|
Root causes are surfacing to the December,
2005 Buncefield oil depot fire and explosion in Hertfordshire, U. K. –
the largest in England since World War II
On December 11, 2005 an
unleaded gasoline tank at the Buncefield Oil Terminal was overfilled and
ignited about one hour after the overfill started. This Terminal was small by American standards but the damage
to the terminal could reach $200 million and the surrounding property
damage will approach $300 million. More
significantly, third party liability is estimated to be around $2 billion.
The terminal is owned by the French oil company Total (60%) and the
USA based Texaco (40%). It was operated by Total.
What is known of the
incident:
● Tank 912 was
being filled from an incoming pipeline, starting at about 6:00 pm on
Sunday afternoon at a rate which should fill the tank in 11 hours.
● At midnight the
loading operations were closed and a stock check was carried out as part
of normal operating procedures.
● At 3:30 am the
gauge sensor on the tank that sent the level indication to the control
room stuck or stopped at that level, but the tank was still being filled.
● 5:20 am tank
calculations showed it to be at the point of overfilling.
● The first
explosion was at 6:01, at which time the gasoline vapors had spread more
than a thousand feet outside the plant property on two sides.
● After the initial
ignition and explosions, there were more than twenty tanks in the Total
terminal and the adjacent terminal which had caught on fire.
● The fires quickly
overcame fire departments preplans. The
fires burned out 4 days later.
Lessons Learned:
1. The investigation is
not complete but there is a great deal of attention centering on the High
Level Alarm and automatic shut down arrangement on the tank.
Primarily it centers on the Cynergy3 brand switches in the control
room. Evidently to test the
system a cover or arm is moved at the switch and then a test is done.
If the cover or arm is not returned to the normal position the
system appears to be operating but it is not, and will not alarm and
perform the automatic shutdown of product flow to the tank.
See official warning attached.
2. The emergency response
plans should consider multiple tank fires, usually defined as all of the
tanks in the largest common dike.
3. Control room operators
should have a clear reminder of which tanks are being filled and what the
estimated fill time would be. Maybe
just a sticky label above each tank monitor with the estimated full time
and the gauge reading at the last hour.
Threading last hour would indicate if the gauge is stuck as well as
being a reminder of when it would be full.
4. Last and most
important there should be a strictly controlled (by special key or
supervisor password) formal written program on bypass and restoration
procedures of any critical warning or shutdown system.
Subsequent
Investigations and Findings
After the Buncefield fire, teams lead by
the Health and Safety Executive visited 108 similar sites in England,
Scotland and Wales during the subsequent four months to perform safety
checks. A report from the HSE
says there is good compliance at the majority of them, but significant
issues were found at five, the most serious being a case of inadequate
maintenance of fire-fighting equipment.
This press release may be viewed here.
The Health and Safety Executive (HSE) has
published initial feedback from the safety alert it issued to operators of
fuel storage depots in February 2006 which may be seen here.
The Aftermath:
A July 25 article
from the U. K. Guardian presents the current status of investigations into
this accident: http://www.guardian.co.uk/uk_news/story/0,,1827982,00.html#article_continue
|
