pour le prevision des effets de suppression, Revue Generale de Thermique, March 1982. viii A. Lannoy, Analyse des explosions air- hydrocarbure en milieu libre. Etudes deterministe et probabiliste du scienario d accident; prevision des effets de surpression, Bulletin de la Direction des Etudes et Recherches d Electricit& de France- S&- ie A, No.4, Saint Denis, 1984. ix K. Gugan, Unconfined Vapour Cloud Explosions, The Institution of Chemical Engineers, London, 1979. x D.K. Pritchard, A review of methods for predicting blast damage from vapour cloud explosions, J. Loss Prev. Process Ind., 2(4) (1989) 187-193. xi A.C. van den Berg, The Multi- Energy Method - a framework for vapour cloud explosion blast prediction, J. Hazardous Mater. 12 (1985) l- 10. xii A summary of vapor cloud explosions: a Second Update IRI xiii Research to improve guidance on separation distance for the multi- energy method xiv Dag Bjerketvedt, Jan Roar Bakke and Kees van Wingerden. Gas Explosion Handbook. Journal of Hazardous Materials Volume 52, Issue 1, January 1997, Pages 1-150 xv Guidelines for Facility Siting and Layout, Center for Chemical Process Safety, AIChE, 2003. xvi Guidelines for Evaluating process plant buildings for external explosions and fires, CCPS, 1996 xvii I.O. Moen, D.M. Knystautas, J.H. Lee, Flame acceleration due to turbulence produced by obstacles Combustion and Flame, Volume 39, Issue 1, September 1980, Pages 21-32 xviii R. Starke, P. Roth, An experimental investigation of flame behavior during cylindrical vessel explosions Combustion and Flame, Volume 66, Issue 3, December 1986, Pages 249-259. xix A. Teodorczyk, J.H.S. Lee, R. Knystautas, in: Twenty- third Symposium (International) on Combustion, The Combustion Institute, Pittsburgh, 1990, pp. 735-741. xx A.R. Masri, S.S. Ibrahim, N. Nehzat, A.R. Green. Experimental study of premixed Flame propagation over various solid obstructions. Experimental Thermal and Fluid Science 21 (2000) 109-116 xxi M.J. Tang, Q.A. Baker, Comparison of blast curves from vapor cloud explosions. Journal of Loss Prevention in the Process Industries 13 (2000) 433 438 xxii Mercx, W.P.M., editor (1994), Modelling and Experimental Research into Gas Explosions, Overall final report of the project MERGE, CEC contract STEP- CT- 0111(SSMA), European Commission, Directorate General XII, Brussels, Belgium, 1994. xxiii Mercx, W.P.M., editor (1997), Extended Modelling and Experimental Research into Gas Explosions, Final summary report of the project EMERGE, CEC contract EV5VCT930274 European Commission, Directorate General XII, Brussels, Belgium, 1997. xxiv O. Talberg, O.R. Hansen, J.R. Bakke and K. van Wingerden. APPLICATION OF A CFD- BASED PROBABILISTIC EXPLOSION RISK ASSESSMENT TO A GAS- HANDLING PLANT. FLUGs document. xxv Hansen, O.R., Talberg, O. and Bakke, J.R.: CFD- Based Methodology for Quantitative Gas Explosion Risk Assessment in Congested Process Areas, International Conference and Workshop on Modelling the Consequences of Accidental Releases of Hazardous Materials, San Francisco, September 1999 xxvi J.T. Berg, J.R. Bakke GexCon A/S, P. Fearnley. A CFD Layout Sensitivity Study to Identify Optimum Safe Design of a FPSO. OTC Paper Number 12159, 2000. 349
xxvii The Netherlands Organization for Applied Scientific Research (TNO) 1997, Methods for the Calculation of Physical Effects (Yellow Book 3rd edition) CPR14E Part 1, Director- General for Social Affairs & Employment, The Netherlands. xxviii Mercx, W.P.M., van den Berg, A.C., Hayhurst, C.J., Robertson, N.J. and Moran, K.C., 2000, Developments in vapour cloud explosion blast modelling, J Haz Mat, 71: 301 319. xxix RIGOS xxx K.G. Kinsella, A Rapid Assessment Methodology for the prediction of vapour cloud explosion overpressure. Health, Safety, and Loss Prevention in the Oil, Chemical, and Process Industries, 1993 xxxi K.G. Kinsella, A Rapid Assessment Methodology for the prediction of vapour cloud explosion overpressure. Health, Safety, and Loss Prevention in the Oil, Chemical, and Process Industries, 1993 xxxii W. P. M. Mercx, D. M. Johnson, J. Puttock, Validation of scaling techniques for experimental vapor cloud explosion investigations. Process Safety Progress. Volume 14, Issue 2, Date: April 1995, Pages: 120-130 xxxiii RIGOS xxxiv Explosion Mechanism Advisory Report, Buncefield Major Incident Investigation Board 350