Multi-tank fire fighting conference highlights

Published:  17 December, 2012

An agenda packed with thought-provoking presentations combined with an audience full of experienced professionals made the Multi-Tank Fire Fighting Strategy Workshop that took place in September an overwhelming success, reports Jose Sanchez de Muniain.

Delegates from Europe and the Middle East congregated in Stockton on Tees, northeast England, to learn and share best practice in regard to multi tank fire fighting, particularly in the light of recommendations that followed the Buncefield incident. The event was organised by Hawkes Fire and supported by Angus Fire and Cleveland Fire Brigade.

Cleveland Fire Brigade Chief Ian Hayton welcomed delegates with an introduction to Teesside and the particular challenges faced by the fire brigade. Teesside is characterised by an industrial landscape which is situated in close proximity with the local communities resulting in a strong relationship between the two. Teesside comprises 12% of the UK’s COMAH sites including 34 top-tier sites and 3 lower tier sites; as well as the country’s busiest cargo port; two power stations (one nuclear) and a local airport. Cleveland Fire Brigade is well versed in dealing with risk and in terms of its history the effective management of potential incidents has not always been theoretical: ‘In 1995 we had the BASF fire, which at the time was the largest post-war fire in history – we know that was surpassed ten years later with Buncefield.’

That experience has led Cleveland Fire Brigade to invest a lot of time and money in drawing together site-specific risk information including site-specific preplans, worse-case scenarios that involve the potential for offsite developments, as well as pulling together response plans for the 37 COMAH sites and beyond: ‘We have in the range of 50-60 site-specific plans as to what we would do in the event of a major incident.’

The strategy is based on a tiered response approach that is built upon long-standing mutual aid arrangements with Teesside operators, as well as regional and national response if necessary, as happened in Buncefield.

Referencing the 3 volumes of the final Buncefield report (11 December 2008, Major Incident Investigation Board) Chief Hayton highlighted the wide-ranging scope of the document, which not only covers the design and operations of Buncefield type facilities but also emergency preparedness and response; advice to local planning authorities; inspections on the part of the Health and Safety Executive; as well as the Environmental Agency’s role in regulations.

‘The focus for this conference is on the recommendations for emergency preparedness and response to – and recovery from – emergency incidents of that nature.’

Two recommendations in particular are to be concentrated on during the two-day workshop: the first is the instruction to review emergency arrangements in sites; and provision of all foreseeable scenarios arising from credible major hazard incidents. ‘The two things that came from Buncefield related to that credible scenario: what was the worst-case planning scenario? At that time a vapour cloud explosion was not deemed to be realistic. In fact, it was not included and as we now know it is a realistic occurrence.’

Most planning scenarios for tank farms have been created around a single tank on fire as the worst-case scenario. ‘And in fact one of the recommendations in relation to Buncefield is that credible scenario planning includes both vapour cloud explosions and multi-tank fires.’

The other recommendation (‘recommendation 23’) relates to mutual aid arrangements: how site operators work together and with the local fire service both at local and national level:

Recommendation 23: The operators of industrial sites where there are risks of large explosions and/or large complicated fires should put in place, in consultation with fire and rescue services at national level, a national industry–fire service mutual aid arrangement. The aim should be to enable industry equipment, together with operators of it as appropriate, to be available for fighting major industrial fires. (Ref 8: FRS Recs 2 and 25) (Ref 16: p 5) Industry should call on the relevant trade associations and working group 6 of the Buncefield Standards Task Group to assist it, with support from CCS. The COMAH Competent Authority should see that this is done.

Stephen Britton, HSE Hazardous Installations Inspectorate: the Regulator’s Viewpoint

Stephen began by setting the scene pre and post Buncefield in regard to the legal duty of COMAH sites to register with the Health and Safety Executive a report containing emergency plans: ‘Up until Buncefield the onsite emergency plan within a COMAH report consisted of a site saying what it had. Not much description in terms of adequacy of mitigation, and it was assumed that the fire service would come and sort it out.’

Things have changed and today the HSE aims to ascertain the vulnerability of a site; looking at consequences versus likelihood (of an incident) – and that provides the level of preparedness of a facility.

