Health and Safety Management for Employees: MORT Analysis of the Buncefield Fire Explosion

Other Underlying Factors and Events

• Two feeder lines supplying fuel to the depot were operated by different sets of people, the Finaline was managed by supervisors at the sight whilst the UKOP line was controlled by an entity external to the site
• Information supplied to operators of the various lines was markedly different, the Finaline operators for instance did not have access to monitoring data and so couldn’t know without using ATG if fuel was flowing or not as well as what the flow rate for fuel was.
• Increase in throughput
• Poor tank filling operations
• Pressure of work
• Loss of secondary containment
• Tie bar operations inadequacies

Events in the ECFA charts above are depicted by rectangles whilst conditions are depicted in oval form. The above events and causal factors are by no means the only ones that were involved or influenced the accident at the Buncefield depot, indeed a host of other underlying systemic and organisational factors were involved including:

• Supervisory failures
• Malfunctioning of the alarm function in the ATG system
• Increase in throughput of the product
• Poor organisational safety culture
• Failures in work procedures.

Events and Causal Factors Analysis of Buncefield Accident

As discussed in length, accidents are investigated to recognise the cause of their occurrence and are also used to determine the actions or steps that need to be taken to prevent them from occurring again. Therefore, accident investigators must probe in-depth into the events and the conditions that create accident situations as well as take into consideration the managerial control systems that may have led to the development of the root causes of the accident (Benner, 1975). If these root causes are identified there develops a great deal of comprehension of the interactions of events and casual factors through a sequenced chain of events and activities that begins with “initiating” events to the final losses that may have been produced from the incident (Kuhlman 1977).

Factors that are considered to be very important in accident causation materialise as being sequential or simultaneously occurring events that interact with existing conditions (Benner, 1975). It is then these patterns of conditions and events which allow for outlining an image to reconstruct the multiple factors that led to the unwarranted loss or other potential losses (Benner, 1975). It is only through pedantically tracing unwanted energy transfers and their connection to each other and the individuals, procedures, infrastructure, and controls does oneunderstandsd the implications which caused the accident to occur and further delineates the sequence of events that have led tothe  accident development (Benner, 1975).

It is through the use of an Event and Casual Factors (ECF) chart that illustrates the essential and appropriate events and causal factors for accident occurrence in a rational sequence. This is often used to analyse not only the accident but is also an essential tool for evaluating the various evidences during the examination of the accident (Benner, 1975). This tool also aids in validating the accuracy of pre-accident systems. Followed is the use of Events and Casual Factors Analysis (ECFA) which is considered to be an intricate and imperative part of the MORT-Based accident investigation method. ECFA is often used with other major MORT tools such as those used in this particular study, MORT tree analysis, energy trace, and barrier analysis to achieve maximum results in the investigation of the Buncefield accident.       

To determine the causal factors associated with the incident under study it is necessary to analyze to determine the causal factors of the accident (Benner, 1975). This is considered an imperative process to conclude what the root causes of the accident were. For this reason, deductive reasoning is used to determine which events or conductions contributed to the accident. The significance of the events within the accident sequence will be evaluated using the question premise:

‘If this event had not occurred, would the accident have occurred?’

Based on this question the causal factors were assessed and then considered before inserting them within the chart. The chart below is the events and casual factor (EFC) that has been composed to outline the events that have led to the subsequent explosion and fire in Buncefield. The chart has only considered important events that overlapped with the MORT analysis and Barrier Analysis. These are considered to be important as they aid in the analysis of the root causes of the accident to ensure that only important events and factors are considered when analysing the underlying causation of the event (Benner, 1975).  The EFC follows the basic standards and rules for composition as outlined in the figure which shows a general example of EFC charts.

Chart 5; EFC of Buncefield Incident

General conventions were used in composing the EFC chart above. The reason that the general method was used was so that it can improve the comparability and consistency in accident reporting and aid in circumstances of communicating the investigation findings. The figure below provides a brief insight into the general format of EFC that was followed to assess the Buncefield incident.

Figure 6- General outline of EFC chart (Source; SCIENTECH, Inc., 1995)

This particular convention attempts to be as simple as possible while at the same time maintaining the effectiveness of the event and casual factor analysis. As outlined in the figure, the square boxes are indications of events, when these events are lined horizontally they are considered as primary events while those in vertical succession are considered as secondary events. Oval shapes used in the diagram are indications of conditions following the same vertical and horizontal rules applied to events. Events are connected in solid arrows while conditions are connected to events and each other with dashed lines.

