Loss Prevention Bulletin 254 April 2017 | 23

Incident

Buncefield: Lessons learned on emergency

preparedness
Graham Atkinson, Health and Safety Executive, UK
system was activated at 06:01; unfortunately this involved starting
Summary the site firewater pump which was located within the cloud.
Early on Sunday 11 December 2005 a gasoline storage Ignition occurred in the pumphouse and a powerful vapour
tank was being filled from a pipeline at a fuel terminal cloud explosion devastated the fuel depot. Twenty storage tanks
at Buncefield. Safety systems fitted to prevent the tank containing gasoline, aviation fuel and diesel were immediately
overfilling failed and gasoline began to spill from the vents set on fire. The fire subsequently spread to two additional
on the tank roof. A low-lying cloud of heavy, flammable tanks and was not fully extinguished for several days. The fire-
vapour accumulated and spread out for about 250m in all fighting operation is described in more detail in the second half
directions around the tank. Ignition of the cloud occurred of this article. A good introduction to the underlying causes and
and a powerful vapour cloud explosion devastated the significance of the incident has been published by the Competent
fuel depot. The ensuing fire spread to other tanks and Authority Strategic Management Group1.
was not fully extinguished for several days. Many nearby The blast effects caused catastrophic damage to all of the
businesses were forced to relocate for months or even areas, both on and off-site, that were covered by the cloud: all of
years causing serious commercial losses. the buildings, tanks and plant in this area had to be completely
This paper considers the lessons learned related to cleared. Commercial and residential premises within about 100m
emergency preparedness at large flammable sites as a of the edge of the cloud also suffered serious structural damage
result of this incident. These include the responsibility and several had to be demolished. Lower levels of blast damage
affected many commercial buildings within about a kilometer

knowledge and
of the operators of fuel depots, tanker terminals, etc.

competence
Examples include: risk assessment, prevention of spillage, from the site: damage was typically to the cladding and weather-
detection and shut-off, bunding of tanks, provision of fire sealing of these large buildings (Figure 1). Although the damaged
water and tertiary containment of fire effluent. However, cladding could be replaced, the scale of this work meant that
some of the more fundamental lessons are still being many businesses were forced to relocate for months or even years
assimilated — for example, the potential for severe causing serious commercial losses.
explosions in open areas is still not widely used as a basis This paper reviews the emergency response to the incident
for safety planning. and the lessons learned for the future. Two types of issue are
Perhaps the most important lesson of all was that our considered:
view of the range of hazards faced by large flammable
1. Emergency preparedness: these issues are mainly the
sites was seriously deficient. The high levels of confidence
responsibility of the operators of fuel depots, tanker terminals,

systems and
procedures
that we had a complete working understanding of
etc. Examples include: risk assessment, prevention of spillage,
flammable risks was not justified. Such attitudes are always
detection and shut-off, bunding of tanks, provision of fire
dangerous and it is an important responsibility for those
water and tertiary containment of fire effluent.
with a stake in controlling major flammable risks to be
open about this. 2. Emergency response: these issues are mainly for the Fire and
Rescue Services (FRS). Examples include: incident control,
Keywords:Emergency preparedness, Buncefield regional/national deployment, foam management, effluent
control etc.

Introduction Reports on the incident and associated

Early in the morning of Sunday 11 December 2005 a gasoline
recommendations
storage tank was being filled from a pipeline at a fuel terminal at Several significant studies of the incident have been published
Buncefield, some 40 km northwest of London. The tank had safety and their findings and recommendations have formed the basis
systems fitted to prevent overfilling, but they failed to operate and for change in the UK.
gasoline began to spill from the vents on the tank roof. Crucially
this occurred in nil-wind conditions and a low-lying cloud of Major Incident Investigation Board2
heavy, flammable vapour accumulated. The gravity-driven cloud
This report included recommendations in several areas:
spread out for about 250m in all directions around the tank. After
25 minutes the overfill was discovered and the site emergency • High integrity overfill protection (ten recommendations);

