lable at ScienceDirect

Journal of Loss Prevention in the Process Industries 22 (2009) 753–756

Contents lists avai

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier .com/locate/ j lp

Accident reports may not tell us everything we need to knowq

Trevor A. Kletz a,b,*

a Department of Chemical Engineering, Texas A&M University, USAb Department of Chemical Engineering, Loughborough University, 64 Twining Brook Road, Cheadle Hulme, Cheadle SK8 5RJ, UK

a r t i c l e i n f o

Article history:Received 15 August 2009Received in revised form27 August 2009Accepted 31 August 2009

Keywords:Accident reportsMissed recommendationsBuncefield

q Beyond Regulatory Compliance: Making SafetySymposium, Mary Kay O’Connor Process Safety CeCollege Station, Texas. October 28–29 2008.

* Tel.: þ44 161 485 3875; fax: þ44 161 485 3875.E-mail address: t.kletz@lboro.ac.uk

0950-4230/$ – see front matter � 2009 Elsevier Ltd.doi:10.1016/j.jlp.2009.08.017

a b s t r a c t

Accident reports often miss some of the lessons that can be learned. We should try to read between thelines and look for the recommendations that might have been made but, for various reasons, were not.They may not have been foreseen, or there may have been reasons for deliberately excluding them, suchas reluctance to embarrass colleagues or to admit that a similar accident had occurred before, but hadbeen forgotten. Examples are described.

� 2009 Elsevier Ltd. All rights reserved.

The [US] Institute of Medicine estimates that it took ‘‘an average of17 years for new knowledge . to be incorporated into practice, andeven then application [was] highly uneven.’’ Progress in medicalscience occurred one funeral at a time. If doctors didn’t learnsomething in medical school or in residency, there was a goodchance they never would. – Ian Ayres (Ayres, 2007)Similarly, it took 15 years for people to adopt the push-buttontelephone over the radial dial (Anon, 2008).

Are engineers any different? Read on before you decide.It is easy to read and note the contents of an accident report,

and, if we so wish, to follow its recommendations or comment onthem. However, reports, including official ones, often overlooksome of the lessons that can be learned. We should learn to readbetween the lines of reports (and listen between the sentences ofverbal reports) and look for the recommendations that might havebeen made but were not. They may have been missed because theywere not foreseen or because there were reasons for deliberatelyexcluding them, such as reluctance to embarrass colleagues or toadmit that a similar accident had occurred before but had beenforgotten. This occurs in many written (and verbal) reports. Forexample, according to a report in the business section of a UKnewspaper,

Second Nature. 11th Annualnter, Texas A&M University,

All rights reserved.

As in life, the narrative may fit the facts, without telling the wholestory. It’s not that we can’t handle the truth. It’s just quite hard towork out what it is (Corigan, 2008).

1. Verbal reports of simple examples

I will first describe some simple examples of accidents due topoor procedures or failures to follow them and then some moreserious accidents where the design could have been better. Thesimple incidents occurred in a factory where the manager chaireda weekly meeting with the foremen who were in charge of all thoseemployees who had been injured the previous week, howeverminor their injuries. The foremen described the accidents and theactions that had been taken afterwards. Visits to the site oftendisclosed significant facts that had not been reported:

C A fitter injured a finger while fixing a clip onto a hose usinga clamping machine. It had been mounted parallel to the edgeof the bench instead of at right angles, so that the fitter caughthis finger on an object on the bench. The accident report didnot say this. A visit to the site of the accident told us morethan the report.

C A man slipped while entering a fenced-off no-smoking area,put his hand out to steady himself and caught it on a sharpprotrusion on the gate. The protrusion was removed. A visit tothe site disclosed that the gate was rarely used and could beremoved.

C An electrician was running a temporary cable on a construc-tion site when he stumbled on a piece of wire mesh, lost his

T.A. Kletz / Journal of Loss Prevention in the Process Industries 22 (2009) 753–756754

balance and hurt his foot on a metal bar. His foreman told himto be more careful when crossing ground disturbed bycontractors. However, a visit to the site showed that the areawhere the electrician was working had not been disturbed bythe contractors. It was covered by weeds, 2 feet tall, which hidnumerous tripping hazards, many sharp and sticking up at allangles. The ground should have been bull-dozed by thecontractors before work started.

