Process safety and the lessons of major incidents

Theo Laurent has spent two years at Kingfisher Bioenergy in Sarnia learning how the plant's units work and how to control them. This term he joins a hazard review team for the new ethyl acetate line, and his manager, Malik Osei, starts him with a reading list rather than a spreadsheet. The list is a set of investigation reports. Malik's reasoning is simple: almost every hazard the team will discuss has already hurt someone somewhere, and the reports explain how ordinary decisions added up to disaster. This course follows Theo through the engineering side of process safety, from toxic exposure and release calculations through fires, explosions and relief systems to hazard studies and risk assessment. The management-system side, how a company organizes leadership, audits and culture around these methods, is the subject of HSE-311 Process Safety Fundamentals, and this course refers to it rather than repeating it.

Personal safety and process safety

Most workplace safety programs focus on personal safety: slips, trips, falls, cuts, burns, struck-by injuries and the hazards of using tools. These are the events counted in injury rates. Process safety is different. It is concerned with preventing the unplanned release of hazardous material or energy from the process itself: a leak of flammable liquid, an escape of toxic gas, a runaway reaction or an overpressured vessel. Such events are rare, but when they occur they can kill many people at once, including people outside the plant fence, and destroy the facility.

The distinction matters because a good record in one area says little about the other. The investigation of the 2005 refinery explosion at Texas City found that the site had a low personal injury rate in the years before the accident, while the equipment, procedures and culture needed to prevent a major release had decayed. Similar findings appear in many other reports. A plant can celebrate a million hours without a lost-time injury in the same month that a relief valve is left blocked or an alarm is bypassed. Process safety therefore needs its own measures, its own hazard analysis methods and its own engineering calculations.

# Incident rates and a simple look at how often "rare" events happen at a site over a career
import math
hours = 2_000_000                     # hours worked at the site in a year, employees and contractors (illustrative)
recordables, lost_time = 3, 1
trir = recordables * 200_000 / hours  # US convention: per 200,000 hours (100 full-time workers)
ltif = lost_time * 1_000_000 / hours  # per million hours, common in Canada and internationally
print(f"total recordable incident rate: {trir:.2f} per 200,000 h   lost-time frequency: {ltif:.2f} per million h")
# Process safety events: tier 1 and 2 loss-of-containment counts (API RP 754 style), illustrative
t1, t2 = 0, 2
print(f"tier 1 process safety events: {t1}   tier 2: {t2}   (a low injury rate says little about these)")
# If a catastrophic event has a frequency of 1e-4 per year at one unit, how likely is it in 40 years at 25 units?
for f in (1e-4, 1e-3):
    p = 1 - math.exp(-f * 25 * 40)
    print(f"frequency {f:.0e}/unit-year, 25 units, 40 years: chance of at least one = {100 * p:.1f} %")

total recordable incident rate: 0.30 per 200,000 h   lost-time frequency: 0.50 per million h
tier 1 process safety events: 0   tier 2: 2   (a low injury rate says little about these)
frequency 1e-04/unit-year, 25 units, 40 years: chance of at least one = 9.5 %
frequency 1e-03/unit-year, 25 units, 40 years: chance of at least one = 63.2 %

The output makes two points. The first is that a site can show excellent injury rates, here a total recordable rate of 0.30 per 200,000 hours, and still have process safety events to learn from. Leading organizations now count loss-of-containment events in tiers, following API Recommended Practice 754, from tier 1 events with serious consequences down to tier 3 and 4 indicators such as safety system demands and overdue inspections. The second point is about probability. An event with a frequency of one in ten thousand per unit per year sounds negligible. Across 25 units over a 40-year career the chance that it happens at least once is about 10 %. At one in a thousand it is better than even. Rare events become likely over large systems and long times, which is why process safety asks engineers to design for events they may never see.

Flixborough, 1974

At Flixborough in England, a chemical plant oxidized cyclohexane in a train of six reactors. When one reactor developed a crack, it was removed and the remaining reactors were joined by a temporary pipe with bellows at each end, supported on scaffolding. No engineering design calculations were made for the bypass, and no one checked how it would behave under pressure. Some weeks later the bypass failed, releasing a large mass of hot cyclohexane that formed a vapour cloud and exploded. Twenty-eight people on site were killed, and the explosion damaged homes in the surrounding villages. The control room, which had not been designed to resist blast, was destroyed with the people in it.

Flixborough taught three lessons that are now built into practice. A modification needs the same engineering as the original design; this is the origin of formal management of change. Large inventories of flammable material under pressure and temperature are hazards in themselves, which led to the idea of inherently safer design: keep inventories small. And occupied buildings must be sited and built with explosion hazards in mind, which led to facility siting studies.