Using the ECFA charting technique and subsequent analysis brings about two primary benefits:

1. Meets the general purposes of accident investigation and conducting investigations
2. Aids in ease of writing the investigation report

It is the primary purpose of accident investigation to identify what happened and why it happened to ensure that similar accidents do not occur again in the future. Under the circumstances of major accidents, there are underlying indicative factors of systematic defects which have also shown to reduce performance and production. This is evident with the Buncefield incident, based on the EFC chart that was composed. The underlying cause which is considered a primary root cause of the failure of barriers and the overall accident is deficiencies within the management system. The deficiencies that have been exposed from the EFC need to be reviewed and benefits need to be derived from them that go beyond the limit of correcting the immediate causes of the accident.

Firstly, as seen in the barrier analysis and MORT analysis, there are a great deal of defects in the management system of HOSL. Management overworks their employees leading to greater chances of underperformance and errors. Further, management has shown a great deal of issues in logging for errors which is considered as a root cause that led to the incident to take place. Had management logged errors in the ATG and IHLS these root technical problems would have been solved and the overall accident would have been avoided. However, there was poor management throughout the facility.

Based on the EFCA conducted it is evident that there is a cause-oriented explanation of the accident. This can be explained using the conditions and events from the EFC to make a table that details a cause-and-effect relationship. These cause-and-effect relationships have been outlined in the table below.

Table 3- Cause and Effect Analysis of Accident

Thematic Areas for Safety Professionals Highlighted by the Buncefield Accident

One of the central purposes inherent in the investigation of accidents in general but more so major accidents of the type that occurred at Buncefield is the opportunity to highlight not only organisational learning points but also the advancement of the field of safety management and professional awareness and knowledge of accidents, to avoid repeat but also to inform response and mitigation efforts (HSE, 2003).

According to the HSE (2014), whilst the incident at Buncefield does not flag up new areas insofar as major accident prevention is concerned the accident still had utility regarding its efficacy in strengthening and reinforcing critical process management principles that organisations as well as professionals linked to the safety management paradigm have been aware of for some time. To that end, the following have been identified in the literature as some of the key thematic areas for safety professionals that the accident helped reinforce:

• Time and safety resources are of vital importance in process safety planning and management. The criticality of the need for resources to process safety is particularly pertinent given the conflict between resource allocation between business activities and safety management activities, with the latter often considered to be a resource-depleting rather than value-creation activity. However as revealed by the incident, more so the effect suffered by the operators of the site as well as non-functional targets of the accident site, the failure to provide sufficient resources as well as the failure to allow for sufficient time for staff to consider safety during process operations can have very severe financial and reputational impacts let alone legal penalties and sanctions.
• Culture and systems for the identification of failure in components critical for safety are vital to organisations. Whilst the design and automation of current process operations make for a setting where systems for the identification of failure in organisations abound, the functioning of the system and the effectiveness of the detection of failure cannot be delinked from the safety culture within an organisation. Because of the poor culture in HSOL about safety, faults as well as inoperability of safety-critical components were not highlighted. Indeed literature shows an organisational culture that is focused on continuity of operations at the expense of safety considerations runs the risk of experiencing a collapse of the oversight and management functions that are vital to the hazard identification and risk management frameworks.
• Awareness of risks, hazards and risk management needs to cut across the organisation and involve every strata and individual in an organisation. Moreover for purposes of ensuring the effectiveness of safety management functions within the organisation is it vital that top management not only considers but rather owns the safety management issues and concerns inherent in processes, activities and operations of the organisation that they manage. Also because of increasing interconnectedness and indeed the nature of business and corporate management in general, organisations often link up with or work in concert with other organisations that have different attitudes and cultures to risk as well as engaged in different sectors. The failure of the informational sharing framework between the operator of the site at Buncefield and its partners in the form of designers of safety equipment (independent high-level switch) as well as contractors and external auditors underscores the importance of an organisation that works with major hazards ensuring all its partners not only have robust risk/hazard management frameworks in place but equally importantly have a focus and attitude similar if not better than their own when it comes to safety management.
• Organisations and professionals should not take it for granted that once safety management systems are in place then they are effective in advancing safety management in the manner in which they have been designed. It is of vital importance that vital safety management systems and equipment are not only audited but issues addressed quickly and effectively. The criticality of testing the effectiveness or capacity of designed systems and processes to work in the manner in which they have been designed is highlighted by the failure of the independent high-level switch to shut off the petrol filling operations. A lot of movement has been witnessed in this area of safety management after the disaster with the adoption of disaster exercises (also known as simulations or war games). It is however important that an organisation does not become content in the effectiveness of the accident war-gaming in highlighting issues and problems rather it should put procedures, and processes in place to ensure highlighted issues are addressed expeditiously but more importantly effectively as well.

