Fatigue can have far-reaching implications in the workplace. John Wilkinson, who was involved in the investigation that took place following the 2005 Buncefield incident, explains how fatigue – combined with shift working – played a crucial role.
The 2005 Buncefield explosion and fires incident, which took place at a fuel storage facility, can be used to highlight some of the key practical factors that health and safety professionals should look for in managing shift work and fatigue. This article focuses on the major-hazard industry, but many of the lessons are relevant to other sectors, including healthcare.
Although healthcare is often said to be a more complex sector than those in heavy industry (Carroll and Edmondson, 2012) employees are affected in the same way by fatigue, whether from poorly designed or poorly controlled shift patterns, or from excessive working hours and workload. The NHS probably represents one of the world’s largest potential sleep laboratories, as it is the EU’s largest employer operating a varied number of shifts (Health and Safety Executive (HSE), 1999).
The central principle when managing risk with shift workers is to “keep it simple”. Shift patterns should be designed and managed to both minimise fatigue and its effects, and to optimise manageability – the ease with which any shift system can be run and worked, and its chosen shift pattern(s) populated and managed in practice.
A smooth-running shift system is good evidence that the shift pattern is reasonable. While shift pattern and shift schedule are interchangeable terms, the term “pattern” is used here throughout.
A shift pattern is part of a wider shift system – in other words, it is part of the relevant safety management system. More recently, this has been developed as a fatigue risk management system (FRMS), although it is essentially the same thing.
The Buncefield incident
The Buncefield explosion was Britain’s largest peacetime explosion (HSE, 2011). Although no one was killed, there were substantial economic and community impacts, especially as the two major fuel pipelines to Heathrow and Gatwick airports were controlled from an adjoining site.
At around 5:40am on Saturday, 11 December 2005, one very large petrol storage tank at the Buncefield oil storage depot in Hemel Hempstead overfilled. The leak was not noticed in the control room or detected outside before a large petrol vapour cloud had formed. This ignited and exploded just after 6am, probably because the site firewater pump started up as staff finally reacted to the overfill and pressed the fire alarm.
All of the safety barriers in place to prevent overfill and to detect and recover from any overspill failed on the night, including the tank level gauge – which became stuck and was the reason no high-level alarm was sounded in the control room on the tank gauging system – and the final, independent, high-level switch (IHLS) on the tank.
A summary of the incident and the events on the night is available as a free PDF download from the HSE.
The depot operation was essentially simple. Three large pipelines delivered a range of fuels to the site. The smaller one was dedicated to the site, and mainly site controlled and operated. The other two were larger and faster, and mainly controlled from elsewhere. These also delivered fuels to other sites, and so could be “on or off” with respect to Buncefield.
The job of the control room supervisors was to receive the fuels and store them in the dedicated tanks on site – for example, for petrol or diesel. Much of the fuel was taken away from the site in road tankers, also controlled by the supervisors. In essence it was a very large garage, but one supplied by pipeline and supplying tankers rather than cars.
The investigation
The investigation was complex, lengthy and demanding, involving a multidisciplinary team of more than 100 inspectors and specialists from the Control of Major Accident Hazards (COMAH) Competent Authority, the HSE and the Environment Agency.
Initially, the destruction of much of the site made this a largely forensic task as evidence was painstakingly recovered and recorded. This task included identifying and assessing the background documentation from the damaged control room and adjoining offices. The main reconstruction of what happened was achieved through interviews with the site staff, after careful preparation based on recovered plant and equipment evidence and documentation.
Because of the foresight of the investigating inspectors, human factors and other specialists were involved from the beginning to help assess documents and other evidence, and to prepare the questions for interviews. This meant that human-factor topics were identified early on in the process and appropriate evidence was captured and professionally assessed.
For fatigue and shift work, my involvement included recovery of the shift pattern, hours worked and related safety management system documents. The HSE’s Health and Safety Laboratories (HSL) provided deep-topic specialist support to help analyse the base shift pattern, and the actual shifts and hours that had been worked, against current standards.
Looking for potential fatigue and shift work issues in incidents is not simple, and something that is often neglected. To find something, you first have to be looking for it.
This incident happened at night and towards the end of a 12-hour shift, the classic “small hours” period. Up to one traffic accident in five on major UK roads has been attributed to fatigue, with a significant number occurring in the early morning period (HSE, 2006). The base shift pattern and the actual shifts worked were found pinned to the wall of the control room and suggested that fatigue could be a factor in the accident.
Analysis of shift patterns
Interviews with Buncefield staff confirmed that the then current eight-week shift pattern was designed for 10 supervisors, but was only being worked by eight because of ongoing recruitment and retention difficulties. This resulted in supervisors working seven 12-hour shifts continuously in weeks four and five, five 12-hour night shifts and increased overtime. They were left to arrange their own holiday and other relief cover. Overtime was also required over a sustained period for ongoing projects and, ironically, for safety improvement work. While individual levels of overtime varied, table 1 shows the scale.
There was also no structured arrangement for within-shift rest and meal breaks, so in practice supervisors would usually eat or take time out at their desk in the control room. Clearly, these were not adequate breaks away from their work.
HSL also carried out an assessment of the shift pattern against the HSE shift work guidance (HSE, 2006). The guidance identifies five main shift factors: start and finish times; shift duration; consecutive shifts; rest periods; and breaks. The analysis also considered cumulative fatigue, the workload and the type of work and overtime.
The HSL report concluded that the continuous periods of night shifts and 12-hour shifts were cause for concern: accumulated fatigue was likely; there were inadequate rest days; rest/meal breaks were irregular; and the overtime levels increased the likelihood of fatigue.
