L9 Incident Investigation Student Handout

8/2/2019 L9 Incident Investigation Student Handout

1/73

Calgary Tel 1-403-221-8077 Fax 1-403-221-8072E-mail: [email protected] Website: www.seal.ab.ca

INCIDENT/ACCIDENT INVESTIGATION AND ROOT CAUSE ANALYSIS

NPC TRAINING PROGRAM

STUDENT HANDOUT

Presented byRon Rosser & Mike Breward


2/73


3/73

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

I

Table of Contents

COURSE OBJECTIVES.................................................................................................. 1

COURSE OBJECTIVES ....................................................................................................... 1

AGENDA ........................................................................................................................... 2

AGENDA ........................................................................................................................... 2 Day 1........................................................................................................................... 2 Day 2........................................................................................................................... 2

INCIDENT INVESTIGATION FLOW PATH ............................................................. 3

WHY I NVESTIGATE I NCIDENTS ?....................................................................................... 4TEAM EXERCISE ............................................................................................................... 4WHY I NVESTIGATE I NCIDENTS ?....................................................................................... 5

INCIDENT RECURRENCE ........................................................................................... 6

I NCIDENT ......................................................................................................................... 6QUESTIONS THAT NEED TO BE ASKED ............................................................................ 6R ECOMMENDATIONS ........................................................................................................ 6I NCIDENT VIDEO - 'NOBODY 'S FAULT ' ............................................................................ 8PRESERVATION OF EVIDENCE .......................................................................................... 9

Segment Objectives:.................................................................................................... 9 There are four types of evidence:................................................................................ 9

POSITION EVIDENCE ...................................................................................................... 10PHOTOGRAPHS : .............................................................................................................. 11POSITION MAPS : ............................................................................................................ 11

PEOPLE EVIDENCE ......................................................................................................... 12 Interviewing Techniques ........................................................................................... 12 PARTS EVIDENCE ........................................................................................................... 14PAPER EVIDENCE ........................................................................................................... 15I NTERVIEWING EXERCISE ............................................................................................... 16

INCIDENT REPORTING ............................................................................................. 17

SEGMENT OBJECTIVES : .................................................................................................. 17 INCIDENT INVESTIGATION FLOW PATH............................................................ 18

TEAM EXERCISE : WHY REPORT INCIDENTS ?.................................................................. 19WHY R EPORT I NCIDENTS ............................................................................................... 20

IMPORTANCE OF QUALITY DATA ................................................................................... 24CASE STUDY .................................................................................................................. 25 Bhopal ....................................................................................................................... 25

A NALYZING TO R OOT CAUSE ......................................................................................... 26R OOT CAUSE A NALYSIS ................................................................................................. 28CASE STUDY PHYSICAL R OOTS ...................................................................................... 32NOBODY S FAULT LATENT R OOT CAUSE A NALYSIS .................................................. 30TEAM EXERCISE : R OOT CAUSE A NALYSIS .................................................................... 32


4/73


II

INCIDENTS TO INVESTIGATE................................................................................. 34

SEGMENT OBJECTIVES : .................................................................................................. 34I NCIDENT I NVESTIGATION FLOW PATH .......................................................................... 35SPORADIC I NCIDENT ...................................................................................................... 36CHRONIC I NCIDENT ........................................................................................................ 37FAILURE MODES AND EFFECTS A NALYSIS (FMEA) ...................................................... 39USING FMEA IN YOUR COMPANY .................................................................................. 39

FMEA WORKSHEET................................................................................................ 40 R EPORTING AND R ECOMMENDATIONS ........................................................................... 41WHY I NVESTIGATE I NCIDENTS ?..................................................................................... 41MAKING APPROPRIATE R ECOMMENDATIONS ................................................................. 41

NOBODY S FAULT LATENT R OOT CAUSE A NALYSIS ..................................................... 42SMALL GROUP EXERCISE ............................................................................................... 43CLASS I NCIDENT ............................................................................................................ 44

APPENDIX...................................................................................................................... 48

GENERAL REFERENCES........................................................................................... 48 BHOPAL CASE STUDY ............................................................................................... 48

GENERAL R EFERENCES :................................................................................................. 49BHOPAL CASE STUDY .................................................................................................... 50

Introduction............................................................................................................... 50 Methyl Isocyanate (M.I.C.) ....................................................................................... 51 Toxicological Effects Acute .................................................................................. 51

Immediate Causes ..................................................................................................... 52 Three Questions:....................................................................................................... 54

Basic Causes ............................................................................................................. 54

SCHEMATIC LAYOUT OF COMMON HEADERS OF MIC STORAGE TANKS ........................ 58


5/73


1

CC OO UU R R SSEE OO BBJJ EE CC TT II VV EE SS

Course Objectives

The objectives for this course are:

Define the purpose of incident investigation.

Explain the importance of incident reporting.

Describe evidence preservation techniques.

Describe the investigation flow path.

Define key terms used in incident investigation.

Correctly complete incident reporting and investigation data. Analyze the causes of incidents.

Make recommendations to prevent incident recurrence.

Explain the importance of determining root cause.

What are your expectations for the course?


6/73


2

AA GG EE NN DD AA

Agenda

Day 1 Introductions

Why Investigate Incidents?

Preservation of Evidence

Incident Reporting

Incidents to Investigate

Day 2 Case Study - Bhopal

Analyzing to Root Cause

Reporting and Recommendations

Group Exercise

Course Wrap-Up

This workshop covers a great deal of material. To ensure that the course can becompleted as planned, please stay within the assigned time frames for team exercisesand breaks.


7/73


3

II NN CC II DD EE NN TT II NN VV EE SSTT II GG AA TT II OO NN FF LL OO WW PP AA TT HH

UNDESIREDEVENT

IS THE CAUSEEVIDENT?

DETERMINE CALL OUT

REQUIREMENTS

NoFOLLOW

INCIDENT GUIDELINES Yes

NEAR MISS MINOR SERIOUS MAJOR

EXTRA- ORDINARY

ASSIGN INVESTIGATION TEAMLEADER

PERFORM F.M.E.A.

FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER.COMPLETE INCIDENT REPORT

FORWARD TO INCIDENT INVESTIGATION ADMINISTRATOR.

INVESTIGATE NOW?Yes

No

DATABASE FOR FUTURE INVESTIGATION &

ANALYSIS

OTHER DATA -PMS

-LOGS -HOT

LINE

PROCESS & MAINTENANCE

TEAMS ATS

MANAGEMENT REVIEW/SELECTION

COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENTTEAM

CAUS

E FOUND No

Yes

DETERMINE:-TEAM MEMBERSHIP DATA REQUIREMENTS -PMT REPRESENTATIVES -LCR & QA RECORDS -EXPERTS -EQUIPMENT HISTORY -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS -CRITICS -INTERVIEW REQUIREMENTS

PERFORM K.T. PROBLEM ANALYSISOR ALTERNATIVE ANALYTICAL

TECHNIQUE TO DETERMINEPHYSICAL CAUSE(S)

CAUSE(S)FOUND?

No Yes

PERFORM ROOT CAUSE ANALYSIS TO IDENTIFY MANAGEMENT

SYSTEMINADEQUACIES


8/73


4


Segment Objectives:

To illustrate the importance of incident investigation.

To discuss the concept of incident recurrence.

To introduce the first segment of the case study exercise.

Team Exercise

Working in your teams, brainstorm a list of reasons why we investigate incidents.


9/73


5


To recognize the unsafe acts and/or conditions that caused the incident.

To identify the management system that failed to prevent it from happening.

To recommend remedial actions that will prevent it from happening again.


10/73


6

II NN CC II DD EE NN TT R R EE CC UU R R R R EE NN CC EE

Incident A person falls from a ladder.

Unsafe act - climbing a defective ladder.

Recommendation - replace the ladder.

Questions That Need To Be Asked

Why was the ladder not inspected?