Bhopal, 1984

At Bhopal in India, water entered a storage tank of methyl isocyanate, a toxic intermediate for pesticide manufacture, and started a reaction that raised the temperature and pressure until the tank's relief system released a large cloud of toxic gas over the surrounding city at night. Thousands of people died in the following days, and many more suffered lasting injuries. Investigations described a long list of contributing conditions: a large stored inventory of an extremely hazardous intermediate, a refrigeration system that was not operating, a vent scrubber and flare that were out of service or unable to handle the release, poor maintenance, reduced staffing, and dense housing next to the plant with no emergency plan for the public. Bhopal remains the worst industrial accident in history, and it drove the development of emergency planning, community right-to-know laws and process safety regulation in many countries.

Texas City, 2005

At the Texas City refinery in 2005, operators were starting up a distillation tower called the raffinate splitter. During the startup the tower was overfilled with flammable liquid for hours; the level indication was misleading and a high-level alarm did not operate. Liquid eventually flowed into the blowdown drum, an older design that vented to the atmosphere through a stack, and overflowed from the top as a geyser. The vapour cloud found an ignition source, probably an idling vehicle, and exploded. Fifteen people were killed and about 180 injured. Many of those killed were contractors working in temporary trailers placed near the unit. The US Chemical Safety Board report found failures of procedures, training, instrumentation, trailer siting and corporate oversight, and noted the focus on personal safety statistics instead of process safety.

Lac-Mégantic and West, 2013

Two incidents in 2013 showed that process safety does not end at the plant fence. On the night of 6 July 2013, an unattended freight train of 72 tank cars of crude oil, parked on a main line above the town of Lac-Mégantic, Quebec, began to roll downhill after its brakes released. It derailed in the town centre. Crude oil spilled and burned, destroying much of downtown and killing 47 people. The Transportation Safety Board of Canada found problems with the securement of the train, the railway's safety management and the classification of the crude, which was more volatile than its documents suggested. Federal rules on rail safety and dangerous goods transport changed as a result.

On 17 April 2013, a fire at a fertilizer storage and distribution facility in West, Texas, led to the detonation of stored ammonium nitrate. Fifteen people were killed, most of them volunteer firefighters and emergency responders, and many nearby buildings, including schools and homes, were damaged. The Chemical Safety Board found that the hazard of the stored material was not well understood by the company, the responders or the community, and that land-use planning had allowed sensitive buildings to grow up nearby.

What the incidents have in common

Reading the reports together, Theo notices that none of these incidents had a single cause. Each involved several barriers failing or being absent at once: a design weakness, a missing procedure, an alarm out of service, a decision under production pressure, an occupied building in the wrong place. This is the basis of the layered approach that runs through the rest of this course. If a hazard is protected by several independent layers, any one can fail without disaster. When the layers erode unnoticed, and they often fail for related reasons such as cost pressure or weak oversight, the protection is much weaker than it appears.

The incidents also show the weight of organizational factors. Investigators repeatedly describe warning signs that were known but not acted upon: earlier near misses, overdue maintenance, audit findings left open, and staff who were uneasy but did not feel able to stop work. Safety culture, the shared beliefs and practices about how safety is treated, is discussed in depth in HSE-311 and in the safety leadership courses. For engineers the practical message is that technical analyses are only as good as the organization that acts on them.

At Kingfisher Bioenergy, the process safety indicators reviewed each month include the number of loss-of-containment events by tier, demands on safety instrumented functions and relief valves, overdue inspections and tests, open hazard review recommendations, and the number of safety systems bypassed. Theo is surprised by how short the list of serious events is and how long the list of small ones is. Malik tells him that this is the point: the small events are free lessons, and a plant that reports and studies them catches the weaknesses that would otherwise line up into a large one.

The engineer's toolkit

The engineering methods in this course fall into a natural sequence. First, recognize the hazards of the materials: toxicity, flammability and reactivity, using safety data sheets under WHMIS and the technical literature. Second, estimate what could be released and how it would spread, using source and dispersion models. Third, estimate the effects of fires and explosions. Fourth, design prevention and protection: inerting, grounding, ventilation, electrical classification and relief systems. Fifth, identify hazards systematically through methods such as HAZOP. Sixth, estimate risk and decide whether it is tolerable. Finally, embed all of this in a management system. At Kingfisher Bioenergy that system follows CSA Z767, the Canadian standard for process safety management, applied alongside Ontario's Occupational Health and Safety Act and the Technical Standards and Safety Authority's rules for pressure equipment.

Malik closes the first meeting with a caution. The calculations in this course give estimates with large uncertainties, often a factor of two or more. They are tools for comparing options and finding the dominant hazards, not predictions to three significant figures. Engineers who forget that tend either to over-trust a result that supports what they wanted to do or to dismiss a result that is inconvenient. The right habit is to state the assumptions, check the sensitivity and lean towards the safer choice when the numbers are close.