CDOIF Guidance

Safety and environmental standards for fuel storage sites

Final report

Consequence assessment

Overview

23 This guidance is concerned with the prevention of the overflow of an atmospheric storage

tank. Such a scenario is only one part of the wider picture of risks associated with storage tank

operations. Therefore, the dutyholder of the storage facility should bear in mind that even once the

risks of a tank overflow have been addressed, there may be other severe events resulting from

(for example) failures of integrity in the tank floor and walls which should also be evaluated before

the risk assessment of the facility can be considered complete. For these cases, techniques other

than LOPA may be appropriate.

24 In the case of the overflow of a gasoline tank, several outcomes are possible with different

safety and environmental consequences:

Prior to the Buncefield explosion, the most likely consequences from the overflow of an

■

atmospheric storage tank would have been assumed to be a flash fire and/or pool fire. The

size of the flash fire would probably have been limited because the influence of vaporisation

from an atomised liquid cascade was not recognised and the flash fire would have been

associated with evaporation from an assumed quiescent pool in the bund. In either case, the

most serious outcome may well have been assumed to be a single fatality somewhere on the

operating facility with the off-site consequences being managed through evacuation.

Following the explosion at Buncefield, the most severe human safety consequence should

■

now be assumed to be an explosion that may cause damage to occupied buildings or places

where people may congregate. The explosion will be accompanied by a flash fire and will

probably result in multiple pool fires.

The Buncefield explosion and subsequent fires caused environmental damage due to the

■

contamination of ground and surface water by oil products and firefighting agents. Some of this

damage was the result of failures of secondary containment during the fires and insufficient tertiary

containment to retain contaminated firefighting water. Experience of leaks from tanks at other sites

has been that where the bunds are permeable, ground water contamination can occur.

Individual Risk and scenario-based assessments

25 This guidance addresses four types of assessment for overflow protection: three for safety risk

and one for environmental risk. These are as follows:

Individual Risk assessment, where the calculation is typically performed for a specified

■

individual (often characterised by ‘the person most at risk’ and referenced to a specific job role

or a physical location). Typically the calculation takes one of two forms: the risk from a tank

overflow is aggregated with contributions from other relevant hazards and then compared

with an aggregated risk target; alternatively, the risk from the single overflow scenario may be

calculated and compared with a target for the contribution to Individual Risk derived for a single

scenario. Individual Risk should aggregate all risks to that individual not just major accident risks.

Consideration of Individual Risk is required within the COMAH safety report for an establishment.

Scenario-based safety risk assessment, where the calculation estimates the frequency with

■

which the hazardous scenario will lead to the calculated consequence (a certain number of

fatalities within the total exposed population). The distinction between this calculation and an

Individual Risk calculation is that this calculation does not focus on any specific individual but

instead considers and aggregates the impact on the whole population. A single scenario-based

risk assessment does not account for all the sources of harm to which an individual may be

exposed in a given establishment. When scenario-based LOPA is carried out, Individual Risk

should also be considered to ensure that Individual Risk limits are not exceeded.

Societal Risk assessment: Where the scenario contributes significantly to the Societal Risk of

■

the establishment an assessment should be made. For top-tier COMAH sites, consideration

of Societal Risk is required within the COMAH safety report and, if applicable, could be more

stringent than Individual Risk.

Scenario-based environmental risk assessment, where the consequence is assessed against

■

a range of outcomes.