Informational Gaps

There is a wealth of in-depth information in nearly all areas pertinent to the accident, except for the lack of understanding of the dynamics of the vapour cloud movement and the subsequent explosion dynamics as detailed in the report of the Major Incident Investigation Bureau and other reports on the accident such as the Competent Authorities on COMAH report.

Effectiveness of Barrier Analysis and ECFA/MORT Techniques

Whereas Barrier Analysis and ECFA/MORT techniques have proven utility in the investigation of accidents and their precursors, there are several limitations attached to both categories of techniques that make it difficult to gauge their effectiveness about accident investigation in general. Not least because of the existence of a unique set of circumstances for every incident but also because of the blindness of the techniques to the investigation of several accident dynamics including:

• Identification of certain classes of hazards, more so in the case of Barrier Analysis where the emphasis is on the flow of unwanted and hazardous energy. The use of this technique on its own will mean those types of hazards that cannot be characterised in terms of energy flow are not investigated if it is the only technique that is used in the analysis.
• It is difficult to determine whether energy can be reduced or even re-directed mainly because the design and build of systems and their components structures are such that it is not easily apparent that either of those control/safety features can be carried out.
• Barrier Analysis does not permit the identification of all hazards irrespective of the robustness of the hazard identification process especially so regarding hazards that are a combination of various factors and elements and hazards that arise due to co-existing system failure modes.
• Barrier Analysis and ECFA/MORT are also heavily dependent on the knowledge an investigator has of the failed system as well as the level of experience they have in applying it. They are as such not techniques that are appropriate for the investigation of incidents where the accident investigator does not have a certain level of detailed knowledge of a system.

That being so, Barrier Analysis as an accident investigation technique is particularly useful in circumstances where the investigation and identification of hazards that are linked to energy sources is pertinent as well as instances where the aim is to examine either retrospectively or proactively whether barriers/safety features offer adequate protection to vulnerable people and other targets. If the objective is the identification of critical events and not the entirety of hazards and precursor conditions and circumstances, then Barrier Analysis and ECFA and MORT techniques offer strong functionality for doing so. As posited by the HSE (2001), Barrier Analysis and other MORT-linked techniques are made further attractive due to their inherent flexibility, a quality that means they can be applied to the investigation of all types of problems more so as a means of establishing a baseline/foundation for further investigation.

Chapter 5; Presentation of Results

 Using the MORT tree map, Barrier analysis, and events and causal factors analysis there is substantial evidence to conclude that the underlying root causes of the explosion at the Buncefield oil storage depot were technical and arose from management error. To conclude, the root causes have been identified as follows from the accident investigation tools used;

1. Failure of the independent high-level switch is mainly found in the switch’s design
2. Failure of the automatic gauging systems
3. Failure in monitoring of tanks
4. Failure in methods of controlling receivable fuel batches from pipelines
5. Failure in pipework penetration and bunding infrastructure

All the root causes as highlighted above are directly or indirectly caused by defects found in the managerial oversight and leadership of the company HSOL. It is evident from the analysis that there are massive deficiencies in the HSOL’s management including

1. safety management system; no safety procedures taught or implemented within HSOL
2. Management was unable to provide and implement an adequate error logging system and it did not train employees to have the full extent of knowledge of the system in place.
3. There was increased pressure of work caused by increased throughput to the facility as all gas pipelines in the area were diverted to the Buncefield oil depot. Supervisors were not equipped to handle the increase in the flow of products. Also, there was a resignation to higher supervisors as it would lead to a pay decrease for employees already present.
4. Supervisors had used inappropriate controlling and management methods to record and control the fuel that was incoming from pipelines.
5. HSOL did not attempt a risk assessment to produce and implement risk management systems to avoid the issues related to this list.
6. There was no presence of contingency plans, or secondary or tertiary containment in the case of such an incidence.
7. Extremely poor communication between employees especially shift changing supervisors; incoming and outgoing supervisors.

