L9 Incident Investigation Student Handout

INCIDENT/ACCIDENT INVESTIGATION AND ROOT CAUSE ANALYSIS
NPC TRAINING PROGRAM
STUDENT HANDOUT
Presented by Ron Rosser & Mike Breward
Calgary Tel 1-403-221-8077 Fax 1-403-221-8072 E-mail: info@seal.ab.ca Website: www.seal.ab.ca
Table of Contents
COURSE OBJECTIVES.................................................................................................. 1 COURSE OBJECTIVES ....................................................................................................... 1 AGENDA ........................................................................................................................... 2 AGENDA........................................................................................................................... 2 Day 1........................................................................................................................... 2 Day 2........................................................................................................................... 2 INCIDENT INVESTIGATION FLOW PATH ............................................................. 3 WHY INVESTIGATE INCIDENTS?....................................................................................... 4 TEAM EXERCISE............................................................................................................... 4 WHY INVESTIGATE INCIDENTS?....................................................................................... 5 INCIDENT RECURRENCE ........................................................................................... 6 INCIDENT ......................................................................................................................... 6 QUESTIONS THAT NEED TO BE ASKED ............................................................................ 6 RECOMMENDATIONS ........................................................................................................ 6 INCIDENT VIDEO - 'NOBODY'S FAULT' ............................................................................ 8 PRESERVATION OF EVIDENCE .......................................................................................... 9 Segment Objectives:.................................................................................................... 9 There are four types of evidence:................................................................................ 9 POSITION EVIDENCE ...................................................................................................... 10 PHOTOGRAPHS:.............................................................................................................. 11 POSITION MAPS: ............................................................................................................ 11 PEOPLE EVIDENCE ......................................................................................................... 12 Interviewing Techniques ........................................................................................... 12 PARTS EVIDENCE ........................................................................................................... 14 PAPER EVIDENCE ........................................................................................................... 15 INTERVIEWING EXERCISE............................................................................................... 16 INCIDENT REPORTING ............................................................................................. 17 SEGMENT OBJECTIVES: .................................................................................................. 17 INCIDENT INVESTIGATION FLOW PATH............................................................ 18 TEAM EXERCISE : WHY REPORT INCIDENTS?.................................................................. 19 WHY REPORT INCIDENTS ............................................................................................... 20 IMPORTANCE OF QUALITY DATA ................................................................................... 24 CASE STUDY .................................................................................................................. 25 Bhopal ....................................................................................................................... 25 ANALYZING TO ROOT CAUSE......................................................................................... 26 ROOT CAUSE ANALYSIS................................................................................................. 28 CASE STUDY PHYSICAL ROOTS...................................................................................... 32 NOBODYS FAULT LATENT ROOT CAUSE ANALYSIS .................................................. 30 TEAM EXERCISE : ROOT CAUSE ANALYSIS .................................................................... 32
INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International I
INCIDENTS TO INVESTIGATE................................................................................. 34 SEGMENT OBJECTIVES: .................................................................................................. 34 INCIDENT INVESTIGATION FLOW PATH .......................................................................... 35 SPORADIC INCIDENT ...................................................................................................... 36 CHRONIC INCIDENT ........................................................................................................ 37 FAILURE MODES AND EFFECTS ANALYSIS (FMEA) ...................................................... 39 USING FMEA IN YOUR COMPANY .................................................................................. 39 FMEA WORKSHEET................................................................................................ 40 REPORTING AND RECOMMENDATIONS ........................................................................... 41 WHY INVESTIGATE INCIDENTS?..................................................................................... 41 MAKING APPROPRIATE RECOMMENDATIONS................................................................. 41 NOBODYS FAULT LATENT ROOT CAUSE ANALYSIS ..................................................... 42 SMALL GROUP EXERCISE ............................................................................................... 43 CLASS INCIDENT ............................................................................................................ 44 APPENDIX...................................................................................................................... 48 GENERAL REFERENCES........................................................................................... 48 BHOPAL CASE STUDY ............................................................................................... 48 GENERAL REFERENCES:................................................................................................. 49 BHOPAL CASE STUDY .................................................................................................... 50 Introduction............................................................................................................... 50 Methyl Isocyanate (M.I.C.) ....................................................................................... 51 Toxicological Effects Acute .................................................................................. 51 Immediate Causes ..................................................................................................... 52 Three Questions:....................................................................................................... 54 Basic Causes ............................................................................................................. 54 SCHEMATIC LAYOUT OF COMMON HEADERS OF MIC STORAGE TANKS ........................ 58
INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International
II
COURSE OBJECTIVES
Course Objectives
The objectives for this course are: Define the purpose of incident investigation. Explain the importance of incident reporting. Describe evidence preservation techniques. Describe the investigation flow path. Define key terms used in incident investigation. Correctly complete incident reporting and investigation data. Analyze the causes of incidents. Make recommendations to prevent incident recurrence. Explain the importance of determining root cause.
What are your expectations for the course?
AGENDA
Agenda
Day 1
Introductions Why Investigate Incidents? Preservation of Evidence Incident Reporting Incidents to Investigate
Day 2
Case Study - Bhopal Analyzing to Root Cause Reporting and Recommendations Group Exercise Course Wrap-Up
This workshop covers a great deal of material. To ensure that the course can be completed as planned, please stay within the assigned time frames for team exercises and breaks.
INCIDENT INVESTIGATION FLOW PATH
UNDESIRED EVENT
FOLLOW INCIDENT GUIDELINES
Yes
IS THE CAUSE EVIDENT?
No
DETERMINE CALL OUT REQUIREMENT S
FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER. COMPLETE INCIDENT REPORT FORWARD TO INCIDENT INVESTIGATION ADMINISTRATOR.
NEAR MISS EXTRAORDINARY
MINOR
SERIOU S
MAJOR
INVESTIGATE NOW?
Yes OTHER DATA -PMS LOGS -HOT LINE ASSIGN INVESTIGATION TEAM LEADER No DETERMINE:TEAM MEMBERSHIP DATA REQUIREMENTS -PMT REPRESENTATIVES -LCR & QA RECORDS -EXPERTS -EQUIPMENT HISTORY -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS -CRITICS -INTERVIEW REQUIREMENTS
DATABASE FOR FUTUR E INVESTIGATION & ANALYSIS
PERFORM F.M.E.A.
PERFORM K.T. PROBLEM ANALYSIS OR ALTERNATIVE ANALYTICAL TECHNIQUE TO DETERMINE PHYSICAL CAUSE(S)
MANAGEMENT REVIEW/SELECTION
CAUSE(S) FOUND? Yes PERFORM ROOT CAUSE ANALYSIS TO IDENTIFY MANAGEMENT SYSTEM INADEQUACIES
No
PROCESS & MAINTENANCE TEAMS ATS CAUS E FOUND
No Yes
COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENT TEAM
Why Investigate Incidents?

Segment Objectives: To illustrate the importance of incident investigation. To discuss the concept of incident recurrence. To introduce the first segment of the case study exercise.
Team Exercise
Working in your teams, brainstorm a list of reasons why we investigate incidents.

