Many organization classifies Buncefield as a landmark incident. It resulted in severe explosion damage at and in the vicinity of the site, widespread damage over a large area, a major accident inquiry followed, major research programmes were undertaken to provide knowledge key to the understanding of the accident, it changed the industry’s hazard and risk assessment approach and management of other storage depots which previously had not been considered to pose significant explosion risks.

The incident, investigation and subsequent research have shown that:

  • Very large vapour clouds can develop in tank overfill accidents when wind speeds are low.
  • Congestion (resulting in turbulence and flame acceleration) can be in the form of vegetation.
  • Ignition of a large vapour cloud in the presence of sufficiently dense congestion can lead to a transition to detonation (DDT).

WHAT HAPPENED

On the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol. The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled. The first gauge stuck and had done so intermittently after the tank had been serviced in August 2005. The IHLS was inoperable as it needed a padlock to retain its check lever in a working position but the padlock was not fitted. The control room staff might have known that the tank was filling to dangerous levels through stock management. They might also have realised that there was a problem had they monitored the gauge. In the event, three hundred tonnes (250,000 litres) of fuel overflowed from the tank, and a vapor cloud formed, which ignited, causing a massive explosion (measuring 2.4 on the Richter scale and heard 200 km away) and a fire that lasted five days.

No one was killed, but 43 people were injured. Some 600 businesses on the adjacent industrial estate, employing about 16,500 people, suffered property damage and/or business disruption. The premises of 20 businesses employing 600 people were destroyed and the premises of a further 60 businesses employing 3,800 people were heavily damaged and became unusable. Damage and disruption was also caused to residential properties outside the perimeter of the depot and 2,000 homes were evacuated during the fire. Total damages were of the order of $1.5 billion.

WHY IT HAPPENED

Formation of a large vapour cloud

When the tank was overfilled, liquid flowed out of the open vents and spread as it reached the tank edge. The tank also had wind girders part way down the tank wall. Liquid falling close to the tank wall would have hit this girder and been deflected away from the tank wall. This outward spray intersected the cascade of liquid from the top of the tank. These features would have promoted the break-up of the liquid which would have aided the formation of vapour. The falling liquid is mixed with fresh air and the droplets provide a large surface area for evaporation. The resulting vapour is forced out at the base of the cascade, producing a dense, initially fast-moving, current that disperses across the ground and mixes with the surrounding air. The gasoline was reported to be a ‘winter mix’ incorporating about 10% butane which would also have increased the rate of vapour generation. As the overfill happened in still/low wind speed conditions, the vapour cloud spread across the site and did not disperse. CCTV records showed a low-lying vapour cloud over a wide area, extending significantly offsite. The total area of the cloud was of the order of 120,000 m2 with an estimated height of at least 2 m over most of the area. There was very little process equipment congestion within the area covered by the cloud.

Explosion severity

Overpressures within the area covered by the cloud were found to be consistently high. From a combination of damage assessment and comparative testing and analysis it was concluded that the overpressure within the cloud was generally greater than 200 kPa; the maximum overpressure was probably much higher. These high levels of overpressure were seen in all areas; there was no distinction between different terrain (car parks, tank farms, open grassland and belts of trees). Overpressure diminished rapidly with distance away from the edge of the cloud; evidence suggests overpressures in the region of 5-10 kPa within ~150m.

It was contended at the time that the violent explosion (being caused by ignition of a flammable cloud in the open) was unprecedented (i.e. could not have been foreseen). However, a review of the literature reveals that a hazard assessment should have anticipated such an incident. For example, large vapour clouds (some the result of tank overfills) had occurred and led to severe explosions in the open in incidents such as Newark (1983), Naples (1985), Saint Herblain (1991), Sri Racha, (1999). There have also been incidents in which severe explosions resulted following ignition of large vapour clouds in the open with no congestion present. Examples include Port Hudson (1970) and Brenham (1992). A common feature of all these incidents is that they resulted following ignition of a large low-lying vapour cloud which had developed in nil to low wind speeds. Another common feature is that a flame acceleration mechanism was present (examples of flame acceleration mechanisms include reactive fuels, congestion, confinement, fast flame ignition (bang box) from a confined space, DDT in a pipe venting, etc.). In a number of these incidents, widespread severe pressure damage throughout the vapour was not consistent with a deflagration in congested regions. In the Newark incident (1983), the investigators suspected that the vapour cloud had detonated, although this could not be proved. In Port Hudson (1970) investigators stated that the cloud had detonated. One of the items of evidence they pointed to was that the eye witnesses described the event as a 'bright flash'. They reasoned that for this to be the case, the flame needed to be travelling at very high speed, consistent only with a detonation.