Was the employee properly trained?

Was the employee informed not to use the ladder?

Recommendations

An improved ladder inspection program.

Improved training.

A clearer definition of responsibilities.


11/73


7

INCIDENT TRAJECTORY INCIDENT TRAJECTORY MODEL FOR LOSS MODEL FOR LOSS

LOSS LOSS Ina dequate defenses Inadequate defenses

Incide nt contact Incident contact (Active Error) (Active Error)

Corporate commitment (Latent Errors - Root

causes )

Corp orate commitment Corporate commitment (Latent Errors - (Latent Errors - Root Root

causes causes ) )

IncidentIncident

Trajectory Trajectory

(Active and Latent Errors) (Active and Latent Errors) Gaps at any level create an Gaps at any level create an incident inducing environment incident inducing environment

HSE Management Systems (Latent errors -Root Causes)

HSE Manag ement Systems HSE Management Systems (Latent errors -Root Causes)(Latent errors -Root Causes)

Process & physical work Process & physical work environment environment

(Active/ Latent Errors) (Active/ Latent Errors)


12/73


8

Incident Video - 'Nobody's Fault'

It is important to keep notes of what you observe during the video, as you will need this

information to complete later segments of the case study exercise.

Names of People and Roles (boss, worker, etc.)

Information/Facts:

Notes:


13/73


9

Preservation of Evidence

Effective preservation of evidence is the key building block to a successful investigation.

Segment Objectives: To introduce the four P's of evidence preservation.

To explain the use of evidence preservation techniques and their importance in the

incident investigation process.

To demonstrate common techniques used for gathering evidence.

There are four types of evidence:

Position evidence: People evidence:

Parts evidence:

Paper evidence:

These are known as the Four P's.

PRESERVATION OF PRESERVATION OF

EVIDENCE EVIDENCE

P O S I T I O N

P E O

P L E

P A R T S

MINS HRS DAYS WEEKS

F R

A G I L I T Y

PAPER


14/73


10

Position Evidence

Steam TrapPilotPlant

Number

2

ElectricCable

Taffys work area

Bunsenburner

Burnt dustsheet

Packing materialBroken glassStains on floor

New equipmentPacking crate

Pilot Plant Number 1

OverheadGallery

Position evidence is the most fragile of all evidence. This form of evidence should begathered as soon as possible after an incident has occurred.

There are several easy ways to record position evidence. The two types of positionevidence we will discuss today are:

photographs

position maps


15/73


11

Photographs:

Position Maps:


16/73


12

People Evidence

Interviewing Techniques Interview one individual at a time (one on one). Neutral, private setting.

Depersonalize.

Use open-ended questions to gather information.

Use close-ended questions to confirm information.

Follow; dont lead.

Listen and record; do not comment.

Encourage follow-up.

People evidence is the second most fragile type of evidence we can gather in an incident

investigation.

The primary method we use for gathering people evidence is personal interviews.

Relevant information is not restricted to the incident itself, but includes the standards and

practices of the work group, the normal operating conditions and any past incidents of a

similar nature. An interviewer should be able to extract useful information of that nature.

People's ability to remember details regarding a situation diminishes quickly. Therefore

it is imperative that witnesses are interviewed as quickly as possible.

In addition, most people are not trained observers. They tend to interpret or rationalize

what they have seen and fill in missing gaps with assumptions or pieces of information

they have heard from others associated with the incident.


17/73


13

Notes:


18/73


14

Parts Evidence

Parts must be retrieved, labeled and protected against damage so that analyses can be

conducted. All too often critical parts are thrown away or damaged, resulting in the lossof valuable evidence.

If a part is moved, it first should be photographed where it was found and then placed in

an appropriate container. Each part should be labeled to identify what it is and where it

was found. This also applies to material or liquid that has been spilled or discharged as a

result of the incident.

It is important to be careful when handling these parts and materials, as fractured surfaces

may be jagged or spilled material may be hazardous.

Notes:


19/73


15

Paper Evidence

Paper evidence is the least fragile of all types of evidence. Most paper evidence will be

available for analysis several days or weeks after the incident.

Some computer evidence, such as process data, will need to be retrieved soon after an

incident has occurred, as these systems often download or dump data every twenty-four

hours.

Notes:


20/73


16

Interviewing Exercise

In this next section, your team will have the opportunity to analyze information from the

Nobody's Fault incident.

You will need:

Observations from the video introduction.

Position evidence.

Notes taken when the instructor answers class questions.

In teams, compose two (2) questions to ask the instructor. One question that is not

allowed to be asked is, What caused the fire? Your questions should be designed to

enable your team to find out:

What happened (sequence of events).

How the fire started.


21/73


17

II NN CC II DD EE NN TT R R EE PP OO R R TT II NN GG

Segment Objectives:

To explain the incident reporting process.

To describe the incident ratio study.

To explain the importance of quality incident data.


22/73


18

INCIDENT INVESTIGATION FLOW PATH

UNDESIREDEVENT


DETERMINE CALL OUT

REQUIREMENTS

NoFOLLOW

INCIDENT GUIDELINES Yes

NEAR MISS MINOR SERIOUS MAJOR

EXTRA- ORDINARY


PERFORM F.M.E.A.

FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER.COMPLETE INCIDENT REPORT

FORWARD TO INCIDENT INVESTIGATION ADMINISTRATOR.

INVESTIGATE NOW?Yes

No

DATABASE FOR FUTURE

INVESTIGATION &

ANALYSIS

OTHER DATA -PMS

-LOGS -HOT

LINE

PROCESS & MAINTENANCE

TEAMS ATS

MANAGEMENT REVIEW/SELECTION

COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENTTEAM

CAUSE FOUND No Yes

DETERMINE:-TEAM MEMBERSHIP DATA REQUIREMENTS -PMT REPRESENTATIVES -LCR & QA RECORDS -EXPERTS -EQUIPMENT HISTORY -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS -CRITICS -INTERVIEW REQUIREMENTS

PERFORM K.T. PROBLEM

ANALYSISOR ALTERNATIVE ANALYTICALTECHNIQUE TO DETERMINE

PHYSICAL CAUSE(S)

CAUSE(S)FOUND? No

Yes

PERFORM ROOT CAUSE ANALYSISTO IDENTIFY MANAGEMENT

SYSTEMINADEQUACIES


23/73


19

Team exercise : Why report incidents?

In your teams, brainstorm a list of reasons why it is important to report incidents:

Why are incidents sometimes not reported?


24/73


20

Why Report Incidents

What you dont report, you cant investigate.

Legal requirements. Develop database of incident reporting and investigation history for future

analysis.

Identify problems in the operation before they lead to major incidents.

INCIDENT RATIOINCIDENT RATIOCOMPARISONCOMPARISON

Substandard Act & ConditionsSubstandard Act & Conditions

Near- Miss IncidentsNear- Miss Incidents

PropertyProperty DamageDamageIncidentsIncidents

Minor Minor InjuriesInjuries

Major Major InjuriesInjuries


25/73


21

Incidents are reported on:

An Incident Report Form

Incident Investigations are recorded on:

An Incident Investigation Report Form

Notes:


26/73


22

INCIDENT REPORT

INSTRUCTIONS: This report is to be filled out by the Onsite Management Representative with the individuals involved inthe occurrence and forwarded to the head office. Use additional paper if necessary.

IDENTIFYING INFORMATION

DATE OF OCCURRENCE: TIME OF OCCURRENCE:

DATE REPORTED: WEATHER CONDITIONS:

LOCATION:

Where did it occur? (Facility Location, Office, etc.)

