@amazeifystore: Two safeguards were in place. Neither stopped the overflow. At Buncefield, Tank 912 kept filling after its automatic gauge stopped tracking the petrol level and an independent high-level switch failed to trigger an alarm. The investigation found the switch’s float had stuck. A backup only helps if you can detect when it fails. What should engineers check first: the backup itself, or how its failure is detected? #Buncefield #ProcessSafety #Engineering #SafetyEngineering #IndustrialSafety #RiskManagement #EngineeringLessons