© Institution of Chemical Engineers

0260-9576/17/$17.63 + 0.00
24 | Loss Prevention Bulletin 254 April 2017

Figure 1 – Damage to a warehouse 400m from the overfilled tank (Copyright: HSE)

• Engineering against escalation e.g. zoning, detection, occur at fuel depots.

overflow systems (six recommendations);
• Secondary and tertiary containment issues (two Hertfordshire Fire and Rescue Service report6
recommendations); This report focussed on the practical firefighting experience
• Human factors, culture and leadership (seven gained by the local fire brigade in dealing with Buncefield. A
recommendations); number of recommendations are made in the areas of:
• Control of land use and risk around major hazards sites (18 • fire fighter health, safety and welfare;
recommendations); • incident command;
• Emergency planning (32 recommendations) – this heading • national deployment of resources;
included recommendations on:
• equipment (especially compatibility issues);
– On and off-site planning (and testing of plans);
• gathering and managing foam resources.
– Siting of critical emergency infrastructure;
– Interfacing site and FRS resources; Scientific studies
– National co-ordination of response to major incidents
by FRS, Health Services, Environmental Protection The incident has prompted a large amount of new
Agencies; experimental, analytical and review work addressing the issues
– Economic and environmental recovery planning for of:
areas with major hazard sites. • vapour cloud formation during overfilling incidents7, 8;
• flame acceleration in congested environments7;
The Process Safety Leadership Group3
• blast effects from extended low-lying vapour clouds7;
This group was designed to meet the need for an effective
• explosion effects on common objects- vehicles, drums
framework for interaction between industry and the UK
boxes, etc.7, 9;
government to jointly develop and implement effective
• explosion effects on tanks and buildings10.
recommendations and practices for fuel storage sites. Their
final report provides detailed guidance in a number of areas, A practical method of assessing the volume and fuel
for example: the use of Layers of Protection Analysis (LOPA) to concentration of the vapour cloud caused during overfilling is
determine appropriate safety integrity levels (SIL) for over-fill now available8 and is increasingly used in risk assessments and
protection systems, the design of fire resistant bunds and the emergency planning for fuel depot sites.
identification of materials (other than gasoline) that can form However, the problem of explosion mechanics remains
large vapour clouds if tanks are overfilled. substantially unsolved. Based on forensic evidence at the
In some areas the PSLG did not support the adoption of scene there is near universal agreement that high (>2000 mbar)
recommendations made by MIIB; for example, the use of overpressures were observed across the whole cloud area at
vapour detection at fuel storage sites and the fitting of overflow Buncefield and in other more recent incidents11 but the nature
pipes to eliminate vapour cloud production if tanks were of these explosion events, and the circumstances that triggered
overfilled. The PSLG report also recommended that in planning the transition to a severe explosion rather than a flash fire,
fire-fighting the appropriate worst case design fire for a fuel remain a subject of active investigation and debate. A review of
depot should be assumed to be fire in a single bund. Several historical vapour cloud explosions9 revealed a number of very
incidents in fuel depots both before and after Buncefield have large (>200 m radius) severe gasoline vapour cloud explosions
clearly demonstrated that this is not appropriate. The PSLG like Buncefield but no equivalent flash fires. Notwithstanding
approach was based on an old code of practice published by the lack of pressure effects, such flash fires could cause deaths
the Energy Institute4. More recent editions of this code5 draw or injuries and would certainly leave a huge burned area. It
attention to the fact that multi-bund fires (like Buncefield) can seems likely that a high proportion of such occurrences would

