Secondary containment and bunds

Every other structure on a plant is designed on the assumption that it works.

A bund is designed on the assumption that something else has already failed. It is the only civil structure whose entire purpose is to be useless, right up to the day it is the only thing standing between a tank failure and a river.

Looking down into the corner of a reinforced concrete bund. Two wall panels meet at an internal corner, with a pale sealed movement joint running vertically down the face of each and across the floor. At the low point of the floor sits a square sump covered by a steel grating in a concrete frame. Beyond the bund wall stands the rusted lower shell and stiffened base ring of a storage tank, with pipework, vessels and plant structures behind it under a flat grey sky. A worker in an orange hi-vis jacket stands at the far right edge of the frame. — The joints are the containment. The concrete either side of them is rarely what leaks.

What a bund has to do

Four things, and they are not all structural:

Hold the volume. Enough net capacity for the design spill, with the rain already in it.
Not leak. Effectively impermeable for the duration of the retention, which means hours to days, not seconds.
Keep the liquid where it can be dealt with. Falls to a sump, a controlled drain, and a route to an interceptor rather than to the storm system.
Not trap people or vapour. Access over the wall, escape from inside, and a geometry that firefighters can actually work with.

A bund that satisfies the first and fails any of the other three is not a containment system.

On the left, a section through a tank inside a bund. The tank stands on a ring wall foundation; the bund wall surrounds it at a lower height, with the design spill level shown inside and a freeboard above it. Notes identify the net capacity as the gross volume inside the bund less the volume taken up by the tank foundation and plinths, and identify the required capacity as the largest tank plus an allowance, commonly 110 per cent. The bund floor is shown falling to a sump at one corner, with a drain line leaving through the wall and a valve on it marked normally closed and locked. A liner or impermeable membrane is shown under the floor and up the inside face of the wall, and stepped access is shown over the wall. On the right, a list of the four duties of a bund, hold the volume, do not leak, control where the liquid goes, and stay accessible, each paired with the way it is commonly lost in service: capacity eaten by later equipment and foundations, joints and penetrations that were never resealed, a drain valve left open, and access steps removed during a modification. — The design is straightforward. Everything on the right-hand side is what actually goes wrong, years later.

Capacity, and how it quietly disappears

The arithmetic is simple enough. For a single tank, the net volume inside the bund must hold the tank’s contents with a margin — commonly stated as 110 per cent, though the figure and the basis vary between codes and jurisdictions.

Where several tanks share a bund, the design case is the largest one, not the sum. But the space available has to be measured net:

net capacity  =  gross volume to bund wall top
                 −  freeboard allowance
                 −  volume of the tank foundations and plinths
                 −  volume of the other tank shells below bund level
                 −  volume of any internal kerbs or dividing walls
                 −  volume of pumps, bases, supports and pipe sleepers

Those deductions are where capacity goes missing. A bund that was compliant at handover loses volume every time a pump plinth, a sample point, a pipe support or an intermediate kerb is added inside it, and nobody recalculates. Over twenty years of small modifications, it is entirely possible for a bund to be ten or fifteen per cent short without a single thing having been done wrong on the day.

Impermeability lives in the joints

Concrete is not waterproof, but over the hours a spill is held, the body of a sound wall is not usually the problem. The leak paths are the discontinuities:

Construction joints between pours, which need a waterstop cast in.
Movement joints, which need a sealant that is compatible with the stored product. A sealant chosen for water is not necessarily a sealant that survives contact with hydrocarbon.
Shrinkage cracks, controlled by reinforcement, pour sizes and curing.
Penetrations — every pipe, cable and drain through the wall, each needing a proper puddle flange or sealed sleeve.
The wall-to-floor junction, which is both a construction joint and the most heavily loaded line in the structure.

Where the product or the regulator demands it, an impermeable liner is added: a geomembrane beneath the floor slab and carried up the inside face, or an applied coating system. The liner then has its own weak points — the terminations, the welds and anywhere it is penetrated — and these need the same attention the concrete joints did.

Falls, sump and the one valve that matters

The floor is graded so that anything spilled runs somewhere predictable: a sump at a low point, like the grated one in the photograph, from which the contents can be pumped or drained through a line passing out through the bund wall.

That drain line carries a valve, and that valve is normally closed and secured — locked, car-sealed or chained. Rainwater removal is a deliberate operation: check for product, open, drain, close, record.

Downstream of the valve the water should pass through an interceptor or oil-water separator before it can reach the surface water system — which means the interceptor is part of the containment system too, and needs its own inspection and desludging regime.

Height, access and the vapour problem

Capacity can be had from area or from height, and height is the expensive choice in every way except land:

A deep bund is hard to escape from and hard to rescue someone from.
It is hard to apply foam into from outside the wall.
In still air it will hold a vapour cloud rather than let it disperse, so the hazard sits in the place people have to walk past.

Codes therefore cap the wall height — broadly in the region of one to one and a half metres for hydrocarbon storage — and expect the volume to come from plan area, with stepped access over the wall at several points around the perimeter so that nobody is ever far from a way out.

Intermediate kerbs inside a large bund are a useful compromise. They divide the floor so a small spill stays local and does not spread across the whole area, without adding enough height to cause the access problems above. They do, of course, take up capacity, and must be in the deduction list.

Cryogenic bunds are a different structure

A bund serving an LNG or other cryogenic tank has to deal with something a hydrocarbon bund does not: the spilled liquid arrives at around −160 °C.

Thermal shock on the concrete, with all the consequences described in what cold does to concrete. The bund concrete is specified for the duty, and is sometimes insulated so the concrete never sees the full shock.
Vaporisation rate, which depends directly on the exposed surface area of the pool. A wide shallow bund produces a bigger vapour cloud faster than a deep narrow one, so cryogenic bunds are often deeper than the access argument would otherwise allow, with that tension resolved deliberately rather than by default.
No rainwater sitting in the bund, since water under a cryogenic spill produces violent boiling. The drainage regime is correspondingly stricter.

And the obvious point: a full containment tank carries its own secondary containment in the outer concrete wall, which is precisely why it can be built without a separate bund, and why the outer wall is designed for a case that should never happen. That argument is set out in LNG tanks: single, double and full containment.

Inspecting an existing bund

A walk round with a notebook will find most of what matters:

Look at	Failing condition
The drain valve	Open, unlocked, or seized
Movement joints	Sealant debonded, split, perished or missing
Wall and floor	Through cracks, spalling, exposed reinforcement
Penetrations	Unsealed, or sealed with a material that has since perished
The sump	Silted, full, or its pump inoperable
Capacity	New plinths, kerbs or equipment added since handover
Access steps	Removed during a modification and never reinstated
Vegetation	Roots in the joints, growth hiding cracks
The interceptor	Full, bypassed, or not on any maintenance schedule

Most of these are findings an engineer of any discipline can raise. None of them require specialist equipment, and the one that most often goes unraised is the last-but-one.

What to take away

A bund assumes the primary containment has already failed. That is the whole point.
Capacity is net, and it shrinks as equipment is added inside the bund over the years.
The joints and penetrations are the containment, not the body of the concrete.
Normally closed, locked drain valve. This is the single most common audit finding.
Height is limited by access and vapour, not by structural capability.
Cryogenic bunds are designed for thermal shock and for vaporisation rate, and a full containment tank does not need one at all.