C A man went up a ladder onto a walkway and then climbedover the handrails onto a fragile roof to pick up a flashlight hehad dropped. The roof was clearly marked as fragile. He triedto stand on the girders but slipped off them onto the sheetingand fell though it into the room below. Fortunately hisinjuries were slight. At first sight the incident seemed to bedue to the foolishness of the man and it seemed that thesupervisor or manager could have done little or nothing toprevent it. However, a visit to the site showed that the foot ofthe ladder leading to the roof was surrounded by junk asshown in Fig. 1. What message did this give to the man as heworked his way through it? Probably, ‘‘In this place we don’tcare about safety.’’

When discussing an accident report, always ask the speaker if heor she has visited the site – or go there yourself.

2. Failure to recognise there is a problem

A senior engineer, who was in ultimate charge of the mainte-nance on a large site, stopped during a site tour, to speak to a groupof maintenance workers who were repairing a piece of machinery.He noticed a number of broken nuts and bolts on the ground thathad obviously been there for some time. The workers told him thatthe machine needed frequent maintenance as the bolts often brokeand had to be replaced. No one had asked why; they just went onreplacing them. The senior engineer spoke to the engineer inimmediate charge of the machine who then sought expert advice.Stronger nuts and bolts solved the problem. Ironically, if themaintenance team had tidied the area around the machine, insteadof leaving the broken nuts and bolts on the ground, the problemmight never have been solved.

A similar but more serious incident occurred on the UK railwaysin 2007, when an express train on the London–Glasgow main line

Fig. 1. Foot of the ladder leading to a fragile roof. What does this tell us about thecompany’s attitude to safety?.

was derailed at speed. One passenger was killed. Fortunately, thenew Pendolino carriages were robust and prevented further loss oflife. The immediate cause of the derailment was failure to carry outa routine inspection of the track. However, the underlying causewas the poor design of a set of switches (points) which was subjectto frequent failure of its components and needed frequent inspec-tion and maintenance. The nuts tended to work loose and thestretcher bars that kept the rails the correct distance apart wereliable to break. The design had been in use since at least 1950. Thefailures seem to have been regarded as inevitable, their integritywas left entirely to the inspection and maintenance staff and no onewas asked to redesign them (Hodgson, 2008), a state of affairs thatcontinued for far longer than the doctors’ 17 years. (See thequotation on the first page.)

It is doubtful if anyone at a senior level knew about the problemwith the points. They knew, of course, what track maintenance wascosting but do not seem to have known what were the majorcontributors to the costs. This was a common problem during mytime in industry. The maintenance costs were allocated to theappropriate product cost but the maintenance engineers com-plained that no one could tell them how much they spent onrepairing pumps, furnaces and other types of equipment. I am toldthat this is less of a problem today.

3. Missed lessons from major accidents

In the following I am not listing all the causes and possibleactions that could have prevented the accidents or made them lesslikely to occur but only those major weaknesses in design that wereoverlooked by most commentators.

3.1. Bhopal

Methyl isocyanate (MIC), the material that leaked at Bhopal in1984 and killed thousands of people, was an intermediate, nota raw material or product. It was convenient to store it but notessential to do so. If it had been used as it was made the worstleak would have been a few kilograms from a broken pipe and thecost of the storage tanks for MIC and the working capital tied upin their contents would have been saved. Most of the reports andcomments on Bhopal, including the official ones, missed thisweakness in design though many companies did reduce theirstocks of hazardous intermediates. In the long term Bhopalincreased the interest in inherently safer designs (Kletz, 2001,chap. 10).

3.2. Flixborough

The explosion there in 1974, the worst explosion in the UKchemical industry if we exclude explosives, was so large becauseonly 6% of the feedstock was converted per pass and the rest gotmany free rides, as it had be recovered by distillation and recycled.Improving the conversion and thus reducing the inventory is not aseasy as it would have been at Bhopal but one company did starta research programme, which looked promising, but abandoned itwhen they realized that there was already over-capacity in theindustry. Again, the official report and most commentators missedthis point (Parker, 1975; Kletz, 2001, chap. 8).