Type of Incident:

__Personal Injury __Equipment Failure __Product Mix __Major Down Time

__Inhalation Exposure __Equipment Damage __T.D.G. Violation __Contamination

__Chemical Exposure __Property Damage __Security / Theft __Spill

__Occupational Illness __Material Loss __Explosion / Fire __Other

__Employee __Contractor __Other __First Aid __Medical Treatment

__Lost Time __Restricted Work

Source of InjuryNature of Exposure

Medical Outcome

EMPLOYER

EMPLOYEE SURNAME LENGTH OF SERVICE AGE

FIRST NAME(S) JOB CLASSIFICATION

DESCRIPTION

DESCRIBE HOW EVENT OCCURRED (USE ADDITIONAL PAPER IF NECESSARY)

(Do not speculate on cause, state only verifiable facts of the events that led up to the Incident)

FUTURE RISK ASSESSMENT (circle appropriate hazard classification level)

HOW SERIOUS COULD THIS HAVE BEEN? HOW LIKELY IS THIS EVENT TO OCCUR AGAIN?

Major (A) Serious (B) Minor (C) Frequently Occasionally Rarely


27/73


23

INCIDENT ANALYSIS

CAUSE ANALYSIS (State Facts, Please Do Not Speculate)

IMMEDIATE CAUSES: (WHAT BEHAVIOURS / OR CONDITIONS CAUSEDOR COULD CAUSE THIS OCCURRENCE?)

ROOT CAUSES: (WHAT ARE THE REASONS FOR THE ABOVE BEHAVIOURS AND / OR CONDITIONS?)

REMEDIAL ACTION

DESCRIBE THE ACTIONS TAKEN AND FOLLOW-UP THAT WILL BE TAKEN TOPREVENT RECURRENCE

CORRECTIVE FOLLOW-UP ACTION REQUIRED ACTION BY: LAST NAME,FIRST INITIAL

COMPLIANCEDATE

DATECOMPLETED

INCIDENT WAS REPORTED TO:

Company: Agency: Agency:

Name: Name: Name:

Location: Location: Location:

Phone No.: Phone No.: Phone No.:

*List all agencies contacted

ENDORSEMENTS

INVESTIGATE BY (PRINT): SIGNATURE:

DATE:

MANAGEMENT APPROVAL OF ACTION TAKEN: Name: Signature: Date:


28/73


24

Importance of Quality Data

Incident analysis.

External reporting requirements (Ministry of Energy) Litigation purposes.

Investigation process.

What is not reported, cannot be investigated.What is not investigated, cannot be changed.

What is not changed, cannot be improved, and therefore . . .

will happen again.

Notes:


29/73


25

Case Study

Bhopal To provide participants with an opportunity to see the results of a major incident

and discuss how they would set up a team to investigate it.

Consider what evidence would need to be gathered and how.

Further details of the Bhopal Incident can be found in the Appendix.


30/73


26

Analyzing to Root Cause

Segment Objectives: To define physical and latent root causes.

To clarify the terms used in various incident/accident causation models.

To demonstrate the root cause analysis process.

INCIDENT TRAJECTORY INCIDENT TRAJECTORY

MODEL FOR LOSS MODEL FOR LOSS LOSS LOSS

Ina dequate defenses Inadequate defenses

Incide nt contact Incident contact (Active Error) (Active Error)

Corporate commitment (Latent Errors - Root

causes )

Corp orate commitment Corporate commitment (Latent Errors - (Latent Errors - Root Root

causes causes ) )

IncidentIncident

Trajectory Trajectory

(Active and Latent Errors) (Active and Latent Errors) Gaps at any level create an Gaps at any level create an incident inducing environment incident inducing environment

HSE Management Systems (Latent errors -Root Causes)

HSE Manag ement Systems HSE Management Systems (Latent errors -Root Causes)(Latent errors -Root Causes)

Process & physical work Process & physical work environment environment

(Active/ Latent Errors) (Active/ Latent Errors)


31/73


27

PHYSICAL ROOTS

LATENT ROOTS

ROOT CAUSE

EHS

SYSTEM

Active/LatentErrors

Innad. Defence

LOSS TOP EVENT RESULT

WHY IT HAPPENED

MANAGEMENT SYSTEM

INADEQUACIES

ROOT CAUSE MODEL INCIDENT TRAJECTORY MODEL

ANALYSIS MODELS COMPARISON ANALYSIS MODELS COMPARISON


32/73


28

Root Cause Analysis

Describe a top event.

Determine what events could have caused the top event. Analyze each event to determine its respective causes.

Continue analysis on each root until management system cause is determined.


33/73


SS ww iitt cc hhFF aa iilluu r r ee

BB aa tt tt ee r r yy DDee aa dd

BB aa tt tt ee r r yy

FF aa iilluu r r ee

MM

f f gg

DDee f f ee cc tt

BB aa tt tt ee r r yy IInn vv ee r r tt ee dd

MMf f gg DDee f f ee cc tt CC oo r r r r oo ss iioo nn

MMDDee ff

FF LLAASS HHLLIIGG HHTT FF AAIILLSS TTOO LLIIGG HHTTTTOO PP EE VVEE NNTT

PP HH Y YSS IICC AALL RR OO OO TTSS

LLAATTEE NNTT RR OO OO TTSS


34/73


Nobodys Fault Latent Root Cause Analysis STEAM LEAK(Equipment not

isolated)

No pre-workcheck out system

Changes to pipe worknot understood

No permit towork procedure

Inadequatecommunication p

Poor maintenance

standards

Poor changemanagementprocedures

Address theroot cause -

would this preventthe incident from

recurring?


35/73


31

NOBODYS FAULTNOBODYS FAULTLATENT ROOT CAUSELATENT ROOT CAUSE

ANALYSISANALYSISSTEAM LEAK

(Equipment not isolated)


Changes to pipeworknot understood

Computer datanot updated

No permit to

work procedure

Inadequate

communication

Inadequate

procedure update

Poor maintenance

standards


If these two management systeminadequacies were corrected

would it prevent further incidentsof improper isolation?


36/73


32

Case Study Physical Roots

CASE STUDYCASE STUDYPHYSICAL ROOTSPHYSICAL ROOTS

Serious Fire inPilot Plant

Steam Leak(Equipmentnot isolated)

Open Flame(Bunsenburner)

FlammableChemical(Solvent)

InadequateResponse

Large Quantityof Combustibles

(packaging)

Notes:


37/73


33

Team Exercise : Root Cause Analysis

Working in your team, conduct a root cause analysis of your assigned root cause. Take the root down to latent cause, management system inadequacy.

Notes:


38/73


34

II NN CC II DD EE NN TT SS TT OO II NN VVEE SSTT II GG AA TT EE

Segment Objectives:

To introduce the Failure Modes and Effects Analysis (FMEA) process.

To provide participants with a mechanism for analyzing incidents.


39/73


35

Incident Investigation Flow Path

UNDESIREDEVENT


DETERMINECALL OUT

REQUIREMENTSNo

FOLLOW LOSSCONTROL

GUIDELINESYes

FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER.COMPLETE INITIAL LOSS CONTROL REPORT

FORWARD TO LOSS CONTROL ADMINISTRATOR.

NEARMISS MINOR SERIOUS MAJOR

EXTRA-ORDINARY

INVESTIGATE NOW?


Yes

DETERMINE:-TEAM MEMBERSHIP DATA REQUIREMENTS-PMT REPRESENTATIVES -LCR & QA RECORDS-EXPERTS -EQUIPMENT HISTORY-VENDOR REPRESENTATIVES -PROCESS DATA DUMPS-CRITICS -INTERVIEW REQUIREMENTS

DATABASE FORFUTURE

INVESTIGATION & ANALYSIS

PERFORM F.M.E.A.

