IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

CHAPTER 9
PRIMARY AND ROOT CAUSES
Immediate and system causes were analyzed using the evidence
compiled. The evidence was broken down into discrete building blocks of
events or conditions from which the Critical (Causal) Factors were
identified. Critical Factors are those events or conditions that, if removed,
might eliminate or reduce the possibility of the event occurring, or reduce
the severity of it. For each Critical Factor, Possible Immediate Causes and
Possible Management System Causes (Root Causes) were identified

9.1

CRITICAL FACTORS
1.

Loss of primary containment

2.

Loss of secondary containment

3.

Inadequate mitigation measures

4.

Shortcomings in design and engineering specifications of facilities

and equipment

5.

Defunct Vital emergency shutdown system

6.

Absence of Operating Personnel in Vital area (Control Room, Field)

7.

Absence of On-site and Off-site Emergency Measures immediately

on loss of containment

The observations given below are primarily based on the information and
feedback gathered during the course of investigation from the Terminal

- 129 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

and Marketing Operation of Indian Oil Corporation Ltd. Their applicability

to other areas may need to be verified by a separate study.
9.2

CRITICAL FACTOR CASUAL ANALYSIS

Critical

Immediate

Root Cause

Policy

Factors

Cause

(Management

Issues

System Cause)
1.Uncontrolled

- Wrong

Loss

Operation

of

Primary

valves

by

Containment in

operator

of

Safety

not

given

adequate priority

Training

- Lack of enforcement of
discipline

- Poor design

the form of a jet

of gasoline

- Ineffective

Awareness

- Improper

- Leadership

Equipment

development

(Hammer

program

not effective

Blind valve)
- Indiscipline

-Safety

- Absence of
- Poor
leadership
- Lack of
supervision

not

independent/autonomous

Second
Operator

function

at - No ESA conducted in

supervisory
level
-

Ineffective

internal

safety

audit
- No

external

safety audit in 6

- 130 -

last 6 years

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

years
2.

Operating - All operating

Lack

of

operational skill

personnel

crew

incapacitated

overcome

by and

poor

Lack

of

Risk

awareness

mental

leaking

gasoline liquid alertness

and vapour
-

of - Lack of Training program

Lack

-Second

training

operator

emergency

attempting

management

rescue

in

also
the -

entered

Non-

affected

area availability/lack

and

was of

awareness

on PPE use

overcome
- No PPE was
used
3.Loss of
Secondary
Containment

- Open dyke
Valve
Tank

Poor

in operating

401A

Discipline

- Leadership
development

dyke
- Lack of

not

effective

Supervision
- Independence of safety
functions lacking

- 131 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

- Position .not

Confidential

- Risk

monitored in

awareness

control room

-No

from control

Management

adequate priority

room made

of

defunct

Procedure

4.Inadequate

- MOV closure

Mitigation
measures

Safety

not

given

Change
-

Risk perception

Risk awareness

Non - Improper PPE

(Personnel

availability
of

self Protective

controlled

Equipment)

breathing

Policy

apparatus
(SCBA)
- Quantitative
Risk
-

-Emergency awareness

Assessment

No

not done

emergency

plan for the

scenario

Absence

Training
Emergency
-

No Management

of
in - Leadership
development

not

effective

emergency
responder

- Inadequate
Leadership

- 132 -

- Independence of safety
functions lacking

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

Ineffective

- Absence of internal

safety

command and audit

control during
emergency

- No

external

audit in 6 years
5.Shortcomings

Selected - Old practice

in design and device

engineering

for

Acceptance of status quo

not reviewed
No formal structure to

positive
isolation

scan

is

latest

industry

potentially

development

/best

hazardous

practices etc. and picking

up best industry practice

Operating
- No Hazard

area was
inside dyke
-

Analysis

MOV

operation was - Improper

from

inside HAZOP

dyke
-

Operating - No Hazard

area

Analysis

access/escap
e
unsatisfactory

- Improper
HAZOP

- 133 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

MOV

Confidential

was

used for tank

isolation

as

well

for

as

Hammer Blind
isolation.
fall

No
back

provision.

Poor - Lack of

6. Absence -

Supervision

from site of operating

one

- Inadequate monitoring
by senior management

and monitoring

discipline

through

operator

- Leadership

surprise checks

development
effective

Laxity

in

strict
enforcement of
Conduct

&

Discipline Rules
-

Lack

of

Supervisory
Control
-Incompetency
at
Supervisory
Level

- 134 -

not

IOC FIRE ACCIDENT INVESTIGATION REPORT

7. Absence

Poor -

Lack

of -

of

emergency

understanding

Immediate

awareness

of

Hazard
-

On-site

Safety

not

given

adequate priority

and Off-site
Emergency

Risk Awareness

potential

Response
to

Confidential

No -

Absence

emergency

Training

responders

Emergency

of
in

Management

- Lack of risk perception

- Lack of PPE
- Unavailability Policy
of PPE

The root causes are aggregated under the following heads and the
indications of:
9.3