To recognize the unsafe acts and/or conditions that caused the incident. To identify the management system that failed to prevent it from happening. To recommend remedial actions that will prevent it from happening again.
INCIDENT RECURRENCE
Incident
A person falls from a ladder. Unsafe act - climbing a defective ladder. Recommendation - replace the ladder.
Questions That Need To Be Asked

Why was the ladder not inspected? Was the employee properly trained? Was the employee informed not to use the ladder?
Recommendations
An improved ladder inspection program. Improved training. A clearer definition of responsibilities.
INCIDENT TRAJECTORY MODEL FOR LOSS

(Active and Latent Errors) Gaps at any level create an incident inducing environment
Inadequate defenses
Incident contact
(Active Error)
LOSS
Process & physical work environment

(Active/ Latent Errors)
HSE Management Systems

Trajectory
Incident
(Latent errors -Root Causes)
Corporate commitment
(Latent Errors - Root causes)
Incident Video - 'Nobody's Fault'

It is important to keep notes of what you observe during the video, as you will need this information to complete later segments of the case study exercise. Names of People and Roles (boss, worker, etc.)
Information/Facts:
Notes:
Preservation of Evidence
Effective preservation of evidence is the key building block to a successful investigation.
Segment Objectives:
To introduce the four P's of evidence preservation. To explain the use of evidence preservation techniques and their importance in the incident investigation process. To demonstrate common techniques used for gathering evidence.
There are four types of evidence:

Position evidence: People evidence: Parts evidence: Paper evidence:
These are known as the Four P's.
PRESERVATION OF EVIDENCE
F R A G I L I T Y
P O S I T I O N MINS
P E O P L E HRS
P A R T S
PAPER
DAYS WEEKS
Position Evidence
Pilot Plant Number 1

Burnt dust sheet
Pilot Plant Number 2
Steam Trap Packing crate
New equipment Overhead Gallery
Electric Cable
Packing material Broken glass Stains on floor
Bunsen burner Taffys work area
Position evidence is the most fragile of all evidence. This form of evidence should be gathered as soon as possible after an incident has occurred. There are several easy ways to record position evidence. The two types of position evidence we will discuss today are: photographs position maps
10
Photographs:
Position Maps:
11
People Evidence
Interviewing Techniques
Interview one individual at a time (one on one). Neutral, private setting. Depersonalize. Use open-ended questions to gather information. Use close-ended questions to confirm information. Follow; dont lead. Listen and record; do not comment. Encourage follow-up.
People evidence is the second most fragile type of evidence we can gather in an incident investigation. The primary method we use for gathering people evidence is personal interviews. Relevant information is not restricted to the incident itself, but includes the standards and practices of the work group, the normal operating conditions and any past incidents of a similar nature. An interviewer should be able to extract useful information of that nature. People's ability to remember details regarding a situation diminishes quickly. Therefore it is imperative that witnesses are interviewed as quickly as possible. In addition, most people are not trained observers. They tend to interpret or rationalize what they have seen and fill in missing gaps with assumptions or pieces of information they have heard from others associated with the incident.
12
Notes:
13
Parts Evidence
Parts must be retrieved, labeled and protected against damage so that analyses can be conducted. All too often critical parts are thrown away or damaged, resulting in the loss of valuable evidence. If a part is moved, it first should be photographed where it was found and then placed in an appropriate container. Each part should be labeled to identify what it is and where it was found. This also applies to material or liquid that has been spilled or discharged as a result of the incident. It is important to be careful when handling these parts and materials, as fractured surfaces may be jagged or spilled material may be hazardous. Notes:
14
Paper Evidence
Paper evidence is the least fragile of all types of evidence. Most paper evidence will be available for analysis several days or weeks after the incident. Some computer evidence, such as process data, will need to be retrieved soon after an incident has occurred, as these systems often download or dump data every twenty-four hours. Notes:
15
Interviewing Exercise
In this next section, your team will have the opportunity to analyze information from the Nobody's Fault incident. You will need: Observations from the video introduction. Position evidence. Notes taken when the instructor answers class questions.
In teams, compose two (2) questions to ask the instructor. One question that is not allowed to be asked is, What caused the fire? Your questions should be designed to enable your team to find out: What happened (sequence of events). How the fire started.
16
INCIDENT REPORTING
Segment Objectives:
To explain the incident reporting process. To describe the incident ratio study. To explain the importance of quality incident data.
17
INCIDENT INVESTIGATION FLOW PATH
UNDESIRED EVENT
FOLLOW INCIDENT GUIDELINES
Yes
No
DETERMINE CALL OUT REQUIREMENT S
FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER. COMPLETE INCIDENT REPORT FORWARD TO INCIDENT INVESTIGATION ADMINISTRATOR.
MINOR
SERIOU S
MAJOR
INVESTIGATE NOW?
Yes OTHER DATA -PMS LOGS -HOT LINE ASSIGN INVESTIGATION TEAM LEADER No DETERMINE:TEAM MEMBERSHIP DATA REQUIREMENTS -PMT REPRESENTATIVES -LCR & QA RECORDS -EXPERTS -EQUIPMENT HISTORY -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS -CRITICS -INTERVIEW REQUIREMENTS
DATABASE FOR FUTUR E INVESTIGATION & ANALYSIS
PERFORM F.M.E.A.
No
PROCESS & MAINTENANCE TEAMS ATS CAUS E FOUND
No Yes
COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENT TEAM
18
Team exercise : Why report incidents?
In your teams, brainstorm a list of reasons why it is important to report incidents: Why are incidents sometimes not reported?
19
Why Report Incidents

What you dont report, you cant investigate. Legal requirements. Develop database of incident reporting and investigation history for future analysis. Identify problems in the operation before they lead to major incidents.
INCIDENT RATIO COMPARISON

Major Injuries
Minor Injuries Property Damage Incidents
Near- Miss Incidents Substandard Act & Conditions
20
Incidents are reported on: An Incident Report Form
Incident Investigations are recorded on: An Incident Investigation Report Form
Notes:
21
INCIDENT REPORT
INSTRUCTIONS: This report is to be filled out by the Onsite Management Representative with the individuals involved in the occurrence and forwarded to the head office. Use additional paper if necessary.
IDENTIFYING INFORMATION DATE OF OCCURRENCE: DATE REPORTED: LOCATION: Where did it occur? (Facility Location, Office, etc.) Type of Incident: __Personal Injury __Inhalation Exposure __Chemical Exposure __Occupational Illness __Employee __Contractor __Equipment Failure __Equipment Damage __Property Damage __Material Loss __Other __Product Mix __T.D.G. Violation __Security / Theft __Explosion / Fire __First Aid __Lost Time Source of Injury Nature of Exposure Medical Outcome EMPLOYER EMPLOYEE SURNAME FIRST NAME(S) LENGTH OF SERVICE JOB CLASSIFICATION AGE __Major Down Time __Contamination __Spill __Other __Medical Treatment __Restricted Work TIME OF OCCURRENCE: WEATHER CONDITIONS:
DESCRIPTION DESCRIBE HOW EVENT OCCURRED (USE ADDITIONAL PAPER IF NECESSARY) (Do not speculate on cause, state only verifiable facts of the events that led up to the Incident)
FUTURE RISK ASSESSMENT (circle appropriate hazard classification level) HOW SERIOUS COULD THIS HAVE BEEN? Major (A) Serious (B) Minor (C) HOW LIKELY IS THIS EVENT TO OCCUR AGAIN? Frequently Occasionally Rarely
22
INCIDENT ANALYSIS
CAUSE ANALYSIS (State Facts, Please Do Not Speculate) IMMEDIATE CAUSES: (WHAT BEHAVIOURS / OR CONDITIONS CAUSED OR COULD CAUSE THIS OCCURRENCE?)
ROOT CAUSES: (WHAT ARE THE REASONS FOR THE ABOVE BEHAVIOURS AND / OR CONDITIONS?)
REMEDIAL ACTION DESCRIBE THE ACTIONS TAKEN AND FOLLOW-UP THAT WILL BE TAKEN TO PREVENT RECURRENCE CORRECTIVE FOLLOW-UP ACTION REQUIRED ACTION BY: LAST NAME, FIRST INITIAL COMPLIANCE DATE DATE COMPLETED
INCIDENT WAS REPORTED TO: Company: Name: Location: Phone No.: *List all agencies contacted ENDORSEMENTS INVESTIGATE BY (PRINT): DATE: MANAGEMENT APPROVAL OF ACTION TAKEN: Name: Signature: Date: SIGNATURE: Agency: Name: Location: Phone No.: Agency: Name: Location: Phone No.:
23
Importance of Quality Data

