Port of Beirut — lessons from the ammonium nitrate explosion that devastated the peninsula, Zoha Tariq, LPB284, April 2022

Zoha Tariq discusses the events leading to the 2020 Beirut explosion, its impact and the main issues in avoiding a future recurrence.

View document

A sticky problem – new light shone on Boston’s great molasses spillage, Tony FIshwick, LPB264, December 2018

In the afternoon of 15 January 1919, a massive leak of molten molasses burst out of a storage tank near the city’s docks, causing widespread death and destruction. At the time, no fully plausible cause for why the wave of molasses caused so much death and damage was established. Recently, however, a new study has been carried out and findings have been presented which explain what happened and the logic behind it. This article summarises the incident and these new findings, and makes brief reference to other disasters involving foodstuff or drinks.

View document

Successful management of change involving closure of three chemical plants, Geoff Gill, LPB267, June 2019

This article describes the approach taken to manage and coordinate the safe transition of three plants from operations through to a care and maintenance (C&M) regime, together with a consequential redeployment and retraining exercise. The plants all operated on a site whose principle business was the manufacture of nuclear fuel, but also operated plants to recover uranium from process residues. A number of additional ancillary plants supported site operations. All three plants were involved in the manufacture of uranium hexafluoride (Hex). Hex had been produced on the site for many years, but market conditions brought on an early closure of the plants. This required the Post Operational Clean Out (POCO) of each of the plants. The plan was to leave the plants in a condition which would allow them to be safely brought back into operation if market conditions allowed it.

View document

Bhopal revisited – a story of neglect, Fiona Macleod, LPB294, December 2023

Fiona Macleod reflects on her visit to the Bhopal site this year and calls for the remediation and redevelopment of the old Union Carbide factory site where much of the original equipment from the 1984 tragedy remains.

View document

Post accident remediation and decontamination: a plea for Bhopal, Ken Patterson, LPB294, December 2023

Ken Patterson contrasts the remediation work carried out at sites of large industrial incidents – Flixborough, Seveso and Toulouse – with the continued pollution afflicting the site of the 1984 Bhopal tragedy.

View document

Natech risk management in Japan after Fukushima – What have we learned? Elisabeth Krausmann, European Commission Joint Research Centre & Ana Maria Cruz, Disaster Prevention Research Institute, LPB277, February 2021

The Great East Japan earthquake and tsunami in 2011 triggered multiple releases, fires and explosions at chemical process installations. Based on the analysis of available accident data, this article identifies the main impacts and consequences and highlights gaps in Natech prevention, preparedness and response. It also presents changes in Natech risk management implemented in Japan after the earthquake and tsunami.

View document

Risk and safety management of ammonium nitrate fertilizer

Zsuzsanna Gyenes analyses some of the major disasters in the ammonium nitrate fertilizer industry (including Oppau, 95 years ago, and Toulouse, 15 years ago) to emphasise the importance of remembering and learning from past mistakes. This paper is aimed at keeping the memory of disasters alive, assuming that risk awareness and implementation of safety measures are facilitated by case histories. There have been several accidents and a few disasters in the ammonium nitrate fertilizer industry, and it is worthwhile to review these from time to time, beyond the regulation and practice changes which they triggered.

View document

Lessons learned from major accidents involving fertilizers

This paper presents the results of the analysis of 25 major accidents involving fertilizers in the European Commission’s major accidents reporting system (the so-called eMARS) and other publicly available sources, including also road traffic accidents. Ammonium nitrate (AN) has been involved in numerous accidents causing explosions, fires, and releasing toxic fumes, and it is known that even small scale storage of ammonium nitrate fertilizers (defined as low as 10 tonnes in some legislation) may place the population at high risk if proper safety measures and procedures are not fully in place.

View document

A review on Toulouse accident trials: some lessons to learn despite uncertainty on direct causes

A number of separate inquiries were carried out in the aftermath of the Toulouse disaster to identify the generic lessons to learn. All provided findings, recommendations and lessons in relation to some of the direct and root causes of the disaster. Some of these findings resulted in changes to both the French law on industrial risk prevention and to European legislation, firstly in 2003 with a change of classification criteria for ammonium nitrate fertiliser and off-specification materials, and later to some extent in Seveso III in 2013. During the third trial in 2017 — more than sixteen years after the disaster — to determine criminal responsibility, the direct causes were still being challenged by the Total group lawyers and other experts. These issues became the major debating points during the three trials. As the prosecution’s main scenario remains contested and uncertainty on direct causes remains, this could raise doubts on the relevance of the learning lessons process that led to changes in French and European legislation.