The following sections of the study provided a detailed look into the root causes that are concluded to be the main events, factors, barriers, and conditions that led to the Buncefield incident. The sections touch upon problem areas in corporate governance and management of the accident site and look to analyse the main management failures that have been identified extensively using the MORT tree map, barrier analysis, and EFCA.  Had these root causes been uncovered before and taken immediate action, likely, the Buncefield incident would not have occurred.     

Human, Organisational and Technical Precursors at Buncefield

Main management failures discovered using MORT Model Inadequacies in management functions at Buncefield spanned the three major areas that literature posits are the main categories where precursors of accidents irrespective of the size tend to fall under human, technical and organisational. Table 4 below captures some of the major problems that were observed at Buncefield after analysis of the contextual factors using the MORT model. The author contends they are all linked to the noted problems with the leadership and management oversight at the site. For some of the issues raised, the link is more apparent including inadequacies of the monitoring function within the site as it reflects not only poor strategic direction but also the lack of appropriate supervision and management control.

For others including failure of barriers (be they mitigation, control and preventive), the link to poor and/or insufficient management is not readily apparent but when consideration is given to the why for instance the wrong or inadequate physical barriers were installed it can be established that it connects with either poor decision making in top management bodies, the lack of commitment and focus as well as poor attitude and organisational culture.

Table 4; Main failures that were observed using the MORT technique

Main management failures observed using the Barrier Analysis model

Failures and inadequacies in management function at Buncefield spanned not only the so-called soft defences but did extend to what literature considers to be hard defences-alarms and physical barriers such as bunds and oil storage tanks.

Failures in management that fall under the soft defences include inadequacies in regulations, poor procedures and poor training. They link with accident prevention through their influence on processes, procedures and systems for risk and hazard identification, accident risk mitigation, the review and monitoring function and engendering and promotion of an appropriate organisational safety culture as well as individual attitudes to risk management in general.

Management failures such as poor top management attitude to safety, lack of training, poor supervision and lack of coordination served to erode accident prevention defences as failures cut across successive layers that are known to be pertinent for effective accident prevention in the organisation. Indeed even in instances where the management failings were limited to one layer of the organisation’s barriers (as is the case for all the failings in human resource management), the erosion of that layer meant that the whole system was left vulnerable to collapse not least because of the interconnectedness between the various types of barriers.

Table 5 below summarises some of the top management failures that were discovered on analysis of the pre-accident and post-accident context using the Barrier Analysis technique. Many of the management failures discovered using barrier analysis relate to the state or the absence of safety functions within the organisational structure as well as corporate management of the site.

Table 5; Main management failures at Buncefield discovered using the Barrier Analysis model

Organisational Precursors

Responsibility of Buncefield site managers insofar as organisational factors that triggered the accident span factors that were connected with emergency preparedness and the emergency evacuation plan and response.

In a departure from established good practised for COMAH sites, management had never conducted any emergency drills or exercises. Indeed the setup of the organisation was such that there we no existent emergency preparedness drills or exercises embedded into the risk and emergency management frameworks. Further evidence suggests management was positioned to do the bare minimum to meet regulatory compliance didn’t help that in some instances the compliance had all to do with having documents that stipulated procedures and processes but nothing was operational.

In addition, the communication framework was so inadequate that not only were there problems in stakeholder engagement but also ineffectiveness in communication between the company and its contractors. The latter was especially responsible for the failure to discover poor installations of equipment as well as the poor functioning of systems at the site. Table 6 below summarises organisational deficiencies and problems that played a part in incubating, causing and exacerbating the accident.

Table 6; Main organisational deficiencies and problems

• Corporate Culture and Governance

The deficiencies and failures in human resource management and organisational leadership regarding safety culture, practices and norms stretched beyond the top level management level of the operators of the Buncefield depot.

Board-level involvement was non-existent regarding the stewardship and oversight of corporate safety in general. Analysis of the expertise and experience of the board members of the companies that were jointly running the site shows that they lacked competence in corporate risk management of a major hazardous site such as Buncefield. Accordingly, safety leadership problems and issues run up to the top corporate governance institutions. The inadequacy of board-level stewardship did ultimately feed into the executive management approach to risk management which in turn trickled down to operational employees.