In order to highlight what an emergency preparedness plan should consider Stephen shared with the audience his experience with the first top tier site report he’d assessed. ‘Unfortunately a fire started and the site burned to the ground. The site knew what the threats were, they had done predictive work on how long the fire would burn – and they were within a minute or two of that. Their plan said the warehouse would burn down within four minutes, and CCTV confirmed it was fully alight after three. The fire services had been to the site and produced a tactical plan, and when it came to it they performed it perfectly. They came, cooled the adjacent building, and waited for the fire to die down.’

It was afterwards that the event started to deteriorate. ‘The fire water hadn’t been fully considered, so it went into local rivers. The newspaper pictures showed a local river covered in foam.’ The next problem came with damping down operations, which needed an excavator to assist the fire service in damping down. ‘So preparedness needs to be over a longer than is traditionally thought of to consider everything that is needed for a site to get back to business as usual.’

Good plans will be wide ranging and tested on the ground via exercises, covering aspects such as where emergency service equipment including radios can be safely operated on sites with flammable materials. ‘The police need to know who which roads and rail links will need to be closed and where they can safely set up a cordon.’

Looking at COMAH incidents in the last ten to 15 years Stephen pointed out that the outcomes had invariably resulted in river or groundwater contamination, so when considering how to deal with an incident containment of the water needs to be robust to avoid contaminating nearby rivers.

Stephen concluded by encouraging operators to study the HSE document “Safety and environmental standards for fuel storage sites”  This document was written for fuel storage sites but contains information that should be considered for all sites including the Buncefield recommendations. Another source of guidance is ‘Model Code of Safe Practice Part 19: Fire precautions at petroleum refineries and bulk storage installations’, published by the Energy Institute, which provides information on how to go about producing onsite tactical plans for COMAH major accident scenarios.

During a question and answer session one delegate asked what was the main recommendation given by the HSE on improving management arrangements. ‘The easy answer is have they actually had the fire brigade in to discuss what their COMAH report contains? The emergency plan should have described what events could happen and how they need to be tackled. If the Fire and Rescue Service are needed to carry that out, then you need to find out their capability since they have a duty and therefore equipment to rescue people, not to protect your plant. If a controlled burn philosophy can’t be used then you have a gap in capability in terms of foam or foam application equipment that a site should fill that gap. This could be either by purchasing equipment or paying for a commercial service to protect your plant. If you ask the Fire and Rescue Service to walk through any plan to see the gaps in your plans which are generally written in the office. The classic one is if the site is at the end of a cul-de-sac, with only one route in, what happens if the smoke is blocking that route?’

The worrying aspect of Buncefield, remarked Stephen, is that a one-in-30-years type incident has since 2005 occurred three times across the world. Therefore emergency responses should not be approached as something we are unlikely to ever need.

Steve Kershaw, Director, Haztech Consultants: COMAH Credible Scenarios 

Steve’s focus was an overview of COHAM; identification of potential major accident hazards; the mechanisms of fire and explosion modelling and escalation; the Buncefield incident and recommendations (and impact for COMAH); and COMAH credible scenarios.

Steve began by saying that few process engineers understood what can actually happen on the fire ground. Saying that, even if his company had carried out the fire risk assessment for Buncefield (which they hadn’t), they would not have picked up on vapour cloud explosion as a risk.

There is a lot of regulation. Control of major accident hazards Regulations 1999 (COMAH); The Control of Major Accident Hazards (Amendment) Regulations 2005; ‘Guide to the Regulations’ L111; preparing safety reports HSG190; Emergency planning for major accidents – COMAH 1999 HSG191; not to mention the Buncefield final report and recommendations.

Regulation 9 (COMAH Emergency Planning Regulations) lays down the requirements for top tier facilities to write an on-site emergency plan, and regulation 10 requires the relevant local authority to produce an off-site plan.

Regulation 7 requires a safety report that includes details of the on-site emergency plan arrangements – and this must include the information required to enable the local authority to write the off-site plan.

One of Steve’s main points was that there was a significant gap between emergency planning and what could actually go wrong in reality. COMAH regulations require that a major accident policy is implemented, and this requires hazards are identified and that adequate safety systems are in place. ‘The whole idea is to drive prevention and to stop something happening and getting bigger. But what happens in reality is there is an assumption that “yes we’ve done that,” so an incident won’t get any bigger.’

