Explainer: How tertiary containment protects tank sites

WorkSafe has put greater focus on what happens when the usual safeguards around above-ground hazardous-substance tanks are no longer enough. Its May 2026 guidance on tertiary containment addresses the controls that can restrict a spill, contaminated firefighting water or other run-off after primary and secondary containment have been breached or overwhelmed. 

Containment layers

Industrial liquid storage is generally built around successive barriers. Primary containment is the tank, vessel, pipework and associated equipment that keeps a substance contained during normal operations. Secondary containment provides another barrier if that equipment leaks or fails. Around an above-ground tank, this is commonly a bund or containment compound. 

New Zealand's hazardous-substances rules use the term "pooling substance" for a hazardous substance that is liquid or is likely to liquefy in a fire. Secondary containment is intended to hold such material after it escapes from its primary container and allow its recovery. 

For above-ground bulk tanks, secondary containment therefore performs a defined regulatory role. WorkSafe describes the general capacity requirement for an above-ground bulk tank system as 110% of the capacity of its largest container. The detailed requirements vary according to the substances and storage arrangements involved. 

Tertiary containment starts beyond that regulated secondary barrier. It is the third line of defence. It can combine site drainage, channels, sumps, interceptors, pumps, paved areas, low walls, containment compounds and other engineering measures to direct and retain escaped liquid. 

The distinction matters. Tertiary capacity cannot be used to reduce the mandatory capacity of a secondary containment system. It is additional protection for circumstances in which secondary containment may fail or become overwhelmed. 

Regulatory roots

New Zealand has regulated containment of hazardous substances for decades. The Hazardous Substances and New Organisms Act was passed in 1996 as part of a wider overhaul of the law governing hazardous substances and new organisms. 

The Hazardous Substances (Emergency Management) Regulations 2001 subsequently established requirements covering emergency response plans and secondary containment. Amendments made in 2004 refined provisions for pooling substances and secondary containment systems. 

The regulatory structure changed again after passage of the Health and Safety at Work Act 2015. The Act came into force in April 2016. The Health and Safety at Work (Hazardous Substances) Regulations followed on 1 December 2017, when many workplace controls previously administered through the earlier hazardous-substances regime moved into workplace health and safety regulation. 

WorkSafe became responsible for controls dealing with the health and safety risks from using, handling, storing and manufacturing hazardous substances at work. The Environmental Protection Authority retained responsibilities that include hazardous-substance approval and classification under the environmental regime. 

Secondary containment remained a specific regulatory requirement under the 2017 regulations. Tertiary containment followed a different path. The regulations do not prescribe minimum requirements for a tertiary system. WorkSafe says one should be installed when a workplace risk assessment identifies it as a suitable way to control remaining risk. 

That difference shifts attention from a standard capacity calculation to the conditions of the individual site. Tank volumes, substances, surrounding infrastructure, potential emergencies and the consequences of secondary containment failure all become relevant to the decision. 

Buncefield lessons

The development of modern containment practice has also been shaped by major industrial accidents overseas. WorkSafe's guidance draws extensively on the Buncefield fuel-storage disaster in the United Kingdom in December 2005. 

At Buncefield, a petrol storage tank overflowed. A vapour cloud developed and ignited, followed by explosions and a large fire. The fire continued for five days and caused extensive damage across the site and surrounding area. 

The incident demonstrated that having tanks inside bunds did not address every credible failure. WorkSafe notes that tertiary containment at Buncefield was limited. Escaping flammable liquid and firefighting run-off moved beyond areas intended to hold them. 

A lagoon intended to store water for firefighting was itself affected when flammable liquid surged across the site. Pumps forming part of the containment arrangements lacked sufficient capacity, while loss of site power also stopped pumping. Some areas consisted of unprotected natural ground, allowing escaped material and run-off to move into areas not designed as secure containment. 

Buncefield subsequently influenced British guidance for flammable-liquid tank storage. The UK Health and Safety Executive says its tank-storage guidance was updated to reflect recommendations arising from the incident. 

For New Zealand workplaces, the practical lesson is not that every tank farm should copy a single design. WorkSafe instead uses the incident to illustrate how an emergency can challenge pumps, drainage, electrical supply, bund walls and firefighting infrastructure at the same time. 