Under such conditions, corporate safety culture became so lax as reflected by the absence of procedures, established norms, lack of processes and focus on doing things to meet minimum compliance requirements rather than genuine consideration and implementation of initiatives that lessened the risk of the site's activities impacting its stakeholders financial, socially and indeed environmentally.

• Corporate Supervision of the Audit Programme

Several failings that directly led to the explosion had been picked up by external auditors. However the implementation of the findings as well as the follow and review of the highlighted deficiencies was not sufficient. The internal audit process was so weak as to be non-functional because of several issues, the main one of which was the lack of leadership and ownership of the audit protocol and process. Failures in the audit programme that were observed at the site included the following:

• Insufficient frequency of audits
• No clarity on what audit protocols need to be used for auditing operations
• The procedure for the reporting of audit findings was not clarified
• The audit manual did not specify what procedures, activities and areas would be audited and the direction of the audit insofar as its focus on either health and safety or environmental protection and also fuel transfer and storage was missing.
• As far as could be established, there is also no procedure for follow-up of procedures and the audit function was silent regarding to whom roles and responsibilities for the same would be. This left an environment where there was not only no identification with the audit procedure but crucially no ownership of the post-audit implementation phase.
• Good practice in the field of organisational auditing requires that resources and personnel required for the audit are specified before. No evidence was seen to prove that had been the case in Buncefield. It is accordingly most likely that the failure to delineate what resources would be needed and what personnel would be involved in the audit meant that there were gaps in the conduct of the audit function was proven to be the case by the failure of management to implement recommendations of external auditors.

Safety Management

• In line with requirements mandated by the health and safety law for the Control of Major Accident Hazards (COMAH) designated sites, there was evidence of embedded risk management systems and a framework that specified initiatives for the management of the major hazards attached to the operations of the site. However evidence reviewed showed that management was at best doing the bare minimum that was required of it to meet regulatory compliance.
• Indeed evidence of the same is provided by the fact that there was a significant disconnect between what was specified in compliance documentation/risk management systems and what was happening at the site. Several inadequacies including the absence of a procedure for management of change of critical parts, ill-prepared and ill-considered critical parts list and general failings in the safety management system such as the failure to log incidents, poor safety culture and poor attitude by top management as well as employees.
• The extent of management failings at the site was further reflected by the failure of the established risk management framework to identify the possibility of several tanks catching fire, failures in ensuring good practice was followed in the design, build and commissioning of physical barriers such as bunds and a less than adequate inspection and maintenance regime. Moreover, the lack of an appropriate inspection and maintenance regime was indicative of the lack of consideration of the health and safety implications in the running of the business with managers tending to focus on the financial aspects instead. 

Human Precursors

 Personal experience, staff knowledge, attentiveness, motivation and personal attitude

Several incidents before the accident, as well as during and after the explosion bring to the fore deficiencies regarding employees’ experience, both in the operational running of the site as well as the management of emergencies.

Whilst the lack of fatalities at the site could be viewed as representative of employee effectiveness in handling emergency situations, there is insufficient evidence to support that position. Rather the absence of loss of human life was remarkable not least because staff had not been trained in appropriate evacuation operations. Indeed because no simulations, drills or emergency exercises had been conducted staff lacked experience insofar as the conduct of emergency evacuations was concerned.

The fact that the overfilling of tank 912 went on for several hours before being noticed never mind that the automatic gauging system had failed further attests to the lack of situation awareness by the operational stall. Experience staff who have had an idea of roughly how long the filling of a tank should take and that should have triggered their investigation of the tank filling operations once they realised it had gone on for a long time. The reliance on technology and alarm systems that failed is also strong evidence pointing out the inadequacies in staff knowledge of operational systems as well as their attentiveness to conditions in their work environment. Lack of attentiveness to the contextual environment was also reflected in the failure to notice the overflow of the tank and the subsequent formation of a vapour cloud, especially as members of the public in the surrounding community had observed an abnormality and had wrong advice about the same.

Motivation of staff was also observed to be lacking, partly due to the increased stress of work but also because of changes in shift patterns and scheduling of work. Indeed the increase in throughput would have been deciphered as the lack of management interest in their employees who would in turn respond by not being attentive and driven to ensure safety procedures and culture were adhered to.

