This post summarises research published by Human Reliability Associates at the 29th European Safety and Reliability Conference in 2019.
Road tanker offloading might not sound like the most dramatic activity in the chemical processing world, but when things went wrong, the consequences could be severe. In 2019, we published research exploring what happened when we looked at this task not just at a single site, but across multiple organisations, and what that wider perspective revealed about risk, variability, and the very human challenges of keeping people and communities safe.
A Common Task with Uncommon Consequences
Road tanker offloading of industrial chemicals is carried out daily across the UK and internationally. It involves a high level of operator involvement, happens frequently, and is a routine operation. However, that familiarity could breed complacency. In October 2016, at a facility in Atchison, Kansas, sulphuric acid was accidentally delivered into a tank of sodium hypochlorite. The resulting chemical release resulted in 11,000 local residents being ordered to shelter in place and 140 people seeking medical attention. Behind that incident lay a catalogue of human factors failures: similar connections placed too close together, poor labelling, a mismatch between written procedures and actual practice, and no remote shutdown capability.
This was precisely the kind of event that Human Factors Critical Task Reviews (HFCTRs), now commonly referred to as Safety Critical Task Analyses (SCTAs), were designed to prevent. By systematically analysing a task before anything went wrong, we could identify where human error was most likely and put controls in place. In the UK, the Health and Safety Executive (HSE) required this type of analysis as part of demonstrating compliance with COMAH (Control of Major Accident Hazards) regulations.
What We Did and What We Found
Our research drew on HFCTR reports produced by HRA across a range of organisations, supplemented by the direct experience of our consultants. We looked for common themes and meaningful differences in how sites approached the same fundamental task.
At a high level, the task steps were remarkably consistent across sites: receive the tanker, conduct safety checks, secure the vehicle, make the hose connection, carry out the offload, disconnect, and complete administrative tasks. The major hazards were similarly shared: overfilling a storage tank, loss of containment at hose connections, inadvertent mixing of incompatible materials (depending what materials were on site) and the risk of a driver moving the vehicle while still connected.
But when we dug into the detail, the variation between sites was notable. We identified ten recurring Human Factors issues across the reports. Here, we focus on three key issues below (all 10 can be found in the published paper).
Drive-away: A Well-Known Risk, Inconsistently Managed
The risk of a tanker driver inadvertently moving the vehicle while the hose was still connected was well understood across the industry. But how sites managed this varied enormously. We found that drive-away was more likely when drivers played a passive role in the offloading process. With little active involvement in the task, drivers could lose track of where they were in the task and move off at the wrong moment.
The most effective control we encountered was an interlocking key system, such as the Susie Salvo system, which physically immobilised the tanker and required the driver to hand over their keys before the offload could begin. A key released at the coupling point was then needed to complete the task, making premature departure mechanically impossible. Some sites relied solely on collecting the drivers keys, which might not always work if they handed in the spare set or simply administrative controls and wheel chocks, which offered a degree of protection against the vehicle rolling but depended on them being consistently applied. The gap between these approaches represented a meaningful difference in risk.
Allocation of Responsibilities: When Everyone Is Responsible, No-One Is
A recurring theme across our reviews was a lack of clarity about who was responsible for what during the offload. The boundary between the tanker driver’s duties and those of the site operator was frequently blurred, particularly for activities such as checking offload details, making the hose connection, and monitoring the transfer as it took place. Where responsibilities overlapped or were undefined, critical steps risked falling through the gap, with each party assuming the other had taken care of it.
This problem extended beyond the driver-operator relationship. Site security sometimes had a role in receiving the tanker, but this was not always formally defined. Again, operators assumed site security were doing checks that they weren’t. At one site, we were told that daily safety checks were carried out by everyone on the team. This was a well-intentioned arrangement, but, in practice, meant there was no single accountable person and checks could go undone.
Safety Culture: The Issue That Resists Simple Fixes
Safety culture was the human factors issue that proved hardest to address through conventional interventions. We found that the safety culture varied across sites. Some sites had operators treated procedures seriously and wore PPE without question, while other sites had drivers sat in their cabs in casual clothing during offloads and taking on a passive role during the task.
What made this particularly challenging was that the visible behaviours were often symptoms of deeper organisational conditions: how alarms were handled, whether maintenance was kept up to date, how much time operators were given to focus on safety-critical tasks without competing pressures. The context shapes the behaviour. And when the context makes shortcuts feel normal or even necessary, reprimands and revised checklists, applied in isolation, were unlikely to shift a culture that had quietly accommodated risk over a long period.
Simple, Complicated, and Complex Problems
Not all of the issues we identified lent themselves to the same type of solution, and we found it useful to think about them in three categories: simple, complicated, and complex.
Some problems had clear, transferable best-practice solutions that could be applied consistently across different sites. Drive-away was a good example. We could make specific recommendations, such as the use of wheel chocks or a Susie Salvo interlocking key system, that were straightforward to implement regardless of context. These were the easiest cases to work with.
Complicated problems still had good-practice solutions, but the right answer depended on the specifics of the site. Allocation of responsibilities was a good example. Clarifying who was accountable for each step could involve redesigning procedures, workload and staffing issues, formalising the driver-operator handover, or defining site security’s role more explicitly. The optimal approach would depend on the site’s configuration, the chemicals involved, and how deliveries were typically managed. We could offer guidance, but each site had to determine what best suited its circumstances.
Complex problems were those where simple and complicated interventions were unlikely to be effective on their own. Safety culture fell into this category. Where deviations from procedure had become embedded over time, a new checklist or a reprimand was not going to shift behaviour. We found that these deeper issues were rarely resolved following a single review. They required evidence to accumulate across multiple assessments and from different sources before organisations were ready and able to act.
Each site we worked with had its own mixture of simple, complicated, and complex issues, and part of the value of the HFCTR process was helping organisations understand which category they were dealing with and therefore what kind of response was actually likely to make a difference.
Why Cross-Industry Learning Matters
One of the central motivations for this research was that HFCTRs were almost always conducted in isolation, site by site. The insights they generated rarely travelled. We believed that was a missed opportunity.
When we looked across multiple organisations, we could begin to see not just what the common problems were, but the range of ways in which they were being handled and which approaches worked best in which contexts. Cross-industry comparison also helped to clarify what As Low As Reasonably Practicable (ALARP) looked like in practice. If most similar facilities had already implemented a particular control, it became harder to justify its absence elsewhere.
What struck us most across this body of work was not the technical complexity of road tanker offloading, but the very ordinary human conditions that shaped how safely it was done: competing priorities, unclear responsibilities, habits that had gone unchallenged for years. The HFCTR process gave organisations a structured way to surface those conditions before they became incidents. But the learning it generated was most valuable when it travelled beyond the individual site. The human factors issues we encountered were not unique to road tanker offloading. Allocation of responsibility, vigilance, and safety culture were challenges shared across healthcare, aviation, and beyond. Recognising that commonality can be the first step towards raising standards across the industry as a whole.
Read the full paper
This post focused on three of the ten Human Factors issues identified in our research. The full paper covers all ten key issues, and explores in more depth how simple, complicated, and complex problems require different approaches.
The incident in Atchinson that opened this post is also the subject of a safety video by the US’s Chemical Safety Board (CSB). Watch it here: Mixed Connection, Toxic Result
Want to learn more about SCTAs?
Safety Critical Task Analyses are one of the most effective tools available for identifying and managing human factors risks before an incident occurs. If you would like to develop your skills in this area, we run a dedicated SCTA training course. Find out more here
