Evidence of the Buncefield Oil Storage and Transfer Depot Fire of 2005 - Assignment Example

Full Citation of the Case and Parties ____________________________________________________________________ Draft Report of (Your Title and Name) Date ____________________________________________________________________ Specialist Field : Assisted by : On behalf of : On instructions of : Subject Matter : Inspection Dates : ____________________________________________________________________ Evidential Report (Buncefield Case) Introduction. This report seeks to review the Evidence of the Buncefield Oil Storage and Transfer Depot fire of 2005, which was caused mainly by neglect or laxity and an inefficient and complacent approach on the part of workers and management when it comes to matters of safety in the oil depot.  The layout of the Buncefield site A tank farm in Hemel, England, Hertfordshire, Hempstead, Buncefield Oil Storage and Transfer Depot is an oil storage and transfer facility with operating sites that transported and distributed fuel in batches to London and South East England. The evidence provided is to the effect that the fire and damage were mainly caused by primary, secondary and tertiary containment failures with the management, the equipment manufacturers and the workers to actually customize, install, maintain and operate the equipment such that it provides the maximum output with minimal accidents or damage. The evidence suggests that the fire and damage could well have been avoided if there were no management and technical failings in the operation of the Independent high level switch and the automatic tank gauging system in that the independent high-level switch was inoperative while the gauging system was ‘sticky’ in its operation. Apart from these technical causes, there were more reasons mainly relating to the workers and the management's complacency and slackness. Chronology of events leading to the fire. According to the Control of Major Accident and Hazards on the causes of the Buncefield oil storage and depot explosion and fire, on the 10th of December 2005, a tank in the Buncefield oil and storage depot, the Hertfordshire Oil Storage Limited (HOSL) tank was in the process of being filled with unleaded petrol.1 The automatic tank gauging system fitted onto the tank and designed in such a way that it would display the level of fuel in the tank on a screen in the control room of the depot malfunctioned and therefore did not alert the workers or those in the control room when the level of fuel rose and overfilled the tank. The independent high level switch which was to automatically close the valves and sound an alarm when the oil exceeded the tank level failed to register the rising level due to the malfunction of the gauging system which in effect resulted in a spill of the petrol out of vents in the tank roof of the HOSL tanks. Because of the spill, a vapour thought to be a mixture of hydrocarbons and ice crystals soon formed from the shell and spread throughout the surrounding areas. Members of the public soon noticed this vapour and alerted the workers at the oil storage facility which in turn sounded the alarm and begun efforts to contain the situation. A firewater pump was used which caused a vapour cloud explosion resulting in a fire which spread to over 50 fuel tanks in the depot some of which were storing jet fuel and burnt for five days with a considerable amount of fuel, water and foam containing some pollutants sipping into the soils and necessitating the need for monitoring programs to check on long-term pollution to the aquifers in the area. Causes of the disaster. 1. Root causes. 1.1 The Independent high-level Switch. The independent high-level switch is a form of level control used by the Hertfordshire Oil Storage Limited. Its primary function is to close automatically down operations if the tank is overfilled with fuel. For the Independent high-level switch to function effectively, it requires a padlock to retain its check in a proper working condition and position.2 In this incident, neither the manufacturers nor the suppliers communicated the need for a padlock to the installers and the workers. In effect, the crucial lock was not fitted with the independent high-level switch. Failure to have this key lock fitted was as a result of a clear disconnect between the designers of the IHLS - TAV Engineering Ltd - the suppliers - Motherwell Control Systems 2003 Ltd - and the subsequent users of the device. The installers and operators of the switch were in such a position that they did not understand the way the switch worked therefore making it effectively inoperable after it was tested. Clear instructions and safety measures plus the crucial operation of the padlock and its criticality in operations of the tank were never apparently passed to the installers and operators thereby creating a gap that necessitated the disaster. Therefore, the disaster was brought about by failure in passing down the crucial operation and maintenance information from the manufacturers to the suppliers down to the operators. TAV Engineering Ltd did not inform the tank operators; neither did Motherwell Control Systems 2003 Ltd, which ordered the IHLS from TAV to be supplied to the final consumers. TAV as the manufacturer also did not offer advice to its customers nor did it make any inquiries as to the purpose for which the IHLS would be used in order to give proper instructions in its use. The staffs on site at the Hertfordshire Oil Storage Ltd also were negligently not aware of the need for a padlock. For a company that deals with highly flammable material, it was their duty to be well acquainted with all the machines needed their operations and safety in order to prevent disasters. 