Twenty Years After Buncefield: Tank Level Monitoring and the Network Behind It

What does tank level monitoring mean at a UK fuel terminal?

At a bulk fuel terminal, tank level monitoring means knowing, continuously and to within a few millimetres, how much product is in every tank, how fast that level is changing, and whether anything around the tank (the bund, the roof, the seal, the water layer at the bottom) is behaving abnormally. The core instrument is the automatic tank gauge, usually a radar or servo gauge on the tank roof, feeding an inventory system and the control room. Around it sit alarms, independent high-level switches and, at the top of the hierarchy, a trip that closes the inlet valve before the tank overfills.

Consumer products that share the name, such as ultrasonic sensors for domestic heating oil tanks, answer a simpler question (when do I need a delivery?). A COMAH-regulated terminal has to answer a harder one, which is whether a transfer can be stopped before a release, and it has to demonstrate that answer to the Competent Authority, namely HSE together with the Environment Agency, SEPA or Natural Resources Wales.

What changed after Buncefield?

In the early hours of 11 December 2005, Tank 912 at the Hertfordshire Oil Storage Terminal near Hemel Hempstead was being filled with unleaded petrol from a pipeline. The tank's automatic gauge stuck, so the control room saw a static level while the tank kept filling. The independent high-level switch, which should have stopped the transfer, did not operate. Petrol cascaded over the roof, formed a vapour cloud, and ignited shortly after 6am. Forty-three people were injured and there were no deaths, largely because of the hour; the explosion and fire destroyed much of the site and damaged homes and businesses nearby.

The investigation by the Buncefield Major Incident Investigation Board, and the Process Safety Leadership Group's final report in December 2009, reset expectations for fuel storage in three ways that still shape the industry: (i) overfill protection must be an automatic system, independent of the gauge used for everyday operation, and designed to a safety integrity level set by a proper risk assessment; (ii) sites must manage the whole filling operation, including the human factors of shift handover and alarm handling, rather than trusting a single instrument; and (iii) secondary and tertiary containment, meaning bunds and site drainage, must hold the product and the firewater if the first line fails.

Those principles are now the baseline that COMAH inspectors test against. The instrumented protection itself is well served by the gauge and safety-system vendors. The weaker area is everything around that loop that tells operators something is going wrong before the trip is needed.

Which parts of tank monitoring should stay hardwired?

The automatic overfill protection system should stay hardwired, and so should the safety instrumented functions that close valves and stop pumps. A SIL-rated loop has a proof-test regime, a defined failure mode and a certification trail that any wireless link would have to match, and there is no operational gain from putting it on radio. The same applies to emergency shutdown and fire and gas detection logic where a site's safety case already specifies wired devices.

We make this point early because the case for private 5G on a tank farm is sometimes pitched as if radio could replace the safety system. It cannot, and a Competent Authority inspector would rightly ask why anyone would try. The useful question is what else on the site is monitored badly, or not at all, because there is no signal and no cable to it.

Where are the gaps in tank farm monitoring today?

Walk a typical UK terminal, whether an inland distribution site such as Kingsbury in Warwickshire or a coastal import terminal on the Thames or the Humber, and a pattern emerges. The gauges on top of the tanks are wired back to the control room. Much of the equipment below and around them is checked by eye, on a round, with a clipboard or a tablet that syncs when it gets back to the office Wi-Fi. The common gaps are:

• Bund levels and bund drain valves: Rainwater collects in bunds and has to be drained, and a drain valve left open is a direct route for product into the site drainage if a tank leaks.
• Floating roof drains and roof position: Standing water on an external floating roof, or a blocked roof drain, can tilt or sink the roof, and many sites confirm drain condition by climbing the tank.
• Rim seal temperature: The LASTFIRE industry study found rim seal fires to be the most frequent fire type on floating roof tanks, and linear heat detection is often limited to the largest tanks.
• Water bottoms and product temperature: Both affect inventory accuracy and corrosion, and on older tanks they are sampled by hand.
• Pump, valve and pipework condition: Vibration and leak sensors on transfer pumps and manifolds are cheap to buy and expensive to cable.