ROOT CAUSES INDICATORS AND REASONS

ROOT CAUSE

INDICATED BY

Inadequate leadership at Absence

Terminal in-charge and Standard
state level management

of

REASONS
written Inadequate

leadership

Operating training

Procedures (SOPs)

KRAs

No review of operating diverse

practices even after CBI
investigation in August
2009
Safety rules not enforced

- 135 -

too

many

&

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

Operating discipline very

poor
PLTs carried on after
dark, never with manager
or

senior

manager

present
Vital safety devices made Safety
non functional since long
Inadequate
Priorities

Safety

System

Management
not

properly

implemented
No

adequate

safety Management of change,

check list

safety training ensuring

competency

of

people

not adequately done

Risk assessment, Hazop,
What If analysis not done
Communication facilities
inadequate
Vital PPEs like SCBA not
readily

available

and

people not trained for

emergency use
Emergency
preparedness for major
events missing or totally
inadequate
Fire

fighting

resources

(manpower,

water)

inadequate
Near-miss

reporting

system absent
No safety campaigns or
- 136 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

posters visible
Did

not

indicate

awareness about safety

policy, safety policy not
displayed
Security staff and the
contractor

had

instructions

no
on

emergency handling on
their own
Inadequate

safety

messages

displayed

through

posters,

billboards; safety policy

not displayed
No External Safety Audit
for last 6 years
Internal

Safety

Audit

inadequate as it could not

point out any deficiency
in design or procedures &
practices
Safety
based

performance
on

lagging

indicators

(accident

statistics)

not

on

adherence to system and

procedures

Inadequate Design and Push buttons of MOV too Hazard

- 137 -

potential

of

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

close to each other

Locations of push buttons
difficult

to

see

while

standing in front of MOV

Entire

assembly

hammer

of

blind

and

isolating valve should be

outside the dyke area
Approachability of valves
poor, very congested
One

additional

valve

should have been there

on

tank

body

before

hammer blind and its

hammer

isolating valve
Construction

blind

Location of fire pumps realized Deficient

and

poorly design review

tanks

conceived

though

meeting

statutory

distances
Bleed

valve

between

hammer blind and MOV

not provided even though
on P&ID
Second
from

escape

route

installation

near

pipeline

area

was

blocked by a wall which

had been constructed to
close the gate

- 138 -

not

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

No checking or guidance
from

Shift

when

Supervisor
emergency

occurred

Poor judgement of Shift Focused

Quality

of

supervision Supervisor taking on Training

inadequate

Supervisor
and

its

too much workload in certification

shift with one operator
gone out, 2nd operator
working 3rd consecutive
day 16 hrs, 3rd operator
being

emotionally

stressed
Miscommunication
between KR Meena &
RN Meena
Marketing and Pipeline
Divisions did not display
coordinated
Working in Silos

emergency

management

Interface

Management

Pipeline Division failed to Focus

realize Hazard potential
of the loss of containment
9.4

ESTABLISHING REASONS FOR OPERATOR ACTION

1. The Committee tried to examine the underline reasons that
may have led to the experienced operators making such a

- 139 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

basic mistake in the operation of the valves. Some likely

causes which could lead to such an event are listed below:
a) Was it because of human error?
b) Was carelessness the cause?
c) Could it be due to operators taking a short cut to the procedures?
d) Were the operators misled due to an equipment deficiency such as a
passing valve?
e) Was bad practice of the past a reason?
f) Was there any possibility of any ulterior or personal motive?
2. It was also known that Shri RN Meena, the operator who
actually operated the Hammer Blind and other valves which
resulted in the leak, was somewhat absent-minded and had
a withdrawn personality, and also was under some stress
due to family problems.
3. Human error, though it can happen any time, seems a little
unlikely because the same group of operating personnel had
just a few minutes ago carried out an identical operation on
another product tank for lining up (SKO). Further, the same
group of operators have been carrying out the PLT operation
for the last 15 years or so.
4. Carelessness could have been a starting point, especially if
we take into account the emotional situation of the
concerned operator Shri RN Meena. There is always a
likelihood that he might have forgotten to check the position

- 140 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

of the Hammer Blind or the HOV before commencing line up

operation.
5. Being misled by a passing valve like the MOV is also a
possibility, though such passing of the valve was never
reported earlier.
6. Operators taking a short cut is also likely as for example if
they were trying to hasten the activity of line pressurizing,
even before the tank gauging exercise was completed.
7. Bad practice of the past such as keeping HOV open first
seems to have been prevalent but this itself may not be the
cause for the incident.
8. As regards ulterior or personal motive the Committee has
noted the presence of some unusual circumstances, viz,

i)

just prior to tank 401-A lining up operation both the operators had lined
up the SKO tank barely 10-15 minutes earlier, when both the operators
were present and SKO tank was successfully lined up.

ii)

The same procedure was not followed in case of MS. While one
operator had gone up the tank, the other operator remained at the
valve line up position and was reportedly doing something. Before the
crew could come down from top of the tank and be briefed about what
he (Shri K R M) had done, for some inexplicable reason he left the
work place and was later found having tea in the canteen. This does
lead to some doubts and suspicion about what could have compelled
him to leave the site.

iii)

There has been a case of unusual stock losses in MS sometime in July

2009 which was under internal investigation at the time of the incident.
Almost a week prior to the incident a letter had also been written to
Senior Terminal Manager by the GM (RSO) regarding these unusual
stock losses.

