During the evening shift of 29 Oct 2009, the Terminal was preparing to carry out a routine transfer of Motor Spirit (MS) to the neighbouring Terminal operated by Bharat Petroleum Corporation Limited (BPCL). Four employees were supposed to be on the shift and the operating crew started to prepare the MS tank (tank 401-A) for pumping to BPCL terminal.

At about 6.10 pm, while preparing the MS tank for the transfer, a huge leak occurred from a ‘Hammer Blind Valve’ at the bottom of the tank. The leak resulted in a jet of MS directed upwards from the valve under the hydrostatic pressure head of MS in the tank. The liquid MS rapidly generated vapours which made the operator lose consciousness. The fact that this critical activity was initiated after normal working hours led to delay in responding to the situation. The shift officer tried to help the operator but was also affected by the vapours and barely managed to evacuate the area. The 2nd operator, who was in the canteen and was contacted by the shift officer, rushed to the tank but also lost consciousness. The 3rd operator on the shift had earlier left for home and was not available for initiate any rescue or mitigating steps. With no other operating crew available to initiate control actions, the leak remained uncontrolled for 75 minutes. After 75 minutes, the vapour cloud ignited causing a huge explosion followed by a fireball covering the entire installation.

It is notable that in the case of the Jaipur incident, the vapour cloud was not visible. Personnel on site were aware of the presence of the vapour by its odour. Some personnel were able to make their escape from the site, whilst others were either incapacitated by the MS vapours or were caught within the vapour cloud when it ignited.

The fire which followed the explosion spread to all other tanks and burnt for 11 days. All the petroleum products stored in the Terminal at the time of the accident (approx. 60 million litres) were consumed in the fire and the installation was totally destroyed. Buildings in the immediate neighbourhood were heavily damaged. Minor damage and window panes breakages occurred within a radius 2 km from the site.

Eleven people lost their lives in the accident - six from IOC and five outsiders, and several others were injured. There were factories and industrial complexes in close proximity to the site.

WHY IT HAPPENED

The immediate causes of the accident were the non-observance of normal safe procedure which involves a sequence of valve operations during line up activity and an engineering design which permitted use of a ‘Hammer Blind Valve’. A large area at the top of these valves can remain completely open every time the valve position has to be changed. It was through this open area that the liquid MS leaked when the tank was prepared for pumping to BPCL) because another valve connecting to the tank was also open when the Hammer Blind was in the changeover position.

The root causes were the absence of site specific written operating procedures, absence of remotely operated shutdown valves and lack of understanding of hazards, risks and consequences.

Formation of a large vapour cloud

At the time the leak and subsequent explosion occurred, calm, low wind speed, conditions prevailed. This, coupled with the nature of the release (an upwards jet of MS), is likely to have assisted in the production of vapour. Post incident analysis indicates that a flammable vapour cloud covered much of the IOC site, bound by a perimeter wall which would have contained most of the cloud. The cloud diameter was approximately 1000 m, almost four times that which developed in the Buncefield accident (12/2005).

Explosion severity

The explosion resulted in widespread severe pressure damage over almost the entire site. The evidence indicates that the vapour cloud explosion generated over pressures that were in excess of 200kPa over most of the IOC site. The nature of damage was similar to that observed at Buncefield (12/2005) with crushing of oil drums above liquid level, severe damage to buildings and severe damage to vehicles. Areas exhibiting high over pressures included many open regions, without trees, bushes or pipework. In these areas, a deflagration would not be sustained and over pressures would have decayed. The overpressure damage evidence is therefore not consistent with the vapour cloud explosion involving only deflagration. Directional indicators were also inconsistent with the explosion resulting from a deflagration only.

The directional indicators point to the source of the detonation being in the Pipeline Division area in the north east corner of the site. Unlike Buncefield, the possibility of the detonation occurring as a result of flame acceleration in trees does not appear consistent with the evidence. The most likely cause of the detonation is flame entering either the Pipeline Area control room or the pipeline pump house, causing a confined or partially confined explosion that then initiated a detonation as it vented from the building. In drawing this conclusion it would seem necessary for some of the directional evidence to be affected by lack of symmetry in the vapour cloud.

The exact source of the transition to detonation cannot be determined due to the limited evidence from the Pipeline Division area.

IMPLICATIONS

Immediate measures
  • Introduction of measures to make emergency action possible from remote locations;
  • Introduction and enforcement of site operating procedures to reduce human error, improve operating discipline, improve site communications and ensure availability and competency in the use of personal protective equipment;
  • Introduction of dual level gauges and alarms, detectors and CCTV systems;
  • Introduce a requirement for QRA to be undertaken on larger sites.
Long-term measures
  • Design and layout improvements to prevent loss of hydrocarbon containment;
  • Improvement to firefighting capabilities;
  • Better training, performance evaluation criteria and safety oriented corporate policies;
  • Making the safety function independent and autonomous, reporting directly to the company CEO;
  • Strengthening the internal safety auditing functions and providing professional safety auditing training;
  • Siting criteria should be informed by QRA;
  • Review of land use legislation in the vicinity of major hazard facilities and the role of local and state governments in such matters;
  • Country-wide review of major hazard facilities from a security view-point.

LESSONS LEARNT

  • Facilities and installations with inherently high hazards should incorporate redundancy in safety systems and ensure their upkeep at all times;
  • Management should ensure that reliable systems are in place to give timely feedback on the current practices and state of readiness in different facilities;
  • Management must ensure that identified actions are being carried out;
  • A high priority on safety from the senior and top management groups will send the right signals down the line to ensure safety and production;
  • High degree of operational competence should be maintained at all times by building on the combined knowledge and experience of all the professional groups. The lessons learnt from all major incidents should be shared and widely disseminated in the entire Industry preferably through an appropriate website.