Lessons from major accidents

Almost every rule in process safety was written after someone died. Management of change grew out of Flixborough. Emergency planning and community right-to-know laws grew out of Bhopal. Permit-to-work and safety case regimes were reshaped by Piper Alpha. Process safety indicators grew out of Texas City. Studying major accidents is not about blaming the people involved; it is about seeing how ordinary organizations drift into conditions where a disaster becomes possible, and recognizing the same patterns in our own plants. This lesson summarizes several major accidents in plain language, draws out the lessons they share, and shows how to use accident history in everyday work.

How major accidents happen

Major accidents almost never have a single cause. Investigations usually find a chain of events and a set of weakened barriers. Some failures are active: an operator opens the wrong valve, a pump is started with a blind still in place. Others are latent conditions that sit in the system for months or years: a design flaw, a disabled alarm, an inspection that was deferred, a procedure that no longer matches the plant, a staffing cut. The psychologist James Reason described this with his Swiss cheese model: each barrier has holes, and an accident happens when the holes in several layers line up at the same time.

Flixborough, England, 1974

At the Nypro plant in Flixborough, six reactors in series oxidized cyclohexane at high temperature and pressure. When a crack was found in reactor 5, it was removed and a temporary pipe was installed to connect reactors 4 and 6. The bypass was designed quickly, without proper engineering calculations, and supported on scaffolding. It used bellows at each end that were never meant to carry the forces involved. About two months later the bypass ruptured, releasing tens of tonnes of hot cyclohexane, which formed a vapour cloud and exploded. Twenty-eight workers were killed and the plant was destroyed; the toll would have been much higher on a weekday. The central lesson was that a modification, even a temporary one, must be engineered and reviewed as carefully as the original design. That lesson became the basis of management of change, covered in Lesson 9.

Bhopal, India, 1984

On the night of 2 to 3 December 1984, water entered a storage tank of methyl isocyanate (MIC) at the Union Carbide India pesticide plant in Bhopal. The water reacted with the MIC, and the temperature and pressure in the tank rose until the relief valve opened and a large cloud of toxic gas drifted over the surrounding neighbourhoods, where people were asleep. Thousands died within days, and many thousands more suffered lasting injuries; estimates of the total vary widely. Several safety systems that might have limited the release were out of service or undersized: the refrigeration that kept the MIC cold had been shut down, the vent gas scrubber and flare were not available or could not handle the flow, and the water curtain could not reach the height of the release. The plant had been losing money and maintenance had been cut. Bhopal showed that storing large inventories of highly toxic intermediates next to communities is a risk in itself, and that safeguards that are not maintained provide no protection. It led to the idea of inherently safer design and to community emergency planning and right-to-know laws in many countries.

Piper Alpha, North Sea, 1988

Piper Alpha was an oil and gas platform in the North Sea. During a maintenance job, a pressure safety valve was removed from one of two condensate pumps and its opening was covered with a loosely fitted blind flange. The work was not finished by the end of the day shift, and the night shift did not learn about it because the permit-to-work system failed to pass the information on. When the other pump tripped, night shift operators started the pump with the missing valve. Condensate leaked, ignited and exploded. Fires fed by oil and then by high-pressure gas from connected pipelines destroyed the platform; 167 men died. The Cullen inquiry led the United Kingdom to adopt a goal-setting safety case regime for offshore installations. Its lessons about permits, shift handover and the isolation of equipment under maintenance are taught in every plant today.

Texas City, United States, 2005

During the startup of a raffinate splitter tower at BP's Texas City refinery, operators filled the tower with flammable liquid for hours while the level indicator showed the level falling. The tower overfilled, and liquid flowed to a blowdown drum that vented directly to the atmosphere. A geyser of flammable liquid and vapour came out of the stack, and the vapour cloud was ignited, probably by an idling pickup truck. Fifteen people were killed and about 180 injured. Most of the dead were contractors working in temporary trailers placed close to the unit. The CSB found that the startup procedure was not followed and had not been updated, the level instruments were unreliable, operators had worked long stretches of 12-hour shifts, an earlier proposal to replace the blowdown drum with a flare had not been carried out, and corporate cost cutting had weakened the site's process safety programs. The Baker Panel review found that the company had focused on personal safety rates and neglected process safety.

