Worked Example: Lightning Protection Risk Assessment for a Fuel Storage Facility — The Buncefield Explosion

On 11 December 2005, at 06:01 on a cold Sunday morning, a massive vapour cloud explosion ripped through the Buncefield oil storage depot in Hertfordshire, England. The explosion registered 2.4 on the Richter scale and was heard over 200 km away in the Netherlands. Miraculously, no one was killed — primarily because it happened on a weekend morning when the depot was largely unstaffed. Forty-three people were injured, and 20 large fuel storage tanks were destroyed along with buildings across a wide radius.

The immediate cause was a tank overflow: a faulty gauge on Tank 912 failed to register the rising fuel level during an overnight delivery, and the independent high-level switch also failed. Petrol cascaded down the tank sides for over 20 minutes, forming a vast vapour cloud at ground level. The ignition source was never definitively identified, but lightning strike to the tank farm infrastructure was investigated as one possible trigger.

Whether or not lightning caused the Buncefield explosion, the incident raised fundamental questions about lightning protection in hazardous areas. IEC 62305 provides the framework for assessing lightning risk and designing lightning protection systems (LPS), but applying it to facilities where the consequence of a lightning-induced spark is a catastrophic explosion requires careful engineering beyond simply following the standard’s minimum requirements.

Perform a lightning protection risk assessment and determine the required protection level for a fuel storage depot.

The equivalent collection area is the ground area that would collect the same number of lightning strikes as the structure, per IEC 62305-2, Clause 7.2:

For a rectangular structure of length L, width W, and height H, the equivalent collection area extends by 3H in all directions:

A_d = (L + 6H) × (W + 6H) × π / 4 — for isolated structure — (Eq. 1)

However, for a complex site with multiple structures, we use the site envelope. For the entire depot (200 m × 150 m, tallest structure 20 m):

A_d = (200 + 6 × 20) × (150 + 6 × 20)

A_d = (200 + 120) × (150 + 120)

A_d = 320 × 270 = 86,400 m² = 0.0864 km²

The expected number of dangerous events (direct strikes to the structure) per year, per IEC 62305-2, Clause 7.2.3:

N_D = N_g × A_d × C_d × 10⁻⁶ — (Eq. 2)

Where N_g = 0.5 flashes/km²/year (southeast England), A_d = 86,400 m², and C_d = environmental factor.

For structures in an open, flat area (typical for fuel depots):

C_d = 1.0 (flat terrain, no surrounding structures)

N_D = 0.5 × 86,400 × 1.0 × 10⁻⁶

N_D = 0.0432 strikes/year (or approximately 1 direct strike every 23 years)

Additionally, calculate strikes to incoming lines (pipelines, power cables). For a 1 km above-ground pipeline approach:

N_L = N_g × A_L × C_d × C_t × 10⁻⁶ — (Eq. 3)

A_L = 40 × L_line = 40 × 1,000 = 40,000 m²

N_L = 0.5 × 40,000 × 1.0 × 0.5 × 10⁻⁶ = 0.01 strikes/year

For loss type L1 (loss of human life), the tolerable risk is R_T = 1 × 10⁻⁵ per year per IEC 62305-2, Table 5.

The risk from direct strikes (R₁) is calculated as:

R₁ = N_D × P_A × L_A — (Eq. 4)

Where P_A = probability of damage from a strike (depends on protection measures), and L_A = consequential loss (depends on structure use).

For a fuel storage depot without lightning protection:

P_A = 1.0 (no protection — any strike causes damage)

L_A = L_f × L_t = 0.1 × 0.1 = 0.01

(Where L_f = loss related to fire = 0.1 for hazardous area, L_t = loss related to occupancy = 0.1 for limited hours)

With hazardous area adjustment:

L_A = 1.0 × 0.1 = 0.1

R₁ = 0.0432 × 1.0 × 0.1 = 4.32 × 10⁻³

This is 432 times the tolerable risk of 10⁻⁵. Lightning protection is clearly required.