© Institution of Chemical Engineers

0260-9576/17/$17.63 + 0.00
 Loss Prevention Bulletin 254 April 2017 | 25

be reported and the lack of such reports suggests that if a very also occurred. Some other types of major incident are possible
large cloud develops at a gasoline fuel depot the probability of for LPG — for example, BLEVE of a strong fuel tank may
a severe explosion is high. The features that lead to transition produce dangerously high thermal doses to people exposed at
from a flash fire to a severe explosion must be common significant distances, but it is still only VCEs that can produce
features of most sites. Consequently it is reasonable to assume widespread damage to people in buildings and infrastructure.
that if a large gasoline vapour cloud accumulates at a fuel depot
then ignition will cause a severe explosion. This is fundamental Prevention of spillage
to the proper definition of requirements for emergency The importance of high-integrity protection against overfilling
response e.g. assessment of blast effects from incidents and is well documented by the MIIB and PSLG reports2, 3. It
the potential for widespread tank fires. should be noted that spray releases (especially those directed
upwards) have also caused very large vapour clouds (radius
Emergency preparedness >400m) with a similar explosion signature to Buncefield. Such
spray releases have occurred in pumped systems and in leaks
Risk assessment driven by hydrostatic pressure.
Buncefield and similar recent incidents have had a profound
effect on our understanding of the potential consequences of Detection and shut-off
loss of containment at gasoline fuel depots and many other Different approaches to mitigation may be appropriate when
large flammable sites. It was immediately apparent from CCTV nil/low-wind scenarios like Buncefield are considered. For
views of the smooth topped vapour cloud that the incident example, detection of gas plumes in windy conditions generally
occurred in nil-wind conditions. At first this was regarded requires a large number of closely spaced devices and the
simply as a coincidence that perhaps somewhat increased the chances of limiting maximum cloud size and risk of ignition
reach of the cloud. More recently, a review of the history of all by shut-down are low because the cloud normally reaches its
large flammable vapour cloud incidents (including gasoline, maximum size very quickly (< 100 seconds). Investment in
LPG and other fuels) has shown that more than 70% of all detection systems may not be warranted. On the other hand,
such incidents occur in nil-wind conditions9. At first sight this in nil/low-wind conditions the cloud develops slowly and can
is a surprising result since such conditions are relatively rare be reliably detected by a small number of sensors. Shut-down
(<5% in the UK); it can however be understood when one on detection may be a key element of a site’s safety planning.
appreciates that the area covered by the flammable cloud
in nil-wind conditions is typically hundreds of times greater Bunding of tanks
than for the same release in light winds and the probability of There was widespread loss of secondary containment (bund
ignition is correspondingly greater. integrity) on the Buncefield site. While the bunds remained
If a tank like that at Buncefield is overfilled in normal (windy) standing throughout the incident, their ability to fully contain
condition the vapour cloud is generally confined to the area the fuel and fire waters was lost as a result of the prolonged
close to the tank and the probability of ignition is extremely fires. Sealant used as infill between concrete panels was not
low. In the aftermath of Buncefield it was noted by many protected and was displaced by the fire in many places. Large
in the fuel supply industry that overfilling of tanks was not leak paths were also opened up by thermal stresses that
uncommon, but incidents like Buncefield certainly are. It is caused the concrete bases of bunds to heave and crack. The
now possible to explain this observation: the formation of PSLG report3 provides good advice on improving performance
large vapour cloud with a high risk of ignition only occurs in covering bund lining systems, expansion and contraction joint
nil-wind conditions. In the vast majority of overfilling incidents design and protection of joints and pipe penetrations.
the vapour is dispersed by the wind without ignition. Similar
comments apply to very large vapour clouds such as those Emergency response
at Jaipur and St Herblain that were caused by gasoline spray
releases in nil-wind conditions12, 13. Initial response
The observation that ignition of such very large gasoline Fire and Rescue Services across the South-East of England
vapour clouds have generally produced severe explosions received more than 200 emergency calls after the explosion
further focusses the risk assessment for liquid fuel depots. and more than 50 calls from automatic fire alarm systems — a
There have been a number of incidents that closely correspond wide range of locations and causes were cited in the calls.
to Buncefield and no other sort of incident has caused Nevertheless the Hertfordshire FRS reached the site within
comparable widespread damage to the site and surroundings. about five minutes, where they encountered workers from the
What happened at Buncefield is not just a contributor to the depot suffering from blast injuries and shock.
total risk of a major incident at fuel depots, it dominates the Initially there were six persons on the site who were
risk of a major incident. It should be the focus of emergency unaccounted for near the west loading gantry and initial FRS
planning. This has been recognised by HSE and the work focused on searching wrecked buildings in this area.
specification of planning zones around gasoline terminals14 is The work was impeded by tank top and cylinder explosions
based on Buncefield-type incidents (only). that cause further damage to weakened buildings as they
The situation for sites handling larger quantities (>25 tonnes) were being searched. Some employees remained at the
of LPG is less clear. There is a parallel history of large vapour site and activated emergency plans; they provided the FRS
cloud incidents in nil-wind conditions9 but the high fuel with a map of the site and advised crews. It took six hours to
volatility means that in this case some over-rich flash fires have search accessible parts of the site and a large number of blast

