Just after 6 am on Sunday 11 December 2005, a series of explosions and subsequent fire destroyed large parts of the Buncefield oil storage and transfer depot near Hemel Hempstead. A huge explosion was followed by a large fire which engulfed 23 large fuel storage tanks. The incident injured 43 people, but there were no fatalities.
Many of the neighbouring properties were damaged and had
the incident occurred during a weekday when the nearby factories would have been
occupied, hundreds could have died or been severely injured by the blast which
encompassed the industrial estate and nearby houses.
There are a number of reports on the incident and its consequences with recommendations for continuing operation which can be downloaded from the HSE website ** This article will concentrate on the avoidance of the main cause of the incident, viz., the overfilling of a floating roof petrol (gasoline) tank.
Tank 912 was one of three tanks in a common bund, the capacity of which presumably exceeded the minimum of 110% of the largest tank. Why this is deemed good practice is a mystery, as a spillage into the bund would surround all the tanks in it and if it caught fire would involve them all.
However, the bund proved to be of no use, as during a delivery by pipeline from an external source, the level controls failed, the tank 912 overfilled and ca. 300 tonnes of petrol exuded from the roof vents and cascaded down the side of the tank. Petrol vapour is heavier than air, so the bund filled with vapour, which then flowed over the bund wall and spread widely as a white mist. The mist may have contained ice particles in the chilled and humid air due to evaporative cooling.
The cloud found a source of ignition, the origin of which is under investigation, but it could have been an auto-ignition by static electricity formed by the diffusion energy as air entered the vapour cloud to produce a mixture within the explosive limits. Lightning is thought to be formed by the friction of ice particles generating static electricity, so it could be that if a vapour release is big enough it will inevitably ignite.
Rather than rely on level controls or control systems, it would be advisable to arrange for one of the tanks in a group to be designated as a “receiver” or “catch” tank, so that overfills can be “caught”. If the designated tank was of equal size to the others in the product group, it would effectively double the filling capacity of a tank in the group and yield a considerable time for investigation and remedial action.
There were a number of recommendations arising from the various reports and inquiries. Recommendation 14 (for new Buncefield type sites) was that “Consideration should be given to modifications of tank top design and the safe re-routing of overflowing liquids”. Recommendation 16 was that Recommendation 14 should be applied to existing sites “as is reasonably practical”.
HSE has decided that the “safe re-routing of overflowing liquids” is impractical and operators are allowed to simply improve the level controls and operational practice.
So the point of this article is to invite Tank Storage Magazine subscribers to consider whether a system in which the excess in an overfilling tank could be diverted to one tank in a group as a dedicated “receiver” or “catch” tank is nevertheless a practical proposition..
One method is to weld a branch pipe just below the top position of the tank floating roof, a pipe connection from which would enter the bottom of the tank designated as a receiver. See Figure 1
The problem is to maintain the floating roof seal as the roof passes the pipe entry. This could perhaps be solved by a sprung, shaped flap filling the hole until the roof has passed it. The flap could be actuated by a rocker engaging on the top of the roof when it reaches its stops, which would release the spring holding the flap in position so that the pump pressure would open it. See Figure 2
A siphon solution is the subject of US Patent 4,723,682
dated 9 February 1988 * in which an overflow duct for prevention of overfilling
is mounted on the outside of a tank.
A disadvantage of this method, anticipated in the patent, is that once initiated the siphon would tend to empty the entire tank, so a siphon-breaker is applied to the top of the siphon pipe is prescribed. The vapour released from this vent could be a problem. However the emptying of the contents to a full sized receiver tank would stop once the level in the receiver tank reached that in the overfilled but now emptying tank. As the overfilling flow might continue into the tank until noted, the levels in both tanks would rise together
So the solution described in Figure 3 is apparently practical, simple and effective. The scheme with the flap valve as in Figures 1 and 2 might be a suitable alternative if the receiver tank was much smaller than the main tank.
There are many unresolved issues related to the Buncefield incident.
BP has been allowed to re-commission its relatively undamaged part of the site by applying radar level controls and a molecular-level external product detection system. Total is engaged in a public consultation as to the measures it should apply when rebuilding the destroyed part.
The source of ignition is reckoned to be a spark from a motor starter in the emergency fire pump house, but no mention as to whether this was of a flameproof type appears in any of the reports. The need to initiate fire pumps would assume that there has been an escape of product, so that the starters should have been to a flameproof standard.
The other ignition candidate is a standby generator at a neighbouring factory offsite, which would not be expected to employ flameproof equipment. This brings into question the presence of other industrial or domestic activities adjacent to an oil installation. The tank farm was fairly isolated when first developed, but as it grew other activities encroached on its boundaries.
In Japan LNG tanks are now built entirely underground as were fuel tanks in the UK and Germany in the war. Had the tank farm been entirely underground, it would not have prevented an overfill, but the resulting explosion would not have involved the other tanks on the site.
There are many other tank farms in the UK at airports and refineries. The universal application of Recommendation 16 would have created great disturbance to their use and considerable expense to the operators. The dedication of one tank in each group of products as a “receiver” or “catch” tank would also reduce storage capacity.
It could be that the vast expense involved in the universal application of Recommendations 14 and 16 is the real implication in assuming their impracticability.
As the finding of a source of ignition from a widely spread vapour cloud is virtually inevitable, it is paramount to maintain the integrity of product containment.
John Busby 22 January 2010
* Patent http://www.patentstorm.us/patents/4723682.html
**HSE http://www.hse.gov.uk
John Busby is a retired engineer following a career in process engineering in the chemical and food industries.
He was once employed as a construction manager in an ICI nylon works in Scotland, where he joined a safety team evaluating the risk to a neighbouring community. His fears of the consequences of breaching the containment of large quanitities of hydrocarbons were subsequently realised in the vapour cloud explosion of a similar works at Flixborough in 1974. Nylon Works Ardeer is no longer there.
The huge explosion at Buncefield triggered his examination of the many documents produced by HSE and the Lord Newton inquiry.
This article was edited down and published in Tank Storage Magazine as "Viability of 'catch' tanks" in March 2010, see http://www.after-oil.co.uk/overfilling.htm