Can overfill protection work when the gauge stops?: The Buncefield oil depot explosion
How can tank overfill be detected when both the level gauge and independent high-level switch fail?
30-second summary
On 11 December 2005, petrol overflow at the Buncefield depot in England produced a vapor-cloud explosion and fire. Nobody died, but more than 40 people were injured and the fire lasted five days. Both the level indication and the independent high-level shutdown failed.
The high-level switch was tested periodically but lacked the means needed to retain its normal operating position afterward. What matters is the function tested, the state restored and whether the device can actually stop receipt.
Work background and incident sequence
Receipt of unleaded petrol through the UKOP South pipeline into Tank 912 began at 18:50 on 10 December. The tank held 6 million liters and its automatic tank gauge, or ATG, displayed level in the control room. The level should have continued rising during receipt.
At 03:05 on 11 December, the displayed level stopped rising while receipt continued. Because indication remained below the set points, the ATG alarms did not activate. The control room relied on alarms and did not recognize the developing overfill.
An independent high-level switch, or IHLS, was intended to close incoming pipeline valves and sound an alarm. It also failed to detect the rising level, so neither the final alarm nor automatic shutdown operated.
At 05:37 petrol began spilling from roof vents. A white cloud appeared around the bund and spread in calm conditions. The HSE and Environment Agency report considered it likely to contain hydrocarbons and ice crystals.
Members of the public and tanker drivers alerted staff to the cloud. At 06:01 the fire alarm was pressed and the firewater pump started; an explosion followed almost immediately. The report identifies a spark associated with pump startup as a probable ignition source. More than 250,000 liters had escaped.
Fire spread to surrounding storage tanks. Crews from multiple areas used large quantities of water and foam. Fuel and firewater escaped the bunds into drains and the ground, leaving an environmental problem after firefighting ended.
Equipment and work principles
An automatic gauge supports routine receipt control. Independent high-level shutdown stops inflow when that control fails. Multiple displays or set points from one transmitter do not establish independence. Review shared sensors, power, signal processing and final valves.
The IHLS used a lever to test part of its function. After testing, that lever needed to be secured in its operating position with a padlock. Its safety-critical role was not adequately communicated through supply, installation and maintenance; it was treated as an anti-tamper feature.
A contact change during a test did not prove protection during operation. If the lever remained or could fall into an inoperative position, a high level would not produce the intended signal. Test records therefore need restoration position and securing checks as well as actuation results.
ATG sticking was not a new problem. It had stuck 14 times after its return from maintenance in late August 2005. Raising and lowering the gauge sometimes restored indication temporarily, but the underlying fault was not resolved and some failures went unrecorded.
Repeated failures require attention to recurrence and unresolved causes, not merely the latest normal reading. Define any temporary operating limit, stop criteria, permanent repair and verification. A recovered display is not proof that the defect has been removed.
Receipt planning needs remaining space, flow and the time required to stop inflow. Changes in an externally controlled pipeline can alter the available response time. Operating limits should account for alarm recognition, communication, valve travel and continuing inflow.
A bund is secondary containment for spilled liquid, but capacity and wall height are not sufficient. Joints, pipe penetrations and tie-bar holes must resist leakage, including during fire. These details and the wider drainage and retention arrangements failed at Buncefield.
A switch test should identify which parts of the sensor-to-valve chain it covers. A lever-operated contact test is not equivalent to testing the mechanical response at the set level and complete valve closure. Restore any bypassed functions, and ensure the manufacturer’s procedure matches the installed model and wiring and piping arrangements.
A test record should contain reproducible conditions rather than only a pass mark: method, actuation point, observed final-device response, restoration and outstanding defects. Repeat the relevant functional test after repair. At Buncefield, periodic testing occurred, but the system could be left unable to protect the tank afterward.
Published chronology and investigation findings
HSE and the Environment Agency traced the technical failures to management weaknesses. Manufacturers, installers, maintainers and the operator did not adequately exchange critical information, and oversight of safety-critical procurement, installation and testing was insufficient.
