104 / 648
Safety and environmental standards for fuel storage sites
Final report
103
Fire protection
109 Fire protection systems are not a relevant mitigation layer for safety because they cannot
realistically be expected to prevent a tank overflow from igniting and exploding (as would be
expected from a prevention layer). Nor can they mitigate the damage caused by an explosion in
such a way as to protect vulnerable people who might otherwise be killed by an explosion.
110 Fire protection systems may be a relevant mitigation layer for environmental damage, but this
would depend very much on the environmental consequence being assessed and whether the fire
protection system is a critical factor in preventing the consequence from developing. It will also be
closely related to the effectiveness of the secondary and tertiary containment and therefore may not
be considered a fully independent layer. The relationship of the fire protection system to other layers
of protection and the effectiveness it is assigned should be judged on a case-by-case basis.
Bunding/secondary and tertiary containment
111Secondary and tertiary containment are not relevant protection layers against an explosion,
but are relevant to minimising the environmental consequences of a tank overflow. The
significance of secondary and tertiary containment will depend on the pathways by which the
gasoline from the tank (or any products such as contaminated firewater which may be an indirect
consequence of the overflow) may enter the wider environment.
112 If secondary containment fails, ground water may be affected. A number of incidents in
recent years have involved secondary containment failures resulting in ground water impacts.
The use of a low probability of failure on demand for ground water impacts due to secondary
containment failures should be justified.
113 Care is particularly required over paths to the environment that may not be immediately
obvious. These may include:
bund floor penetrations for groundwater monitoring bore holes or pipework that may present
■
■
an easier route to groundwater than through the bulk of the bund floor;
drainage arrangements for the collection and removal of rainwater and/or water that is
■
■
drained from the storage tank, especially if these rely on an operator to keep a bund drain
valve closed, or to close it after heavy rainfall. Also, if the bund includes rubble drains these
may reduce the effective thickness of the bund floor;
penetrations of the bund wall, where these are inadequately sealed;
■
■
degradation of the condition of earth bund walls, eg due to slumping, settlement and
■
■
burrowing animals. Also, where access arrangements into the bund result in a reduced
effective bund wall height.
114 A LOPA considering the level of reduction of risk provided by secondary and tertiary
containment requires a realistic case-by-case assessment which may take into account the extent
to which measures comply with current good practice, the means of recovery of spilt material (if it is
safe to do so) and the extent to which loss of integrity may occur for the event being considered.
115 The performance of the tertiary containment systems cannot be separated from the
emergency response arrangements and their effectiveness. For sites where excess contaminated
fire water is piped directly to a suitably sized and designed treatment plant and then to the
environment a low probability of failure on demand for the tertiary containment systems would
be appropriate. Where such excess fire water would be released directly into surface water or
allowed to spill onto the ground and hence pass to ground water, a high probability of failure on
demand would be expected to be used. The use of a high risk reduction factor for surface water
and/or ground release of excess fire water should be fully justified.
116 Where secondary and tertiary containment arrangements fully meet the requirements for bund
permeability, a low probability of failure on demand can be assigned to the protection layers. Where
there are gaps against best practice, a higher probability of failure on demand may be warranted.