© Institution of Chemical Engineers

0260-9576/17/$17.63 + 0.00
26 | Loss Prevention Bulletin 254 April 2017

damaged commercial and residential properties surrounding Main foam attack

the site.
Debris blocking roads meant that crews could not access In preparing for attacking the main fire the command group
large parts of the site perimeter to assess the full extent of made the following assumptions:
the fire. A police helicopter attended from 6:46 am but the 1. Fire size 100 x 100m
Fire Incident Commander could not access these pictures. 2. Foam application rate 8 litres per minute per m2
Eventually a FRS officer was taken up shortly after 9:00 am and
3. Concentrate/water ratio 3%
was able to report back to the command team on the full extent
4. Time required 1 hour
of the incident.
This analysis suggested 150,000 litres of concentrate would
Early fire firefighting be required — which was doubled to 300,000 litres to provide
The FRS dealt with smaller fires in office buildings around a margin for error and allow for foam blanket maintenance. In
the site, but until midday on 11/12/2005 the tactical mode of practice extinguishing the main fire took about 60 hours and
on-site operations remained defensive (Figure 2). Some hoses required 786,000 litres of concentrate with 53 million litres of
for cooling jets were laid around the site perimeter and foam clean water.
calculations were carried out for attack on the main fire. Local On-site water supplies represented less than 2% of total
stocks of foam were nowhere near sufficient to allow an attack water requirements and the bulk of fire-fighting water was
on the main tank/bund fires. Within an hour of the explosion taken from a balancing tank at a distance of about 1.9 km from
the FRS had contacted the main UK supplier of fire-fighting the site. This required the laying of hardcore as a temporary
foam to discuss mustering national stocks of foam concentrate. road to allow installation of High Volume Pumps. A sufficient
A one million litre water supply was immediately accessible water supply to support the main attack took more than 24
in the north-east part of the site. From shortly after midday this hours to set up.
water was used (at about 600,000 litres per hour) for cooling The main attack started at about 08:30 on 12/12/2005
jets to protect road tankers near the gantry, unaffected tanks (explosion + 25.5 hours). The final ignited tank collapsed
in Bund D and other unaffected parts of the site. Lack of water and allowed control to be established at about 07:00 on
and safety concerns about tank collapse led to withdrawal after 14/12/2005 (+73 hours). The fire-fighting effort met with a
about two hours. number of difficulties:
The first foam attack was made at 17:00 on 11/12/2005 on
a rim seal fire in a tank on the eastern edge of the tank farm 1. Rapid re-ignition of bund fires – requiring fresh blanketing
fire. Semi-fixed foam pourers were used but the attempt was every 15 minutes;
aborted because of concerns that the floating roof would sink. 2. Running fires caused by bund overtopping;
At 21:00 a successful foam attack was made on a tank on the 3. Uncertainties about the structural integrity of badly
southern edge of the fire. damaged tanks;