MANAGEMENTREVIEW/SELECTION

No

OTHER DATA-PMS

-LOGS-HOT LINE

PROCESS &MAINTENANCE

TEAMS ATS

CAUSEFOUND

No

COMPLETE REPORT AND GENERATERECOMMENDATIONS TO PMT OR MANAGEMENT TEAMYes

PERFORM K.T. PROBLEM ANALYSISOR ALTERNATIVE ANALYTICAL

TECHNIQUE TO DETERMINEPHYSICAL CAUSE(S)

CAUSE(S)FOUND? No

Yes

PERFORM ROOT CAUSE ANALYSISTO IDENTIFY MANAGEMENT

SYSTEM INADEQUACIES


40/73


36

Sporadic Incident

Sudden adverse change in the status quo.

Requires remedy through restoration of the status quo . Tends to be dramatic and receive immediate attention.

Examples:

Major fire, explosion

Fatality

Structural collapse

Major equipment damage

Major loss of production Typically incidents costing more than $10 million

Notes :


41/73


37

Chronic Incident

Long-standing, adverse situation. Requires remedy through changing the status quo .

Usually not dramatic because it often has been occurring for a long time.

Often difficult to solve.

Sometimes regarded as status quo .

Examples:

Recurring quality deviation.

Recurring equipment failure.

System corrosion/erosion.

Fugitive emissions.

Slips, trips and falls.

Notes:


42/73


38

Notes:

Relationship Between Chronic

and Sporadic Incidents

SporadicFailure

Fix

STATUSQUO

Solving achronic failurechanges thestatus quo

Chronic Failuresare part of theStatus Quo

Continual Improvement


43/73


39

Failure Modes and Effects Analysis (FMEA)

Systematic approach to analyzing failures.

Highlights high versus low cost failures.

Indicates need for further analysis.

Used to prioritize incidents to investigate.

Focuses on result rather than causes.

Using FMEA in your company

Obtain incident reporting and investigation data for last six months (incident

report records, log books, etc.)

Break area down into components, e.g., pumps, valves, etc. Use equipment

identification when possible.

List actual incidents and cost for each piece of equipment. Estimate production

loss.

Tabulate incident investigation analysis and determine highest cost items.

Investigate at least two incidents from the list. Determine the physical and

management system causes for each incident.

Recommend actions to prevent recurrence.

Repeat every six months.


44/73


40

FMEA WORKSHEET

AREA: Plant 13-2 FROM: 01/01/02 - 06/30/02

CONDUCTED BY: A.N. Other


45/73


41

Reporting and Recommendations

Segment Objective:

To identify and explain the steps in developing investigation recommendations

and actions.

To have teams practice-developing recommendations using the case study

example.


To recognize the unsafe acts and/or conditions that caused the incident,

To identify the management system that failed to prevent it from happening, and To recommend remedial actions that will prevent it from happening again.

The Investigation Report should satisfy the above criteria.

Notes:

Making Appropriate Recommendations

Most important part of an investigation report.

Investigation fails if the report merely states the facts and draws conclusions.

Corrective actions are needed.

Specific recommendations should be made to address each root from your

analysis. Actions should be assigned for persons accountable for their completion.

Stewardships and action logs should reflect agreed upon actions.


46/73


42

Nobodys Fault Latent Root Cause Analysis

STEAM LEAK(Equipment not isolated)


Changes to pipeworknot understood

Computer datanot updated

No permit towork procedure

Inadequatecommunication

Inadequateprocedure update

Poor maintenance

standards


If these two management systeminadequacies were corrected

would it prevent further incidentsof improper isolation?

Notes:


47/73


43

Small Group Exercise

In your teams, use the root cause analysis you created in the last exercise to developactions that will prevent this incident from recurring.

Select a team spokesperson.

List your recommendations on a flip chart.

Be prepared to present your findings in 10 minutes

Notes:


48/73


44

Class Incident

Apply what you have learned.

Take notes on Tank Incident.

In teams, on flip charts:

Whom would you need on your investigation team?

How would you collect evidence?

Do a root cause analysis.


49/73


45

Workers were filling one of two MIBCtanks with water from fire hydrant to valve.

One worker had justchecked to see if air wasbeing forced from pressurerelief valve on top and hadbeen standing onpermanent structure.


50/73


46

Worker had on foot onbottom rung of ladder

and one foot on concreteafter descending when aloud explosion was heardand felt.


51/73


47


52/73


48

AA PP PP EE NNDD II XX

GG eenn eerr aa ll R R eef f eerr eenn cceess

BB hh oopp aa ll CC aa ssee SStt uu dd yy


53/73


49

General References:

Accident Prevention Manual for Industrial Operation s: Administration and Program,

ninth ed. (National Safety Council, Chicago, Illinois, 1988) p.p. 149 166 ISBN 0-87912-135-1

Guidelines for Investigating Chemical Process Incidents (American Institute of ChemicalEngineers, New York, 1992) ISBN 0-8169-0555-X

Bird, Frank Jr. and Germain, George L., Practical Loss Control Leadership (InstitutePublishing, Loganville, Georgia, 1986) p.p. 57 95 ISBN 0-88061-054-9

Firenze, Robert J., The Process of Hazard Control (Kendall/Hunt Publishing, Dubuque,Iowa, 1978) p.p. 171 250 ISBN 0-8405-8002-X

Ferry, Ted S., Modern Accident Investigation and Analysis (John Wiley & Sons, NewYork, 1988) ISBN 0 471-62481-0


54/73


50

Bhopal Case Study

Introduction

At approximately 12:40 a.m. on December 3, 1984, a control room operator at UnionCarbides Pesticide Plant in Bhopal, India noticed very significant changes in plant

operating conditions.

A storage tank containing Methyl Isocyanate (MIC), used for pesticide production,

normally was refrigerated. Yet the temperature, usually at 0C (32F) had risen to 25C

(77F). Pressure, normally between 14 Kpa and 172 Kpa (2 psi-25 psi) was rising rapidly

beyond 379 Kpa (55 psi).

The operator, assistant operators, and MIC supervisor rushed to the storage tank. There

was a rumbling sound. A plume of gas was gushing out of the scrubber vent stack. The

flare was out.

They took emergency action:

They tried switching on the refrigeration that had been shut off.

They started the scrubber on the stack that had been shut off.

They attempted to spray water on the escaping gases.

These attempts all failed, gas continued to escape; and some plant personnel panicked

and fled. Approximately 4,000 kg (40 tons) of MIC gas escaped in the form of a heavy

cloud over a 45-minute period. The wind was approximately 10 km/hr (6.2 miles/hr).

Two large slum areas were located directly across the street. In the panic of the night,

well over 100,000 people were urged to flee. Morning found death strewn over a stunned

city.


55/73


51

At least 2,500 people were killed initially, but as of August 2002 (nearly 18 years later),

the death toll is estimated to be 20,000.

By most reports, the large majority of deaths were caused by gassing. However, many

people also died from blunt injuries.

The shantytown had few large streets to facilitate a quick evacuation, and no evacuation

plan existed. Residents knew something was wrong. Many felt the burning sensation in

their respiratory system, others heard of the toxic release, and they panicked. The

population attempted to flee and flooded the streets. The few people who owned cars

drove as quickly as possible, often running over the crowds who were running on foot.

Many people tripped, fell and were crushed by the crowd.

Even in 2002, there still are 120,000 150,000 people suffering from long term health

problems resulting from the disaster. There are many and varied medical ailments

amongst the survivors, but the most common ones are lung diseases.

Ironically only 1 of the 100 workers in the vicinity of the plant was affected, and even

then the consequences were not fatal.

Methyl Isocyanate (M.I.C.) Molecular formula : C 2H3 NO

At normal pressure, boils at 39C (102F).

Volatile, with a vapour pressure of 348 mm Hg at 20C (68F).

As vapour, it is twice as dense as air, and tends to settle out of still air. The gentle

wind on December 3, 1984 moved it slowly along.

Has a flash point of 18C (0F).

Toxicological Effects Acute Before Bhopal, not a single death from MIC had been reported anywhere.

Little toxicological data was available regarding the effect on humans.


56/73


52

This knowledge increased rapidly after the first autopsy reports from Bhopal were

available.