Incident analysis. External reporting requirements (Ministry of Energy) Litigation purposes. Investigation process.
What is not reported, cannot be investigated. What is not investigated, cannot be changed. What is not changed, cannot be improved, and therefore . . . will happen again.
Notes:
24
Case Study
Bhopal
To provide participants with an opportunity to see the results of a major incident and discuss how they would set up a team to investigate it. Consider what evidence would need to be gathered and how. Further details of the Bhopal Incident can be found in the Appendix.
25
Analyzing to Root Cause

Segment Objectives: To define physical and latent root causes. To clarify the terms used in various incident/accident causation models. To demonstrate the root cause analysis process.
INCIDENT TRAJECTORY MODEL FOR LOSS

(Active and Latent Errors) Gaps at any level create an incident inducing environment
Inadequate defenses
Incident contact
(Active Error)
LOSS
Process & physical work environment

(Active/ Latent Errors)
HSE Management Systems

Trajectory
Incident
(Latent errors -Root Causes)
Corporate commitment
(Latent Errors - Root causes)
26
ANALYSIS MODELS COMPARISON

ROOT CAUSE MODEL
TOP EVENT RESULT
Innad. Defence
INCIDENT TRAJECTORY MODEL

LOSS
PHYSICAL ROOTS
WHY IT HAPPENED
Active/Latent Errors
EHS SYSTEM LATENT ROOTS MANAGEMENT SYSTEM INADEQUACIES ROOT CAUSE
27
Root Cause Analysis

Describe a top event. Determine what events could have caused the top event. Analyze each event to determine its respective causes. Continue analysis on each root until management system cause is determined.
28
TOP EVENT PHYSICAL ROOTS

Batter y Failure
FLASHLIGHT FAILS TO LIGHT
Switch Failure
Bulb Failure
Mfg Defect
Batter y Dead Battery Inverted
Mfg D e fe c t
Broken Filament
Mfg Defect
Corrosion
Improper Voltage Rating
LATENT ROOTS
29
Nobodys Fault Latent Root Cause Analysis STEAM
LEAK (Equipment not isolated)
No pre-work check out system No permit to work procedure
Changes to pipe work not understood

Inadequate communication
Computer data not updated Inadequate procedure update
Poor maintenance standards
Address the root cause would this prevent the incident from recurring?
Poor change management procedures
30
LATENT ROOT CAUSE ANALYSIS

STEAM LEAK (Equipment not isolated) No pre-work check out system No permit to work procedure Changes to pipework not understood Inadequate communication Computer data not updated Inadequate procedure update
NOBODYS FAULT
If these two management system inadequacies were corrected would it prevent further incidents of improper isolation?
31
Case Study Physical Roots
CASE STUDY PHYSICAL ROOTS

Serious Fire in Pilot Plant
Steam Leak (Equipment not isolated)
Open Flame Large Quantity Flammable of Combustibles Chemical (Bunsen (packaging) burner) (Solvent)
Inadequate Response
Notes:
32
Team Exercise : Root Cause Analysis

Notes: Working in your team, conduct a root cause analysis of your assigned root cause. Take the root down to latent cause, management system inadequacy.
33
INCIDENTS TO INVESTIGATE
Segment Objectives:
To introduce the Failure Modes and Effects Analysis (FMEA) process. To provide participants with a mechanism for analyzing incidents.
34
Incident Investigation Flow Path

UNDESIRED EVENT
FOLLOW LOSS CONTROL GUIDELINES
Yes
No
DETERMINE CALL OUT REQUIREMENTS
FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER. COMPLETE INITIAL LOSS CONTROL REPORT FORWARD TO LOSS CONTROL ADMINISTRATOR.
MINOR
SERIOUS
MAJOR
INVESTIGATE NOW?
Yes OTHER DATA -PMS -LOGS -HOT LINE ASSIGN INVESTIGATION TEAM LEADER No DETERMINE:TEAM MEMBERSHIP DATA REQUIREMENTS -PMT REPRESENTATIVES -LCR & QA RECORDS -EXPERTS -EQUIPMENT HISTORY -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS -CRITICS -INTERVIEW REQUIREMENTS
DATABASE FOR FUTURE INVESTIGATION & ANALYSIS
PERFORM F.M.E.A.
No
PROCESS & MAINTENANCE TEAMS ATS CAUSE FOUND
No Yes COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENT TEAM
35
Sporadic Incident
Sudden adverse change in the status quo. Requires remedy through restoration of the status quo. Tends to be dramatic and receive immediate attention. Examples: Major fire, explosion Fatality Structural collapse Major equipment damage Major loss of production Typically incidents costing more than $10 million
Notes:
36
Chronic Incident
Long-standing, adverse situation. Requires remedy through changing the status quo. Usually not dramatic because it often has been occurring for a long time. Often difficult to solve. Sometimes regarded as status quo. Examples: Recurring quality deviation. Recurring equipment failure. System corrosion/erosion. Fugitive emissions. Slips, trips and falls.
Notes:
37
Relationship Between Chronic and Sporadic Incidents

Notes:
Solving a chronic failure changes the status quo
Sporadic Failure
Continual Improvement
Fix
STATUS QUO
Chronic Failures are part of the Status Quo
38
Failure Modes and Effects Analysis (FMEA)

Systematic approach to analyzing failures. Highlights high versus low cost failures. Indicates need for further analysis. Used to prioritize incidents to investigate. Focuses on result rather than causes.
Using FMEA in your company

Obtain incident reporting and investigation data for last six months (incident report records, log books, etc.) Break area down into components, e.g., pumps, valves, etc. Use equipment identification when possible. List actual incidents and cost for each piece of equipment. Estimate production loss. Tabulate incident investigation analysis and determine highest cost items. Investigate at least two incidents from the list. Determine the physical and management system causes for each incident. Recommend actions to prevent recurrence. Repeat every six months.
39
FMEA WORKSHEET
AREA: Plant 13-2 CONDUCTED BY: A.N. Other FROM: 01/01/02 - 06/30/02
40
Reporting and Recommendations

Segment Objective: To identify and explain the steps in developing investigation recommendations and actions. To have teams practice-developing recommendations using the case study example.

