First Out

Incident lessons

Lessons from Buncefield (2005): a stuck gauge and an inoperable high level switch

A petrol tank overfilled because the tank gauge stuck and the independent high level switch had been left inoperable; the lessons for overfill protection and device management.

2 min read · First Out AI knowledge library

What happened

On 11 December 2005 Tank 912 at the Buncefield fuel depot near Hemel Hempstead, UK, was being filled with petrol by pipeline. The automatic tank gauge stuck and kept showing a constant level while the tank kept filling; it had stuck repeatedly in the preceding months without the cause being resolved. The independent high level switch, intended to stop the filling, needed a padlock to keep it in its working position; the importance of the padlock was not communicated to the installer, maintenance contractor or site operator, it was not fitted, and the switch did not act.

Petrol overflowed from the roof vents early in the morning; roughly 250,000 litres escaped and formed a large vapour cloud that ignited and exploded, causing fires across the depot. There were no fatalities, but the damage on and off site was extensive and fuel and firefighting water reached the groundwater. The Major Incident Investigation Board published its final report in 2008.

Lessons for SIS and instrumentation

  • Independence must be real and maintained. An "independent" overfill protection is only as good as its last valid test and its configuration.
  • Device information must reach installers and maintainers. Safety-critical details from the supplier (here, the padlock) belong in the safety manual, the installation records and the proof test procedure.
  • Repeated faults are a warning. A gauge that sticks again and again is evidence that the basic control layer cannot be trusted; failures must be investigated, not just reset.
  • Proof tests must exercise the real function. A test that does not confirm the switch is in its working position and would stop the transfer does not reveal the failure.
  • Overfill is a major hazard scenario. It deserves a LOPA and usually an automatic overfill protection SIF.

Related First Out AI articles

"HAZOP deviation library: atmospheric storage tanks", "Sensors: transmitters, switches, analysers and their pitfalls", the tank overfill worked example (SIF-105).

Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.