MIC causes damage to two systems:

Lungs much more severe

Eyes somewhat recoverable

Most deaths were due to respiratory failure:

Pulmonary edema swollen tissue, with serious fluid, local dropsy

Bronchitis inflammation of mucous membranes

Among the 150,000 others affected, main damage was to lungs capacity

reduced by 50-60%

Most common complaints were:

Eye irritation

Breathlessness

Chest pains

Vomiting

Muscular weakness

Long term studies are being carried out on:

Abnormalities in babies born after the Bhopal accident

Lung function with time Effect on blood systems

Incidence of cancer

Immediate Causes

A batch process was used to manufacture MIC.

The plant was at only 40% capacity due to low demand.

The last batch before the disaster had been made on October 22, 1984. 4,000 kg (40 tons) of MIC was stored in Tank 610

Maintenance work was planned.


57/73


53

The plant had several safety features:

Vent gas scrubber with caustic neutralizer but it was not on.

Flare tower for burning small amount of gases but it was not on.

Refrigeration system to keep MIC cool, particularly in summer months but

it was not on.

Water-spray pipes that could be used to control some quantities of escaping

gases but they were not on.

With the batch process that manufactured MIC shut down, parts of the plant were

dismantled for maintenance:

Flare system was shut down to repair pipe.

Refrigeration was shut down with refrigerant drained.

Nitrogen pressure system on tanks developed faults.

Pipes were flushed with water before repairs.

Leaking valves and open valves allowed water to flow into MIC Tank 610.

Workers should have inserted a blind, but the inexperienced mechanical

crew did not.

500kg (1,100 pounds) of water flowed into Tank 610.

Water reacted with MIC in presence of metallic impurities (acted as catalyst) and

caused a tremendous exothermic reaction. Temperatures approached 260C

(500F), probably exceeding tank design criteria.

Secondary chemical reactions also took place. There was rapid release of vapour

through the relief valve system.

The scrubber system was designed to deal with gases alone, not gases mixed with

liquid. It failed to operate and therefore had to be started up.

The flare was down for maintenance.

The refrigeration system was out of commission.

Water sprinklers could not throw water high enough to neutralize the escaping

gases.

Hence, toxic gases were able to bypass all these safety features.


58/73


54

Three Questions:

1. Even if all these systems had been working, could they have handled the large mass

of vapour?

2. How much water is required to set off a catastrophic event, with or without metallic

impurities?

3. They took a risk. Did they know the extent of the risk, and was it an acceptable

risk? Did they have their guard down? Were they complacent?

Excerpts from the press and other published sources now will be provided. The reader

will notice some inconsistencies in the information provided by various journalists and

scientists. This is a real life example of the conflicting information with which

incident/accident investigators have to cope. After an actual incident or accident, the

investigators encounter numerous pieces of evidence, some of which conflict with each

other. The investigators need to collect all of the position evidence, people evidence,

parts evidence and paper evidence. They then need to compile and analyze the

evidence. After a catastrophic accident that is the consequence of a complex

combination of causes, it takes a considerable amount of time to conduct the analysis.

Basic CausesPaul Shrivastava, Executive Director Industrial Crisis Institute, New York

Human Factors

The plant was losing money, running at 40% capacity.

Morale was low.

1982 Operational Safety Survey indicated safety rules, permits, etc., were not

being effectively enforced by Union Carbide Inc. The best employees were leaving; 80% of workers trained in the U.S.A. had left.

Between 1980 and 1984, staff level was cut by half.

No maintenance supervisor was on second or third shift. Maintenance supervisors

had been responsible for ensuring proper blanking of lines before water washing.


59/73


55

It was not a computerized plant; hence human backup was very important.

Rumors of sabotage delayed bringing systems under control.

Organizational Factors

Bhopal Plant was an unprofitable plant in an unimportant division of the

corporation.

Union Carbide India Limited (UCIL) was one of fifty international subsidiaries of

Union Carbide Corporation. It represented 2% of Union Carbide Corporations

world sales and 2% of its profits.

Bhopal Plant was one of 13 Union Carbide India Limited plants. It had been

operating below 40% capacity for several years due to weak markets.

It was not receiving much attention or support from top management. Because of the above-mentioned economic conditions, the plant was up for sale at

time of disaster.

Top Management Discontinuity. The plant had had 8 managers in 15 years.

Many had come from non-chemical industry backgrounds. The result was that

systems, procedures, emergency response and training all suffered.

The parent company did an audit in 1982 and identified 10 major areas of

concern. Five of these contributed to the accident: instrumentation, permits, procedures and maintenance.

The plant had no contingency plans for dealing with major incidents. The lethal

nature of MIC was not fully understood by the plant workers and members of the

community.

Management systems were of a poor quality, including Safety and Loss

Management.

Technological Factors Large storage of bulk MIC in an operating area using manual non-computerized

control systems.

Tank 610 had not been under continuous positive nitrogen pressure for 2 months.

This had allowed metallic impurities to enter, and they acted as a catalyst.


60/73


56

Without these impurities, the reaction would have been much less severe.

Plant design and piping systems allowed a pathway for large quantities of wash

water to back into tank during flushing operations.

The scrubber system was designed for vapour only.

There was no radio communication system for operating staff.

The Environment

The rapidly developing city of Bhopal sought and obtained sophisticated western

industrialization without investing in industrial infrastructures.

Bhopal was selected as the capital of the State of Madhya Pradesh in 1956. It

grew rapidly from a fairly small town to a city of approximately 800,000.

(Growth was especially dramatic from 1974 to 1984). The plant site originally had little population around it.

Because of rapid population increase, shantytown areas grew around the plant.

They were densely populated with poor streets, lighting, etc.

A combination of social factors, local infrastructure, lack of awareness and lack of

community preparedness added severely to the results.

Overall Lessons

Plants like these must have first class design and technology with built-in reliable

safety features and must be kept up to date over the years by capital investment.

Management must be totally committed to Safety and Loss Management both

at the local and corporate levels, independent of the local economy (or threat of

shutdown).

Location of plant with respect to population areas should be a major

consideration.

Infrastructure of surrounding areas must be supportive roads, water, sewers,

access to fire stations, emergency measure organizations, etc.

Combined knowledge and experience of operating, maintenance, technical and

management personnel must always be maintained at a high level. This may


61/73


57

require some non-local expertise. Today we have retired much of this knowledge.

Does this mean we have increased our level of risk?

Strength of organization needs continual risk assessment.

Prime Causes:

lack of management / government attention

not knowing how sloppy the operation had become

failure to ensure known actions were carried out


62/73


58

Schematic Layout of Common Headers of MIC Storage Tanks


63/73


59

Murder charges in Bhopal case dropped(The Edmonton Journal Sunday, September 22, 1996)

Almost 12 years after the world's worst industrial accident, India's Supreme Court has

dropped homicide charges against eight former senior officials of chemical maker UnionCarbide.

But, the court cleared the way for the prosecution of the accused for a string of lesser offenses, including causing death by negligence.

The charges were brought after nearly 4,500 people died in a toxic gas lead in the centralIndian city of Bhopal in December, 1984.

In 1989, the Supreme Court chief justice ordered Union Carbide to pay a settlement of $425 million US and its Indian subsidiary $45 million.


64/73


60

Bhopal : Learning from Accidents by Trevor Kletz, D.Sc., FRCS, FIChe1994(ISMB 0 7506 1952X)

The gas leak just can't be from my plant. The plant is shut down. Out technology justcan't go wrong. We just can't have such leaks.

The first reaction of the Bhopal works manager.

The worst accident in the history of the chemical industry occurred in the Union Carbide plant at Bhopal, India on 3 December 1984 when a lead of over 25 tonnes of methylisocyanate (MIC) from a storage tank spread beyond the plant boundary, killing over 2,000 people. The official figure was 2,153 2 but according to some reports the true figurewas nearer 10 000 3, 4. In addition about 200 000 people were injured. Most of thosekilled and injured were living in a shantytown that had grown up close to the plant.