To recognize the unsafe acts and/or conditions that caused the incident, To identify the management system that failed to prevent it from happening, and To recommend remedial actions that will prevent it from happening again.
The Investigation Report should satisfy the above criteria. Notes:
Making Appropriate Recommendations

Most important part of an investigation report. Investigation fails if the report merely states the facts and draws conclusions. Corrective actions are needed. Specific recommendations should be made to address each root from your analysis. Actions should be assigned for persons accountable for their completion. Stewardships and action logs should reflect agreed upon actions.
41
Nobodys Fault Latent Root Cause Analysis
STEAM LEAK (Equipment not isolated) No pre-work check out system No permit to work procedure Changes to pipework not understood Inadequate communication Computer data not updated Inadequate procedure update
If these two management system inadequacies were corrected would it prevent further incidents of improper isolation?
Notes:
42
Small Group Exercise

In your teams, use the root cause analysis you created in the last exercise to develop actions that will prevent this incident from recurring. Select a team spokesperson. List your recommendations on a flip chart. Be prepared to present your findings in 10 minutes
Notes:
43
Class Incident
Apply what you have learned. Take notes on Tank Incident. In teams, on flip charts: Whom would you need on your investigation team? How would you collect evidence? Do a root cause analysis.
44
Workers were filling one of two MIBC tanks with water from fire hydrant to valve.
One worker had just checked to see if air was being forced from pressure relief valve on top and had been standing on permanent structure.
45
Worker had on foot on bottom rung of ladder and one foot on concrete after descending when a loud explosion was heard and felt.
46
47
APPENDIX
General References
Bhopal Case Study
48
General References:
Accident Prevention Manual for Industrial Operations: Administration and Program, ninth ed. (National Safety Council, Chicago, Illinois, 1988) p.p. 149 166 ISBN 087912-135-1 Guidelines for Investigating Chemical Process Incidents (American Institute of Chemical Engineers, New York, 1992) ISBN 0-8169-0555-X Bird, Frank Jr. and Germain, George L., Practical Loss Control Leadership (Institute Publishing, Loganville, Georgia, 1986) p.p. 57 95 ISBN 0-88061-054-9 Firenze, Robert J., The Process of Hazard Control (Kendall/Hunt Publishing, Dubuque, Iowa, 1978) p.p. 171 250 ISBN 0-8405-8002-X Ferry, Ted S., Modern Accident Investigation and Analysis (John Wiley & Sons, New York, 1988) ISBN 0 471-62481-0
49
Bhopal Case Study

Introduction
At approximately 12:40 a.m. on December 3, 1984, a control room operator at Union Carbides Pesticide Plant in Bhopal, India noticed very significant changes in plant operating conditions. A storage tank containing Methyl Isocyanate (MIC), used for pesticide production, normally was refrigerated. Yet the temperature, usually at 0C (32F) had risen to 25C (77F). Pressure, normally between 14 Kpa and 172 Kpa (2 psi-25 psi) was rising rapidly beyond 379 Kpa (55 psi). The operator, assistant operators, and MIC supervisor rushed to the storage tank. There was a rumbling sound. A plume of gas was gushing out of the scrubber vent stack. The flare was out. They took emergency action: They tried switching on the refrigeration that had been shut off. They started the scrubber on the stack that had been shut off. They attempted to spray water on the escaping gases.
These attempts all failed, gas continued to escape; and some plant personnel panicked and fled. Approximately 4,000 kg (40 tons) of MIC gas escaped in the form of a heavy cloud over a 45-minute period. The wind was approximately 10 km/hr (6.2 miles/hr). Two large slum areas were located directly across the street. In the panic of the night, well over 100,000 people were urged to flee. Morning found death strewn over a stunned city.
50
At least 2,500 people were killed initially, but as of August 2002 (nearly 18 years later), the death toll is estimated to be 20,000. By most reports, the large majority of deaths were caused by gassing. However, many people also died from blunt injuries. The shantytown had few large streets to facilitate a quick evacuation, and no evacuation plan existed. Residents knew something was wrong. Many felt the burning sensation in their respiratory system, others heard of the toxic release, and they panicked. The population attempted to flee and flooded the streets. The few people who owned cars drove as quickly as possible, often running over the crowds who were running on foot. Many people tripped, fell and were crushed by the crowd. Even in 2002, there still are 120,000 150,000 people suffering from long term health problems resulting from the disaster. There are many and varied medical ailments amongst the survivors, but the most common ones are lung diseases. Ironically only 1 of the 100 workers in the vicinity of the plant was affected, and even then the consequences were not fatal.
Methyl Isocyanate (M.I.C.)

Molecular formula : C2H3NO At normal pressure, boils at 39C (102F). Volatile, with a vapour pressure of 348 mm Hg at 20C (68F). As vapour, it is twice as dense as air, and tends to settle out of still air. The gentle wind on December 3, 1984 moved it slowly along. Has a flash point of 18C (0F).
Toxicological Effects Acute

