On 11 December 2005, a series of explosions and a major fire tore through the Buncefield oil storage depot in Hertfordshire. It remains one of the largest industrial explosions in Europe in peacetime.
Most commentary focuses on overfilling of Tank 912 and failed level instrumentation. But from a containment and environmental perspective, Buncefield is remembered for something more fundamental:
Buncefield showed what happens when bunds and containment systems are treated as civil infrastructure – not as safety-critical, regulated assets.
Despite extensive bunding on site, large volumes of petrol, contaminated firewater and foam escaped, polluting soil and the underlying Chalk aquifer used for public water supply. The event reshaped regulatory expectations in the UK and Ireland and, just as importantly, changed what “good” looks like in the detailed engineering of bunds and their inspection.
How the Bunds Actually Failed at Buncefield
1. Joints – the Weakest Link
Every concrete bund will have joints in its walls and floor – both for construction and to manage thermal movement. At Buncefield, many of the worst failures occurred at these joints.
Investigations and subsequent industry analysis highlight three contrasting outcomes:
- Bunds with metal waterstops in wall and floor joints – these generally performed well. The metal waterstops maintained integrity under fire and prevented leakage through the joint.
- Bunds with plastic waterstops plus metal cover plates – these also performed well, provided the detail was correct and the cover plate protected the joint and sealant.
- Bunds with no waterstops, relying only on sealant – three bunds performed particularly badly. Sealant alone was not fire-resistant; it degraded under heat and allowed oil and firewater to escape through the joint.
Angle joint at Bund 12 expanded from fire
Practical design and upgrade lessons include:
- For new bunds storing flammable or environmentally hazardous inventories, best practice is to use either metal waterstops or plastic waterstops combined with metal cover plates and fire-resistant sealant on the liquid side of the bund.
- For existing bunds, establish whether waterstops are present. If they cannot be confirmed, the conservative approach is to upgrade the joint with fire-resistant sealant and metal cover plates on the liquid side.
Movement joint details after Mason et al. (1997): (a) in a slab and (b) in a wall
Cover Plates are manufactured from 6mm thick 316 Stainless Steel in accordance with the requirements of CIRIA guidance document C736 & HSE PSLG final report.
2. Pipe Penetrations – Where Liquid Finds a Way Out
Buncefield also saw a large number of failures at pipe penetrations through bund walls. Hydrostatic testing can reveal whether a penetration leaks at ambient conditions, but it does not tell you how that penetration will behave in a prolonged fire.
At Buncefield, penetrations that were not properly detailed and protected became leakage paths for oil and contaminated firewater once the fire took hold.
Bund pipe penetrations (lacking puddle flanges)
Modern good practice for pipe penetrations includes:
- For new construction, use puddle flanges or cast-in sleeves that are properly bonded into the wall and compatible with both the bund structure and the product.
- For existing bunds, where retrofitting puddle joints is difficult, a common solution is to sleeve the pipe – locally reducing the pipe diameter at the wall penetration and using the original pipe as a sleeve – and sealing the annulus with materials that maintain integrity under fire and chemical exposure.
When we carry out bund integrity assessments, penetrations and joints are often where we find the highest risk of loss of containment, particularly where legacy modifications have been made without revisiting the original design intent.
Example of satisfactory pipe penetration
3. Capacity and Tertiary Containment
Buncefield was not a single-tank incident. Multiple tanks, in multiple bunds, were involved. Firefighting over several days used tens of millions of litres of water and foam.
Two systemic weaknesses became apparent:
- Bund capacity was overwhelmed. Many bunds had not been sized for realistic worst-case scenarios (multi-tank loss plus firewater), and may have met simple “110% of largest tank” rules on paper while still being inadequate in practice.
- Tertiary containment was inadequate. Once liquids overtopped or leaked from bunds, site drainage allowed significant quantities of contaminated water and product to leave the site and impact groundwater, contributing to classification of the event as a Major Accident to the Environment (MATTE).
Current guidance now expects operators to treat primary, secondary and tertiary containment as an integrated system, designed and assessed against realistic, site-specific scenarios rather than generic rules of thumb.
How Regulation Has Moved On – UK and Ireland
UK: COMAH, EA/SEPA, HSE and PSLG
In the UK, Buncefield led directly to the COMAH Competent Authority Containment Policy for bulk hazardous liquids at COMAH establishments. The joint Competent Authority (HSE, Environment Agency and SEPA) significantly raised expectations around containment.
Key themes from the Containment Policy and supporting guidance include:
- Primary containment – overfill protection and level systems treated as safety-critical, often implemented as SIL-rated safety instrumented functions for petrol storage tanks.