Figure 2 – Photograph taken at 10:40am 11/12/2005 (4.6 hours after the explosion) (Copyright Chiltern Air Support).
The photograph shows the main bund fire. The explosion has also caused a fire in the office building in the bottom left corner

© Institution of Chemical Engineers

0260-9576/17/$17.63 + 0.00
 Loss Prevention Bulletin 254 April 2017 | 27

Air pollution
Smoke from the fire produced a huge, high-level smoke
plume blanketing much of southern England. However, high
rates of heat release and relatively low wind speeds led to
efficient and sustained plume lift-off for most of the incident;
without grounding of the plume at long range. Almost all of
those seeking medical assistance for respiratory effects were
engaged in fire-fighting operations15.

Conclusions
The Buncefield incident has had an enormous impact on all
aspects of planning for emergency preparedness at large
flammable sites in the UK and more widely. Some of the more
fundamental lessons are still being assimilated — for example,
safety assessments at many gasoline fuel depots now include
gravity driven vapour clouds extending to long range but
awareness of such incidents is still uncommon at sites handling
LPG. Similarly the potential for severe explosions in open
areas, illustrated by Buncefield and subsequent incidents, is
still not widely used as a basis for safety planning.
Perhaps the most important lesson of all was that our view
Figure 3 – Photograph taken at 15:47pm 13/12/2005 (57 of the range of hazards faced by large flammable sites was
hours after the explosion) (Copyright Chiltern Air Support). seriously deficient. The high levels of confidence that existed
The photograph shows residual tank fires: Tank 912 (top right) amongst some regulators and industry experts, that we had a
still has a substantial inventory. complete working understanding of flammable risks, was not
justified. Such attitudes are always dangerous and it is quite
likely that there will be other incidents with a similar impact
4. High ground level smoke concentrations as the heat in the future. It is an important responsibility for those with a
release was reduced; stake in controlling major flammable risks to be open
5. Flange fires that could not be isolated at the foot of tanks about this.
with high initial inventories (Figure 3).
References
The fire was declared to be “ALL OUT” at 12:30 on
15/12/2005 (+102 hours Figure 4). Many nationally mobilised 1. Competent Authority Strategic Management Group, 2011,
resources were released in the evening of 16/12/2005. Foam Buncefield: Why did it happen? The underlying causes of
application (to maintain blanketing) was halted at 10:40 on the explosion and fire at the Buncefield oil storage depot,
17/12/2005 but there was a re-ignition soon afterwards. Hemel Hempstead, Hertfordshire on 11 December 2005,
A permanent FRS presence on the site was required until http://www.hse.gov.uk/comah/buncefield/buncefield-
5/1/2006. Freezing temperatures caused hose bursts and report
affected some appliances. 2. MIIB, 2008, Buncefield Major Incident Investigation
Removal of product residues commenced on 17/12/2005. Board, The Buncefield Incident - 11 December 2005:
The final report of the Major Incident Investigation
Effluent management Board, HSE Books ISBN 978 0 7176 6270 8 www.
buncefieldinvestigation.gov.uk
Only 2.5 million litres of firewater retention capacity could be
made available by emptying the site waste water reservoir; 3. PSLG, 2009 Process Safety Leadership Group Final report:
which corresponded to <5% of the total tertiary containment Safety and environmental standards for fuel storage sites:
capacity required. Water was regularly redistributed HSE Books 2009 ISBN 978 0 7176 6386 6 www.hse.gov.
around various bunds that were available, but many were uk/comah/buncefield/fuel-storage-sites.pdf
compromised. Effluent was pumped into bunds on an adjacent 4. Energy Institute, 2007, Model Code of Safe Practice Part
fuel depot site but then had to be pumped back when advice 19: Fire precautions at petroleum refineries and bulk
on bund integrity changed. A local electrical sub-station was storage installations ISBN 978 0 85293 437 1
inundated by rising water levels and had to be isolated. 5. Energy Institute, 2012, Model Code of Safe Practice Part 19
About 22% of the total water used in cooling and foam (3rd Edition): Fire precautions at petroleum refineries and
production was recycled by pumping from bunds. Recycled bulk storage installations ISBN 978 0 85293 634 4.
water was generally used for cooling; with clean water being 6. Herfordshire Fire and Rescue Services (2006), Buncefield,
used for foam production. The Stationery Office, ISBN 978 0 11 703716 8.
Because the amount of tertiary containment available was so 7. SCI (2014) Dispersion and Explosion Characteristics of
small a high proportion of the water and foam applied was lost Large Vapour Clouds Volume 1 – Summary Report, Steel
to local watercourses and groundwater. Construction Institute, SCI Document ED023