Before 1984 the worst accidents that had occurred in the chemical industry were theexplosion of a 50/50 mixture of ammonium sulphate and ammonium nitrate at Oppau inGermany in 1921, which killed 430 people including fifty members of the public, and theexplosion of a cargo of ammonium nitrate in a ship in Texas City Harbour in 1947, whichkilled 552 people, mostly members of the public 5. If conventional explosives areclassified as chemicals, then we should include the explosion of an ammunition ship inHalifax, Nova Scotia in 1917, which killed about 1,800 people. Earlier in 1984, on 19

November, 550 people were killed when a fire occurred at a liquefied petroleum gas processing plant and distribution centre in San Juanico, a suburb of Mexico City 6 and on25 February at least 508 people, most of them children, were killed when a petrol piperuptured in Cubatao, near Sao Paulo, Brazil and the petrol spread across a swamp andcaught fire 7. In both cases most of those killed were living in shantytowns. 1984 wasthus a bad year for the chemical industry.

The Bhopal tragedy started when a tank of MIC - an intermediate used in themanufacture of the insecticide carbaryl - became contaminated with water - probably asthe result of sabotage - and a runaway reaction occurred. The temperature and pressurerose, the relief valve lifted and MIC vapour was discharged into the atmosphere. The

protective equipment which should have prevented or minimized the discharge was out of action or not in full working order: the refrigeration system which should have cooledthe storage tank was shut down, the scrubbing system which should have absorbed thevapour was not immediately available and the flare system, which should have burnt anyvapour which got past the scrubbing system, was out of use.

10.1 "What you don't have, can't leak"There are many lessons to be learned from Bhopal, but the most important is that thematerial that leaked need not have been there at all. It was an intermediate, not a productor raw material, and while it was convenient to store it, it was not essential to do so.Originally MIC was imported and had to be stored but later it was manufactured on site.


65/73


61

Nevertheless over 100 tonnes were in store, some of it in drums. After the tragedy it wasreported that DuPont intended to eliminate intermediate storage from a similar plant thatthey operated. Instead they use the MIC as soon as it is produced, so that instead of 40tonnes in a tank there will be only 5-10 kg in a pipeline. Mitsubishi were said to do thisalready 8,9. During the next few years other companies described plans for reducing their

stocks of other hazardous intermediates10

. At the end of 1985 Union Carbide claimedthat the inventories of thirty-six toxic chemicals had been reduced by 74% 11.

The main lesson of Bhopal is thus the same as that of Flixborough: What you don't have,can't leak. Whenever possible, we should reduce or eliminate inventories of hazardousmaterials, in process or storage. It is unfortunate, to say the least, that more notice wasnot taken of the papers written after Flixborough, which stressed the desirability of inherently safer designs, as they are called 12-14 . It seems that most companies felt soconfident of their ability to keep hazardous materials under control that they did not look for ways of reducing inventories. Yet to keep lions under control we need expensiveadded-on protective equipment that may fail or may be neglected. It is better to keep

lambs instead.Plant managers usually want intermediate storage, as it makes operation easier. Onesection of the plant can continue on line when another is shut down. Computer studies onequipment availability always show that intermediate storage is needed. However, theydo not allow for the fact that if intermediate storage is available it will always be used,and maintenance will be carried out at leisure, but if it is not available people doeverything possible to keep the plant on line, carrying out maintenance as soon as

possible. The need for intermediate storage is thus a self-fulfilling prophecy.

Another alternative to intermediate storage is to build a slightly larger plant and acceptfewer running hours per year. Intermediate storage, including working capital, isexpensive as well as hazardous, but the alternative is rarely considered.

If reducing inventories, or intensification as it is called, is not practicable, an alternativeis substitution, that is, using a safer material or route. At Bhopal the product (carbaryl)was made from phosgene, methylamine and alpha-naphthol. The first two were reactedtogether to make MIC, which was then reacted with alpha-naphthol. In an alternative

process used by the Israeli company, Makhteshim, alpha-napthol and phosgene arereacted together to make a chloroformate ester, which is then reacted with alpha-naphtholand phosgene are reacted together to make a chloroformate ester which is then reactedwith methylamine to make carbaryl. The same raw materials are used, but MIC is notformed at all.

Of course, phosgene is also a hazardous material and its inventory should be kept as lowas possible, or avoided altogether. If carbaryl can only be made via phosgene, perhapsanother insecticide should be manufactured instead.

Or instead of manufacturing pesticides perhaps we should achieve our objective - preventing the harm done by pests - in other ways, for example, by breeding pest-


66/73


62

resistant plants or by introducing natural predators. I am not saying we should -- both of these suggestions have disadvantages -- merely saying that the questions should be asked.

10.2 Plant locationIf materials that are not there cannot leak, people who are not there cannot be killed. The

death toll at Bhopal would have been much smaller if a shantytown had not been allowedto grow up near the plant. In many countries, planning controls prevent suchdevelopments, but not apparently in India. Of course, it is much more difficult to preventthe growth of shantytowns than of permanent dwellings, but nevertheless it is essential tostop them springing up close to hazardous plants. If the government or local authoritiescannot control their growth, then industry should be prepared, if necessary, to buy up theland and fence it off. As already mentioned, the high death tolls at Mexico City andCubatao earlier in 1984 occurred in shantytowns.

It is generally agreed that if a lead of toxic gas occurs people living in the path of the plume should stay indoors with their windows closed. Only if the lead is likely to

continue for a long time, say, more than half-an-hour, should evacuation be considered.However, this hardly applies to shanties that are usually so well ventilated that the gaswill enter them at once. It may be more difficult to prevent the growth of shantytownsthan of permanent buildings, but it is also more important to do so.

The need to keep hazardous plants and concentrations of people apart has been known for a long time. In the 19th century a series of explosions in fireworks and explosivesfactories in the United Kingdom led ultimately to regulations on location and aninspectorate to enforce them. In 1915, however, the government insisted that TNTshould be manufactured in a factory at Silvertown, a heavily built-up area near London.The owners of the factory, Brunner Mond, objected but were overruled, as explosiveswere urgently needed to support the war effort. In 1917, 54 tons of TNT exploded,devastating the site and the surrounding area. Seventy-three people were killed,including everyone working in the factory, and a hundred were seriously injured. Eighty-three houses were flattened or so badly damaged that they had to be demolished and 765were seriously damaged and needed new interiors. After the explosion the officials whohad insisted that production of TNT at Silvertown was essential now said that the loss of the factory would make no practical difference to the output of munitions 16.

The immediate cause of the explosion is unknown, but the underlying cause was theerroneous belief that TNT was not very dangerous. It was not covered by the ExplosivesAct, although another TNT factory had blown up in 1915. Compare the quotation at thehead of this chapter.

10.3 Why did a runway reaction occur?The MIC storage tank became contaminated by substantial quantities of water andchloroform, up to a tonne of water and 1 tonnes of chloroform, and this led to acomplex series of runaway reactions, a rise in temperature and pressure and discharge of MIC vapour from the storage tank relief valves 17. The precise route by which the water entered the tank is not known, though several theories have been put forward 18,19 . One


67/73


63

theory is that it came from a section of vent line some distance away that was beingwashed out. This vent line should have been isolated by a slip-plate (spade) but it had not

been fitted. However, the water would have had to pass through six valves in series andit seems unlikely that a tonne could have entered the tank in this way. Another theory isthat the water entered via the nitrogen supply line. Kalelkar has argued convincingly that

there was a deliberate act of sabotage by someone who did not realize what the results of his actions would be 20. This theory has been criticised by many people who sympathisedwith the victims and thought an attempt was being made to whitewash [exonerate] UnionCarbide. This was not the case. The company is still responsible for stocking more MICthan is necessary, for allowing a shantytown to grow alongside the plant, for not keeping

protective equipment in working order (see next section) and for all the other deficienciesdiscussed later in this chapter.