A number of video clips of real life events were shown, including a boilover involving 210,000 gallons of crude. ‘What happens if things go really wrong? That is the gap between a safety case now – including what the local authorities and planning people need to look at - and a site that’s gone wrong beyond the risk that can be controlled.’

Steve then looked at how sites can assess risks so they are as low as can be reasonably practicable (the legal term).

This includes having a management system that is active and that shows onsite plans are effective, as well as an offsite emergency plan. ‘So you have to measure your hazards; identify what could happen; how big an incident could be; how often it could happen; the likelihood; and how you manage the equipment and people to reduce the risk further.’

The starting point for this process is a ‘source’ term, whether it be vapour or liquid leak, and the specific areas it applies to; ‘Without this, an accurate answer is impossible – garbage in, garbage out.’

Modelling work is useful but requires firm foundations looking at realistic parameters that include size of release; gas dispersion; atmospheric stability; concentration; and type of confinement (for vapour cloud explosion modelling).

Steve then focussed on possible escalation scenarios in tank farms. ‘For all tanks we would look at catastrophic tank failure and bund overtopping. If it suddenly failed, could you get flammable material flowing over the tank and, if it is uphill, could it run downhill and cause fatalities?’

Badly designed facilities could have disastrous consequences and as an example of bad practice Steve showcased several tanks that shared the same vent line for collection or destruction, thus providing a potential fire route from one tank to another.

A video clip highlighted what can happen if the lid of a tank has not been welded properly according to API 650 (Welded Steel Tanks for Oil Storage), which is that the tank lid does not blow off as a result of the increased pressure within the vessel. ‘If it is not properly controlled in terms of construction, the welders may think, “I’ll put a little bit more on because I don’t want it collapsing,” and he thinks he’s done a good job.’ Another video clip showed a properly welded tank lid blowing off an atmospheric tank filled with flammable liquid; in this case the fire consequently spread to a neighbouring tank.

Turning to Buncefield, Steve remarked how tank farm operators hadn’t previously considered vapour cloud explosions as a risk. In addition, planning tended to revolve around a single tank fire. ‘One of the issues highlighted by Buncefield was that if you have a high level alarm or trip, it is only meant to operate on a rare occasion when everything goes wrong, for example if you overfill a tank by mistake. What a lot of people do is use the high level alarm or trip to check whether the tank is full or not. But if you are using a high level trip to stop the inflow, it is not a trip any more – it’s not a safety system – it is a control system. So you need a separate system on top of that.’

On the day of the Buncefield explosion there was very low wind speed, which resulted in a large uncontrolled release over a long period, leading to the formation of a large ‘carpet’ of vapour. ‘We actually went to the site after the incident, and these trees here are actually like pipe structures, with two solid rows. And if you look at the damage caused, you can see it follows all the trees.’

Concluding, Steve remarked that - pre-Buncefield - sites still had the requirement to identify credible scenarios: ‘I don’t see any change in that in terms of the legislation – but it is the guidance that will change, specifying what scenarios you should be planning for.’ This may include considering trees and surrounding structures as ‘confinement’ for large vapour releases at very low wind speeds.

Kevin Westwood, BP: Tank Fires and Boilovers

After walking the audience through some of the generic types of incidents that can occur on atmospheric tanks Kevin Westwood made his first major point: large scale tank fires can be managed if the right planning and the right resources are in place. ‘This particular event was the largest full surface tank fire extinguished. It is an 82m-diameter tank filled with gasoline. It was extinguished by Williams Fire and Hazard Control as part of their response to this facility. It took 12 hours to respond to the event, and a little over 60 minutes from start of the foam attack to extinguishment.’

