Fuel depot loading gantry fire

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• Petrol is highly flammable. It gives off vapour that can ignite at a low temperature, and the vapour is heavier than air and can travel along the ground to a source of ignition.
• A fire needs fuel, oxygen and a source of ignition. The vapour near the bays is the fuel, and the sources of ignition at the gantry include welding, vehicle engines, static electricity and mobile phones.
• Static electricity can build up when fuel flows through a hose, and a spark can occur if the tanker is not bonded to earth, which is why the earthing interlock matters.
• Other hazards are the movement of tankers in the depot, working on the raised platform, and the health effects of breathing petrol vapour.
• The fire risk assessment was three years old, and it was not updated when the fourth bay and the vapour recovery unit were added, so it did not cover the present layout.
• The assessment should have been reviewed after changes and after the near miss in month 3, when a small fire occurred at the hose connection.
• The assessment correctly identified that vapour may be present and recommended gas detection with automatic shut-down, but the recommendation was not fully carried out.
• Two of the detectors were out of order for weeks, so the controls that the assessment depended on were not working, and the assessment did not say what to do when a control fails.
• The assessment should have covered the work of contractors, such as hot work near the gantry, since this is a foreseeable source of ignition.
• The assessment should have considered all people who could be harmed, including tanker drivers, contractors, visitors, and people outside the depot.
• The assessment should have been carried out by a competent person, in consultation with the operators and drivers who know the real working practices, such as the jumper lead.
• The significant findings should have been recorded, and an action plan with owners and dates should have been made, with a check that the actions were done.

Practice points counted: 0 of 12

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• Remove or reduce the fuel: use a closed loading system with vapour recovery so that less vapour escapes, and avoid overfilling and spills.
• Assess flammable-atmosphere hazards and control ignition sources under a competent system. Avoid or segregate hot work from hazardous loading and use suitable equipment; designating a zone or displaying signs does not itself remove ignition risk.
• Use electrical equipment in the gantry that is certified for use in a flammable atmosphere.
• Provide and verify a suitable bonding/earthing system and associated protective functions under competent design and maintenance. Restore the defeated safety function; a connection does not eliminate all sources of ignition or establish zero residual risk.
• Stop bypassing the interlock, investigate the operational reasons for it and have competent specialists repair and validate the safety function. Faster reset alone is not the safety objective.
• Install gas detectors at the gantry, test them regularly, repair faults at once, and arrange an alarm and an automatic shut-down of the pumps.
• Never silence fault alarms. When a detector fails, stop loading until it is repaired or provide a tested alternative.
• Keep the foam system and the fixed fire protection in working order, with planned testing and records.
• Supply suitable fire extinguishers at each bay and inspect them on a schedule, with tags that show the last check.
• Display clear and durable signs for the hazardous zone and for the ban on phones, and give drivers a briefing when they arrive.
• Define competent driver/operator supervision, attendance, safe working positions, communication and emergency escape under a site-specific loading procedure. Do not impose an unsupported rule requiring drivers to remain inside a vehicle during every loading operation.
• Check the controls by inspection and audit, and make sure that the targets for loading speed do not put pressure on staff to bypass them.