Buncefield, England, 2005

At the Buncefield oil storage depot north of London, a large storage tank was being filled with petrol from a pipeline overnight. The tank's level gauge stuck and kept showing the same level, so no alarm sounded. An independent high-level switch, which should have shut off the flow, was inoperable because a test lever had not been put back in the correct position after maintenance. Petrol overflowed from the tank roof for about 40 minutes, forming a large cloud of vapour that ignited early on a Sunday morning. The explosion was much more powerful than expected for a vapour cloud in a relatively open area, and the fire burned for days. There were no deaths, but 43 people were injured and nearby businesses and homes were damaged. Buncefield changed thinking about overfill protection, the independence of safety systems and the explosion potential of vapour clouds in open areas with vegetation and congestion.

Accidents closer to home: Canada

In Toronto in August 2008, explosions at the Sunrise Propane facility forced the evacuation of thousands of nearby residents. A worker died, and a firefighter died the next day while working at the scene. Investigators found that propane had been transferred directly from one truck to another, a practice that was not permitted, and the company and its directors were later convicted of offences under Ontario's environmental and occupational health and safety laws. In July 2013 a runaway train carrying crude oil derailed in Lac-Mégantic, Quebec, killing 47 people; it is covered from the transportation side in HSE-250. In October 2017 three workers died after an ammonia leak at the refrigeration plant of an arena in Fernie, British Columbia. These events show that process safety hazards in Canada are not limited to large refineries.

Beirut, Lebanon, 2020

On 4 August 2020, a fire in a warehouse at the port of Beirut led to the explosion of about 2,750 tonnes of ammonium nitrate that had been stored there for years after being seized from a ship. More than 200 people were killed and thousands injured, and large parts of the city were damaged. The material had been stored with fireworks and other goods, warnings had been raised for years, and no one with authority acted. Beirut is a reminder that hazardous materials do not have to be in a process plant to cause a major accident, and that storage, segregation and clear ownership matter as much as process design.

Common threads

When investigators compare major accidents, the same themes come up again and again. The table below summarizes them. Most organizations that suffered a major accident had warning signs that were not acted on: earlier smaller incidents, near misses, audit findings, complaints from operators, or deferred work.

# Tally recurring causes across a set of accident summaries (simplified coding).
accidents = {
    "Flixborough 1974":  {"change", "design"},
    "Bhopal 1984":       {"safeguards", "inventory", "pressure", "siting"},
    "Piper Alpha 1988":  {"handover", "permits", "safeguards"},
    "Texas City 2005":   {"instruments", "procedures", "siting", "pressure", "warnings"},
    "Buncefield 2005":   {"instruments", "safeguards"},
    "West 2013":         {"inventory", "siting", "warnings"},
    "Beirut 2020":       {"inventory", "warnings", "siting"},
}
counts = {}
for causes in accidents.values():
    for c in causes:
        counts[c] = counts.get(c, 0) + 1
for cause, n in sorted(counts.items(), key=lambda kv: (-kv[1], kv[0])):
    print(f"{cause:<12} {'#' * n} {n}")

siting       #### 4
inventory    ### 3
safeguards   ### 3
warnings     ### 3
instruments  ## 2
pressure     ## 2
change       # 1
design       # 1
handover     # 1
permits      # 1
procedures   # 1

Coding accidents this way is crude, but it shows why process safety programs emphasize a small number of disciplines. Disabled or unreliable safeguards, people sited close to hazards and large inventories of hazardous material appear again and again. These are also the factors a site can check for itself today without waiting for an incident.

Using accident history at work

Accident case studies are most useful when they are tied to everyday decisions. Many plants start safety meetings or shift handovers with a five-minute review of a CSB or other investigation video, followed by the question: could this happen here? Engineers use case histories when they review designs and changes. Managers use them to explain why a deferred inspection or an unresolved audit finding matters. The aim is to keep a sense of unease alive: an awareness that the absence of accidents does not prove the absence of risk.