Buncefield report targets level gauging systems

London – The Buncefield Major Incident Investigation Board (MIIB) has highlighted the potential safety benefits of new level sensing technology within its recommendations for improvements to the design and operation of sites that store and handle large fuel volumes. A faulty level gauge was found to be one of the primary causes of the massive explosion at the Buncefield oil storage depot on 11 Dec 2005.

Tank gauging systems often employ mechanical servo gauges to sense the liquid level. However, such gauges appear to be vulnerable to a number of potential failure modes, according to the MIIB report.

Detection of ultimate high liquid level in storage tanks often relies on a switch mounted on the roof or the uppermost level of the tank wall. However, the operation of these switches cannot be tested fully in situ other than by raising the liquid level in the tank to the ultimate high level.

Other testing methods leave potential failure modes uncovered and so leave the switch in a faulty state, unknown to the operator or maintenance staff. The testing itself introduces the possibility of overfilling so must be undertaken under strict supervision, said the MIIB.

Moreover, the more basic switches do not benefit from the ‘on line’ diagnostics of more advanced sensors such as tuning fork- or thermocouple-based technologies to ensure that all foreseeable failure modes are detected as they occur.

The MIIB, therefore, wants industry to move away from the use of simple high-level switches and towards more advanced ‘fail safe’ sensors, which it noted, are already widely used including several certified for use in SIL2/3 applications in accordance with BS EN 61511.

The MIIB report further recommends that ultimate high level detection systems do not rely on components inside storage tanks as these internal components are difficult to inspect, maintain and test safely. It cited an alternative of using a small external tank tapped into the main tank through a small bore pipe at the ultimate high level. The ultimate high-level sensor would be fitted to this external tank so that any ‘overspill’ from the main tank is sensed.

The setting of the ultimate high level would be determined by the physical position of the tapping and would not be vulnerable to unintended changes, MIIB pointed out. Wet testing of the level sensor would be possible without the need to overfill the main tank, the report added.

The practicalities of fitting such an external tank and the associated instrumentation and cabling should be considered, the report continued: “It may be that the tapping could be made without the need to empty the main tank, although this would need to be confirmed. This would significantly reduce the installation costs.”

The report also highlighted the potential safety contribution of modern electronic gauge sensors, such as those based on radar technology, which eliminate the many failure modes associated with mechanical components.

Overall, the MIIB said it aims to encourage industry “to make effective use of the facilities provided in state-of-the-art tank gauging systems to reconcile the indications of product level in tanks with all available information such as product movement requests, pipeline flow measurements, temperature, etc. In this way … failure of a single element of the system, such as a servo gauge, is detected and the operators alerted before a hazardous situation develops or before a demand is placed on the overfill prevention system."