Case Ditails

Scenario
Case Name Leakage of gasoline loaded into a tank lorry caused due to disregard of an over-loading alarm
Pictograph
Date July 23, 1994
Place Kawasaki, Kanagawa, Japan
Location Refinery
Overview The lorry driver continued loading to the lorry tank which was full of gasoline, because he was convinced that he had switched to another tank of the lorry. Therefore, the anti-overflow system operated. However, the driver and the control room operator did not confirm the situation, and judged it was a malfunction. The control room operator reset the alarm, the driver opened the anti-overflow valve by hand, and the loading was continued. As a result, gasoline leaked through the clearance of a loading arm seal and a tank manhole, and injured the driver. Damage was minimized, because the operator released the loading arm, enforced release of the anti-overflow valve was canceled, and loading was arrested again.
Incident When loading of gasoline into No. 2 tank of the tank lorry had been completed, the loading tank had to be changed to No. 3 tank. However, the tank lorry's driver forgot to switch to No.3 tank. Naturally, over-loading instrumentation functioned, an alarm sounded, and an anti-overflow valve closed. The driver and a control staff of the lorry station judged the alarm to be malfunctioning without confirming the situation. The control staff in the control room reset the alarm, and the driver temporarily released the arrested anti-overflow valve by hand, and continued loading. As a result, 1 or 2 L of gasoline leaked through the clearance between a loading arm seal and a tank manhole. Gasoline entered the eyes of the lorry driver, who was injured slightly and went to hospital for seven days. Refer to Fig2.
Processing Transportation
Substance Gasoline
Type of Accident Leakage
Sequence At 10:59 on July 23rd, 1994, the lorry driver was instructed about loading at reception of the control room in the lorry station.
At 11:09, loading to No. 5 tank of the tank lorry finished, and loading to No. 2 tank (for 2 kl ) started.
At 11:11, as loading to No. 2 tank finished, the driver should have switched the loading tank to No. 3.
At 11:12, the driver forgot to switch to No.3 tank, and started loading to No. 2 tank again. A mechanical anti-overflow valve mounted at the loading arm operated, and the flow was cut off. Simultaneously, the alarm system operated at both the control room and the lorry station. A buzzer sounded, an alarm lamp lit, and the flow control valve shut. The control staff was convinced that a malfunction had been caused due to a very small leakage, although he confirmed that the alarm lamp was flashing. He reset the abnormal alarm system and turned off the light of the alarm system. At the same time he asked a lorry station's field operator to check the tank level with the paging system.
At 11:13, the lorry driver judged that there was a malfunction of the alarm system. After he confirmed the alarm lamp was off in the control room, he ontinued loading with making anti-overflow valve open with his hand.
Therefore, the gasoline blew out through the clearance between a loading arm seal and a tank manhole, and he injured his eyes.
The enforced release of the anti-overflow valve was canceled, because the driver let go the anti-overflow valve, and the alarm system operated again, and loading of gasoline automatically stopped.
Cause 1. The lorry driver was convinced that he had switched to No.3 tank.
2. Simultaneously, both the lorry driver and the control room staff in the lorry station believed actuation of the abnormal alarm was due to a malfunction. They reset the alarm system without confirming the situation, and/or, without hearing the results of confirmation.
3. The Anti-Overflow valve of the loading arm, which was originally not allowed to be opened, was opened by force.
Response The lorry driver was taken to hospital by ambulance.
Countermeasures 1. The transport company has to execute retraining to the employees (including tank lorry drivers) based on the operating procedure book for loading into lorries. The company has to educate drivers to report to the control room when the alarm system is actuated.
2. The operating company of the lorry station has to inform employees and lorry drivers about responses to the alarm system, and that resetting of the alarm is prohibited without confirmation on the spot and communication with drivers by paging.
Knowledge Comment 1. This accident shows that unconscious behavior of a person cannot be corrected by the person him/herself. Moreover, uncorrected judgment and behavior might sometimes promote incorrect behavior of others.
2. The accident was caused by two persons who were in contact with each other. From another point of view, it was caused when the situation changed from storage to transportation. Under changing conditions, accidents generally occur frequently compared with in a stable operation or under a static condition. Therefore, education that can reduce human error is important.
3. It is sometimes difficult to cope with human error, even if an excellent system is introduced. Sometimes it is important to introduce countermeasures in hardware phase to prevent an accident.
Background 1. This accident is a very classic example of human error which occurred by self-deception and/or misunderstanding.
2. An imperfect operation manual is considered to be partially responsible. In the countermeasures prepared after the accident, there are the following sentences. "Resetting is forbidden if safety in the field is not confirmed," and "the transport company must instruct drivers to rapidly and completely report to the control room when the alarm system is actuated." Essentially, these are matters to be completed before operation of facilities in the operation manual.
3. There might be a problem in the structure of the overflow valve. Even if the mechanical anti-overflow valve operates and loading is stopped by force, temporary opening of the valve is possible by manipulating the handle installed at the loading arm without resetting in the control room. This system may cause an incident due to a mistake in operation.
Incidental Discussion An accident occurred due to disregarding of information from an automatic alarm system. It tends to be considered simply as a classical example of the cause of an accident. However, in this kind of accident, a problem of system reliability is often hidden in the background of the accident. According to an accident report, the probability of malfunction occurring was about 0.3%. However, the probability is higher for the person who experienced a malfunction. It reaches 100% at the moment of malfunction occurring. Naturally, the operator who has encountered an alarm malfunction before would think, "Oh it's happened again!", when he encounters a real alarm. It is important to take immediate countermeasures for malfunctions and to remove doubt and anxiety about the system of people concerned by explaining the cause and probability.
Some accidents treated as human error might have been prevented if such countermeasures were taken.
Reason for Adding to DB Example of accident caused due to disregard of an alarm
Scenario
Primary Scenario Carelessness, Insufficient Precaution, Carelessness of Operator, Misjudgment, Misperception, Mis-Convincement, Organizational Problems, Poor Management, Slackness of Management, Malicious Act, Rule Violation, Safety Rule Violation, Secondary Damage, External Damage, Leakage, Bodily Harm, Injury, 1 person injured
Sources Kawasaki City. Fire fighting station. Prevention division. Peace section. T Co. K factory. Gasoline leakage accident at a dangerous material transfer tank area. Material of the Kawasaki City Complex safety countermeasure committee (1995)
Number of Injuries 1
Physical Damage About 1-2 L of gasoline
Multimedia Files Fig2.Rough Sketch of Operation
Field Chemicals and Plants
Author KOBAYASHI, Mitsuo (Office K)
TAMURA, Masamitsu (Center for Risk Management and Safety Sciences, Yokohama National University)
Scenario