Before Bhopal, not a single death from MIC had been reported anywhere. Little toxicological data was available regarding the effect on humans.
51
This knowledge increased rapidly after the first autopsy reports from Bhopal were available. MIC causes damage to two systems: Lungs much more severe Eyes somewhat recoverable
Most deaths were due to respiratory failure: Pulmonary edema swollen tissue, with serious fluid, local dropsy Bronchitis inflammation of mucous membranes
Among the 150,000 others affected, main damage was to lungs capacity reduced by 50-60% Most common complaints were: Eye irritation Breathlessness Chest pains Vomiting Muscular weakness
Long term studies are being carried out on: Abnormalities in babies born after the Bhopal accident Lung function with time Effect on blood systems Incidence of cancer
Immediate Causes
A batch process was used to manufacture MIC. The plant was at only 40% capacity due to low demand. The last batch before the disaster had been made on October 22, 1984. 4,000 kg (40 tons) of MIC was stored in Tank 610 Maintenance work was planned.
52
The plant had several safety features: Vent gas scrubber with caustic neutralizer but it was not on. Flare tower for burning small amount of gases but it was not on. Refrigeration system to keep MIC cool, particularly in summer months but it was not on. Water-spray pipes that could be used to control some quantities of escaping gases but they were not on.
With the batch process that manufactured MIC shut down, parts of the plant were dismantled for maintenance: Flare system was shut down to repair pipe. Refrigeration was shut down with refrigerant drained. Nitrogen pressure system on tanks developed faults. Pipes were flushed with water before repairs. Leaking valves and open valves allowed water to flow into MIC Tank 610. Workers should have inserted a blind, but the inexperienced mechanical crew did not. 500kg (1,100 pounds) of water flowed into Tank 610.
Water reacted with MIC in presence of metallic impurities (acted as catalyst) and caused a tremendous exothermic reaction. Temperatures approached 260C (500F), probably exceeding tank design criteria.
Secondary chemical reactions also took place. There was rapid release of vapour through the relief valve system. The scrubber system was designed to deal with gases alone, not gases mixed with liquid. It failed to operate and therefore had to be started up. The flare was down for maintenance. The refrigeration system was out of commission. Water sprinklers could not throw water high enough to neutralize the escaping gases. Hence, toxic gases were able to bypass all these safety features.
53
Three Questions:
1. Even if all these systems had been working, could they have handled the large mass of vapour? 2. How much water is required to set off a catastrophic event, with or without metallic impurities? 3. They took a risk. Did they know the extent of the risk, and was it an acceptable risk? Did they have their guard down? Were they complacent? Excerpts from the press and other published sources now will be provided. The reader will notice some inconsistencies in the information provided by various journalists and scientists. This is a real life example of the conflicting information with which incident/accident investigators have to cope. After an actual incident or accident, the investigators encounter numerous pieces of evidence, some of which conflict with each other. The investigators need to collect all of the position evidence, people evidence, parts evidence and paper evidence. They then need to compile and analyze the evidence. After a catastrophic accident that is the consequence of a complex combination of causes, it takes a considerable amount of time to conduct the analysis.
Basic Causes
Paul Shrivastava, Executive Director Industrial Crisis Institute, New York Human Factors The plant was losing money, running at 40% capacity. Morale was low. 1982 Operational Safety Survey indicated safety rules, permits, etc., were not being effectively enforced by Union Carbide Inc. The best employees were leaving; 80% of workers trained in the U.S.A. had left. Between 1980 and 1984, staff level was cut by half. No maintenance supervisor was on second or third shift. Maintenance supervisors had been responsible for ensuring proper blanking of lines before water washing.
54
It was not a computerized plant; hence human backup was very important. Rumors of sabotage delayed bringing systems under control. Organizational Factors
Bhopal Plant was an unprofitable plant in an unimportant division of the corporation. Union Carbide India Limited (UCIL) was one of fifty international subsidiaries of Union Carbide Corporation. It represented 2% of Union Carbide Corporations world sales and 2% of its profits.
Bhopal Plant was one of 13 Union Carbide India Limited plants. It had been operating below 40% capacity for several years due to weak markets. It was not receiving much attention or support from top management. Because of the above-mentioned economic conditions, the plant was up for sale at time of disaster. Top Management Discontinuity. The plant had had 8 managers in 15 years. Many had come from non-chemical industry backgrounds. The result was that systems, procedures, emergency response and training all suffered.
The parent company did an audit in 1982 and identified 10 major areas of concern. Five of these contributed to the accident: instrumentation, permits, procedures and maintenance.
The plant had no contingency plans for dealing with major incidents. The lethal nature of MIC was not fully understood by the plant workers and members of the community.
Management systems were of a poor quality, including Safety and Loss Management. Technological Factors
Large storage of bulk MIC in an operating area using manual non-computerized control systems. Tank 610 had not been under continuous positive nitrogen pressure for 2 months. This had allowed metallic impurities to enter, and they acted as a catalyst.
55
Without these impurities, the reaction would have been much less severe. Plant design and piping systems allowed a pathway for large quantities of wash water to back into tank during flushing operations. The scrubber system was designed for vapour only. There was no radio communication system for operating staff. The Environment
The rapidly developing city of Bhopal sought and obtained sophisticated western industrialization without investing in industrial infrastructures. Bhopal was selected as the capital of the State of Madhya Pradesh in 1956. It grew rapidly from a fairly small town to a city of approximately 800,000. (Growth was especially dramatic from 1974 to 1984).
The plant site originally had little population around it. Because of rapid population increase, shantytown areas grew around the plant. They were densely populated with poor streets, lighting, etc. A combination of social factors, local infrastructure, lack of awareness and lack of community preparedness added severely to the results.
Overall Lessons Plants like these must have first class design and technology with built-in reliable safety features and must be kept up to date over the years by capital investment. Management must be totally committed to Safety and Loss Management both at the local and corporate levels, independent of the local economy (or threat of shutdown). Location of plant with respect to population areas should be a major consideration. Infrastructure of surrounding areas must be supportive roads, water, sewers, access to fire stations, emergency measure organizations, etc. Combined knowledge and experience of operating, maintenance, technical and management personnel must always be maintained at a high level. This may
INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International 56
require some non-local expertise. Today we have retired much of this knowledge. Does this mean we have increased our level of risk? Strength of organization needs continual risk assessment. Prime Causes: lack of management / government attention not knowing how sloppy the operation had become failure to ensure known actions were carried out
57
Schematic Layout of Common Headers of MIC Storage Tanks
58
Murder charges in Bhopal case dropped (The Edmonton Journal Sunday, September 22, 1996) Almost 12 years after the world's worst industrial accident, India's Supreme Court has dropped homicide charges against eight former senior officials of chemical maker Union Carbide. But, the court cleared the way for the prosecution of the accused for a string of lesser offenses, including causing death by negligence. The charges were brought after nearly 4,500 people died in a toxic gas lead in the central Indian city of Bhopal in December, 1984. In 1989, the Supreme Court chief justice ordered Union Carbide to pay a settlement of $425 million US and its Indian subsidiary $45 million.
59
Bhopal : Learning from Accidents by Trevor Kletz, D.Sc., FRCS, FIChe 1994 (ISMB 0 7506 1952X) The gas leak just can't be from my plant. The plant is shut down. Out technology just can't go wrong. We just can't have such leaks. The first reaction of the Bhopal works manager. The worst accident in the history of the chemical industry occurred in the Union Carbide plant at Bhopal, India on 3 December 1984 when a lead of over 25 tonnes of methyl isocyanate (MIC) from a storage tank spread beyond the plant boundary, killing over 2,000 people. The official figure was 2,1532 but according to some reports the true figure was nearer 10 0003, 4. In addition about 200 000 people were injured. Most of those killed and injured were living in a shantytown that had grown up close to the plant. Before 1984 the worst accidents that had occurred in the chemical industry were the explosion of a 50/50 mixture of ammonium sulphate and ammonium nitrate at Oppau in Germany in 1921, which killed 430 people including fifty members of the public, and the explosion of a cargo of ammonium nitrate in a ship in Texas City Harbour in 1947, which killed 552 people, mostly members of the public5. If conventional explosives are classified as chemicals, then we should include the explosion of an ammunition ship in Halifax, Nova Scotia in 1917, which killed about 1,800 people. Earlier in 1984, on 19 November, 550 people were killed when a fire occurred at a liquefied petroleum gas processing plant and distribution centre in San Juanico, a suburb of Mexico City6 and on 25 February at least 508 people, most of them children, were killed when a petrol pipe ruptured in Cubatao, near Sao Paulo, Brazil and the petrol spread across a swamp and caught fire7. In both cases most of those killed were living in shantytowns. 1984 was thus a bad year for the chemical industry. The Bhopal tragedy started when a tank of MIC - an intermediate used in the manufacture of the insecticide carbaryl - became contaminated with water - probably as the result of sabotage - and a runaway reaction occurred. The temperature and pressure rose, the relief valve lifted and MIC vapour was discharged into the atmosphere. The protective equipment which should have prevented or minimized the discharge was out of action or not in full working order: the refrigeration system which should have cooled the storage tank was shut down, the scrubbing system which should have absorbed the vapour was not immediately available and the flare system, which should have burnt any vapour which got past the scrubbing system, was out of use. 10.1 "What you don't have, can't leak" There are many lessons to be learned from Bhopal, but the most important is that the material that leaked need not have been there at all. It was an intermediate, not a product or raw material, and while it was convenient to store it, it was not essential to do so. Originally MIC was imported and had to be stored but later it was manufactured on site.