When we are looking for the underlying causes of the accident, rather than the immediatecause, the route by which the water entered the MIC tank hardly matters. Since it is wellknown that water reacts violently with MIC, no water should have been allowed

anywhere near the equipment, for washing outlines or for any other purpose. If water isnot there, it cannot lead in or be added deliberately. If any of the suggested routes were possible, then they should have been closed before the disaster occurred. So far as isknown, no hazard and operability study (HAZOP) 21, 22 was carried out on the designthough HAZOP is a powerful tool, used by many companies for many years, for identifying routes by which contamination (and other unwanted deviations) can occur.

10.4 Keep protective equipment in working order - and size it correctlyThe storage tank was fitted with a refrigeration system which should have absorbed theMIC discharged through the relief valve was not in full working order. The flare systemthat should have burned any MIC that got past the scrubbing system was disconnectedfrom the plant for repair. The high temperature and pressure on the MIC tank were atfirst ignored, as the instruments were poorly maintained and known to be unreliable 23.The high temperature alarm did not operate as the set point had been altered and was toohigh 24. One of the main lessons from Bhopal is thus the need to keep all protectiveequipment in full working order.

It is easy to buy safety equipment; all we need is money and if we make enough fuss weget it in the end. It is much more difficult to make sure that the equipment is kept in fullworking order, especially when the initial enthusiasm has worn off. Procedures,including testing and maintenance procedures, are subject to a form of corrosion morerapid than that which affects the steelwork and can vanish without trace in a few monthsonce managers lose interest. A continual auditing effort is needed by managers at alllevels to make sure that procedures are maintained (see Chapter 6).

Sometimes procedures lapse because managers lose interest. Unknown to them,operators discontinue safety measures. At Bhopal it went further than this.Disconnecting the flare system and shutting down the refrigeration system are hardlydecisions that operators are likely to take on their own. The managers themselves musthave taken these decisions and thus shown a lack of understanding and/or commitment.


68/73


64

It is possible that the protective equipment was out of use because the plant that producedthe MIC was shut down and everyone assumed that the equipment had been installed to

protect the plant rather than the storage. Runaway reactions, leaks and discharges fromrelief valves are more common on plants than on storage systems but they are by no

means unknown on storage systems. Twenty-four of the hundred largest insurance lossesin a thirty-year period occurred in storage areas and their value was higher thanaverage 25. Furthermore, since a relief valve was installed on the storage tank, it wasliable to lift and the protective equipment should have been available to handle thedischarge. As stated in Chapter 9, if the designers were sure that a relief valve wouldnever lift there would have been no need to install it.

It has been argued that the refrigeration, scrubbing and flare systems were not designed tocope with a runaway reaction of the size that occurred and that there would have been asubstantial discharge of MIC to atmosphere even if they had all been in full workingorder. This may be so, but they would certainly have reduced the size of the discharge

and delayed its start.The relief valve was too small for the discharge from a runaway reaction. The pressurein the storage vessel, designed for a gauge pressure of 40 psi (2.7 bar), reached 200-250

psi (14-17 bar). The vessel was distorted and nearly burst. If it had burst the loss of lifemight have been lower as there would have been less dispersion of the vapour. The relief valve was designed to handle vapour only but the actual flow was a two-phase mixture of vapour and liquid 26.

If the protective equipment was not designed to handle a runaway, or two-phase flow, weare entitled to ask why. Were the possibilities of a runaway or two-phase flow notforeseen or were they considered so unlikely that it was not necessary to guard againstthem? What formal procedures were used during design to answer these questions?

Although the managers (and also the operators, but they take their cue from themanagers) showed less competence and commitment to safety than might reasonablyhave been expected, we should not assume that Indian managers (and operators) are ingeneral less competent than those in the west. There are poor managers in every countryand there is no reason to believe than the standard in India is any lower than elsewhere.In one respect the managing director of Union Carbide India Limited showed moreawareness than his American colleagues: He queried the need for so much more storage

but was overruled.

Bhopal illustrates the limitations of hazard assessment techniques both before theaccident and after it happens - by fault tree or similar techniques. Most analysts wouldhave estimated the failure rates of the refrigeration, scrubbing and flare systems butwould not have considered the possibility that they might all be switched off. Hazardassessments become garbage if the assumptions on which they are based are no longer true.


69/73


65

Similarly, estimates of human error are usually estimates of the probability that a manwill forget to carry out a task, such as closing a valve, or carry it out wrongly. We cannotestimate the probability that he will make a conscious decision not to close it, either

because he considers it unnecessary to do so or because he wishes to sabotageoperations 27.

Some reports on Bhopal suggested that the instrumentation there was less sophisticatedthan on similar plants in the United States and that this may have led to the accident.This is a red herring [distraction]. If conventional instrumentation was not adequatelymaintained and its warnings were ignored, then there is no reason to believe thatcomputerised instrumentation would have been treated any differently. In fact thereverse may be the case. If people are unable to unwilling to maintain basic equipment,they are less likely to maintain sophisticated equipment. Nevertheless, during theinvestigation of accidents that have occurred because the safety equipment provided wasnot used, people often suggest that more equipment is installed (see Chapter 6).

Another protective device was a water spray system that was designed to absorb smallleaks at or near ground level. It was not intended to absorb relief valve discharges at ahigh level and failed to do so.

10.5 Joint venturesThe Bhopal plant was half-owned by a US company, Union Carbide Corporation, andhalf-owned locally. Although Union Carbide Corporation had designed the plant and had

been involved in the start up, by the time of the accident the Indian company had becomeresponsible for operations, as required by Indian law.

In the case of such joint ventures it is important to be clear as to who is responsible for safety in design and operation. The technically more sophisticated partner has a specialresponsibility if it is not directly responsible. It should make sure that the operating

partner has the knowledge, skill, commitment and resources necessary for safe operation.If not, it should not go ahead with the venture. It cannot shrug off responsibility bysaying that it is no longer in full control. Soon after Bhopal one commentator wrote, multinational companies and their host countries have got themselves into asituation in which neither feels fully responsible. 28

People who sell or give dangerous articles to children are responsible if the childreninjure themselves or others. Similarly, if we give dangerous plant or material to peoplewho have not demonstrated their competence to handle it, we are responsible for theinjuries they cause.

For Union Carbide Corporation the Bhopal plant was a backwater, making littlecontribution to profits, in fact often losing money, and may have received less than itsfair share of management resources 29. At Flixborough (Chapter 8) the partner withknowledge of the technology (Dutch State Mines) was in control.


70/73


66

10.6 Training in loss preventionBhopal makes us ask if the people in charge of the plant, and those who designed it,received sufficient training in loss prevention 30. If they do not they are not able to jointhe Institution of Chemical Engineers as full or corporate members. In most other countries, including the United States, most undergraduate chemical engineers receive no

such training, although the American Institute of Chemical Engineers is now encouraginguniversities to introduce it.

There are several reasons why loss prevention should be included in the training of chemical engineers 31:

1. Loss [accident] prevention should not be something added on to a plant after design like a coat of paint but an integral part of design. Hazards should,whenever possible, be removed by a change in design, such as reduction ininventory, rather than by adding on protective equipment. The designer shouldnot ask the safety adviser to add on the safety features for him; he should be

taught to design a plant that does not require added-on safety features.2. Most engineers never use much of the knowledge they acquire as students but

almost all have at some time to take decisions on loss prevention. Universitiesthat give no training in loss prevention are not preparing their students for thetasks they will have to undertake.

3. Loss prevention can be used to illustrate many of the principles of chemicalengineering and to show that many problems that at first sight do not seem tolend themselves to numerical treatment can in fact be treated quantitatively.