None of these is exotic. They are missing because trenching cable across an operating tank farm means hot-work permits, excavation near live pipework, and hazardous-area installation standards for every junction box. A £300 battery sensor can easily carry a £10,000 cabling bill, and at that ratio most sites keep the round.

How does private 5G carry tank level and tank farm data?

A private 5G network gives the terminal its own licensed radio coverage across the tank farm, the jetty or rail gantry, the loading bays and the control building, with the core network and data kept on site. Battery-powered sensors certified for the relevant hazardous zone connect directly or through a small ATEX-rated gateway, report at intervals set by the site (every few seconds for a pump, hourly for a water bottom), and land in the same historian as the wired gauges.

Three characteristics make it fit a tank farm better than the obvious alternatives. Firstly, coverage: steel tanks, bund walls and pipe racks are hostile to Wi-Fi, whilst a small number of 5G radios mounted on lighting towers or the control building can cover a site of several hundred metres across with planned, measured coverage. Secondly, licensed spectrum: Ofcom's shared access licences in the n77 band give the site its own channel, so a contractor's hotspot or a neighbouring site cannot interfere with the monitoring traffic. Thirdly, one network for several jobs: the same radios carry sensor data, ATEX handsets for operators and permit issuers, and CCTV on the perimeter, which matters at sites that have had to deal with trespass, as several terminals did during the 2022 protests.

LoRaWAN and other low-power networks are a reasonable choice for slow, low-volume sensors, and some sites already run them. The trade-off is capacity: once a site wants video, voice and push-to-talk alongside the sensors, a separate network is needed for those, and the operator is back to running two or three radio systems. For a site that only wants bund levels, LoRaWAN may be the cheaper answer; for a site that wants to retire paper rounds and connect its people, one 5G network usually costs less over its life.

What about smaller depots and the 3G switch-off?

Tank level monitoring at the smaller end of the market, meaning fuel distributors' depots, agricultural and marine fuel stores, and heating oil yards, has a different problem. Many of these sites relied on cellular telemetry units that reported tank levels over 2G or 3G. With 3G now switched off across the UK networks and 2G scheduled to go by 2033, a number of those units have already fallen silent or been swapped for 4G modems on whatever public coverage the site happens to have, which in rural areas can be poor.

For a single depot, a private network is rarely justified on tank monitoring alone. It becomes sensible where the depot sits within a larger connected site, such as a port, an airfield, a quarry or a farm estate, and can share the network that site already runs. We see this most at harbours and marinas, where the fuel berth, the storage tanks and the CCTV all sit on the same few hectares and the same operator pays for all of it.

How does this help with COMAH compliance?

COMAH does not specify a network, and no inspector will mark a site down for using clipboards. What the regulations do require is that operators take all measures necessary to prevent major accidents and limit their consequences, and demonstrate that they have done so. Continuous data helps with that demonstration in concrete ways: (i) a timestamped record of bund drain valve positions shows the valves were closed, rather than relying on a round sheet; (ii) trend data on roof drains and seal temperatures shows problems caught early, which feeds the safety report and the inspection plan; and (iii) alarm and event data from monitoring devices gives the site evidence for its alarm management review, one of the areas the Process Safety Leadership Group flagged.

There are costs and risks to set against this. More sensors mean more alarms, and a badly configured sensor network can add to the alarm flooding that Buncefield-era reviews warned about. Battery devices need a replacement cycle. A private network is another system for the site's OT security team to own, and it has to sit inside the site's network segregation rather than becoming a back door into the control system. We would expect any serious proposal to address all three before the first sensor goes on a tank.

Where should a terminal start?

We would start with a coverage survey across the tank farm and loading areas, followed by a short list of the rounds that operators do most often and value least, typically bund drain checks and floating roof inspections. A pilot on one tank compound, with a handful of sensors and a small number of ATEX handsets, is enough to show whether the data is reliable and whether operators trust it. If it works there, the site can extend coverage compound by compound, and the wired overfill protection stays exactly where it is.