CDOIF Guidance

Safety and environmental standards for fuel storage sites

Final report

26 The distinction between an Individual Risk assessment and a scenario-based safety

assessment is important for how the consequence is calculated and for how this is presented in

the LOPA. It is of particular relevance to how some protection layers (in particular evacuation, see

paragraphs 118–122) and conditional modifiers (probability of presence and probability of fatality,

see paragraphs 142–145) are applied.

27 For a scenario-based assessment, there may be no single value for factors such as

occupancy or probability of fatality that can be applied across the entire exposed population. If

this is the case, it is not appropriate to represent the factor in the LOPA as a protection layer or

conditional modifier. Instead the factor should be incorporated into the consequence assessment

by subdividing the exposed population into subgroups sharing the same factor value and then

aggregating the consequence across all the subgroups.

Estimating the consequences of a Buncefield-type explosion

28 The full details of the explosion at Buncefield are not fully understood at the current time,

although the explosion appears to be best characterised by the detonation of at least part of the

vapour cloud formed by the overflow (RR718

). The available evidence suggests over-pressures

of at least 200 kpa within the flammable cloud, but rapidly decaying outside the cloud for the

prevailing conditions and Buncefield.

29 Given the limitations on current understanding, it is appropriate to apply the precautionary

principle as outlined in

Reducing risks, protecting people

and the policy guidelines published by

the United Kingdom Interdepartmental Liaison Group on Risk Assessment:

The Precautionary

Principle: Policy and Application

As described in

Reducing risks, protecting people

, the

precautionary principle ‘rules out lack of scientific certainty as a reason for not taking preventive

action’. Therefore this guidance offers judgements based on the information currently available in

recognition that future developments in modelling and understanding may allow these judgements

to be revised.

30 Currently there is no widely available methodology for estimating the size, shape and rate

of development of the flammable cloud that could be formed from a storage tank overflow.

The behaviour of the explosion and effects cannot be predicted with the more commonly used

models such as the multi-energy model. More sophisticated models may be able to estimate

the explosion hazards and risks for particular sites. Otherwise it is proposed that consequence

assessments are based on the experience of the Buncefield incident.

31 In estimating the spread of the flammable cloud, the simplest assumption is that it spreads in

all directions equally. This assumption is conservative and is considered reasonable if there are no

topographical factors influencing directionality. At wind speeds of less than 2 m/s, it is assumed

that the wind direction is too variable and hard to measure reliably to have a significant directional

impact. However, the spread of the flammable cloud at Buncefield was influenced by local

topography and the cloud did not spread equally in all directions even under very low wind speed

conditions. The influence of topography will need to be considered on a case-by-case basis and

should be justified by supporting evidence. This may involve specialised dispersion modelling as

standard models cannot reproduce the source term from the plunging cascade and may not be

reliable at very low wind speeds. The effort to produce such a justification may only be worth

making if the directionality has a significant impact on the consequence.

32 The following distances (Table 7) are considered to be a conservative approximation of

the hazard zones for a Buncefield-type explosion and, in the absence of other information, are

recommended as a method by which operators can determine relevant hazard zones.