Since in many countries universities are not providing training in chemical engineering,companies should make up the deficiency by internal training. Many try to but often doso in a rather haphazard way - an occasional course or lecture. Few companies put allnew recruits through a planned program.

At Bhopal the original managers had left and had been replaced by others whoseexperience had been mainly in the manufacture of batteries. There had been eightdifferent managers in charge of the plant in 15 years 32. Many of the original operatorshad also left and one wonders how well their successors were trained 33.

However, while these facts, and reductions in manning, may be evidence of poor management and a lack of commitment to safety I do not think that they contributeddirectly to the accident. The errors that were made, such as disconnection of safetyequipment and resetting trips at too high a level, were basic ones that cannot be blamedon inexperience of the particular plant. No manager who knew and accepted the first

principles of loss prevention would have allowed them to occur.

10.7 Handling emergencies More than any other accident described in this book Bhopal showed up deficiencies in the


71/73


67

procedures for handling emergencies, both by the company and by the local authorities. Itshowed clearly the need for companies to collaborate with the emergency services inidentifying incidents that might occur and their consequences, drawing up plans to copewith them and exercising these plans. In the United Kingdom this is now required bylaw34. This aspect is discussed in reference 35.

10.8 Public responseIn the United States Bhopal produced a public reaction similar to that produced in theUnited Kingdom by Flixborough (Chapter 8) and in the rest of Europe by Seveso(Chapter 9). Many companies spent a great deal of money and effort making sure that asimilar accident could not occur on their plants. Even so, Bhopal seems to have producedless regulatory fallout than Flixborough or Seveso. The U.S. chemical industry hastried to convince the authorities that it can put its own house in order. In particular theAmerican Institute of Chemical Engineers set up a Center for Chemical Process Safety,generously funded by the chemical industry, to provide advice on loss prevention. Oneof its objectives is to have loss prevention included in the training of undergraduates.

The Chemical Manufacturers Association has launched a Community Awareness andResponse 9CAER) program to encourage companies to improve their emergency plansand a National Chemical Response Information Center to provide the public andemergency services with advice and assistance before and during emergencies.

Nevertheless in a paper called "A field day for the legislators" Stover 36 lists thirty-twoU.S. Government proposals or activities and thirty-five international activities that had

been initiated by the end of 1985. In addition there have been state and local responses inthe U.S. These have been reviewed by Horner 37.

In India there were, of course, extensive social effects. They are reviewed in reference38.

After Bhopal many international companies reviewed the extent to which they controlledand audited the subsidiaries. Chapters 4 and 5 also showed what can happen when theyare left to do as they wish. Jim Whiston has described the changes made by ICI in theyears after Bhopal.

Terrible though Bhopal was, we should beware of over-reaction and of suggestions thatinsecticides, or even the whole chemical industry, are unnecessary. Insecticides, byincreasing food production, have saved far more people than Bhopal has killed. ButBhopal was not an inevitable result of insecticide manufacture. By better design or by

better operation, by just one of the recommendations summarised in Figure 10.2, Bhopalcould have been prevented. The most effective methods of prevention are those near the

bottom of the diagram, such as reduction in inventory or change in the process. Thesafety measures at Bhopal, such as the scrubber and the flare stack, were too near the topof the chain, too near the top event. If they failed there was nothing to fall back on. To

prevent the next Bhopal we need to start at the bottom of the chain.


72/73


68

References :

1. Bidwai, P., quoted by Bogard, W., The Bhopal Tragedy , Westview Press, Boulder,Colorado, 1989, p.14.

2. Tachakra, S.W., Journal of Loss Prevention in the Process Industries . Vol.1, No.1,

January 1988, p..3.3. Free Labour World , International Federation of Free Trade Unions, Brussels,Belgium. No. 1/86, 18 January 1986, p.1.

4. Shrivastava, P., Bhopal - Anatomy of a Crisis , Ballinger, Cambridge,Massachusetts, 1987. p.64.

5. Lees, F.P., Loss Prevention in the Process Industries . Vol.2, Butterworths, London1980. Appendix 3.

6. BLEVE - The Tradegy of San Juanico , Skandia International, Stockholm, 1985.7. Hazardous Cargo Bulletin , June 1984, p.34.8. Chemical Week . 23 January 1985, p.8.9. Chemistry in Britain . Vol.21, No.2, Feb.1985, p.123.

10. Wade, D.E., Proceedings of the International Symposium on Preventing Major Chemical Accidents . American Institute of Chemical Engineers, Washington, DC,3-5 February 1987, Paper 2.1.

11. Chemical Insight . Late Nov.1985, p.1.12. Kletz, T.A., Chemical Engineering , Vol.83, No.8, 12 April 1976, p.124.13. Kletz, T.A., Chemistry and Industry , 6 May 1978, p.37.14. Kletz, T.A., Hydrocarbon Processing , Vol.59, No.8, Aug. 1980, p.137.15. Reuben, B.M., Private Communication .16. Neal, W., With Disastrous Consequences , Hisarlik Press, London, 1992, Chapters 3

and 7.17. Bhopal Methyl Isocyanate Incident: Investigation Team Report , Union Carbide

Corporation, Charleston, South Carolina, March 1985.18. The Trade Union Report on Bhopal , International Federation of Free Trade Unions

and International Federation of Chemical, Energy and General Workers' Unions,Geneva, Switzerland, 1985.

19. Varadarajan, S. et al., Report on Scientific Studies on the Factors related to Bhopal Toxic Gas Leakage , Indian Planning Commission, Delhi, India, Dec. 1985.

20. Kalelkar, A.S., Investigations of large magnitude incidents - Bhopal as a case study . Preventing Major Chemical and Related Process Accidents, Symposium,Series No.110, Institution of Chemical Engineers, Rugby, UK, 1988, p.553.

21. Kletz, T.A., Hazop and Hazan - Identifying and Assessing Process Industry Hazards , 3rd edition, Institution of Chemical Engineers, Rugby, UK, 1992.

22. Knowlton, R.E., A Manual of Hazard and Operability Studies , ChemeticsInternational, Vancouver, Canada, 1992.

23. New York Times . 28 Jan-3 Feb 1985.24. Shrivastava, P., The Accident at Union Carbide Plant in Bhopal - A case Study . Air

Pollution Control Association Conference on Avoiding and ManagingEnvironmental Damage from Major Industrial Accidents, Vancouver, Canada, 3-6

Nov. 1985.


73/73

25. One Hundred Largest Losses , Marsh and McLennan, Chicago, Illinois, 8th edition.1985.

26. Swift, I.. In The Chemical Industry after Bhopal , Proceedings of a Symposium,London, 7/8 November 1985, IBC Technical Services.

27. Kletz, T.A., An Engineer's View of Human Error , 2nd edition, Institution of

Chemical Engineers, Rugby, UK, 1991, Chapter 5.28. Smith, A.W., The Daily Telegraph , 15 Dec. 1984, p.15.29. As ref.4 p.51.30. First Degree Course including Guidelines on Accrediting of Degree Course ,

Institution of Chemical Engineers, Rugby, UK, 1989.31. Kletz, T.A., Plant/Operations Progress . Vol.7, No.2, April 1988, p.95.32. As ref. 4. p.52.33. The Bhopal Papers . Transnationals Information Centre, London, 1986, p.4.34. Control of Industrial Major Accident Hazard Regulations , Statutory Instrument

No.1902. Her Majesty's Stationery Office, London, 1984.35. As ref.4 Chapter 6.

36. Stover, W., In The Chemical Industry after Bhopal , Proceedings of a Symposium,London, 7/8 November 1985, IBC Technical Services.37. Horner, R.A., Journal of Loss Prevention in the Process Industries , Vol.2, No.3,

July 1989. p.123.38. As ref.4. Chapters 4 and 5.

L9 Incident Investigation Student Handout

Documents

Transcript of L9 Incident Investigation Student Handout