Employee attitude to health and safety was also remarkably poor and in some cases, the behaviour exhibited by staff increased and amplified risk and hazards rather than reduced them. Staff errors and well as failure to log incidents, disregard of rules and established procedures of performing specified operations as well as distractions were indicative of a very poor attitude to health and safety in general and accident prevention at the site. The failure to log previous incidents as near-misses in a site replete with major hazards as Buncefield was is also indicative of not only individual employee disregard of safety but more importantly showed the failures in human resource management at the site.

Physical/technical Precursors

 Workplace layout

The three different operational sites at Buncefield all complied with requirements to be rated as so-called ‘top tier’ COMAH sites. There was a clear separation of storage tanks based on the kinds of fuel that were held in them, with different storage areas bundled and zoned.

The site was as such generally well laid out with clearly demarcated areas for different operations including designated zones for moving equipment and machinery among other things. Adjacent to the storage tanks were several drains and soakways. These however were not known to the employees at the site, a situation that is indicative of the lack of detailed site plans at the depot.

The layout of the site about other settlements and installations was however problematic. There was a big industrial estate adjacent to the tank farm, and residential settlements were a couple of 100 feet away from the site. Further, the site was adjacent to a rather busy motorway (m1).

The development of an industrial site next to the site as well as a residential dwelling near a site of such high risk is indicative of general failings in spatial planning and societal risk management on the part of regulatory authorities and public governance institutions, but it is also symptomatic of the lack of engagement of the top management at Buncefield with the development review process. There is no evidence to show they objected to the location of major facilities next to a site of such high risk.

• Design of Equipment

The design and nature of equipment at Buncefield were in keeping with leading practices in installations in oil storage depots and oil facilities in general. Indeed the observed failures in control and forewarning equipment such as the independent high-level switch and the tank gauging system had nothing to do with the design, but rather the failures in maintenance, inspection and repair as well as the commission of storage and protective installations.

Moreover, the overwhelming failures of the tanks once they had caught fire also had nothing to do with flaws or inadequacies with the design of the tanks rather the intensity of the resultant blaze was such that even the superior design and make-up of the storage tanks could not withstand the ferocity of the fire.

Physical Environment

Aside from a few number of trees around the periphery of the depot, there weren’t any physical environmental features or landmarks that could be construed as having played a part in causing or exacerbating the accident. The general layout of the surrounding area is flat and undulating with sparse vegetation. Moreover, the physical environmental aspects that played a central role in engendering the incident (ice and cold) were not unique to the site. There was as such not much that the organisation’s management could have done except identification of the likelihood as well as the potential impact of the physical environment on the causation of the appearance of a vapour cloud in the event of a leakage.

Safety Management

In line with requirements mandated by the health and safety law for the Control of Major Accident Hazards (COMAH) designated sites, there was evidence of embedded risk management systems and a framework that specified initiatives for the management of the major hazards attached to the operations of the site. However evidence reviewed showed that management was at best doing the bare minimum that was required of it to meet regulatory compliance.

Indeed evidence of the same is provided by the fact that there was a significant disconnect between what was specified in compliance documentation/risk management systems and what was happening at the site. Several inadequacies including the absence of a procedure for management of change of critical parts, ill-prepared and ill-considered critical parts list and general failings in the safety management system such as the failure to log incidents, poor safety culture and poor attitude by top management as well as employees.

The extent of management failings at the site was further reflected by the failure of the established risk management framework to identify the possibility of several tanks catching fire, failures in ensuring good practice was followed in the design, build and commissioning of physical barriers such as bunds and a less than adequate inspection and maintenance regime. Moreover, the lack of an appropriate inspection and maintenance regime was indicative of the lack of consideration of the health and safety implications in the running of the business with managers tending to focus on the financial aspects instead.

External Precursors

Attributing the influence of major political events and factors to the 2005 Buncefield disaster is by no means an easy task.

• Political Influence

Not least because suggesting a causal link between external political events and operational issues and factors that led to the occurrence of the accident is by no means a straightforward task, precisely because of the fuzziness in the dynamic between politics/political events and organisational performance.

The following three political events could have played a part in causing the accident, both directly and indirectly. In the case of the former through their influence on the price of oil that rose sharply in the year 2005 and in the case of the latter through their influence on management indifference to safety concerns as has anecdotally been shown to happen during election years as well as years major environmental disaster as did happen in 2005 happen.