This was in stark contrast to the images shown in the next example: Port Kembla (Australia) 2004, involving a 32m-diameter tank containing about 4000 m3 of ethanol. ‘How much foam is reaching the product? Next to none. Note many small ineffective monitors being employed in the fire-fighting tactics. At one point a helicopter was also used to no effect. You need to consider this is a hydrophilic product, so it will consume any non-polar resistant foam that is applied in an aggressive type III application.’ After a number of similar examples Kevin focused on the key theme of his talk the ‘boilover’ phenomena and introduced the audience to a boilover experiment carried out by LASTFIRE in Abu Dhabi, using a 5m-diameter tank. The impressive video showed a flame envelope reaching 145m into the air. ‘If that was a 100m diameter tank you are talking about - at least - a 1000m fireball, as well as escalation through product ejected out of the tank.’

A case study of a boilover incident that took place in 1976 in Milford Haven served as a textbook example of how these incidents happen. Incandescent hydrocarbon particles from a nearby flare ignited a spill fire on the roof of a 250ft diameter tank that had experienced some small quantities of crude oil leakage. The l fire spread and the metal seams became heated which led to more product on the roof. The roof then sank and the fire engulfed the full surface of the tank. Eventually and unknown to the firefighters at the scene – as the thermal re-radiation feedback from the fire heated the top of the tank contents, the lighter fractions of the crude vapourised and burned. The heavier fractions slowly sank below the surface to form the so-called ‘heat wave’ – a hot layer that typically grows over time and gradually sinks during the boilover process. As the lighter fractions burn off the hot layer sinks at an average rate above 3ft per hour. ‘This distillation process occurs throughout the tank fire, and the reaction continues until the hot layer hits the water at the bottom of the tank. And then the contents are ejected out of the tank.’

The forceful ejection is caused by water found in stratified layers throughout the tank or at the base of the tank becoming superheated and boiling to steam. ‘When water boils to steam it expands by a factor of more than 1700 times.’ In the case of the tank at Milford Haven, the flames were sent several 100s of feet into the air, and 1000s of tonnes of burning crude oil landed in the bund, with some reaching neighbouring tanks, sparking fires up to an estimated four acres away. Vapours inside neighbouring tanks ignited in spite of the foam previously applied to prevent ignition.

‘In this event the time to boilover was 12 hours; the time to the second boilover – because it was a multiple boilover type event – was 14 hours 10 minutes. In this event there would have been more boilovers, and the reason there wasn’t is that with the second boilover the tank split and the product and the water flowed out of the tank.’

Kevin warned the audience that there was a temptation to feel complacent about such events if one didn’t understand the devastating consequences. ‘There is a quasi-steady period, a boilover premonitory period and a boilover period. In the premonitory period there is an intensification of flaming and sometimes people can hear crackling. That is often the precursor to the boilover event. However, it doesn’t always happen. So don’t think you can wait until the crackling for the boilover to occur.’

Kevin explained the conditions for boilover to occur; first the product should have a wide boiling range i.e. a number of different components, as is the case with crude oil. Next is the presence of water in the tank. ‘If you take the same tank fire scenario with a refined product the regression rate or consumption of product due to fire occurs without the generation of a heat wave because there is only one boiling point. And when it hits a water layer there is no boilover or at best a thin film boilover may occur.’

Over a period of four years LASTFIRE has conducted more than 200 boilover experiments in order to predict the time to boilover; effect of water level and fuel quality; types of fuels that will boilover; and the effects for firefighters.

In collaboration with Professor Geoff Hankinson at Loughborough University LASTFIRE has built a boilover rig  - a piece of equipment with a glass front to see the boilover effect in action, and Kevin showed one such video: ‘The vapour bubbles coming off the top of the water produce a noise, and that is probably the crackling reported by 1st hand witnesses of boilovers in the premonitory stage.’

As to lessons learned by LASTFIRE, Kevin pointed out that if the product had a wide boiling range and there was a full surface fire, with no capability to put it out, the probability of boilover was one; ‘You will have a boilover’.

Some boilovers result in a gentle ‘waterfall’ type event; others in a violent ejection. ‘Fire spread to other tanks is almost inevitable and we have a rule of thumb: 10 tank diameters down wind and five tank diameters cross wind. In the LASTFIRE experiment conducted in Abu Dhabi we had product spread to 9 tank diameters down wind.’

Although a number of boilover prediction models have been developed there is still insufficient data and too many variables to validate them with any degree of confidence. But one thing is clear: ‘There is only one way to prevent escalation of a full surface crude oil tank fire into a boilover and that is to extinguish it. And do it quickly.’