3.3. Piper alpha

After the explosion on the Piper Alpha oil platform (Appleton,2001, chap. 17; Cullen, 1990) in 1988 a number of writers asked if itwould be possible to pump the mixture of oil and gas ashore beforeseparation instead of separating them on a platform. Little or no

T.A. Kletz / Journal of Loss Prevention in the Process Industries 22 (2009) 753–756 755

work was carried out on this possibility until 2004 when BP startedto develop a subsea multiphase pumping system which, at the timeof writing, was in use on two platforms (Knott, 2008).

3.4. Nitration

Accident statistics reveal nitration as the most widespread andpowerfully destructive industrial unit process operation and therehave been many explosions on nitration plants (Urben, 1999). Manyof the nitrated products are then further processed by hydroge-nation into amines. Chemists say that there is no other practicablemethod for producing amines but, so far as I am aware, no one hasever looked for alternative processes.

3.5. Colour coding: an overlooked way of preventing some accidents

It is a cheap and easy method of avoiding confusion betweensimilar items of equipment, but is little used. The following isa typical example:

3.6. A confusing layout of pipework

All the pipelines in Fig. 2 contained gases under pressure. ValveA had to be changed, so the operator closed the valve below A andthen valve B, as they were both the third from the ends of the rows.He did not notice that the end pipe on the right did not follow thesame route as the others. The bends in the horizontal plane madevalves A and B the third valves from the ends of their rows. Whena fitter started to dismantle valve A the topwork flew off, fortu-nately missing the fitter. The incident could have been fatal.

The company was a large one. The investigators agreed that theoperator had made an understandable error, but their onlyrecommendation was to change the instructions on preparingequipment for maintenance to make the need to trace lines clearer.

Re-routing the pipes was obviously impracticable, but should benoted for the future. Colour coding the pipes or valves would havemade a repeat of the accident very unlikely. This was suggested butdismissed because it was not company policy. In some companies,especially small and medium-sized ones, the manager or foremanwould have bought some paints or coloured tapes and coloured thepipes or valves.

Fig. 2. Valve A had to be changed so the operator closed the valve below A and thenvalve B because they were both located third from the ends of the rows.

After a similar incident elsewhere, a senior designer engineerwas asked to avoid misleading valve layouts in future. He repliedthat it was difficult to get all the pipework into the space availablewithout worrying about the relative positions of valves. This maybe true but misleading valve layouts lead to accidents.

I recently reviewed a book on major process accidents, whichwas well-written but was based mainly on official reports, and thusdescribed Flixborough without mentioning inherently safer design.The kindest praise I could give the book was to suggest thatstudents should be given a chapter to read, either as a group or asindividuals, and asked to say what other recommendations mighthave been made.

4. What is the most common omission in accident reports?

It is the fact that similar accidents have happened before, oftenin the same factory or company. Kletz (1993) describes manyexamples of this. Often the author of a report does not know whathas happened on his own plant ten or more years earlier. After tenyears, personnel have changed, and no one knows the reasons whycertain operating practices or pieces of equipment, which wereintroduced after an accident, are there. Someone keen to improveefficiency, a very desirable thing to do, asks why are we followinga cumbersome time-consuming procedure or using unnecessaryequipment. No one remembers and the procedure is changed or theequipment removed – until the accident happens again. This couldbe avoided if every instruction, code and standard, introduced toincrease safety, included a note on the reasons why it wasintroduced.

The most recent major example of widespread ignorance of thepast is the explosion in December 2005, at the Buncefield OilStorage Depot in Hertfordshire, UK. A large storage tank containinggasoline was receiving liquid. The level measuring equipment andthe high level alarm on the tank were out of order so the gasolineoverflowed through the vent at the top of the tank, splashed downits side and formed a large vapor cloud. It ignited and an explosionwas followed by a large fire. 45 people were injured and there wasextensive damage not only to the Depot but to a neighbouringindustrial estate, where the ignition probably occurred. Thepremises of 20 businesses employing 5000 people were destroyedand those of 60 businesses employing 3500 people were damagedand made temporarily unusable. The explosion, said to have beenthe largest in peace-time Europe, occurred at 6 am on a Saturday. Ifit had occurred during a working day the injuries would have beenmuch greater. (The explosion may well have damaged a larger areathan earlier ones but it was not the largest in its results. Theexplosion of a mixture of ammonium nitrate and sulfate at Oppauin Germany in 1921 killed 500–600 people.)