Risk decisions

WorkSafe's approach begins with the possibility of secondary containment failing. Where that is a reasonably foreseeable risk, the failure is also treated as a reasonably foreseeable emergency that needs to be addressed in emergency planning. Tertiary containment may then be an appropriate engineering control. 

That assessment should examine more than a single tank rupture. Multiple failures can create surge and heave, while debris and large quantities of firefighting water or foam can place additional pressure on secondary containment. Drainage and transfer systems can also become bottlenecks. 

Site conditions matter. WorkSafe's example risk assessment considers factors such as flammability, the volume stored and earthquake exposure. The underlying principle is that tertiary containment addresses residual risk after other controls, including compliant tanks and secondary containment, have been considered. 

The system itself can also create hazards if poorly designed. Open drains may become trip hazards. Flow paths can obstruct evacuation routes. Escaped flammable liquid can be directed towards ignition sources. Incompatible substances can meet inside drains, pipes or holding areas. Pumps or interceptors can fail and cause liquid to back up elsewhere in the system. 

WorkSafe therefore calls for assessment of the tertiary arrangement as a complete system rather than treating each drain, compound or pump in isolation. Monitoring can also form part of the design. Possible measures include liquid-level sensors, flammable-gas detectors, temperature sensors and remote cameras. 

Design choices

There is no universal layout for tertiary containment. A workplace might use permanent drainage and compounds, or combine fixed infrastructure with temporary measures. WorkSafe identifies options including channels, sumps, valves, drain covers, contoured paved areas, low barriers, appropriately rated pumps, vacuum trucks and additional containment compounds. 

The design needs to control both volume and flow. Capacity should be based on reasonably foreseeable risks, rather than being treated as an extension of the regulatory calculation for the secondary bund. Several secondary containment systems can discharge into one tertiary system where the substances and materials involved are compatible. 

Fire can change those calculations quickly. Water and firefighting foam add volume. Transfer pipes and drains that are adequate for an ordinary spill can be overwhelmed during prolonged firefighting. The design also has to account for the rate at which liquid could leave secondary containment, not simply the amount that a final holding area can theoretically store. 

Power availability is another consideration. An arrangement that depends entirely on electrically driven pumps may lose part of its capability during the emergency it was installed to manage. WorkSafe recommends considering combinations of active controls, such as pumps, and passive controls, such as gravity-fed drainage. Remote shutdown and equipment suitable for the substances involved may also be required. 

Temporary equipment still requires advance planning. A vacuum truck, for example, is useful only if suitable vehicles are available, operators can reach the site and access remains safe during the incident. WorkSafe recommends addressing those practical questions during emergency exercises rather than assuming outside resources will be available when required. 

Ongoing upkeep

Installing tertiary containment does not finish the job. Once the system forms part of a workplace's emergency arrangements, it has to remain capable of performing its intended function. WorkSafe recommends a scheduled programme covering inspection, testing and maintenance. 

The regulator does not set a universal minimum testing interval for tertiary containment. Instead, it recommends aligning functional tests with secondary-containment testing where practicable. Water used for hydrostatic testing of secondary containment can be released through the tertiary system so operators can observe whether drainage, transfer and retention arrangements work as intended. 

Testing also provides an opportunity to exercise the emergency response plan. Workers need to understand how and when the system is activated, where liquid will travel and what their responsibilities are. Any manual intervention has to account for the hazards faced by the person carrying it out. Automatic equipment requires functioning sensors, alarms and calibration. 

After an actual spill or fire, the system must be inspected before normal reliance on it resumes. Compounds, sumps, interceptors and drains may contain contaminated water, sediment or debris. Pumps and other equipment may have been damaged or blocked. The clean-up itself needs controls so contaminated material is not simply transferred into stormwater, groundwater or another uncontrolled area. 

The history of containment regulation has largely been a progression from keeping hazardous substances inside their normal containers to considering what happens after each successive defence fails. Tertiary containment extends that logic across the wider workplace. WorkSafe's 2026 guidance does not impose a standard third bund around every tank. It asks operators to determine whether their existing barriers can cope with credible emergencies and, where they cannot, to plan where the escaped liquid will go next.