The investigation also examined increased throughput, workload and limited engineering support. Tank 912’s display was behind other tank windows. Alarm-dependent operation and unreliable indication combined to make the flatlined level difficult to recognize.
At BP Texas City as at Buncefield, actual inventory and indication diverged while liquid continued entering. Buncefield overflowed from a tank roof, whereas Texas City discharged through a tower relief system. The useful comparison is the remaining shutdown protection after misleading indication, rather than equipment names.
Hiring specialist maintainers does not remove the operator’s need to understand safety-critical functions. Specify the intended application, reconcile installed equipment with drawings and instructions, and obtain missing supplier information. A high-level-only application may require particular test and restoration arrangements.
Secondary bunding and wider tertiary containment should be assessed together. Retention adequate for a tank spill may be challenged by continuing firewater. Unidentified drains and soakaways create unanticipated escape paths. Exercises should address runoff notification, drain isolation and additional retention as well as water supply, using the actual site layout.
Some supervisors restored indication by raising and resettling the gauge. The underlying cause remained unidentified, fault logging was inconsistent, and maintainers did not analyze repeated callouts. Restored movement does not establish that the defect has been eliminated. Recurring symptoms call for a review of temporary restorations and operating conditions.
| When | Established account | Source |
|---|---|---|
| 2005-12-10 18:50 | Receipt into Tank 912 began | HSE p.10 |
| 2005-12-11 03:05 | ATG display flatlined | HSE p.10 |
| 2005-12-11 05:37 | Overflow began | HSE p.11 |
| 2005-12-11 06:01 | Alarm and pump startup followed by explosion | HSE p.11 |
| Afterward | Fire lasted 5 days; 0 deaths, over 40 injured | HSE pp.11–12 |
Consequences and emergency response
The explosion damaged buildings in the adjacent industrial area. Early Sunday occupancy was relatively low and nobody died, but that outcome is not a safe assumption for another tank incident. Evaluate occupancy by time of day and off-site exposure.
Pollutants reached the ground through leaking bunds, drains and soakaways. The report discusses fuel components and PFOS in the foam used then. The aquifer required monitoring. The reported lack of an effect on drinking-water supplies did not eliminate the possibility of longer-term pollution.
Emergency planning needs a destination for contaminated firewater as well as water for suppression. Match drawings to actual drains, define who isolates normally open outlets and check paths leading off site.
Questions for your site
| Question | How to check |
|---|---|
| Who verifies the operating position and securing after a high-level switch test? | Specify restoration, securing and the tested scope of final shutdown. Distinguish a contact test from a complete system test. |
| What governs continued receipt after repeated gauge sticking? | Review fault history with temporary-measure expiry conditions. Do not close a defect solely because indication resumes. |
| Is stopping time reassessed when incoming pipeline flow changes? | Review remaining capacity, maximum inflow and notification and closure delays. Align stopping arrangements with the supplying party. |
| Will bund joints and penetrations retain liquid during fire? | Inspect penetrations and drains against drawings. Incorporate leakage paths and emergency retention into the firewater plan. |
Application at Korean sites
Comparable work in Korea is subject to the Rules on Occupational Safety and Health Standards, MOEL Ordinance No. 450, effective 2026-03-02. The following concerns present work; findings about the incident depend on its investigation and proceedings.
Article 277 specifies checks before use after repair or alteration and for changes of use, including feedstock. Connect corrosion review and maintenance records to return-to-service authorization.
Article 279 requires immediate work stoppage and evacuation where an imminent fire or explosion danger exists. It also requires restricted access and signs until the danger is confirmed absent.
How I would approach this incident at work
I use functional tests to check whether restored alarms and trips actually operate.
I do not leave safety-critical unresolved matters on a routine follow-up list; I approve readiness through the pre-startup safety-check procedure.