The results can be devastating and in the majority of such events there have been multiple fatalities due to not understanding the potential for escalation. The committing of firefighters and resources too close to the scene and allowing onlookers is a recipe for disaster. To finish off, Kevin showed some pictures of the infamous Venezuelan boilover event that occurred 9 December 1982. ‘It wasn’t crude oil but a heavy fuel oil. Boilover occurred, 150 people were reported killed - and that’s the lowest casualty number I can find in records. 500 were injured and 1,000 rendered homeless.’

Martin Hawkes, Hawkes Fire: Foam Application Rates

Specialist risk engineer for Hawkes Fire, Martin Hawkes presented on foam equipment (oft portrayed as a ‘black art’), foam application rates, and both fixed and mobile systems.

After a quick summary of the different types of foam (high/medium/low expansion) and the basic components necessary (water supply/proportioning device/concentrate/foam discharge device), Martin focussed on the different systems available to introduce the correct amount of foam concentrate in the water.

Foam inductors are basic and simple to use but they have the drawback that they need to be matched to the flow rate, and can also suffer from backpressure issues.

Round-the-pump pump proportioning systems are predominantly used in ARFF trucks and are a better system than foam inductors because they can be adjusted to the required flow rate. However, if there is a hard backpressure on the suction side the systems won’t work.

Balanced pressure systems are extremely versatile and accurate, and these are mostly associated with fixed systems and specialist mobile equipment. ‘These are very good because they give you variable flow rates and there are no back pressure issues.’

Martin then introduced the water turbine system, a relatively new technology from Angus: ‘These are very accurate and because they are powered by water they don’t need an external power supply.’

There are three different types of low expansion foam systems. Foam pourers are normally installed on the rim seals of storage tanks; foam deluge nozzles are usually fixed on loading racks or process areas; foam monitors are usually fixed in process areas.

For full surface tank fires without fixed foam systems – or where fixed systems are no longer working – big gun monitors are usually used.

Foam application rates are a source of widespread confusion as a result of the number of different standards. ‘It really depends where in the world you are; what the local regulations are; and what your policy documents are.’

NFPA states that protection on fixed roof tanks should be 6.5 litres of foam concentrate per m2 on top of the tank, per minute. ‘This requirement is low and we would normally suggest you include a 60% uplift to account for the fallout from the monitor’s application.’

For bund fire-fighting NFPA recommends 4.1 litres per minute for low-level foam discharge outlets, and 6.5l per m2 for foam monitors.

As regards EN standards, tanks fires up to 45m in diameter should have an application rate of 10l per m2 per minute, for 60 minutes. Up to 60 metres diameters, it is 11l per m2 per minute, and over 60 metres diameter it is 12l.

‘We often go out to assess systems and we find the application rate and run time are too low. We’ve worked with independent experts and come up with a calculation of 10.4l per m2, for 65 minutes of fire fighting. But you should also factor in vapour suppression for at least 4 hours afterwards. We usually calculate this at about a third of the application rate, so 3.466l per minute. This is critical – you may have enough to extinguish the fire, but have you got enough foam for vapour suppression? Many people don’t take that into account in their foam calculations, and it is quite critical.’

All delegates were given handy foam spreadsheet calculators provided by Angus Fire. By inserting the tank diameter and foam percentage (1/3/6), the calculator provides the amount of foam solution required, eg 9,500 l per minute. ‘The total solution for 65 minutes application is 6,100 litres, and then also the 50% reserve stock requirements. So in total where you would come out with 6,000l of foam, in reality you’d need 9,000l of foam to give you the four-hour vapour suppression. And now you have all the foam concentrate requirements you can move forward your emergency response plans.’

Mark Scoggins, Solicitor Advocate, Fisher Scoggins Waters LLP: After the Event: a Lawyer’s View

For the last 20 years Mark Scoggins has been defending organisations that find themselves in ‘big trouble’. Disasters are his speciality and past cases include defending the Metropolitan Police over the Jean Charles de Menezes shooting (July 2005); Balfour Beatty in the aftermath of the Hatfield train crash (October 2000), and the company that supplied the high level tank alarms at Buncefield.