View document

The imperfections of accident analysis, Erik Hollnagel & Fiona Macleod, LPB270, December 2019

Most accident analyses assume that it is possible to reason backwards in time from effect(s) to cause(s) in order to implement specific remedial actions and learn the relevant lessons. The simplicity of this way of thinking has made it attractive, but it leads to a false sense of comfort; the real world of work is too complex for such simple methods to work. This paper presents four concepts that help us understand why simple solutions are insufficient, hence why accidents recur.

View document

Management of Change – what does a ‘good’ system look like? Ken Patterson & Gillian Wigham, LPB267, June 2019

The process industries have a history littered with the consequences of not managing change carefully and safely. Despite these lessons and a great deal of good practice, globally we continue to struggle to get it right. As time passes, our memories of the human tragedies linked to Flixborough (a temporary change) and Hickson & Welch (a series of non-assessed changes) fade and fall out of our common experience. However, we still need to learn the lessons – properly – and ensure that they are embedded in our industries’ everyday practice. So, what is it that makes a good system for change management? At heart it is a combination of a robust assessment, especially risk assessment, and appropriate management, ensuring any change has the correct authorisation. That’s a start but not sufficient to answer to the question “What does a good Management of Change (MoC) system really look like?” The rest of this paper attempts to answer that question, especially from the viewpoint of someone auditing an MoC system. Both authors are experienced process safety and occupational health & safety auditors, having worked on sites from the Americas to the Far East. We do not claim in any way that what follows is the only or the right answer, but it does draw on our experience both of systems that are working well and those that were clearly failing.

View document

Limitations and misuse of LOPA, Roger Casey, Cantwell Keogh & Associates, LPB265, February 2019

Layers of Protection Analysis (LOPA) is a simplified form of numerical risk assessment. It is an order of magnitude approach and hence precise figures are not used. The technique does have significant limitations compared to more advanced techniques such as Fault Tree Analysis, QRA, etc. This paper highlights some of the mistakes that are seen in its application and challenges some of the practices that are occurring within LOPA calculations – in particular with the use of conditional modifiers related to exposure times which causes an underestimation of the risk. Keywords: Layer of Protection Analysis, LOPA, risk assessment

View document

Investigation and bias – procedures, Andy Brazier, AB Risk Ltd, LPB264, December 2018

Incident investigations often conclude that one of the causes was either that people did not follow a “good” procedure or that procedures were not fit for purpose. These findings are often based on an inflated opinion of what procedures can achieve. The reality is that procedures appear very low on the hierarchy of risk control and will only ever make a fairly modest contribution to safety. Avoiding hindsight bias when considering the role of procedures in incidents can mean that more effective recommendations can be made, leading to a set of procedures that provide effective support to competent people.

View document

Piper Alpha - what have we learned? Fiona Macleod and Stephen Richardson, LPB261, June 2018

The investigation into the Piper Alpha disaster has much to teach us thirty years on. Most of the physical evidence sank to the bottom of the North Sea, so the testimony of survivors and witnesses had to be woven together into a coherent story. The Cullen inquiry uncovered not only what probably happened on the terrible night of 06 July 1988, but also the complex path leading up to it, the early warnings and missed opportunities that might have prevented a tragedy in which 167 people lost their lives. The lessons to be learned are applicable far beyond the offshore oil industry, across all hazardous industries, and every bit as relevant today.

View document

Hamlet chicken processing plant fire, Tony Fishwick, LPB260, April 2018

A major fire occurred at a chicken processing plant in North Carolina, USA, resulting in the death of 25 workers. The main outcome of the investigation into the accident was that the consequences of the fire resulted from serious shortcomings in the management of safety, including that the plant had never received a safety inspection.