Table 7: Major political events that could have played a part in causing and engendering the Buncefield incident

• Regulatory Influence

There is evidence to show that the Buncefield accident was both a result of systemic failures in the oil industry in general not least because of the poor handling of health and safety by corporate entities but also as a single event disaster of the low probability-high impact kind.

Several missed opportunities as well as failure to conduct certain oversight functions including the monitoring of risk the risk management framework as well as the auditing of processes and general lack of compliance monitoring regarding such things as contingency plans show that there were failures in the design and implementation of the risk management framework as well as major problems in the operational oversight function of the regulatory regime put in place ensure companies are run in a manner that ensures their potential to damage the environment, property and human beings are minimised. Moreover, the context of the dismantling of the tough corporate regulatory environment that had commenced under the government at the time of the disaster may have led to the laxity on the part of the Health and Safety Executive, the Environment Agency and other corporate governance regulatory bodies to conduct their duties. The weakening of the regulatory environment as a result of governmental policy could conversely be argued to mark the accident as a so-called policy disaster not least because of the unintended consequence of the government's poor intentional decision-making in relaxing the regulatory environment to cut red-tape turned out to be a bad decision as it created an environment where corporate entities could get away with not putting in place effective controls and systems that may have prevented the accident from occurring.

The table below reflects some of the regulatory failures and inadequacies that played a part in causing the explosion at Buncefield oil depot.

Table 8: Regulatory influence

• Societal Influence

Social factors that may have influenced the explosion at Buncefield are a little bit difficult to delineate not least because unlike other factors that form part of the key drivers of safety culture and conduct in an organisation such as regulations and policies, audits, safety training and initiatives that are aimed at making employees develop and operate safety norms and behaviour.

Management culpability in the area insofar as allowing societal factors to influence the accident at the depot related to their failure to ensure networking relationships and social trust between their organisation and external stakeholders that included governmental agencies but also their suppliers. The failures and inadequacies in external communication, trust, and openness led to a situation where the social safety climate was eroded and ultimately led to the erosion of the safety climate within the organisation. This among others was evidenced by the fact that the installers of some of the safety equipment at the site failed to inform the company of the need for a component that needed removing so the gauging system would be activated and work properly. But that was by no means the only evidence of the erosion of social trust between the organisation and its stakeholders.

Effectiveness of MORT and Barrier Analysis as Accident Investigation Tools

The ability to learn from accident events is often lauded as one of the most critical principles in effective safety management hence the presence of several post-accident investigation techniques including those that are founded on a collection of statistical information and those are viewed as in-depth analytical methods that reveal not only patterns but also accident precursors and conditions that when managed well can prevent further events (Lundberg et al., 2010), albeit the notion of prevention of accidents is a hotly contested one.

Whilst the utility of systematic accident investigation insofar as accident prevention is well espoused, there is a wealth of evidence that suggests the presence of inherent biases in specific accident investigation techniques as well as widely spread sources of error in the field of accident investigation in general, all of which can impact investigation of an accident but more importantly, the extent to which individuals and organisations can learn from accidents (Johnson, 2003; Lundberg et al., 2010). Indeed the effectiveness of an accident investigation technique is dependent on not only its fit with the context it is employed in but effectiveness has also been shown to be influenced by several individual-specific as well as the background from which an investigation is conducted, for instance Svenson et al., (1999) posit that the professional background as well as the psychology of an investigator impact the analysis of accidents never mind the choice of investigation tool or technique.

The situation is not helped by the absence of a holistic and comprehensive accident investigation technique that is applicable for the analysis of all accidents irrespective of the contextual factors and sectors or areas in which they occur. This section evaluates the effectiveness of two of the most commonly used systematic accident investigation techniques, MORT and Barrier Analysis.

Effectiveness of MORT

The MORT methodology for accident investigation is part of a group of models that are conceptualised as holistic partly because it highlights an accident’s causal factors but also because it delineates what the events leading up to the incident were (Attwood, 2006). By its incorporation and inclusion of extra safety measures elements in its analytical scope, MORT is largely a more comprehensive approach to the investigation of an accident. It is further strengthened by its investigation of the causal relationship between so-called trigger factors and enabling events as well as the failure of preventive action including those that are centred in the areas of equipment protection, operator protection, operational staff recovery and mitigation measures.