The session started with a theme that would be addressed interactively over the next two hours of Mark’s presentation: what are your post-event priorities.

‘Imagine you’ve just taken care of a big tank fire, Buncefield, and the world’s press are picking over it. What would you like said about you?’

Answers ranged from ‘did a fantastic job’ (‘yes, credit to the service… anything else’) to ‘did everything right’ (‘that’s a post factor rationalisation judgement – I’m concerned not with whether people were right but whether they made rational decisions based on what they knew or didn’t know at the time’).

It is important to encourage third parties to say good things about you (‘the presumption that you must have done a brilliant job is - if anything - the other way’), in the face of a non-technical audience.

Fundamental for the defence is having the right ‘ammo’ for inquests, criminal prosecution or public inquiries, and that can only come from the people closely and directly involved – not from the lawyers.

The preparation phase leading to an incident is usually where problems arise (not the event itself), with the real failings tending to come in the run-up, be it months or years before. ‘It doesn’t matter what the cause of an incident is, whether railway or chemical or storage plant or shooting – what goes wrong to produce that unfortunate outcome is normally the same.’

Preparation, planning and response are aimed to make organisations legally compliant. However, nobody can be completely certain that compliance has been achieved until a person who has the authority to declare what the law is actually says so. ‘It can take five years, like Buncefield, but the point is you can never know for sure whether what you are doing is going to comply with the law.’

Mark’s advice therefore is as follows: ‘Do what you think is best designed to meet your statutory and moral duties – keeping people alive and well, putting out fires, , mitigating loss of life, injury etc. That’s your role.’

Mark’s role on the other hand is proving that the people he is representing did a good job, or if they didn’t, that they didn’t do a wicked job (‘the key word is “prove”’).

There are two types of evidence – living (witnesses) and ‘everything else’ (videos, spreadsheets etc). ‘It’s the “everything else” that corroborates your account of events.’

One of the challenges for Mark in defending people in managerial positions is countering the lack of understanding surrounding this type of role. ‘Your role is not to man a fire engine, it is to lead, plan, coordinate – that is what will be examined. Not your technical qualifications but your leadership qualities. That is the pitch I have to put out, and it leads me to defend what you did and why you did it. The field in which you work is complicated and highly technical, and very few people outside your world understand it.’

Most incidents involve a post-event debrief identifying what could have been done better, and it is at this point that organisations have to choose whether to ‘say sorry’ or ‘keep quiet’. Being ‘up front’ is the best action, as the facts will come out eventually. ‘And if it is a big enough event, and you haven’t been upfront about that, there will be two pieces of bad news. One, that you were incompetent during the incident and two, you tried to cover it up. And that is actually worse.’

Admitting wrong, apologising and seeking to learn from an event is the best option. ‘The public are very forgiving. But to go the other way as the police commonly did until recent years and go into denial, is very bad. It is the wrong strategy and for big events it doesn’t work.’

After using some real-life cases to illustrate the importance of lesson-learning Mark made another important point: post-incident enquiries almost always contain the same recommendations. ‘This is a translation of part of the recent official report into the atrocities Anders Behring Breivik carried out in Oslo.

‘Any failures were primarily due to:

•           The ability to acknowledge risk and learn from exercises has not been sufficient.

•           The ability to implement decisions that have been made, and to use the plans that have been developed, has been ineffectual.

•           The ability to coordinate and interact has been deficient.

•           The potential inherent in information and communications technology has not been exploited well enough.

•            Leadership's willingness and ability to clarify responsibility, set goals and adopt measures to achieve results have been insufficient.

‘You can apply that paragraph to pretty much every major event I’ve ever been involved with… the fact it’s Norway doesn’t matter; the fact he’s a shooter doesn’t matter. What went wrong is a classic case study of poor preparation, poor communication, and lack of joined up working between involved agencies.’

Mark went on to talk about the report following the 7/7 bombings in London. Again, the report highlighted that what went wrong was the lack of understanding of the agencies working together. ‘And most of the recommendations are about improving links of communications and mutual working.’

He then added, ‘If I find things that you haven’t done, contained in previous reports like that, and I ask you why you didn’t implement them, and you answer that you didn’t because you couldn’t be bothered to read it… then things are not going very well.’

