Learning from Accidents

Trevor Kletz

• Publisher: Routledge
• Year: 2007
• Print ISBN: 9780750648837
• eBook ISBN: 9781136388132
• Topic: Technologie et ingénierie
• Subtopic: Ingénierie de la chimie et de la biochimie

Review of previous edition: "Trevor Kletz's book makes an invaluable contribution to the systematic, professional and scientific approach to accident investigation". The Chemical Engineer Fully revised and updated, the third edition of Learning from Accidents provides more information on accident investigation, including coverage of accidents involving liquefied gases, building collapse and other incidents that have occurred because faults were invisible (e.g. underground pipelines). By analysing accidents that have occurred Trevor Kletz shows how we can learn and thus be better able to prevent accidents happening again. Looking at a wide range of incidents, covering the process industries, nuclear industry and transportation, he analyses each accident in a practical and non-theoretical fashion and summarises each with a chain of events showing the prevention and mitigation which could have occurred at every stage. At all times Learning from Accidents, 3rd Edition emphasises cause and prevention rather than human interest or cleaning up the mess. Anyone involved in accident investigation and reporting of whatever sort and all those who work in industry, whether in design, operations or loss prevention will find this book full of invaluable guidance and advice.

Chapter 1

Two simple incidents

Last year, at the Wild Animal Park in Escondido, California, my younger daughter got her first glimpse of a unicorn. She saw it unmistakeably, until the oryx she was looking at turned its head, revealing that, in fact, it had two horns. And in that moment, she learned that the difference between the mundane and the magical is a matter of perspective.

B. Halpern¹ (Figure 1.1)

In the same way, when we look at an accident, we may see technical oversights, hazards that were not seen before or management failings; what we see depends on the way we look.

This chapter analyses two simple accidents in order to illustrate the methods of ‘layered’ accident investigation and to show how much more we can see if we look at the the accidents from different points of view. They also show that we should investigate all accidents, including those that do not result in serious injury or damage, as valuable lessons can be learned from them. ‘Near misses’, as they are often called are warnings of coming events. We ignore them at our peril, as next time the incidents occur the consequences may be more serious. Engineers who brush aside a small fire as of no consequence are like the girl who said by way of excuse that it was only a small baby. Small fires like small babies grow into bigger ones (see Chapter 18).

1.1 A small fire

A pump had to be removed for repair. The bolts holding it to the connecting pipework were seized and it was decided to burn them off. As the plant handled flammable liquids, the pump was surrounded by temporary sheets of a flame-resistant material and a drain about a metre away was covered with a polyethylene sheet. Sparks burned a hole in this sheet and set fire to the drain. The fire was soon extinguished and no one was hurt. The atmosphere in the drain had been tested with a flammable gas detector two hours before burning started but no gas was detected, probably because flammable gas detectors will work only when oxygen is present and there was too little oxygen below the sheet. It is possible, however, that conditions changed and flammable vapour appeared in the drain during the two hours that elapsed before burning started.

Figure 1.1 Unicorn or oryx? What we see depends on the way we look (Copyright: Bill Clark)

First layer recommendations: Preventing the accident

In future we should:

• Cover drains with metal or other flame-resistant sheets before allowing welding or burning nearby.
• Test the atmosphere above the sheets, not below them.
• Test the atmosphere immediately before welding starts, not several hours before. In addition, install a portable flammable gas detector which will sound an alarm if conditions change and gas appears while welding or burning are in progress.

These recommendations apply widely, not just on the unit where the fire occurred, so the information should be passed on to other plants.

Second layer recommendations: Avoiding the hazard

Why were the bolts seized? Lubricants which prevent seizure, even at the high temperatures used in this case, are available. Whose job is it to see the need for such lubricants and see that they are used?

In an area where flammable liquids or gases are handled seized bolts would normally be cut off rather than burned off. In the present case access was so poor that it was decided to burn them off. Why was access so poor? The normal policy in the company was to build a model of the plant before detailed design is carried out and to review access for maintenance on the model (as well as access for operations, means of escape and many other matters). What went wrong in this case? Was the model review really carried out and were operating and maintenance people present?

Third layer recommendations: Improving the management system

Did the men on the job understand that flammable gas detectors will not detect flammable gas unless it is mixed with air (or oxygen) in the flammable range. Many operators do not understand this limitation of flammable gas detectors. Is this point covered in their training? What is the best way of putting it across so that people will understand and remember?

The plant instructions said that drains must be covered with flame-resistant sheets when welding or burning take place nearby. Over the years everyone had got into the habit of using polyethylene sheets. Did the managers not notice? Or did they notice and turn a blind eye? (‘I’ve got more important things to do than worry about the use of the wrong sort of sheet’.) To prevent the fire, it needed only one manager to keep his eyes open, see that polyethylene sheets were being used, and ask why. On this plant do the managers spend a few hours per day out on the site with their eyes open or do they feel that wandering round the site can be left to the foremen and that their job is to sit in their office thinking about technical problems?

Note that I am using the word ‘manager’ in the United Kingdom sense of anyone working at the professionally qualified level and that it includes people who in many United States companies would be called supervisors or superintendents.