Practice points counted: 0 of 12

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• A permit to work is a formal written system that controls high risk work, such as hot work, so that the work is done only after the hazards are assessed and the precautions are in place.
• The permit at Harbour is a single page form that does not require a gas test, a check of the work area or a time limit, so it is not suitable for hot work near flammable vapour.
• The permit for the welder said 'general repairs'. It should have named the exact job, the location and the hazards.
• Permits were signed in advance for a whole week, but conditions change from hour to hour, so a permit should be valid for a short and stated period.
• No gas test was done before the welding. A gas test should be done before the work begins and repeated at set intervals.
• The person who issues the permit should visit the site of the work and check that the precautions are in place, and should be trained and authorised.
• The system should include isolation of the area, for example stopping loading at the neighbouring bays, and fire watch with an extinguisher while the hot work is done and for a period afterwards.
• Whenever possible, avoid hot work in the hazardous zone by moving the job to a workshop or using a cold method of repair.
• The permit should be signed by the issuer and the person receiving it, and should be closed out by both when the work is finished, with the area handed back safely.
• Operations and maintenance staff need to communicate about the permit and about which bays are loading, and the maintenance fitters need not feel pressure to start before the area is safe.
• Contractors should be selected on the basis of competence and safety record, not only on cost, and Harbour should ask for their method statements and risk assessments.
• Contractors should receive an induction that covers the hazards, the rules, the emergency procedures and the permit system, in a language that they understand, and the induction should be given by a competent person and not just a security guard.
• Harbour should supervise contractors and check their work, and should have meetings with them to agree responsibilities and to share information.
• The system should be monitored by audits of permits and by checking that the rules are followed, and any breaches should be dealt with.

Practice points counted: 0 of 14

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• The depot manager has overall responsibility on site and should make sure that there are enough resources and competent people to manage the risks of the depot.
• The depot manager should not set targets for loading speed that put pressure on staff to bypass safety measures, and should review the targets to include safety.
• The depot manager should make sure that the risk assessment is kept up to date and that the actions from it are done, including the repair of the gas detectors.
• Supervisors should enforce the rules at the bays, stop unsafe practices such as the jumper lead, and report the faults and incidents that they see.
• Supervisors should check that the permits are properly issued and should not sign them in advance.
• The maintenance manager should plan the inspection and testing of the safety systems, such as the foam system and the detectors, and should keep records.
• Contractors should follow the permit and the site rules, use safe working methods, report hazards and tell the depot if the conditions change.
• Workers and drivers should follow the training, use the equipment correctly, and not interfere with the safety devices.
• The board should set the health and safety policy and name the people who are responsible for each task, and the policy should be updated.
• The board should appoint a competent safety manager to replace the one who left, should receive regular reports about performance that include leading indicators, and should lead by example.

Practice points counted: 0 of 10

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• Employers must give workers the information, instruction and training needed to work safely, and the amount should match the risk of the work.
• Operators in the control room should be trained in the use of the gas detection system, the emergency shut-down and the response to alarms, and should be told never to silence a fault alarm.
• Operators and drivers should be trained in the correct use of the earthing connection and the interlock, and told why it must never be bypassed.
• Drivers who visit the depot should have an induction on arrival that covers the hazardous zone, the ban on phones, the loading rules, the alarm, and the muster point.
• The induction should use pictures and signs as well as words, and should be provided in languages that the drivers understand.
• Contractors should be trained in the permit system and in the hazards of the depot, and welders should be trained in the hazards of hot work near flammable vapour.
• Members of the fire team should receive regular fire training and practise with the equipment, since only two of the six had been trained.
• Supervisors need training in their role, which includes leadership, supervision, the permit system, the investigation of incidents and the handling of pressure.
• Refresher training should be given at intervals, and after incidents, changes to the plant and near misses.
• Training should be recorded, and its effectiveness should be checked by observation and by questions.
• Communication can be improved with a clear system for reporting faults and near misses, so that the fault of detector 2 was known and acted on.
• Regular toolbox talks, notice boards and meetings should be used, and the safety committee should include workers, contractors and managers.