Better is to answer: ‘I read it, I considered if it was necessary for my brigade and we came to the rational informed view that what we already had was up to scratch.’

When dealing with an incident there are three possible outcomes. ‘First, what you did and how you managed it ended up with an injury or death toll less than would have been otherwise… secondly, neutral: your decision made no difference. Thirdly: your meddling killed people that would have been alive if you hadn’t got out of bed that day.’

It is with the latter outcome that allegations and recriminations begin, and it is why Mark’s style of defence is to emphasise the difficult, stressful jobs that are carried out by emergency response personnel. But to prove how difficult and stressful a particular situation was, evidence is needed.

The defence needs enough information to reconstruct a diarised series of events. The ‘how’ is the most important aspect – how decisions were arrived at. ‘Decisions are only defensible in their context. When it happened, what you knew at the time, and what you didn’t know. That’s the plot.’

Unfortunately not much tends to get written down during an incident, and again Mark used a real-life case (the Cumbria shootings, June 2010, where Derrick Bird killed 12 people) to show the importance of having appropriate records of events. ‘When I say, “why didn’t you write it down”, here are the excuses. “Well, we were too busy.” Yes, I can appreciate there will be periods of activity when you don’t have time to write things down, but there will come a bit of a lull. That first opportunity you get, before memory begins to fade – don’t spoil it or squander it. If it’s not completely contemporaneous it doesn’t matter, as long as I can show there was a good reason why it couldn’t be written down at the time. And that at the first reasonable opportunity, it was written down.

‘The second excuse is even more ludicrous: “Meant to write it down but the moment never came”. Yes it did, it came and went. And it’s not coming back – and that’s your fault.’

‘I cannot for the life of me understand why there is such resistance to making a record of as many of those timings as you can. Four digits - at most - that may well be your salvation. Because all those timings tell me – when I match them against what you knew – the context. They tell me that you made that decision at that time because this is what you knew. They all fit or should align.’

Not all post-incident reports are negative. In the first Channel Tunnel fire in November 1996, a lorry on fire entered the French side. The report by the Channel Tunnel Safety Authority (Inquiry into the fire on Heavy Goods Vehicle shuttle 7539 on 18 November 1996) was positive about the fire and rescue service’s response; it was prompt and competent, and the English and French commanders worked together. Such praise was not heaped upon the Rail Control Centre, however, whose staff were not trained for such a complex situation. ‘You know what they had on the wall? A big decision tree. You start at the top and depending on “yes” or “no” you end up with a decision. All decision trees have a potential flaw – they don’t account for the absence of information. So you end up at a particular switch, yes or no, and you cannot answer so you come to a stop.’

An audit of the Rail Control Centre had been carried out by the Eurotunnel Health, Safety and Quality Directorate five months before the incident but no corrective actions had been taken. ‘It’s bad enough not to have known about a problem and therefore not fixed it, but it is far worse to have known about a problem – even identified it yourself – and done nothing.’

Mark then came to the ‘nadir’ of performance: the 400+ pages-long 9/11 Commission Report. He urged delegates to concentrate on chapter 9 of the report: ‘There is no page in that chapter which does not contain some excoriating criticism of the senior management of one of the agencies involved.’

The Port Authority – which had owned the site – had no meaningful agreements or arrangements with organisations in preparation for an event. The organisations that occupied the top floors each had their own plans for evacuation, but these were not shared between themselves – nor the thresholds for evacuation. On the day of the event this meant that most people evacuated to the same stairway, which was crowded and slow-moving.

The relationship between the Port Authority and the fire department was poor – there was only one wet rise per stairway, and there was reluctance to install back up systems as the buildings were reaching the end of their useful lives.

Most of these issues had been identified before – in fact, they were flagged up after February 26, 1993, when a 1,500-pound bomb stashed in a rental van was detonated on a parking garage ramp beneath the Twin Towers. ‘It’s impossible to say how many people would have lived if they had bothered to act on the 1993 recommendations, but conservative figures suggest at least 200 more people, or possibly twice that, would have got out before the towers collapsed.’