Nevertheless over 100 tonnes were in store, some of it in drums. After the tragedy it was reported that DuPont intended to eliminate intermediate storage from a similar plant that they operated. Instead they use the MIC as soon as it is produced, so that instead of 40 tonnes in a tank there will be only 5-10 kg in a pipeline. Mitsubishi were said to do this already8,9. During the next few years other companies described plans for reducing their stocks of other hazardous intermediates10. At the end of 1985 Union Carbide claimed that the inventories of thirty-six toxic chemicals had been reduced by 74%11. The main lesson of Bhopal is thus the same as that of Flixborough: What you don't have, can't leak. Whenever possible, we should reduce or eliminate inventories of hazardous materials, in process or storage. It is unfortunate, to say the least, that more notice was not taken of the papers written after Flixborough, which stressed the desirability of inherently safer designs, as they are called12-14. It seems that most companies felt so confident of their ability to keep hazardous materials under control that they did not look for ways of reducing inventories. Yet to keep lions under control we need expensive added-on protective equipment that may fail or may be neglected. It is better to keep lambs instead. Plant managers usually want intermediate storage, as it makes operation easier. One section of the plant can continue on line when another is shut down. Computer studies on equipment availability always show that intermediate storage is needed. However, they do not allow for the fact that if intermediate storage is available it will always be used, and maintenance will be carried out at leisure, but if it is not available people do everything possible to keep the plant on line, carrying out maintenance as soon as possible. The need for intermediate storage is thus a self-fulfilling prophecy. Another alternative to intermediate storage is to build a slightly larger plant and accept fewer running hours per year. Intermediate storage, including working capital, is expensive as well as hazardous, but the alternative is rarely considered. If reducing inventories, or intensification as it is called, is not practicable, an alternative is substitution, that is, using a safer material or route. At Bhopal the product (carbaryl) was made from phosgene, methylamine and alpha-naphthol. The first two were reacted together to make MIC, which was then reacted with alpha-naphthol. In an alternative process used by the Israeli company, Makhteshim, alpha-napthol and phosgene are reacted together to make a chloroformate ester, which is then reacted with alpha-naphthol and phosgene are reacted together to make a chloroformate ester which is then reacted with methylamine to make carbaryl. The same raw materials are used, but MIC is not formed at all. Of course, phosgene is also a hazardous material and its inventory should be kept as low as possible, or avoided altogether. If carbaryl can only be made via phosgene, perhaps another insecticide should be manufactured instead. Or instead of manufacturing pesticides perhaps we should achieve our objective preventing the harm done by pests - in other ways, for example, by breeding pestINCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International 61
resistant plants or by introducing natural predators. I am not saying we should -- both of these suggestions have disadvantages -- merely saying that the questions should be asked. 10.2 Plant location If materials that are not there cannot leak, people who are not there cannot be killed. The death toll at Bhopal would have been much smaller if a shantytown had not been allowed to grow up near the plant. In many countries, planning controls prevent such developments, but not apparently in India. Of course, it is much more difficult to prevent the growth of shantytowns than of permanent dwellings, but nevertheless it is essential to stop them springing up close to hazardous plants. If the government or local authorities cannot control their growth, then industry should be prepared, if necessary, to buy up the land and fence it off. As already mentioned, the high death tolls at Mexico City and Cubatao earlier in 1984 occurred in shantytowns. It is generally agreed that if a lead of toxic gas occurs people living in the path of the plume should stay indoors with their windows closed. Only if the lead is likely to continue for a long time, say, more than half-an-hour, should evacuation be considered. However, this hardly applies to shanties that are usually so well ventilated that the gas will enter them at once. It may be more difficult to prevent the growth of shantytowns than of permanent buildings, but it is also more important to do so. The need to keep hazardous plants and concentrations of people apart has been known for a long time. In the 19th century a series of explosions in fireworks and explosives factories in the United Kingdom led ultimately to regulations on location and an inspectorate to enforce them. In 1915, however, the government insisted that TNT should be manufactured in a factory at Silvertown, a heavily built-up area near London. The owners of the factory, Brunner Mond, objected but were overruled, as explosives were urgently needed to support the war effort. In 1917, 54 tons of TNT exploded, devastating the site and the surrounding area. Seventy-three people were killed, including everyone working in the factory, and a hundred were seriously injured. Eightythree houses were flattened or so badly damaged that they had to be demolished and 765 were seriously damaged and needed new interiors. After the explosion the officials who had insisted that production of TNT at Silvertown was essential now said that the loss of the factory would make no practical difference to the output of munitions16. The immediate cause of the explosion is unknown, but the underlying cause was the erroneous belief that TNT was not very dangerous. It was not covered by the Explosives Act, although another TNT factory had blown up in 1915. Compare the quotation at the head of this chapter. 10.3 Why did a runway reaction occur? The MIC storage tank became contaminated by substantial quantities of water and chloroform, up to a tonne of water and 1 tonnes of chloroform, and this led to a complex series of runaway reactions, a rise in temperature and pressure and discharge of MIC vapour from the storage tank relief valves17. The precise route by which the water entered the tank is not known, though several theories have been put forward18,19. One
theory is that it came from a section of vent line some distance away that was being washed out. This vent line should have been isolated by a slip-plate (spade) but it had not been fitted. However, the water would have had to pass through six valves in series and it seems unlikely that a tonne could have entered the tank in this way. Another theory is that the water entered via the nitrogen supply line. Kalelkar has argued convincingly that there was a deliberate act of sabotage by someone who did not realize what the results of his actions would be20. This theory has been criticised by many people who sympathised with the victims and thought an attempt was being made to whitewash [exonerate] Union Carbide. This was not the case. The company is still responsible for stocking more MIC than is necessary, for allowing a shantytown to grow alongside the plant, for not keeping protective equipment in working order (see next section) and for all the other deficiencies discussed later in this chapter. When we are looking for the underlying causes of the accident, rather than the immediate cause, the route by which the water entered the MIC tank hardly matters. Since it is well known that water reacts violently with MIC, no water should have been allowed anywhere near the equipment, for washing outlines or for any other purpose. If water is not there, it cannot lead in or be added deliberately. If any of the suggested routes were possible, then they should have been closed before the disaster occurred. So far as is known, no hazard and operability study (HAZOP)21, 22 was carried out on the design though HAZOP is a powerful tool, used by many companies for many years, for identifying routes by which contamination (and other unwanted deviations) can occur. 10.4 Keep protective equipment in working order - and size it correctly The storage tank was fitted with a refrigeration system which should have absorbed the MIC discharged through the relief valve was not in full working order. The flare system that should have burned any MIC that got past the scrubbing system was disconnected from the plant for repair. The high temperature and pressure on the MIC tank were at first ignored, as the instruments were poorly maintained and known to be unreliable23. The high temperature alarm did not operate as the set point had been altered and was too high24. One of the main lessons from Bhopal is thus the need to keep all protective equipment in full working order. It is easy to buy safety equipment; all we need is money and if we make enough fuss we get it in the end. It is much more difficult to make sure that the equipment is kept in full working order, especially when the initial enthusiasm has worn off. Procedures, including testing and maintenance procedures, are subject to a form of corrosion more rapid than that which affects the steelwork and can vanish without trace in a few months once managers lose interest. A continual auditing effort is needed by managers at all levels to make sure that procedures are maintained (see Chapter 6). Sometimes procedures lapse because managers lose interest. Unknown to them, operators discontinue safety measures. At Bhopal it went further than this. Disconnecting the flare system and shutting down the refrigeration system are hardly decisions that operators are likely to take on their own. The managers themselves must have taken these decisions and thus shown a lack of understanding and/or commitment.
It is possible that the protective equipment was out of use because the plant that produced the MIC was shut down and everyone assumed that the equipment had been installed to protect the plant rather than the storage. Runaway reactions, leaks and discharges from relief valves are more common on plants than on storage systems but they are by no means unknown on storage systems. Twenty-four of the hundred largest insurance losses in a thirty-year period occurred in storage areas and their value was higher than average25. Furthermore, since a relief valve was installed on the storage tank, it was liable to lift and the protective equipment should have been available to handle the discharge. As stated in Chapter 9, if the designers were sure that a relief valve would never lift there would have been no need to install it. It has been argued that the refrigeration, scrubbing and flare systems were not designed to cope with a runaway reaction of the size that occurred and that there would have been a substantial discharge of MIC to atmosphere even if they had all been in full working order. This may be so, but they would certainly have reduced the size of the discharge and delayed its start. The relief valve was too small for the discharge from a runaway reaction. The pressure in the storage vessel, designed for a gauge pressure of 40 psi (2.7 bar), reached 200-250 psi (14-17 bar). The vessel was distorted and nearly burst. If it had burst the loss of life might have been lower as there would have been less dispersion of the vapour. The relief valve was designed to handle vapour only but the actual flow was a two-phase mixture of vapour and liquid26. If the protective equipment was not designed to handle a runaway, or two-phase flow, we are entitled to ask why. Were the possibilities of a runaway or two-phase flow not foreseen or were they considered so unlikely that it was not necessary to guard against them? What formal procedures were used during design to answer these questions? Although the managers (and also the operators, but they take their cue from the managers) showed less competence and commitment to safety than might reasonably have been expected, we should not assume that Indian managers (and operators) are in general less competent than those in the west. There are poor managers in every country and there is no reason to believe than the standard in India is any lower than elsewhere. In one respect the managing director of Union Carbide India Limited showed more awareness than his American colleagues: He queried the need for so much more storage but was overruled. Bhopal illustrates the limitations of hazard assessment techniques both before the accident and after it happens - by fault tree or similar techniques. Most analysts would have estimated the failure rates of the refrigeration, scrubbing and flare systems but would not have considered the possibility that they might all be switched off. Hazard assessments become garbage if the assumptions on which they are based are no longer true.
