37 / 648
Safety and environmental standards for fuel storage sites
Final report
36
resulting from water collecting in the bund or sump. The installation of liquid hydrocarbon sensors
at suitable locations connected to alarms in the control room should be considered.
119 The installation of the correct resolution CCTV with appropriate lighting of tanks and bunds may
assist operators in detecting tank overflows, so this should also be considered. The action to take
on detection of an overflow should be clearly documented, typically as part of an emergency plan.
120 Designers and dutyholders should review how they currently control and log override actions.
In general they should consider:
the need for any overrides – when they may be needed, who should have access to them and
■
■
their duration;
the possible impairment of effective delivery of a safety instrumented function created by
■
■
an override against any safety risks that an inability to override could result in. Such reviews
should consider both normal operation and the response to abnormal/emergency situations;
if current logs would allow the effective identification and review of when overrides are in
■
■
operation or have been operated.
121 More detailed guidance on the approach to overrides can be found in Appendix 4.
122 Dutyholders should identify those records needed for the periodic review of the effectiveness
of control measures, and for the root cause analysis of those incidents and near misses that could
potentially have developed into a major incident. The records should be retained for a minimum
period of one year. Refer to ‘Availability of records for periodic review’ in Appendix 5.
123 Further information relating to the retention and storage of records for SIS can be found in
the guidance provided against Recommendation 2, ‘Management of instrumented systems for
fuel storage tank installations’.
124 Dutyholders should measure their performance to assess how effectively risks are being
controlled. Active monitoring provides feedback on performance and a basis for learning to
improve before an accident or incident, whereas reactive monitoring involves identifying and
reporting on incidents to check the controls in place, identify weaknesses and learn from failures.
125 Appendix 5 provides guidance on establishing process safety performance measures.
MIIB Recommendation 9
Operators of Buncefield-type sites should introduce arrangements for the systematic
maintenance of records to allow a review of all product movements together with the operation
of the overfill prevention systems and any associated facilities. The arrangements should be fit
for their design purpose and include, but not be limited to, the following factors:
(a) The records should be in a form that is readily accessible by third parties without the need
for specialist assistance.
(b) The records should be available both on site and at a different location.
(c) The records should be available to allow periodic review of the effectiveness of control
measures by the operator and the Competent Authority, as well as for root cause analysis
should there be an incident.
(d) A minimum period of retention of one year.
MIIB Recommendation 10
The sector should agree with the Competent Authority on a system of leading and lagging
performance indicators for process safety performance. This system should be in line with HSE’s
recently published guidance on
Developing process safety indicators
HSG254.