Mark then moved on to the experience of the witness box, setting out the questions that really mattered. He then invited the audience to think about what they would answer when asked what their job was during the incident. ‘If I asked you to only give me one answer, and 100% correctly, how long do you think you would need to formulate a reply?’

That is the question that most people in the witness box don’t give a second thought to. ‘And that is usually the beginning of the slippery slope to disaster.’ People tend to give an answer to a different question:

‘They say what the job is called, not what it is. And then they get it wrong, because as the questioning goes on, they say “I forgot to mention this,” or they didn’t “put it right”. And that begins to infect the credibility of all their evidence.’

Mark advised, ‘Be specific about your role. If you were relevantly trained to do it, that’s fine. If not, whom did you tell about that? Did you keep quiet? Did you put yourself forward for a job you weren’t qualified for? You see what ammunition that gives me?’

To the question, could you have done a better job? The answer has to be ‘yes’. ‘It’s always got to be “yes” – if you had more information, more time, more resources. The moment you say “yes”, you have to tell me why it wasn’t reasonable to do better than you actually did, you have to prove your case.’

The next question follows on – if the job could have been done better, then how? The answer to this will usually be in the post event debrief, which will contain the recommendations made about what would be done differently next time.

The reality is that everything identified in the post-event analysis will very likely have been identified previously within the same organisation. ‘Time goes by and people forget and recommendations cease to be urgent. The only time they are resurrected is when things go wrong again a few years later.’

Coming back to the subject of Buncefield, Mark said, ‘The key point is coordination between yourselves - whether private or public - because there is no statutory framework that takes account of such an incident. It is not a Civil Contingencies Act issue, because it wouldn’t be big enough – even Buncefield wasn’t big enough to trigger a full CCA response, as it was geographically limited.’

Mark ended his presentation with a warning note: if another Buncefield were to take place, interrelations between operators and fire brigades would be heavily scrutinised, particularly if the ability of the public side to respond was to become lower than it was seven years ago as a result of financial cutbacks.

‘If I’ve done my job properly and you’ve done yours, we shan’t meet again.’

  • Operation Florian

Sign up: eMagazine & eNewsletter

The latest issues in your inbox.

Company Profiles

Waterax - We move water

Trusted by wildland firefighters around the world, WATERAX sets the industry standard by developing innovative, portable fire pumps and water-handling equipment designed to withstand demanding applications and rugged environments.

Big Water Flow for Industrial and Municipal Firefighting Applications

Protecting the lives of the public and firefighters while limiting the structural damage caused in large scale fires is our primary mission

We are committed to improving lives and doing business in the right way

We have a unique mix of capability and culture that we refer to as 3M Science and we strive to develop products that improve people’s daily lives in a multitude of ways.

HazSim - Bringing situational HazMat training to life

HazSim, LLC provides innovative simulation training to ensure your team works safely and effectively. HazSim Pro simulation equipment is in use by hundreds of fire departments, training schools, industrial fire teams, and private trainers across the US, Canada and further afield as well as the US Army.

The ultimate in innovation, quality and service

For 60 years Lehavot has been delivering the world’s most advanced fire detection and suppression automatic systems

Advancing rescue technology

The specialist supplier of quality PPE and Rescue Equipment to Emergency Services.

Revolutionizing fire fighting foam technology

The one-stop resource for fire fighting foam concentrates and custom-designed foam suppression systems hardware.

Trust the best, let us be your foam solution

AUXQUIMIA is a Spanish company whose main activity is the design, manufacture and commercialization of firefighting foam concentrates.

Williams Fire & Hazard Control offers a full line of specialized fire response equipment for oil and gas platforms

From storage tanks and pipeline emergencies to offshore platforms and vessels at sea, Williams' response personnel and specialized equipment quickly address adverse fire emergencies.

The leader in truck-mounted hydraulic platforms

Our mission is to provide the best and the safest solution to professionals that work at height.

If you want quality, you want Zico

Since its inception Ziamatic Corp has provided the men and women of the fire service with products designed to make their jobs safer and easier.

The independent alternative

Dafo Fomtec AB is a privately owned company with head office in Stockholm Sweden and manufacturing in Helsingborg in the south of Sweden.