Evidence from experiments in the 1980’s had also shown that flame acceleration up to a point where transition from deflagration to detonation occurred was possible with propane and cyclohexane, which have very similar properties to the main elements of the cloud in the Buncefield explosion, namely butane and pentane. In those experiments, the flame acceleration was caused by regular arrays of pipes. Dense vegetation in Buncefield had a similar effect on the flame as it propagated through them.

The forensic examination of the evidence at Buncefield led to the suspicion that the vapour detonated after initial ignition in the pumphouse and flame acceleration through dense vegetation along one of the depot’s perimeters. This was confirmed in subsequent joint industry projects that studied at large scale the development of vapour clouds due to tank overfills in still conditions, the characteristics of large flat vapour clouds and the propensity of vegetation to accelerate the flame leading to a deflagration to detonation transition (DDT).

It is noteworthy that, since the Buncefield incident, there have been several incidents which resulted in the development of large vapour clouds which were either suspected or have been shown to have detonated. These include Jaipur (2009), Puerto Rico (2009) and Amuay (2012).

IMPLICATIONS IN RELATION TO DDT

  • Nil or very low speed conditions can lead to very large vapour clouds (>100,000 m2). Such clouds have the potential to engulf areas of congestion - onsite or offsite (e.g. process equipment, vegetation). Whilst severe explosions can also occur in other wind conditions, the result of low wind speeds is less mixing with air, larger flammable clouds and therefore even small leaks can result in large explosions following delayed ignition.
  • A vapour fence may contain the cloud and may have advantages in limiting the spread of heavier than air pancake-shaped clouds. For example, at Jaipur (2009), the vapour cloud was largely contained on-site by a surrounding wall. This is especially true when the dispersing fluid is denser than air and wind speed is close to zero.
  • Where environmental screening is required around sites, the use of trees and vegetation should be carefully considered. Large scale tests have shown that screening with a depth of less than 2 m will not generate flame acceleration up to DDT if engulfed by a vapour cloud with propane like combustion and detonability properties. A maintenance regime should ensure that ground level vegetation is cleared away or limited in width to less than 2 m.
  • Where flame acceleration up to the ambient speed of sound is possible (e.g. fast flame ignition of the external cloud (bang box scenario) or interaction with congestion), transition from deflagration to detonation is a realistic possibility with fuels such as propane, butane and pentane, and highly likely for more reactive and detonable fuels such as ethylene (DDT can take place with more reactive fuels than C3-C5).
  • The blast overpressure decay with distance from the cloud edge is rapid. Protection of occupied buildings is best achieved by locating them as far as possible from congestion and areas of potential vapour cloud accumulation. The level of blast proofing implemented may be established on with the aid of a risk-based approach.
  • New industrial sites should consider separating process units into smaller sections with at least 10 m separation between each section in order to limit flame acceleration.
  • Plant audits, HAZID, HAZOP and LOPA studies should consider the possibility of detonation. HAZOP and LOPA studies generally look at the RAM ratings to determine the LOPA risk criteria that are to be met, then add controls to satisfy those criteria. The aim is to ensure the nature and ultimate consequences of the event (ranging from flash fire, deflagration, DDT, full detonation) are understood in the RAM rating used as inputs to these HEMP studies.
  • The possibility of a detonation may have implications offsite (especially where there is the potential for the vapour cloud to drift offsite) as it can lead to severe pressure damage to offsite buildings and offsite fatalities. In the case of a deflagration of a flammable cloud which is as big as or larger than the congested area, the pressure decays with distance once outside the congested area. In the case of a detonation, however, the pressure only starts to decay outside the cloud even if the congested area is smaller than the cloud.

IMPLICATIONS FOR CONTROLS AT FUEL STORAGE TERMINALS

The Buncefield incident led to a number of changes to the controls that should be in place at fuel storage terminals. Key changes include:

  • Re-evaluation of the risks associated with overfilling a large petrol storage tank and to understand where further automatic protection systems should be installed and procedures strengthened and checked by audits.
  • Installation of automatic overfill protection systems on petrol storage tanks and testing at suitable intervals to make sure that they are operational and will work when a high level is detected in the tank.
  • For UK operations, completion of hazardous area assessments against the Dangerous Substances and Explosive Atmospheres Regulations 2002 and review to ensure that the equipment installed on site is properly located and protected. This should be underpinned by an understanding of vapour dispersion and control of ignition sources.
  • Review and update of emergency plans and arrangements to ensure that the site, emergency services and other relevant agencies and bodies understand their role and responsibilities in response to an incident. These plans should be regularly tested to ensure that everyone is prepared in the event of a real incident. This should focus on what to do where there is a significant vapour dispersion away from the area of the secondary containment. Control of ignition sources and use of foam onto the spill are two key areas. Stopping the flow into the tank is another.
  • Implementation of improvements to secondary and tertiary containment such as sealing gaps around pipework that enters the bund and assessing and improving the integrity of concrete bund wall joints, including the installation of fire proof steel plates where appropriate.

Image Source: BBC News