64
Similarly, estimates of human error are usually estimates of the probability that a man will forget to carry out a task, such as closing a valve, or carry it out wrongly. We cannot estimate the probability that he will make a conscious decision not to close it, either because he considers it unnecessary to do so or because he wishes to sabotage operations27. Some reports on Bhopal suggested that the instrumentation there was less sophisticated than on similar plants in the United States and that this may have led to the accident. This is a red herring [distraction]. If conventional instrumentation was not adequately maintained and its warnings were ignored, then there is no reason to believe that computerised instrumentation would have been treated any differently. In fact the reverse may be the case. If people are unable to unwilling to maintain basic equipment, they are less likely to maintain sophisticated equipment. Nevertheless, during the investigation of accidents that have occurred because the safety equipment provided was not used, people often suggest that more equipment is installed (see Chapter 6). Another protective device was a water spray system that was designed to absorb small leaks at or near ground level. It was not intended to absorb relief valve discharges at a high level and failed to do so. 10.5 Joint ventures The Bhopal plant was half-owned by a US company, Union Carbide Corporation, and half-owned locally. Although Union Carbide Corporation had designed the plant and had been involved in the start up, by the time of the accident the Indian company had become responsible for operations, as required by Indian law. In the case of such joint ventures it is important to be clear as to who is responsible for safety in design and operation. The technically more sophisticated partner has a special responsibility if it is not directly responsible. It should make sure that the operating partner has the knowledge, skill, commitment and resources necessary for safe operation. If not, it should not go ahead with the venture. It cannot shrug off responsibility by saying that it is no longer in full control. Soon after Bhopal one commentator wrote, multinational companies and their host countries have got themselves into a situation in which neither feels fully responsible.28 People who sell or give dangerous articles to children are responsible if the children injure themselves or others. Similarly, if we give dangerous plant or material to people who have not demonstrated their competence to handle it, we are responsible for the injuries they cause. For Union Carbide Corporation the Bhopal plant was a backwater, making little contribution to profits, in fact often losing money, and may have received less than its fair share of management resources29. At Flixborough (Chapter 8) the partner with knowledge of the technology (Dutch State Mines) was in control.
65
10.6 Training in loss prevention Bhopal makes us ask if the people in charge of the plant, and those who designed it, received sufficient training in loss prevention30. If they do not they are not able to join the Institution of Chemical Engineers as full or corporate members. In most other countries, including the United States, most undergraduate chemical engineers receive no such training, although the American Institute of Chemical Engineers is now encouraging universities to introduce it. There are several reasons why loss prevention should be included in the training of chemical engineers31: 1. Loss [accident] prevention should not be something added on to a plant after design like a coat of paint but an integral part of design. Hazards should, whenever possible, be removed by a change in design, such as reduction in inventory, rather than by adding on protective equipment. The designer should not ask the safety adviser to add on the safety features for him; he should be taught to design a plant that does not require added-on safety features. Most engineers never use much of the knowledge they acquire as students but almost all have at some time to take decisions on loss prevention. Universities that give no training in loss prevention are not preparing their students for the tasks they will have to undertake. Loss prevention can be used to illustrate many of the principles of chemical engineering and to show that many problems that at first sight do not seem to lend themselves to numerical treatment can in fact be treated quantitatively.
2.
3.
Since in many countries universities are not providing training in chemical engineering, companies should make up the deficiency by internal training. Many try to but often do so in a rather haphazard way - an occasional course or lecture. Few companies put all new recruits through a planned program. At Bhopal the original managers had left and had been replaced by others whose experience had been mainly in the manufacture of batteries. There had been eight different managers in charge of the plant in 15 years32. Many of the original operators had also left and one wonders how well their successors were trained33. However, while these facts, and reductions in manning, may be evidence of poor management and a lack of commitment to safety I do not think that they contributed directly to the accident. The errors that were made, such as disconnection of safety equipment and resetting trips at too high a level, were basic ones that cannot be blamed on inexperience of the particular plant. No manager who knew and accepted the first principles of loss prevention would have allowed them to occur. 10.7 Handling emergencies More than any other accident described in this book Bhopal showed up deficiencies in the
procedures for handling emergencies, both by the company and by the local authorities. It showed clearly the need for companies to collaborate with the emergency services in identifying incidents that might occur and their consequences, drawing up plans to cope with them and exercising these plans. In the United Kingdom this is now required by law34. This aspect is discussed in reference 35. 10.8 Public response In the United States Bhopal produced a public reaction similar to that produced in the United Kingdom by Flixborough (Chapter 8) and in the rest of Europe by Seveso (Chapter 9). Many companies spent a great deal of money and effort making sure that a similar accident could not occur on their plants. Even so, Bhopal seems to have produced less regulatory fallout than Flixborough or Seveso. The U.S. chemical industry has tried to convince the authorities that it can put its own house in order. In particular the American Institute of Chemical Engineers set up a Center for Chemical Process Safety, generously funded by the chemical industry, to provide advice on loss prevention. One of its objectives is to have loss prevention included in the training of undergraduates. The Chemical Manufacturers Association has launched a Community Awareness and Response 9CAER) program to encourage companies to improve their emergency plans and a National Chemical Response Information Center to provide the public and emergency services with advice and assistance before and during emergencies. Nevertheless in a paper called "A field day for the legislators" Stover36 lists thirty-two U.S. Government proposals or activities and thirty-five international activities that had been initiated by the end of 1985. In addition there have been state and local responses in the U.S. These have been reviewed by Horner37. In India there were, of course, extensive social effects. They are reviewed in reference 38. After Bhopal many international companies reviewed the extent to which they controlled and audited the subsidiaries. Chapters 4 and 5 also showed what can happen when they are left to do as they wish. Jim Whiston has described the changes made by ICI in the years after Bhopal. Terrible though Bhopal was, we should beware of over-reaction and of suggestions that insecticides, or even the whole chemical industry, are unnecessary. Insecticides, by increasing food production, have saved far more people than Bhopal has killed. But Bhopal was not an inevitable result of insecticide manufacture. By better design or by better operation, by just one of the recommendations summarised in Figure 10.2, Bhopal could have been prevented. The most effective methods of prevention are those near the bottom of the diagram, such as reduction in inventory or change in the process. The safety measures at Bhopal, such as the scrubber and the flare stack, were too near the top of the chain, too near the top event. If they failed there was nothing to fall back on. To prevent the next Bhopal we need to start at the bottom of the chain.
67
References: 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. Bidwai, P., quoted by Bogard, W., The Bhopal Tragedy, Westview Press, Boulder, Colorado, 1989, p.14. Tachakra, S.W., Journal of Loss Prevention in the Process Industries. Vol.1, No.1, January 1988, p..3. Free Labour World, International Federation of Free Trade Unions, Brussels, Belgium. No. 1/86, 18 January 1986, p.1. Shrivastava, P., Bhopal - Anatomy of a Crisis, Ballinger, Cambridge, Massachusetts, 1987. p.64. Lees, F.P., Loss Prevention in the Process Industries. Vol.2, Butterworths, London 1980. Appendix 3. BLEVE - The Tradegy of San Juanico, Skandia International, Stockholm, 1985. Hazardous Cargo Bulletin, June 1984, p.34. Chemical Week. 23 January 1985, p.8. Chemistry in Britain. Vol.21, No.2, Feb.1985, p.123. Wade, D.E., Proceedings of the International Symposium on Preventing Major Chemical Accidents. American Institute of Chemical Engineers, Washington, DC, 3-5 February 1987, Paper 2.1. Chemical Insight. Late Nov.1985, p.1. Kletz, T.A., Chemical Engineering, Vol.83, No.8, 12 April 1976, p.124. Kletz, T.A., Chemistry and Industry, 6 May 1978, p.37. Kletz, T.A., Hydrocarbon Processing, Vol.59, No.8, Aug. 1980, p.137. Reuben, B.M., Private Communication. Neal, W., With Disastrous Consequences, Hisarlik Press, London, 1992, Chapters 3 and 7. Bhopal Methyl Isocyanate Incident: Investigation Team Report, Union Carbide Corporation, Charleston, South Carolina, March 1985. The Trade Union Report on Bhopal, International Federation of Free Trade Unions and International Federation of Chemical, Energy and General Workers' Unions, Geneva, Switzerland, 1985. Varadarajan, S. et al., Report on Scientific Studies on the Factors related to Bhopal Toxic Gas Leakage, Indian Planning Commission, Delhi, India, Dec. 1985. Kalelkar, A.S., Investigations of large magnitude incidents - Bhopal as a case study. Preventing Major Chemical and Related Process Accidents, Symposium, Series No.110, Institution of Chemical Engineers, Rugby, UK, 1988, p.553. Kletz, T.A., Hazop and Hazan - Identifying and Assessing Process Industry Hazards, 3rd edition, Institution of Chemical Engineers, Rugby, UK, 1992. Knowlton, R.E., A Manual of Hazard and Operability Studies, Chemetics International, Vancouver, Canada, 1992. New York Times. 28 Jan-3 Feb 1985. Shrivastava, P., The Accident at Union Carbide Plant in Bhopal - A case Study. Air Pollution Control Association Conference on Avoiding and Managing Environmental Damage from Major Industrial Accidents, Vancouver, Canada, 3-6 Nov. 1985.
68
25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38.
One Hundred Largest Losses, Marsh and McLennan, Chicago, Illinois, 8th edition. 1985. Swift, I.. In The Chemical Industry after Bhopal, Proceedings of a Symposium, London, 7/8 November 1985, IBC Technical Services. Kletz, T.A., An Engineer's View of Human Error, 2nd edition, Institution of Chemical Engineers, Rugby, UK, 1991, Chapter 5. Smith, A.W., The Daily Telegraph, 15 Dec. 1984, p.15. As ref.4 p.51. First Degree Course including Guidelines on Accrediting of Degree Course, Institution of Chemical Engineers, Rugby, UK, 1989. Kletz, T.A., Plant/Operations Progress. Vol.7, No.2, April 1988, p.95. As ref. 4. p.52. The Bhopal Papers. Transnationals Information Centre, London, 1986, p.4. Control of Industrial Major Accident Hazard Regulations, Statutory Instrument No.1902. Her Majesty's Stationery Office, London, 1984. As ref.4 Chapter 6. Stover, W., In The Chemical Industry after Bhopal, Proceedings of a Symposium, London, 7/8 November 1985, IBC Technical Services. Horner, R.A., Journal of Loss Prevention in the Process Industries, Vol.2, No.3, July 1989. p.123. As ref.4. Chapters 4 and 5.
69

