The Gauge Had Stuck 14 Times

October 26, 2026

At 06.01 on Sunday 11 December 2005, a vapour cloud ignited at the Buncefield oil storage depot in Hertfordshire.

The tank at the centre of it, Tank 912, had been filling with unleaded petrol through the night. At 03.05 its level gauge stopped moving. The reading flatlined while the petrol kept coming, and for more than two and a half hours nobody knew. By the time of the explosion, over 250,000 litres had escaped.

Over 40 people were injured. It was early on a Sunday, which is a large part of why nobody died.

Since maintenance at the end of August, that gauge had stuck 14 times.

Two failures, not one

It is tempting to tell Buncefield as the story of a faulty instrument. That version is neat, and it is wrong.

A stuck gauge should not be able to cause a major accident on its own. Tank 912 had a second line of defence: an independent high-level switch, designed to shut things down if the tank got too full, whatever the gauge said.

It didn't work. The switch needed a padlock to hold its test lever in the working position. The padlock was never fitted, because the need for it was never passed on to the people who installed and operated the switch. So the backup barrier sat on the tank looking fine, but it couldn't do its job.

Now the story is harder to put down to bad luck. The main barrier had a known, repeating fault. The backup barrier couldn't work at all. Neither problem was hidden in any dramatic sense. They were just not being looked at by anyone with the authority to act.

How a known fault becomes normal

Fourteen sticks in roughly three months is not a secret. People on shift would have seen the gauge freeze and learned to work around it. Every time the plant carried on safely, the fault became a little more ordinary.

That is the pattern worth recognising, because every site has a version of it:

the level transmitter that "always reads a bit high"
the alarm that goes off so often it gets acknowledged without a glance
the trip that's been in bypass since a job three months ago
the valve that needs a second go to close

None of these feels like a major accident in waiting. Each one is a known quirk with a known workaround. The trouble is that workarounds rely on people noticing, and major accidents tend to arrive when people are busiest or least expecting them.

The investigation into Buncefield didn't stop at the equipment. The site's throughput had grown substantially over the years, putting pressure on storage space and on the supervisors monitoring tank filling. Faults weren't logged and followed up effectively. Engineering support was thin. And there was no system for senior management to see the state of key safety equipment. The report found that keeping the process running had become the main focus.

That is the real lesson. The gauge was a symptom. The failure was an organisation that had no reliable way to hear what its own instruments were telling it.

What COMAH actually asks of you

Sites that store dangerous substances above certain thresholds fall under the Control of Major Accident Hazards Regulations 2015. COMAH sets two tiers:

Lower-tier establishments must notify the Competent Authority and have a Major Accident Prevention Policy, or MAPP.
Upper-tier establishments must also produce a safety report, prepare and test an internal emergency plan, supply information for the external emergency plan and make information available to the public.

It is easy to treat the MAPP as a document to write and file. It isn't. A MAPP has to cover how you organise, identify hazards, control operations, manage change, plan for emergencies, and monitor and audit performance.

Monitoring is exactly where Buncefield fell down. A MAPP that says "we monitor safety-critical equipment" means nothing unless someone senior can actually see repeat faults, open bypasses and failed tests, and is expected to act on them.

The Competent Authority, which is HSE and the Environment Agency in England, SEPA in Scotland and Natural Resources Wales in Wales, will judge your system on whether it works. Having the documents is not enough. Buncefield led to fines of around £4.35 million across five companies. The reputational damage lasted much longer.

Five things to check on Monday

You don't need to be a COMAH site to use these. Any site with safety-critical equipment can run them this week:

Which safety-critical instruments have faulted more than once in the last three months? If nobody can answer quickly, that is your first finding.
Where is your bypass and override register, and how old is the oldest entry? Anything open longer than the job that justified it needs a decision today.
When were your independent trips and high-level alarms last proof-tested end to end? Test the whole loop, from the sensor to the valve actually closing. Checking that the panel lights up is not enough.
Would your site leader know about a repeat instrument fault without being told by chance? If the answer depends on who happens to be on shift, the system isn't doing its job.
What have operators stopped reporting because "it always does that"? Ask them directly. They know, and they'll usually tell you if the question is asked properly.

Picture the control room on a busy night, with several transfers running and one screen showing a level that hasn't moved for a while. The operator has seen it stick before. Whether that moment becomes a near-miss or a disaster depends on work done months earlier, by people who aren't in the room.

The question worth asking

The people at Buncefield weren't careless. They were working in a system that had grown used to its faults, and nobody could see how far the margins had shrunk.

What fault has your site learned to live with?

Sources