Some readers may feel that I am making heavy weather of a minor incident but questions such as these are unlikely to be asked unless an incident or series of incidents throw them into focus. Obviously the answers given and the changes made will depend on whether the incident is an isolated one or if other incidents have also drawn attention to weaknesses in training, managerial powers of observation and so on.

The investigating team for an incident such as this would not normally contain any senior managers and we would not expect the unit manager or supervisor to think of all the second and third layer recommendations. But more senior managers should think of them when they read the report and should not approve the report until they have been checked. Nor does it take any longer to think of the deeper recommendations as well as the obvious ones. The resource needed is a realisation that such recommendations are possible and necessary, rather than additional time to spend on investigations.

Figure 1.2 Summary of Section 1.1 – A small fire

Figure 1.2 summarises, on a time scale, the events leading up to the accident and the recommendations made. It should be read from the bottom up. First, second and third layer recommendations are indicated by different typefaces. First layer recommendations, the immediate technical ones, are printed in ordinary type, second layer recommendations, ways of avoiding the hazard, are printed in italics and third layer recommendations, ways of improving the management system, are printed in bold type. The same scheme is followed in later chapters though the allocation between categories is inevitably in some cases a matter of opinion. Thus Hazop is shown as a means of avoiding the hazard but might equally well be considered a means of improving the management system.

The diagram shows us that there were many opportunities of preventing the accident, by breaking the chain of events that lead up to it at different points. Some of the actions had to be taken shortly before the accident occurred, others a long time before. Some of these actions would have removed the immediate causes while others would have removed the hazard or dealt with the weaknesses in the management system which were the underlying causes.

In general, the most effective actions are those at the bottom of the diagrams. If we are constructing defences in depth we should make sure that the outer defences are sound as well as the inner ones. Protective measures should come at the bottom of the accident chain and not just at the top. In many of the accidents described later there was too much dependence on the last lines of defence, the protective measures at the top of the accident chain. When these defences failed there was nothing in reserve.

1.2 A mechanical accident

This section describes an accident to a mixer – but it is really about all accidents, so please read it even if you never have to design or operate a mixer.

A mixing vessel of 1 m³ (264 US gallons) capacity was fitted with a hinged, counter-weighted lid (Figure 1.3). To empty the vessel the lid was opened (Figure 1.4), the vessel rotated anti-clockwise and the contents shovelled out (Figure 1.5). One day the lid fell off and hit the man who was emptying the vessel. Fortunately his injuries were not serious.

Figure 1.3 The mixing vessel in use

Figure 1.4 The lid is opened

Figure 1.5 The vessel is rotated so that the contents can be removed

It was then found that the welds between the lid and its hinges had cracked. It was a fatigue failure, caused by the strains set up by repeated opening and closing of the lid. There was nothing wrong with the original design but the lid had been modified about ten years before the incident occurred and, in addition, some repairs carried out a few years before had not been to a high enough standard.

Detailed recommendations were made for the repair of the lid. Though necessary they do not go far enough. If we look at the inner layers of the onion, four more recommendations are seen to be necessary (Figure 1.7):

Figure 1.6

Figure 1.7 Summary of Section 1.2 – A mechanical accident

(1)

What is the system for the control of modifications? Is anyone who thinks he can improve a piece of equipment allowed to do so? Before any equipment is modified the change should be approved by a professionally qualified engineer who tries to make sure that the change is to the same standard as the original design and that there are no unforeseen side-effects (see Section 7.1). This is one of the lessons of Flixborough (Chapter 8). Many other accidents have occurred because plants or processes were modified and no one foresaw the consequences of the change^2^–^4. After a modification has been made the engineer who approved it should inspect the c...

Table of contents

• Front Cover
• Half Title
• Dedication
• Title Page
• Copyright
• Contents
• Forethoughts
• Preface
• Acknowledgements
• Introduction
• 1 Two simple incidents
• 2 Protective system failure
• 3 Poor procedures and poor management
• 4 A gas leak and explosion – The hazards of insularity
• 5 A liquid leak and fire and the hazards of amateurism
• 6 A tank explosion – The hazards of optional extras
• 7 Another tank explosion – The hazards of modification and ignorance
• 8 Flixborough
• 9 Seveso
• 10 Bhopal
• 11 Three Mile Island
• 12 Chernobyl
• 13 Aberfan
• 14 Missing recommendations
• 15 Three weeks in a works
• 16 Pipe failures
• 17 Piper Alpha
• 18 The King’s Cross underground railway station fire
• 19 Clapham Junction – Every sort of human error
• 20 Herald of Free Enterprise
• 21 Some aviation accidents
• 22 Invisible hazards
• 23 Signals passed at danger
• 24 Longford: the hazards of following fashions
• 25 The Gresford Colliery explosion
• 26 Green intention, red result
• 27 Looking beyond violations
• 28 Keeping an open mind
• 29 Secondhand software: the Therac story
• 30 Conclusions
• Appendix 1
• Appendix 2
• Appendix 3
• Afterthought
• Index