The causes underlying the Buncefield accident, on 11 December 2005, were not quoted in real detail in the several initial reports published, and even in the final report of the Major Incident Investigation Board, issued in 2008, basically because of the impending legal proceedings against several of the companies involved. Sentence was passed on the Defendants on 16 July 2010, with fines and associated costs charged to them of around GBP8.5m. Following that the issue of the Health and Safety Executive COMAH summary report “Buncefield – Why did it happen?” tried to summarize the details of the story. You can see this report on www.hse.gov.uk/comah/buncefield/buncefield-report.pdf.
What was more interesting was to listen to a recent presentation to the InstMC Wessex Section by Colin Howard, of Istech Consulting in Teesside, a company he founded in 2001 after a 35 year career with ICI, and various other roles in C+I, QA and safety. Introducing Mr Howard as a Past President of the Institute of Measurement and Control, and as a soon-to-be Honorary Fellow of the same, Graham Dunkley, Chairman of the Wessex section of InstMC explained to an audience of well over 100 engineers at the National Motor Museum at Beaulieu that Howard had been the “Expert witness to the Court” in these Buncefield prosecutions: this is an impartial advisor to the Judge – and the Jury – on the technical aspects being discussed in the presentations of evidence to the Court.
Background to the operations
The detail was that the 6000m3 tank receiving the pipeline delivery of 8400m3 of heavy gasoline containing 10% butane inevitably overflowed, by around 300 tons / 250,000 litres, because the operational system in use covering this part of the site relied on high level alarms from the tank level gauging system to tell the operators to switch over to another receiving tank. This level gauging system failed, as it had done 14 times in the previous 3 months, but the operators did not have a display of the tank level visible (which would have shown a static level): the single screen display available to them was devoted to showing a different tank. The independent high level alarm (IHLS), a spring-supported magnetically actuated reed switch driven from a weight on the floating roof, also failed. This was of an early 1980s design, and the failure was because the padlock holding the maintenance test arm on this switch had not been refitted after use, and therefore did not hold the self test arm in the correct place. The test arm dropped, making the relay move in relation to the end stop, and prevent the magnet reaching the reed switch. In the manual it stated “Fit the padlock for security”, which did not indicate that the padlock hasp had to be 5mm dia +/- 0.1mm, and that any different size would make a malfunction possible, and that this padlock played an essential part in the functioning of the level alarm system. It seems that most other sites using this system have also lost or replaced this padlock with their own unit, not of the required size.
At Buncefield, when delivery drivers reported to the control room that there was a dense cloud of fuel vapour around the tanks – the butane had vaporized when dropping over the edge of the tank in a spray – the operators pressed the Emergency Shut-Down button on the system – use of this was meant to close all tank side valves: but there was no software associated with this button. Later it was shown that of the five security levels in the software only one level was used, and everyone had access to that. While there was no procedure written down for the tank filling activity – a point missed during a recently completed DNV assessment and review of the site procedures – the operators knew that they had to phone Birmingham to have the operators there stop the delivery of the gasoline down the line: they had to use the normal commercial phone land-lines, they had no control system feature that could halt the inflow on site at Buncefield.
The operators did have a Fire Alarm button, which would start the firewater pump to cover the tanks with water, and protect them from the heat of any fire. However, pressing that led to an immediate vapour cloud explosion, probably ignited by a spark from the pump itself: it measured 2.4 on the Richter scale. The fire burned for several days, and the bund walls, another essential safety feature, showed themselves to be inefficient, and leak: the tertiary containment was inadequate. Fire suppressants and fuel leaked into the groundwater around the site.
The fines imposed
The fines imposed were a total of: Total (UK) Ltd GBP2.6m, Hertfordshire Oil Storage Ltd (HOSL), a Total subsidiary, GBP 1.45m, British Pipeline Agency Ltd (BPAL) GBP300k, Motherwell Control Systems 2003 Ltd GBP1k and TAV Engineering GBP1k. In this, apparently it was recognized that larger fines for these two instrumentation companies would threaten their commercial future. Initially some press reports suggested the high level alarms were Cobham float switches, but while Cobham float switches were common on this site, none were involved in this accident. This business has subsequently been sold by Cobham, to AMSensors Ltd.
Howard further commented that these overfill hazards are common occurrences, and over the last 30 years six similar events have been reported. Since Buncefield, there have been two further such events. He comments that in August 2003 Buncefield had a near miss – a dress rehearsal for the December 2005 accident. Then, the IHLS failed, but it was not replaced until April 2004!
What did the Judge say?
The Judge said all the things you would expect. But most relevant was the response to the defence offered by the main operators on site: their defence was that they had sub-contracted level gauging and alarm system maintenance, that they had subcontracted the safety and procedures audit, or in the case of HOSL, it had subcontracted all operational matters on site to Total (UK). In other words they said “It wasn’t our responsibility, we told them to do it!” The Judge ruled that it was not legally possible to pass on (ie sub-contract) such responsibility. “The core of a major hazard business should be clear and positive process safety leadership and board level involvement and competence to ensure that major hazard risks are being properly managed.” It was also noted that “Routine operations are often those in which lax habits are most likely to develop”. The summary report quoted above gives many more such comments.
What did Howard say?
The small comments, maybe of detail, from Colin Howard, were in a way more interesting. The whole site had been split into separate companies, and a perimeter fence built half way across the area covered by a control system: so the half of a system left with the operators of the BPA pipeline was not really adequate. The operators did not like the fact that they had no control over the delivery system, and indeed did not have a flow measurement indicator for that delivery line: during the delivery that caused the overflow, from 1850 hours on the Saturday night, the flow rate was around 550m3/hr: shortly before the accident the rate of flow increased to around 900m3/hr, without the knowledge of the operators, when other off-takes further down the line were ceased.
The IHLS supplied by TAV to Motherwell Control Systems to replace the alarm on this receiving tank was poorly specified (in April 04), and was of a different design: possibly the original design had been upgraded. It had a dual function test lever, for high or low level alarm. There were no MOC procedures in place to check the implications of this, for performance or maintenance procedures, even if there were such maintenance procedures available (this was not specified, but there were no written procedures relating to the tank filling operation). One supervisor did request the fitting of a back-up, second IHLS.
The staff on site were under pressure to increase throughput, possibly by dealing with higher volume deliveries where tank capacity was at a premium – and they were doing excessive overtime: with high staff turnover, their competencies and experience were open to question.
Will it happen again?
Howard commented that since Buncefield, there have been two further similar overfilling events. There are 60 sites of this type known around the UK, and the Process Safety Leadership Guide entitled “Safety and environmental standards for fuel storage sites” that is considered mandatory has seen patchy implementation across these sites: some have a schedule, and plan to conform only by 2014.
Filed under: Application story, automation systems, Control systems, Education, Hazardous areas, Instrumentation, Legislation, Liquid level control, Oil and Gas Industry, Process Safety | Leave a comment »