System safety and security are critical for every organization because they allow professionals to predict and identify possible threats and issues that can have negative influences on organizational performance, human health, and the environment. Functional safety in this framework focuses on those hazards that are caused by technology, such as equipment, its specific part, or application. A failure to ensure safety often leads to critical disasters. Buncefield Oil Depot is an organization from the UK that dealt with such kind of problems in 2005. On December 11, one of its oil storages exploded unexpectedly, which made the whole safety group unpleasantly surprised and worried.
The disaster at the oil depot was tracked back to December 10, 2005. It was reported that “at around 07:00 pm, tank 912 of the Buncefield oil depot started receiving unleaded motor fuel from the Coryton refinery” (Taveau, 2012, p. 55). Still, the issue became critical only with time, as the filling of the tank continued, which resulted in the overflow that happened on the morning of the next day. As the fuel was leaking away, it filled the oil storage facility, creating a fuel-air mixture. Soon, the vapor cloud reached a height of 3m and covered not only the oil depot but also the area around it, so that more than 100,000 sq. m. were affected (Gant & Atkinson, 2011). At about 6:00 a.m., the first big explosion happened and triggered further fires. As a result, more than 20 storage tanks were damaged that day. Even the car parks located in that area were affected. The plume of smoke spread to the South and could be easily seen from a distance. Emergency services and the strategic group gathered that day as soon as they got to know about the accident. The next day, firefighters successfully coped with the peak of the fire but it was already impossible to avoid a critical loss of secondary containment. On December 15, the fire stopped, and an on-site investigation began on December 16 even though some parts remained dangerous to approach for months. All actions finished only in February (Buncefield Major Incident Investigation Board, 2006).
The investigation conducted under the lead of the Investigation Board revealed that the disaster was caused by problems with the automated tank gauging system (ATG) and the independent high-level switch (IHLS). As it turned out, they were not able to operate effectively, which caused extreme increases in the fuel level and a loss of primary containment.
The IHLS was adopted by Buncefield Oil Deport in the middle of 2004. This tool was provided by TAV Engineering Ltd., an organization that both designed and manufactured it. It designed the switch so that it required routine tests that assessed its effectiveness. However, the installation was maintained by people who were not aware of the way the IHLS worked, which made oil depot full of the false belief that its operations were secure. After the test, the tool was not operating, and no one paid attention to this fact. Thus, if TAV had all systems in place and Buncefield was able to use the IHLS in practice appropriately, explosions could have been avoided. Focusing on the design of this tool, professionals indicated that it was possible to cope with the design faults on the initial stages even before manufacturing. In addition to that, issues could have been minimalized if clear guidance was provided. It cannot be denied that TAV was well aware of the fact that the tool it provided would have been used in the high-hazard environment. Thus, it should have implemented additional assessments to ensure safety. In this way, TAV should have maintained extra research to gather the information about Buncefield and peculiarities of its operations so that the switch it provided met customer’s needs.
The defects in design and poor availability of critical information that were among the triggers of the discussed disaster could have been addressed later as well. Motherwell Control Systems 2003 Ltd was able to check the information provided by TAV and emphasize the necessity to give sufficient clarity considering the design and use of the switch. Motherwell had well-educated and experienced professionals who were able to identify discussed drawbacks however they failed to pay enough attention to the system for checking and understanding (COMAH, 2010). Thus, its failure dealt with the specification of the requirements of switches, the absence of critical data obtained from the manufacturer, and poor understanding of the vulnerabilities of the tool. It also relied on TAV to much instead of focusing on personal significance and duties.
Problems with the ATG system were reported to be another critical issue that led to explosions. The problems with servo-gauge were observed since the end of August 2005. It had stuck 14 times before the accident, which should have already been thoroughly investigated by the professionals (Mannan & O’Connor, 2009). However, supervisors focused mainly on the symptoms. Even though they were interested like the problem as well, it was never identified decently. In this way, it can be claimed that there were managerial and organizational issues that led to the failure of the ATG system and caused explosions. In addition to that, it is critical to mention that unlike with the IHLS, Motherwell identified no necessity of regular tests for the ATG. Its personnel was not interested in the reasons for frequent issues and did not try to analyze the reliability of the system.
In addition to that, the ATG system had a poor monitoring screen. It allowed displaying the data that related only to one tank while there were many more of them in Buncefield. In this way, the possibility of overlooking a problem increased greatly because professionals were not able to use several computers to control tank filling decently. In the framework of the discussed disaster, it would have been rather beneficial if the staff was able to close the valves. However, the emergency shutdown was not managed, and there was no possibility to close several pipelines. The ATG system was claimed to have built-in security that could have been modified to meet the parameters of the organization that used it. In general, it was not proved that it could have triggered the incident. However, the control room staff had an opportunity to implement changes in the alarm settings, which could have prevented the personnel from noticing the issue. Similarly, they also had a chance to alter settings, focusing on the tank level and filing data so that the problem could have been identified if the sticking gauge happened.
Based on the discussed information, it can also be claimed that a range of improvements apart from those connected with systems and their shortcomings need to be addressed. For example, Buncefield should ensure that its personnel is ready to perform its duties effectively and efficiently outside of normal operations. They require training to get to know how to record and review issues as well. The company should also pay more attention to the pressure of work because it affects people’s actions and their ability to operate properly (Taveau, 2012). Management should ensure that personnel’s workloads are reasonable and all people are in similar conditions. Realizing that Buncefield was a high-hazard setting, the organization should have ensured that no issues among the parties occur. For instance, it could have benefited from formal arrangements (Mishra, Wehrstedta, & Krebsb, 2013).
Professionals were extremely worried about the consequences of the disaster because it affected the environment. A range of monitoring processes was maintained to assess contamination levels and consider who they can be reduced. Fortunately, there was no crucial impact made on the quality of air. However, the surface layer of land and groundwater was polluted to some degree. It was not extreme, but the necessity to cooperate with the environment agency and develop a model to continue assessments and enhance the situation was not denied.
Thus, it can be concluded that the discussed disaster happened mainly because of the problems with system design and operation. In addition to that, emergency response was not maintained decently, which prevented Buncefield from the at least partial reduction of negative consequences caused by explosions. Even if the design of the ATG system and IHLS were not improved in the initial stages, the oil depot could have limited damages to the tank that was overflown from the very beginning. Buncefield should analyze this disaster and fill those safety gaps that affected its operations, developing a range of the best practices.
References
Buncefield Major Incident Investigation Board. (2006). Buncefield major incident investigation. Web.
COMAH. (2010). Buncefield: Why did it happen? Web.
Gant, S., & Atkinson, G. (2011). Dispersion of the vapour cloud in the Buncefield incident. Process Safety and Environmental Protection, 89(6), 391-403.
Mannan, S., & O’Connor, M. (2009). A technical analysis of the Buncefield explosion and fire. Web.
Mishra, K., Wehrstedta, K., & Krebsb, H. (2013). Lessons learned from recent fuel storage fires. Fuel Processing Technology, 107, 166-172.
Taveau, J. (2012). The Buncefield explosion: Were the resulting overpressures really unforeseeable? Process Safety Progress, 31(1), 55-71.