The lightning protection system (LPS) must reduce the risk to below R_T. The protection efficiency E required:

E = 1 − R_T / R₁ = 1 − (10⁻⁵ / 4.32 × 10⁻³) — (Eq. 5)

E = 1 − 0.00231 = 0.998 (99.8%)

Per IEC 62305-3, Table 3, the LPS classes and their interception efficiency:

Even LPS Class I (the highest) provides only 98% efficiency, but we need 99.8%. Per IEC 62305-2, Annex D, additional measures are required:

• Surge protection devices (SPDs) on all incoming lines (adds P_SPD = 0.01 reduction factor)
• Equipotential bonding of all metallic structures within the bund (reduces L_A)
• Isolation of electrical equipment from Zone 1 areas (Ex-rated equipment)

With combined measures: LPS Class I + SPDs + equipotential bonding:

R_1,protected = 0.0432 × 0.02 × 0.01 × 0.1 = 8.64 × 10⁻⁷

8.64 × 10⁻⁷ < 10⁻⁵ — PASS

With LPS Class I selected, the rolling sphere radius is 20 m. This means the air termination network must be designed so that a sphere of 20 m radius, rolled over the entire facility, cannot touch any part of the structure without first touching an air termination.

For a cylindrical tank of height 20 m and diameter 40 m, the rolling sphere analysis reveals:

Sphere radius r = 20 m, Tank height H = 20 m, Tank radius R = 20 m

Since the sphere radius equals the tank height, a sphere resting on the ground beside the tank just touches the top edge. This means the top of the tank IS within the protection zone of an air termination mounted at the top of the tank.

Air termination design for the tank:

• For floating roof tanks: the roof seal area between the floating roof and tank shell is the most vulnerable point (Zone 1 area where vapour escapes)
• Shunting connections (flexible braided bonds) between the floating roof and the tank shell at 3 m intervals around the circumference per IEC 62305-3 Clause E.5.2.4.2
• Minimum 2 down conductors per tank, spaced no more than 20 m apart (LPS Class I requirement: mesh size 5 × 5 m on flat surfaces)

Mesh width on tank top for LPS Class I:

Mesh size = 5 × 5 m per IEC 62305-3, Table 2

For a 40 m diameter circular roof: minimum number of parallel conductors:

n = diameter / mesh width = 40 / 5 = 8 parallel conductors — (Eq. 6)

The earthing system for LPS Class I must achieve a combined earth resistance below 10 Ω per IEC 62305-3, Clause 5.4.1. For a fuel depot, industry practice targets < 2 Ω to minimise step and touch potential during a lightning strike.

Type B earthing (ring conductor around the structure perimeter):

Ring conductor length = perimeter = 2 × (200 + 150) = 700 m

Using 50 × 6 mm copper tape buried at 0.5 m depth in soil with resistivity ρ = 100 Ω·m:

R_ring ≈ ρ / (2πL) × ln(2L² / (a × d)) — (Eq. 7, simplified)

Where L = 700 m, a = 0.025 m (equivalent radius of tape), d = 0.5 m depth:

R_ring ≈ 100 / (2π × 700) × ln(2 × 490,000 / (0.025 × 0.5))

R_ring ≈ 0.0227 × ln(78,400,000)

R_ring ≈ 0.0227 × 18.18 = 0.41 Ω

0.41 Ω < 2 Ω target — PASS. The ring earth alone provides adequate resistance. Additional vertical rods at each down conductor will further reduce this to approximately 0.3 Ω.

Result: LPS Class I with SPDs on all incoming services and full equipotential bonding. The facility requires the highest level of lightning protection due to the combination of explosive atmosphere (Zone 1) and the catastrophic consequences of ignition. Even with LPS Class I, additional measures (SPDs, bonding, Ex equipment) are essential to achieve the tolerable risk level.

The Buncefield explosion was caused by a tank overflow due to faulty level instrumentation, not by lightning. However, the facility’s vulnerability to lightning-induced ignition was a known risk that required the same rigorous engineering assessment:

• Apply hazardous area factors in the risk calculation — standard IEC 62305 loss factors dramatically underestimate the risk for Zone 1 and Zone 0 areas; the consequence of a single spark is not “some damage” but potentially catastrophic explosion
• Always design to LPS Class I for Zone 1/Zone 0 areas — even if the numerical risk calculation suggests Class II or III is sufficient, the consequences of failure justify the highest protection level
• Maintain shunting bonds on floating roof tanks — these bonds provide the primary path for lightning current to bypass the gap between the floating roof and the tank shell; corroded or broken bonds leave the seal area unprotected
• Install surge protection on ALL incoming services — lightning can enter a facility through power cables, control cables, and pipelines, not just via direct strikes to the structure
• Test earth resistance annually — soil conditions change with moisture content and temperature; an earthing system that measured 0.5 Ω at commissioning may deteriorate to 5 Ω over years of corrosion