L9 Incident Investigation Student Handout

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

L9 Incident Investigation Student Handout

Uploaded by

Copyright:

Available Formats

INCIDENT/ACCIDENT INVESTIGATION AND ROOT CAUSE ANALYSIS

NPC TRAINING PROGRAM

Presented by Ron Rosser & Mike Breward

Calgary Tel 1-403-221-8077 Fax 1-403-221-8072 E-mail: info@seal.ab.ca Website: www.seal.ab.ca

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

What are your expectations for the course?

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT INVESTIGATION FLOW PATH

FOLLOW INCIDENT GUIDELINES

IS THE CAUSE EVIDENT?

DETERMINE CALL OUT REQUIREMENT S

DATABASE FOR FUTUR E INVESTIGATION & ANALYSIS

PROCESS & MAINTENANCE TEAMS ATS CAUS E FOUND

COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENT TEAM

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Why Investigate Incidents?

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Why Investigate Incidents?

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Questions That Need To Be Asked

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT TRAJECTORY MODEL FOR LOSS

Process & physical work environment

HSE Management Systems

(Latent errors -Root Causes)

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Incident Video - 'Nobody's Fault'

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

There are four types of evidence:

These are known as the Four P's.

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Pilot Plant Number 1

Pilot Plant Number 2

Steam Trap Packing crate

New equipment Overhead Gallery

Packing material Broken glass Stains on floor

Bunsen burner Taffys work area

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

INCIDENT INVESTIGATION FLOW PATH

FOLLOW INCIDENT GUIDELINES

IS THE CAUSE EVIDENT?

DETERMINE CALL OUT REQUIREMENT S

DATABASE FOR FUTUR E INVESTIGATION & ANALYSIS

PROCESS & MAINTENANCE TEAMS ATS CAUS E FOUND

COMPLETE REPORT AND GENERATE RECOMMENDATIONS TO PMT OR MANAGEMENT TEAM

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Team exercise : Why report incidents?

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Why Report Incidents

INCIDENT RATIO COMPARISON

Minor Injuries Property Damage Incidents

Near- Miss Incidents Substandard Act & Conditions

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International

Incidents are reported on: An Incident Report Form

Incident Investigations are recorded on: An Incident Investigation Report Form

INCIDENT/ACCIDENT INVESTIGATION S.E.A.L. International