© Institution of Chemical Engineers

0260-9576/17/$17.63 + 0.00
28 | Loss Prevention Bulletin 254 April 2017

Figure 4 – Photograph taken at 12:52pm 15/12/2005 (102 hours after the explosion) (Copyright Chiltern Air Support).
The photograph shows rising water levels - due to continued water use and leakage from bunds

8. FABIG (2013), Technical Note 12 - Vapour cloud Buncefield Incident – 11th December 2005 – The Final Report
development in over-filling incidents,. Available from of the Major Incident Investigation Board, Vol. 1., ISBN 978-
http://fabig.com/video-publications/TechnicalGuidance# 07176-6270-8. http://www.hse.gov.uk/comah/buncefield/
9. Atkinson, G. (2015) A review of large vapour cloud miib-final-volume1.pdf
incidents, HSL Report MH15/80 SCI (2009). Buncefield Explosion Mechanism Phase 1,
10. Atkinson G. (2011) Blast damage to storage tanks and Research Report RR718 HSE Books, Sudbury (http://www.
steel clad buildings. Process Safety and Environmental hse.gov.uk/research/rrhtm/rr718.htm)
Protection, Vol. 89, No. 6, pp. 371-381.
11. CSB (US. Chemical Safety and Hazard Investigation Board)
2015, Caribbean Petroleum Tank Terminal Explosion
and Multiple Tank Fires (October 23rd 2009) – Final Buncefield: Hertfordshire Fire and Rescue
Investigation Report Service’s Review of the Fire Response
12. MoPNG Committee (2010) (constituted by Govt. of India) The explosion and fire at the Buncefield Oil Storage Depot
Independent Inquiry Committee Report on Indian Oil involved 22 tanks. The main fires were extinguished in
Terminal Fire at Jaipur on 29th October 2009; completed three days but the overall fire response lasted 26 days
29th January 2010. Available from http://oisd.nic.in, and 642 fire appliances were moved to the incident. This
accessed 19 August 2013. report sets out the chronological sequence of events and
13. Lechaudel, J.F. and Mouilleau Y., 1995, Assessment of reviews the fire response.
an accidental vapour cloud explosion - A Case Study: St
It covers:
Herblain 7th October 1991. Loss Prevention and Safety
Promotion in the Process Industries Vol 1, p377. • pre-planning and pre-training;
14. HSE SPC /TECH/GEN 43 Land use planning advice around • the response of the Hertfordshire Fire and Rescue
large scale petrol storage sites http://www.hse.gov.uk/ Service;
foi/internalops/hid_circs/technical_general/spc_tech_ • the response by other fire provider and supporting
gen_43/ organisations; and
15. Hoek, M. R., Bracebridge, S. and Oliver, I., (2007) Health • presents the learning points of local, national, and
impact of the Buncefield oil depot fire: Study of accident international significance, which are drawn both from
and emergency case records, J. Public Health, June 2007, good practice at the incident and the areas that could
p1-5. have been improved.

Further reading For further information, see https://www.tsoshop.co.uk/

bookstore.asp?FO=1296546&DI=616388
Buncefield Major Incident Investigation Board (2007) The

© Institution of Chemical Engineers

0260-9576/17/$17.63 + 0.00