Practice points counted: 0 of 12

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• An emergency plan should be written for foreseeable events, such as a fire at the gantry, a spill or a vapour release, and should be based on the risk assessment.
• The plan should name the people who have roles, such as the incident controller, the fire team, the first aiders and the person who calls the emergency services.
• The alarm should be heard and understood in every part of the site, including the tank farm, with sounders and flashing lights, and should be tested.
• The emergency shut-down should be quick to use and should be operated from the control room and from points at the gantry, and operators should be trained to use it without waiting for confirmation.
• At Harbour the gas alarm did not sound and the operator was slow to shut down, which allowed the fire to spread.
• The muster point should be upwind of the likely hazard and away from the gantry, and the car park point was on the downwind side, which put people at risk.
• Routes and exits should be marked, kept clear, and known to everybody, including visitors, drivers and contractors, and each person should be accounted for with a roll call.
• Regular drills should be held, with learning from each one, and there had been no drill for two years, so some workers went to the wrong point.
• Fixed fire protection such as foam systems and water spray should be tested and maintained, and the foam system at the gantry failed.
• A fire team should be trained, equipped and available at all times, and the depot should have trained people on each shift, including nights.
• The emergency services should be told about the depot, should have access to the plan and the site, and should take part in joint exercises, since the fire station was 20 minutes away.
• First aid arrangements should match the risk, including trained first aiders on every shift, burns treatment supplies, and the ability to arrange quick transfer to hospital.
• Provision for the care of those with burns should be part of the plan, and a list of emergency numbers should be kept up to date and accessible in the control room.
• After an emergency, the site should be made safe, evidence should be preserved, the incident should be investigated, the plan should be reviewed, and workers should be offered support.

Practice points counted: 0 of 14

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• The purpose of an investigation is to find out why the incident happened so that similar events can be prevented, and not to blame a person.
• The first step is to make the scene safe, give care to the injured and call the emergency services, and then to preserve the evidence, including the gantry, the earthing connection and the jumper lead.
• The next step is to collect information: photographs, camera records, the permit, the maintenance log, witness statements, the gas detection data and the training records.
• The investigation should be done by a team that includes a manager, a supervisor and a worker representative, with people who are competent, and it may need outside experts because of the severity.
• Witnesses should be interviewed soon after the event, separately and with care, since several of them are distressed.
• The team should analyse the information to establish the sequence of events and should look for the immediate, underlying and root causes.
• Immediate cause: welding sparks ignited petrol vapour on the platform, and the flash fire spread to the tanker.
• Immediate cause: the earthing interlock had been bypassed with a jumper lead so that static electricity was not controlled, and the detectors that should have given a warning were not working.
• Underlying cause: the permit system allowed hot work without a gas test, was signed in advance, and was not supervised.
• Underlying cause: the maintenance of the detectors and the foam system was delayed because of the targets for loading and there was no budget or priority for safety.
• Underlying cause: weak training and induction of drivers and contractors, and poor supervision of unsafe habits such as the use of phones at the gantry.
• Root causes include a poor safety culture, in which production was put first, a lack of clear responsibilities, no safety manager, and a failure to learn from the small fire in month 3.
• The team should make recommendations with an action plan that has owners and dates, should follow up that the actions are done, and should share the lessons with all workers.
• Harbour should report the incident to the authority as the law requires, keep records, inform the families, and review the risk assessments in the light of the findings.

Practice points counted: 0 of 14

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• Moral: a worker died and another was permanently disabled, and no one should be harmed by their work.
• Moral: the families of the injured have lost earnings and support, and colleagues who saw the fire may suffer lasting distress.
• Moral: Harbour has a duty of care to contractors and drivers as well as to its own employees, and the contractors had little information about the hazards.
• Legal: employers have a duty to provide safe plant, safe systems of work, information, instruction, training and supervision, and a duty to assess risk.
• Legal: the failures at Harbour, such as the missing gas test, the broken detectors and the lack of drills, are likely to be breaches of these duties.
• Legal: the authority may inspect the depot, issue an improvement or prohibition notice, or prosecute, and the managers may be personally liable.
• Legal: a civil claim for compensation may be made by the injured workers or their families.
• Financial: the direct costs include damage to the tanker, the gantry and the foam system, the loss of fuel and the clean-up.
• Financial: the loading bays may be closed for a long time, which means lost income and fees to customers, and the cost of the investigation.
• Financial: fines, compensation and higher insurance premiums can be large, and some costs, such as the loss of customers and trust, are hard to recover.
• Financial: good safety management reduces the risk of such losses, and improves efficiency, morale and reputation.
• Reputation: a fatal fire at a fuel depot attracts attention from the public, the media and the regulator, and customers may choose other suppliers.

Practice points counted: 0 of 12