The fact that the Buncefield supervisor was monitoring tasks over long periods, and with workload peaks and troughs, is also known to increase the likelihood of error (HSL, 2007; HSE, 2006). Another significant factor was the absence of a formal policy or procedure for managing fatigue and shift work. If there is no focus on the safety management system, effective arrangements are unlikely.
The fatigue and shift work aspects were important at Buncefield, but were not, of course, the only factors – it is never that simple. But they did colour staff judgments, decision making, behaviour, effectiveness, vigilance and much more over a sustained period.
Fatigue and shift work could be considered as more of an insidious, low-level gas attack than a smoking gun, making it harder to assign direct consequences. Other human factors contributed to the disaster, including shift handover, competency and training, procedures, the control room layout and the human-computer interface.
So what went wrong at Buncefield? Among the many other contributory human factors, there was one key issue: the supervisors’ “situational awareness” – or their grasp of the bigger picture – was faulty, as evidenced by their shared confusion about the pipeline-tank alignments immediately after the incident. This meant that what they said in their initial police statements later changed, although they still expressed surprise and disbelief at the outcome. Where error is involved, those concerned can usually describe what they have done and seen but cannot explain or link it to the result (HSE, 1999).
Due to the poor shift handover arrangements in place at the site, and a series of bad handovers leading up to the incident, supervisors had confused which pipeline was filling which tank. Indeed, in the configuration they believed was in effect, neither tank would have filled that night. Why did this basic human error persist? Put simply, it was because the supervisors were not expecting to fill a petrol tank on that night shift and therefore need to switch tanks, and so the absence of an alarm was no cause for concern. With the serial failure of all the other barriers, the final human one also failed.
Table 1: Average overtime worked by the Buncefield supervisors in the five months before the incident |
|||
| Time period (2005) | Minimum | Maximum | Average per person |
| 14 Nov – 13 Dec | 0 | 114 | 34.86 |
| 14 Oct – 13 Nov | 0 | 127 | 60.35 |
| 14 Sept – 13 Oct | 0 | 87 | 34.18 |
| 14 Aug – 13 Sept | 10 | 92 | 53.36 |
| 14 Jul – 13 Aug | 6 | 121 | 57.4 |
| Source: Health and Safety Laboratories | |||
What can we do to get shift work right?
A good start is to take a risk assessment approach to managing fatigue and shift work, and the HSE guidance on this approach is simple and accessible (HSE, 2006): avoid over-complicating things.
I must declare a bias here, in that I consider the current enthusiasm for FRMS among safety practitioners often seems overly complex. FRMS can delay effective action and result in risk management becoming an end in itself.
On the other hand, simply gathering feedback from operating experience through auditing and monitoring, and from those involved in managing, supervising and working the shift system, is immediately useful alongside the actual individual hours and shifts worked. Both a policy and a procedure are essential, but these should be kept short and flexible enough to develop as you engage with the issue and gain experience.
Equally, a shift system needs managing. It is no good leaving those working the pattern – or an overloaded supervisor – to deal with planned and unplanned absences on an ad-hoc basis. While inevitably there will be exceptions, it is how these periods of leave are managed that really matters so that tired people are not then returned to work without at least some effective mitigation.
There is also no point in tinkering with an existing shift pattern if it is not being worked as planned. The underlying organisational factors are usually simple – for example, there are not enough staff to work the rota or not enough in certain roles, or insufficient flexibility in the pattern to cope with real work demands.
Workloads and work planning may also need fixing. These factors need to be addressed first, and then you can consider the pattern and review it after you have experience of it working as planned. For those who work, supervise and manage the shifts, it is necessary to find a reasonable and workable shift pattern. However, there is no perfect shift system. All patterns are compromises because human beings are diurnal, and shift working, especially at night, is not natural to us.
This leads to another point: the range of shift pattern choices is, in practice, small because of simple arithmetical facts about dividing the available time and days into workable patterns over a calendar year (Miller, 2006).
Training and awareness play a part, particularly in focusing manager and supervisor attention on what matters in operating the shift system. Shift workers and their families should be advised of the likely impacts on health, safety and their social and domestic lives, and how best to mitigate this.
Finally, considering the social and domestic side of working shifts is a vital part of getting things right (HSE 2006; Miller 2006), and a predictable shift pattern at least allows those working it – along with their families – to make plans to mitigate the loss of normal social and domestic contact caused by working shifts. Patterns that result in ad hoc working to fill gaps, cover overtime and so on are inherently unpredictable.
A good shift system and shift pattern will be one that has less “noise”, in the sense that it will work quietly and not create undue management, supervisory or user difficulties. But nothing remains constant, so any pattern will need effective monitoring and auditing, as well as regular review against operating experience, which will help with improving standards and knowledge.
References
Carroll JS, Edmondson AC (2012). “Organisational matters: Leading organisational learning in healthcare”. Quality & Safety in Health Care; vol.11, pp.51-56.
Health and Safety Executive (1999). “Reducing error and influencing behaviour” (HSG48).
Health and Safety Executive (2006). Managing shift work(HSG256).
Health and Safety Executive (2011). Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005. HSE (on behalf of the Competent Authority for the Control of Major Accident Hazards).
Health and Safety Laboratories (2007). “Report on the Buncefield shift pattern”.
Miller, J (2006). “Fundamentals of shiftwork scheduling”. Air Force Research.
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
Laboratory & Human Effectiveness Directorate, AFRL-HE-BR-TR-2006-0011. National Technical Information Service, Springfield VA.
The Energy Institute (2006). “Viability of using sleep contracts as a control measure in fatigue management”. Energy Institute, London.
