Sensitive resources

May 1, 2007
FUEL storage terminals should determine safety integrity level requirements for overfill prevention systems by taking into consideration nearby sensitive

FUEL storage terminals should determine safety integrity level requirements for overfill prevention systems by taking into consideration nearby sensitive resources or populations, the nature and intensity of depot operations, realistic reliability expectations for tank gauging systems, and the extent and rigor of operator monitoring, according to a board that investigated a major explosion and fire near London, England in 2005.

The board issued recommendations in March 2007 on the design and operation of fuel storage sites, responding to the incident that occurred at the Buncefield petroleum storage depot in Hemel Hempstead in Hertfordshire, causing $2 billion in damage. The blast that came before the fire registered 2.4 on the Richter scale. It was described at the time as the largest fire in England since World War II. No one died in the disaster. In the following investigations, officials determined that the fire was caused when a storage tank was overfilled, spilling 100,000 gallons of product into a dike. Vapors from the product were ignited.

“The Buncefield incident highlighted the need for high integrity systems,” the board stated in the latest report. “However, our firm belief is that before protective systems are installed there is a need to determine the appropriate level of integrity that such systems are expected to achieve. The sector currently lacks a common methodology to ensure a systematic approach to this determination process. Several methodologies exist, but there is no consistency. A common methodology would provide greater assurance.”

Recommendations from the Buncefield Standards Task Group soon after the accident were noted in the board's report: “The overall systems for tank-filling control must be of high integrity with sufficient independence to ensure timely and safe shutdown to prevent tank overflow. Site operators should meet the latest international standards.”

Other information from the investigation included:

  • the need for high integrity systems to prevent breaches of primary containment.
  • the need for a review of the adequacy of existing safety arrangements, including communications, employed by those responsible for pipeline transfers of fuel.
  • operators should evaluate the siting and/or suitable protection of emergency response facilities, such as firefighting pumps, lagoons, or manual emergency switches.
  • operators should employ measures to detect hazardous conditions arising from loss of primary containment, including the presence of high levels of flammable vapors in secondary containment.

In the United States in 2006 the Chemical Safety and Hazard Investigation Board (CSB) issued a courtesy notice related to level switches on storage tanks after the incident in England. ”The report indicates that the explosion probably resulted from the ignition of a vapor cloud formed when a tank containing unleaded gasoline overflowed,” CSB said at the time it released its notice. “One aspect of the investigation is the operation of the ‘ultimate high level switch’ on the tank. It is part of the system designed to prevent the tank from overflowing.”

A United Kingdom agency safety alert at the time also included a check list to aid in identifying and testing the switches. Although these types of level switches are manufactured in the United Kingdom, the agency believes they may have been supplied to customers throughout Europe and North America. The safety alert was primarily for the attention of companies operating oil/fuel storage facilities. However, it may also be relevant to other sites storing hazardous substances in large tanks where level gauges are used, CSB said.

The most recent report from the United Kingdom investigation board can be seen by going to