Whilst its inclusion of a breadth of events, trigger factors and causal factors as well as safety barriers ensures as wide a scope as possible is cast over the accident context, there is a danger its extensive scope may lead to a superficial investigation of links and relationships between the said factors not least due to the tendency for analytical work to be time-barred. That said, MORT is a proficient methodology for instances where there is an urgent need for valid information that then feeds into the design of immediate action plans as it enables immediate from an accident event. The MORT technique through its enabling of the recording of the so-called non-contributory events is particularly useful as it enables implications regarding the causation of similar events that occur in different contexts to be drawn. So whilst the recording of non-contributory events and factors can be of no immediate use, the design of the MORT framework is such that that information becomes useful to other incidents. In so doing it advances individual as well as organisational learning from disasters.

The MORT model is however decidedly qualitative. Granted there are a lot of positives to qualitative analysis of accidents including simplicity of application, enabling of a detailed examination of an event and it’s enabling of a foundation for subsequent analytical work to be undertaken. But there are inherent weaknesses in qualitative linked analytical models not least because they are impacted by subjective opinions, experiences and expertise of investigators but also because they do not permit the modelling of events and factors dynamics. For instance, whereas the use of MORT enabled the identification of the vapour cloud as one of the key factors at play during the incident at Buncefield, except for that identification enabling subsequent quantitative modelling of the dynamics of the vapour cloud in the context of the prevailing conditions at the time of the accident it was not possible to decipher how big the vapour cloud was and how fast it was moving once it had been formed.

Another deficiency of the MORT model is inherent in its identification of factors that are at times best characterised as proximate causal factors as so-called root cause factors. In so doing there is the potential of symptoms of an incident or accident being managed in a way that does not do much to reduce future accidents (Leveson, 2004). It is the reason why Hoveden et al (2008) argue that MORT often does need supplementing with models that not only represent are more suited to engendering alternative thinking and consideration of accident dynamics and also support imaginative thinking and creativity insofar as accident prevention is concerned as well as frameworks that incorporate system dynamics modelling including techniques that enable data mining and the study of work processes.

Effectiveness of Barrier Analysis

The Barrier Analysis accident investigation technique is founded on Gibson's (1961) energy-barrier principle that posited accidents occur due to the loss of control of dangerous energy, hence the suggestions for the separation of energy from vulnerable targets. However as argued by Reason (1997) in the so-called Swiss-Cheese model, every barrier has deficiencies (holes) that have the potential to line up and in so doing allow a hazard to penetrate a system. The Swiss-Cheese model in effect questions the effectiveness of Barrier Analysis insofar as accident investigation is concerned because even though robust steps are taken to manage barriers in such a way that the inherent barriers in a system are maintained and improved through the lifespan of a system, considerable challenges exist albeit there are conversely several benefits to be derived in the use of BA in accident investigation (Johansen and Rausand, 2015).

According to Hollnagel (2004) and Sklet (2005) one of the key benefits of using BA as an accident investigation technique is its permitting the classification of barriers in several approaches including; classification based on the role and function of the barrier in the accident sequence (preventive, mitigation or controlling barriers) and categorisation based on the nature of the barrier hence the notion of technical, organisational, operational as well as distinction as physical, symbolic, functional and incorporeal. In the case of Buncefield, the use of BA enabled the researcher to clearly distinguish barriers not only based on functionality but also based on the nature of the barrier itself.

Whilst the categorisation of barriers enables an accident investigator to drill down and look at functional as well as physical nature-specific factors of an accident, the overall effectiveness of the technique is limited byseveralf deficiencies not onlyregardingo philosophical foundations but also regarding the framework's lack of clarity regarding what is and what is not a barrier in an accident environment. Because of the absence of barrier-linked performance requirements for the various functions, systems and elements of the Buncefield accident site, it was difficult to judge the difference in positions between the regulatory authority positions and those of the operators of the site. Further, it was not easy to distinguish between operational and organisational elements of the accident as the Barrier Analysis framework is ambiguous about the distinction between those two groups of elements, a situation not helped by the existence of published opinion that considers the two to be the same.

The Barrier Analysis framework also does require an investigator to know the performance of a barrier beforehand so that they can then make a judgement regarding whether the specific barrier was functioning well or impaired, it is accordingly not suitable for investigators that lacks prior knowledge of the system that they are investigating as well as those who are inexperienced in system audits and the requirements of a fully operational installation.