- 141 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

iv)

Confidential

It is also known that there was an incident being investigated by the

CBI regarding diesel (HSD) pilferage which happened in June/July
2009.

v)

Both the operators were highly experienced and normally not be

expected to commit such a mistake of leaving the hammer blind open
and opening the MOV.

vi)

In the light of what is stated above the Committee feels that motivated
actions by the operators for whatsoever reasons cannot be entirely
ruled out. In case the delivery line pressurizing is done before the tank
is gauged it would distort the tank receipt figures from the pipeline
group and reduce the stock loss figure of Marketing Installation.

vii)

However, as it was not strictly in the remit of this Committee to collect

any concrete evidence or records related to pilferage/mal-intention, the
Committee has no means of establishing, with any degree of certainty,
that this was indeed a driving motive for the action.

viii)

Since both the operator are no more, the committee could not
concretely substantiate these issues

9.5 POSSIBILITY OF SABOTAGE

There is no concrete evidence of any sabotage as per the extensive field
surveys, analysis/equipment conditions.
9.6 SUMMARY OF BASIC CAUSES
Human Factors
-

Operational safety rules, procedures were not being effectively enforced

Experience level of supervisory staff in installation was considerably

diluted as a result of company policy on transfers

- 142 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

No effort made to assess competency and aptitude of officers and

managerial staff and use this for company postings

Even though plant had some degree of automation, in the tankage

operation and pipeline transfer area, considerable human intervention was
called for, and therefore human back up should have been carefully
assessed.

One of the shift operators, who was quite experienced and well versed
with the Installation and its operation was not at site as he had reportedly
gone home for 3-4 hours for some work.

Technical and Engineering Factors

-

Design of system inadequate use of Hammer Blind. MOV used for

isolating HB. Only one press of a wrong button when HB is open can
result in extreme hazard. No fallback in case of leak except remote
shutting provision. This can always be defeated but an additional valve on
tank cannot be removed that easily. Location of HB and MOV inside dyke
is unsafe.

Construction and equipment congested area, approachability poor. Push

buttons placed inconveniently.

Drainage system tank dyke is connected to storm water drain also which
is open to atmosphere, Hydrocarbon entering this allows vapor to spread
throughout installation.

Fire water, fire pumps & storage tanks water adequacy norms not based
on major fire explosion. Location of five pumps and FW storage not ideal.

- 143 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

Restricted VHF communication facility, paging facility for operating staff

and no Public Address System.

Flow meter on product lines from the Installation was not provided.

Organisational Factors

No contingency plans in place for dealing with major incidents. Hazards in

operating large installation like Jaipur were not fully understood.

Safety and loss management systems were inadequate (e.g. Internal

Safety Audit, risk reduction strategies etc), No near miss reporting system
seems to be in place, there was no evidence of any accident records,
even minor ones, absence of safety posters/slogans etc.

Corporate Safety Group being inadequate, professional training to safety

and line managers in quantitative methods and risk assessment
techniques etc., was not provided.

In terms of overall corporate priorities, terminal operations, primarily being

a cost center, may be getting less management time and attention than
direct revenue earners like sales or production or other external facing
departments like retail sales and lubes etc.

Manpower requirement and quality of personnel not assessed properly.

Discontinuity in senior management in the Terminal. During the about 14

years of operation since commissioning, the installation had 8 managers
(incharges). Result was that systems, procedures and training and follow
up suffered greatly.

- 144 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

Emergency/Contingency plans for dealing with major incidents were

inadequate.

Internal Safety Audits conducted did not point out the non availability of
the emergency remote close facility on the critical motor operated valves
since several years. External Safety Audit had been conducted about six
years ago which had pointed out a deficiency in these valves.

A growing corporation with bigger sizes of installations and plants and also
increasing numbers of such installations needs greater sophistication in
both technology and engineering controls as well as in management
systems. No evidence seems to be in place of a review mechanism to
periodically oversee these aspects.

Environment

The original location about 15 years ago had hardly any industrial
establishment around it.

.Rapidly developing Jaipur city resulted in industries being set up

contiguous to the installation.

Overall Lessons Learnt

-

Management must always ensure that systems to provide realistic

feedback to them about the safety and operational readiness and the
practices in the field areas, are always in place and a system of checks
and balances is maintained.

Terminals and installations should be subjected to a QRA and treated as a

high hazard location

- 145 -

IOC FIRE ACCIDENT INVESTIGATION REPORT

Confidential

Combined knowledge and experience of operations maintenance and

management personnel must be maintained at a high level

Senior management both at local and corporate level need to give more
attention to monitor installation actual practices

Greater coordination required between local Land Planning Authorities

and major high hazard and other Industries.

- 146 -