1.2 The Automatic Tank Gauging System. It is another level of control used by the tanks to enable the workers to monitor filling operations from their working stations. The automatic tank gauging system in this instance had stuck intermittently on various occasions and, unfortunately, was not replaced.3 It was, therefore, unreliable, and when the time came for it to control the level of fuel and set off alarms, it failed. According to the report, the servo- the gauge was stuck, an occurrence that was not uncommon. It is caused the level indicator to flat line. Despite this happening about 14 times in the recent past, no major rectifications had been made, the staff only manually stuck and raised the sticking gauge to its highest position then let it settle again in order to restore it to its normal functions. In addition to this, the staff also logged in the incidents with the sticking gauge as a fault and not something recurrent that needed to be replaced or properly fixed. Motherwell, the suppliers, were called on occasions to repair the stock gauge, but they made no investigations as to the cause of its malfunction or made any attempts to rectify the problem. 1.3 The Monitoring screen. The staff at the Hertfordshire Oil Storage Limited used visual display screens to monitor the status of the tanks in the process of being filled with fuel. The visual display screens were such that only the state of one tank could be viewed at a time. It was inappropriate for a facility that large. The entire Automatic gauge system ran on one computer that did not even have a backup, therefore, could not be remedied in cases of incidents such as that which occurred. 1.4 Redundant Emergency Shutdown. Apart from the Independent high-level switch padlock not being fitted, the emergency shutdown red ‘stop’ button supposed to be installed with the tanks were never fitted. This red ‘stop’ button, when pushed in an emergency, is meant to close all the side valves of the tank thereby preventing a spillage. Although it takes a while for the valves to close with this method, it would nevertheless have been an effective way to contain the spillage. It showed the weak management controls by both the staff and mother well Ltd who never tested the emergency buttons to see if at all they worked or saw the need to install them. 1.5 System Security and Alarm functions. The automatic gauge security system was set such that anyone in the staff could modify the parameters set. It did not pose any danger on the day of the incident but would be potentially dangerous in other situations. In the alarm function case, the alarm function system of the automatic gauge was never modified to a later version that would be able to detect any inconsistencies that may have occurred between the data filled and the tank level measurements and be able to set off the alarms. 2. Management failures. 2.1 Control of incoming fuel Fuel into the Buncefield oils storage facility was always transported in batches and separated then later separated into the assigned tanks according to its type. Fine line batch of fuel was controlled by the supervisors while the other batch was controlled from elsewhere. It necessitated a lack of proper information that undermined the ability to control and plan for the batches. Some lines had to be given priority over others that made the situation no better.4 This system ensured a gap in the receipt of incoming fuel that is one of the reasons there was no proper supervision of the fuel tanks and, therefore, a spillage occurring. 2.2 Increase in throughput. The Buncefield depot had experienced an increase for fuel being directed to its tanks because of the closure of another facility near it. It meant that that the throughput had increased over time bringing about confusion among the supervisors who Apparently had not put in proper and effective systems to monitor the functions of the tanks while being filled with the fuel. There were also no proper staff handover procedures that would have been able to alert incoming staff of the ongoing functions or any problems that had been experienced so that they would be able to watch out for them. The issue of the overlapping screens was also further worsened by the increase in throughput as a lot of functions in the depot meant the monitor screens showed overlapping tabs and there was no way to alert the supervisors if a tank was filled if its tab was overlapped by another. 2.3 Pressures of work. The faulty and inadequate equipment at Buncefield necessitated a system that put unnecessary pressure on the supervisors and workers as well. Supervisors also worked a 12-hour shifts and only took breaks when the conditions of operating the tanks allowed them to. It meant that they were overworked and in no position to go the extra mile to check on systems that were faulty. 2.4 Inadequate fault logging. The staff and supervisors at the Hertfordshire Oil Storage Limited were in the habit of inadequately recording defects in the equipment they used. In addition, quick fixes were applied when equipment malfunctioned, and no proper maintenance or repair was made.5 It was further worsened by the poor shift handover processes in the facility, which only documented faults experienced at the end of the day and not at the end of one supervisors shift to alert the incoming supervisor. The staff and supervisors had also failed to make use of the available fault log systems put in place. Within the 14 times the automatic gauge had stuck, not one incidence was ever recorded thus leading to the disaster that occurred. Proper scrutiny of the equipment and logs would have been able to detect the vulnerability of the systems in use and be able to fix them or refrain from their use to avoid accidents. 