- Secondary containment (bunds) – bunds must be designed, constructed and maintained to be impermeable and structurally sound, including walls, floors and penetrations. Detail around joints and pipe penetrations must be robust for fire conditions, not just normal operation.
- Tertiary containment – drainage and off-site pathways must be managed so that, even if a bund fails or overtops, contaminated liquids are retained and controlled on site.
The Process Safety Leadership Group (PSLG) then produced the benchmark guidance Safety and environmental standards for fuel storage sites – widely known as the “Buncefield standard”. For bunds, PSLG reinforces the expectations on leak-tightness, realistic capacity calculations and integrated secondary/tertiary containment.
CIRIA C736, Containment systems for the prevention of pollution, is now the principal design and good practice reference for containment in the UK, covering design, inspection, maintenance and upgrading of bunds and associated systems.
Ireland: EPA and Bund Testing Expectations
In Ireland, the Environmental Protection Agency (EPA) regulates relevant facilities under Industrial Emissions (IE) and IPC licensing, and issues detailed guidance on bunds and containment through documents such as the IPC Guidance Note on Storage and Transfer of Materials for Scheduled Activities.
EPA-aligned best practice now expects:
- Bunds to be tested for integrity at least every three years, or after repairs or modifications, to protect soil and groundwater.
- Testing to follow recognised technical standards such as EN 1992-3:2006 and BS 8007, with appropriate test durations and acceptance criteria.
- Test methods to be selected in line with EPA guidance, particularly where full hydrostatic testing is not feasible for operational or structural reasons.
EPA audit and enforcement activity increasingly focuses on whether operators can demonstrate documented, competent and timely bund integrity assessments, rather than simply showing that a bund exists on a drawing.
Beyond Compliance: What Good Bund Integrity Management Looks Like
From Buncefield, subsequent regulatory work and extensive site experience, a clear picture has emerged of what good bund integrity management looks like in practice.
- Treat bunds as engineered safety-critical systems
Bunds are not simply civil structures or “nice to have” pollution controls. They are safety-critical and environmentally critical assets:
- Include bunds in safety-critical and environmentally-critical equipment registers.
- Align design and operation with COMAH Containment Policy, PSLG guidance, CIRIA C736 and EPA guidance as appropriate to the jurisdiction.
- Go beyond simple hydrostatic tests
Hydrostatic testing is important, but on its own it is not enough. It confirms whether the bund leaks under test conditions; it does not confirm how joints and penetrations will behave in a fire.
A robust assessment should also review:
- Presence and type of waterstops.
- Whether metal cover plates are installed on the liquid face of joints.
- The specification and condition of joint sealants, including fire performance.
- The detailing of pipe penetrations and any sleeves or puddle flanges.
Independent inspections typically combine visual and dimensional surveys, hydrostatic or equivalent testing, and a detailed review of joint and penetration details against current best practice.
- Verify, not assume, capacity and tertiary containment
Recalculate bund capacity against credible worst-case scenarios – multi-tank incidents, realistic firewater flows and rainfall – and confirm that sufficient freeboard is available. Map and understand drainage and tertiary containment so you can show how contaminated liquids will be contained on site during an emergency, rather than diverted to a watercourse or soakaway.
- Use independent third-party expertise
There is a strong regulatory and practical case for independent, third-party bund integrity assessments:
- They provide objective evidence of compliance with EA/SEPA/HSE expectations in the UK and EPA expectations in Ireland.
- They help identify defects – such as missing waterstops, inadequate penetration details or capacity shortfalls – before they become incidents.
- They support risk-based investment, allowing operators to prioritise remedial work with the greatest impact on risk reduction and regulatory compliance.
Field experience consistently shows that details at joints and penetrations are where Buncefield-type vulnerabilities still hide; independent assessment is often the most efficient way to surface and address these risks.
Conclusion: Turning Buncefield Lessons into Practised Reality
Buncefield fundamentally changed the question regulators and operators must ask. It is no longer “Do we have a bund?” – the real question is:
Can we prove our containment will still work after days of fire and millions of litres of firewater?
Answering “yes” requires sound, modern design of joints, waterstops and penetrations; realistic capacity and firewater planning; integrated primary–secondary–tertiary containment; and regular, independent verification that bunds are performing as intended.
The technical details now in focus – waterstops, metal cover plates, puddle joints, test intervals and drainage mapping – are precisely the details that failed at Buncefield. Getting them right is how we ensure that, if the worst does happen, the environment is not the next casualty.
The authors, George Byrne and Bob Sutcliffe, are Chartered Engineers and Directors of Environmental Efficiency. The material in this articles draws from his own experience of bund inspections throughout the UK and Ireland. Additional material has been taken from the HSE investigation into the fire at Buncefield. The author welcomes comments on this article.