View document

Buncefield: Lessons learned on emergency preparedness, Graham Atkinson, HSE, LPB254, April 2017

Early on Sunday 11 December 2005 a gasoline storage tank was being filled from a pipeline at a fuel terminal at Buncefield. Safety systems fitted to prevent the tank overfilling failed and gasoline began to spill from the vents on the tank roof. A low-lying cloud of heavy, flammable vapour accumulated and spread out for about 250m in all directions around the tank. Ignition of the cloud occurred and a powerful vapour cloud explosion devastated the fuel depot. The ensuing fire spread to other tanks and was not fully extinguished for several days. This paper considers the lessons learned related to emergency preparedness at large flammable sites as a result of this incident. These include the responsibility of the operators of fuel depots, tanker terminals, etc.

View document

Hazard identification - can power engineers learn from the process industries? Matt Clay, Health & Safety Laboratory, LPB253, February 2017

The power engineering sector features similar challenges to the early process industries at the time when they first developed hazard identification techniques. This paper summarises a pilot study carried out by the Health & Safety Laboratory (HSL) working with an electricity Distribution Network Operator (DNO) involving engineers and managers to determine whether process industry techniques could be adopted successfully to power engineering applications. The study focussed on the application of HAZOP and bow-tie.

View document

Chernobyl - 30 years on, Fiona Macleod, LPB251, October 2016

The 1986 Chernobyl accident has lessons that extend beyond the nuclear industry and the former Soviet Union. These lessons are directly applicable to today’s international chemical industry: artificially imposed deadlines lead to shortcuts; simplified targets in complex environments will lead to perverse incentives and unintended consequences; real experts tell leaders things they don’t want to hear; good leaders listen; you don’t get safety by rules and regulation, it starts with the design and evolves with experience; good design is iterative — it takes time, expertise and feedback; things happen differently on night shift; whatever the designers intended, sooner or later the operator will do something unimaginable — often on night shift; sharing process safety information means sharing what went right (near misses) as well as what went wrong (accidents); sharing process safety stories widely and acting on the lessons they teach us is the way we shore up our defences faster than the changes can overwhelm us; management of change, and a sense of chronic unease, stops only when the field is green again.

View document

Flixborough: Lessons which are still relevant today, Robin Turney, LPB237, June 2014

Robin Turney considers how relevant the lessons from Flixborough are to the process industries today – focussing on the control of modifications; understanding of vapour cloud explosions; occupied buildings; competence and organisational change and safety culture. Particular emphasis will be given to issue of management competence and the organisational changes that took place on the site before the incident occurred. It will question whether the systems advocated today would be fully effective in dealing with the unplanned changes that were at the root of the disaster.

View document

Seveso — 40 years on, Mark Hailwood, LUBW, LPB251, October 2016

Saturday 10 July 1976 was a day that changed the face of chemical process safety in Europe and linked a small northern Italian town with a European Directive and with a particular chemical molecule. Mark Hailwood outlines the circumstances surrounding a release of toxic chemicals, the lessons learned and similar, more recent incidents involving out-of-control exothermic reactions.

View document

The Challenger Space Shuttle disaster, John Wilkinson, Human Instrumental, LPB251, October 2016

The space shuttle Challenger disintegrated 73 seconds after launch on 28 January 1986 killing all seven astronauts aboard. An O-ring seal in the right solid rocket booster (SRB) failed at lift off causing a breach in the SRB joint seal. This let pressurised hot gas escape and ignite, affecting nearby SRB attachment hardware and an external fuel tank leading to structural failure. NASA management knew the design of the SRB had a potentially catastrophic flaw in the O-rings but did not address this effectively. They also appeared to have disregarded warnings from engineers and not to have passed on their technical concerns.

View document

Lessons from Longford — 20 years on, Bob Weiss, LPB262, August 2018

Bob Weiss outlines a timeline of the “everyday” type of events which led up to the accident and reflects on some of the lessons that have most resonated with him since.

View document

Lessons from Texas City — A case history, Michael P. Broadribb, BP America Production Company, LPB192, December 2006

Michael Broadribb outlines how and why the incident occurred, the lessons learned and actions taken, and some wider messages for the industry.

View document

Lessons from Buncefield, Mark Hailwood, LUBW, LPB206, April 2009

Mark Hailwood reviews some of the main lessons from Buncefield relating to overfill protection, tank design, scenario modelling and general safety management.

View document