2.5 Motherwell control Systems The contract that Motherwell Systems had with Buncefield to supply, install and maintain the automatic gauge system was a critical safety arrangement that was neglected. As shown earlier, they had the duty to inspect and install the equipment yet the padlocks for the IHLS were never fitted and the emergency buttons not installed. The instances they were called to fix the sticking gauge, they never looked to the cause of the problem or offered a lasting and permanent solution to the problem. They did not fulfil their contractual obligations and instead maintained merely casual relationship with Buncefield with resulted in faulty equipment and consequent damage. 3. Loss of secondary containment. 3.1 Bund joints It is a general rule that concrete structures used for storing or retention of liquids are to be made in such a way that they minimise the formation of cracks. Any cracks that would form in the concrete structures are to be repaired to avoided damage and spillage. The bands used in the Buncefield facility were not up to standard and were, therefore, permeable and not fire resistant. It allowed the large amounts of water used in fighting the resultant fire, fuel and foam to sip out of the bounds thereby polluting the soil. The supervisors were in a position to see that the bunds would not be able to withstand any heat or fire and would allow a leakage in the event. 3.2 Tie bar holes and Pipe Penetrations. These tie bar holes were constructed such that they could not withstand certain pressures. In the event of the fire that occurred, they were unable to hold up under the rigors of the fire due to their faulty construction. Many of the bunds had pipes penetrating through them which, according to statute, decreases their integrity causing them to rupture and even lose their seals between pipes and walls. It caused the risk of burning fuel that floats over water to overflow and spill over the bunds thus worsening the situation. 3.3 Tertiary containment. There were no proper drainage systems to counter the flow of the water, foam and fuel from the bands. The only drainage system was that generally set up for rain and floods that would not be adequate for the containment of these harmful pollutants. There were no boundary walls or mounds to actually keep the liquids from flowing everywhere and many other failures in the systems and structures set up to deal with a potential spill.6 Buncefield had not considered or put in place any tertiary containment structures or systems to avoid such disasters. It seems they had never found such an occurrence would come up. Therefore, the Buncefield incident exposed the many lapses that are evident in the oil storage and transfer facilities. These facilities are wanting from their construction to their operation. The Buncefield incident would not have occurred if, in the first place, the proper construction of the facility was ensured. It is in relation to the construction of the bands and tertiary containment measures to protect the adjoining land from pollutant spillage. The installers, suppliers, and equipment manufacturers, have a duty and contractually bound to ensure they understand an equipment's use for and to provided the necessary information needed for the use and maintenance of the equipment. For the suppliers whose contracts includes maintenance and repair, thorough work should be done to ensure that the equipment work to the optimum potential, and if they are damaged, then they can be properly repaired.7 There is a duty also to train the employees on how to properly use the equipment and detect any faults or even fix them. The Buncefield employees did not see the sticking gauge as something serious yet advice from the installers or manufacturers would have alerted them as to its seriousness. Conclusion The supervisors and other employees should not be made to work under circumstances where they feel pressured and or overworked. It has always been a recipe for disasters and accidents, especially if heavy machinery or flammable products are in use. Proper communication between the supervisors and employees is necessary especially during the shift handover to be able to detect any problems or faults on the machines. Lack of communication between the supervisors was among the causes of the disaster when this is something that can be easily remedied. Having no engineering experts on site to fix simple faults or determine whether a failure need particular attention and repair is another primary cause of the fire. An expert on site would have been able to see a problem when the gauge stuck about 14 times or in the absence of padlocks for the independent high-level switch and the emergency stop button to close the side valves. There were no proper auditing controls put in place at Buncefield. Verification systems are primarily supposed to test the existing systems and whether or not they are being used effectively. If a proper auditing and monitoring system had been put in place, then the lapses would have been detected. Overall, the senior managers did not apply any effective controls to prevent the accident. Bibliography 1. Sewers for Adoption: A Design and Construction Guide for Developers. Blagrove, Swindon, Wiltshire: WRc plc, on behalf of Water UK, 2012. 2. The Buncefield Incident, 11 December 2005: The Final Report of the Major Incident Investigation Board. Sudbury: Health and Safety Executive, 2008. 3. Curtin, W G, and N J. Seward. Structural Foundation Designers' Manual. Oxford: Blackwell Pub, 2006, p.26. 4. The Storage of Flammable Liquids in Tanks. Sudbury: HSE Books, 1998. 5. The Report of the Bp U.S. Refineries Independent Safety Review Panel. US: BP U.S. Refineries Independent Safety Review Panel, 2007. 6. BS 8007: 1987 Code of Practice for design of concrete structures for retaining aqueous liquids British Standards Institution. 1987. 7. The Storage of Flammable Liquids in Tanks. Sudbury: HSE Books, 1998. Read More