The industrial estate had been sited near the Depot and allowedto expand as all those concerned were unaware of similar explo-sions in Newark, NJ in 1983 (Anon., 1984, further information canbe found by searching Google for Gasoline spills resulting in vaporcloud explosions; Henry, 1985; Kletz, 1986), Naples, Italy in 1995(Russo, Maremonti, Salzano, Tufano, & Ditali, 1999), St. Herblain,France in 1991 (Lechaudet, 1995) and elsewhere (They can be foundby searching Google for Gasoline spills resulting in vapor cloudexplosions). They believed that cold gasoline could not explode inthe open air. The group of oil companies that owned the Depotclaimed that an explosion of cold petrol in the open air had neveroccurred before. Two chemical engineers, interviewed by the BBCsoon after the explosion, mentioned the Newark incident. A regu-lator, also interviewed, denied any knowledge of it. Damage atBuncefield was, however, more extensive than at Newark andelsewhere.

T.A. Kletz / Journal of Loss Prevention in the Process Industries 22 (2009) 753–756756

The UK Health and Safety Executive have published a report onBuncefield (Buncefield Major Accident Investigation Panel, 2008).Overfilling of tanks is a common occurrence (Kletz, 2009).

5. Why are so many recommendations missed?

There are, I suggest, several other reasons, in addition to thosequoted in the first paragraph, why so many reports miss recom-mendations that in retrospect seem almost obvious. The first is thatreports produced by committees are consensus reports and theseusually lack originality. If anyone makes an entirely novel sugges-tion, such as inherently safer design would have been before 1974,some other members will probably, on the spur of the moment,think of objections and difficulties. There is no consensus and thesuggestion is not pursued further. In my time as a process safetyadviser in industry, I soon found that if I described at a meetingwhat I was intending to do, someone was likely to have somereservations and the chairman of the meeting was then likely to saythat we should give further thought to the proposal. Instead, Ireported what I had already done.

The second reason is that many engineers (and other technol-ogists), as they move up their companies’ hierarchies, lose contactwith the developments in the technology, become more interestedin commercial and financial matters and look upon original tech-nical suggestions as fashions or gimmicks. Such people often chairaccident investigation committees or have to approve the reportsbefore publication.

The third reason is that many people take a narrow view ofa committee’s objectives, for example, they may be unwilling tosuggest recommendations that are beyond their authority toauthorize or which may be the responsibility of departments notrepresented on the committee. Accident investigation committeesshould be encouraged to range as far as they wish and should bewilling to include in their report views that are not agreed by thewhole committee or even a majority.

Two environmental engineers have criticised their colleagues(Pilkey & Pilkey-Jarvis, 2006):

Young scientists view it as their solemn duty to knock therevered old-timers off their perches, constructed over decadesof pronouncements and discoveries. Young costal engineershave more of a tendency to revere their elders. Researchscientists thrive in an environment of criticism and analysis, butin the technical coastal modelling literature, criticisms arenearly non-existent and the models remain unchallenged. Tocriticize is almost an ungentlemanly thing to do.Can we replace ‘‘costal’’ by ‘‘chemical’’? I hope not.

6. Conclusions

Many accident reports, on both minor and major accidents, failto identify all the lessons that can be learned from them. Seniormanagers should read all reports on serious accidents and some ofthose on minor accidents. Before approving reports they shouldlook for failures to identify root causes and other lessons that can belearned, and discuss them with the investigating team or itschairman. Engineers are good at solving problems but less good atrecognizing that there is a problem. This paper has tried to makethe problem clear.

Students could be given an accident report without the rootcauses and asked to make extra recommendations.

References

Anon. (June 1984). Report on the incident at the Texaco Company’s Newark storagefacility, 7th January 1983., Loss Prevention Bulletin, No. 057, p.11-15. Reprinted inLoss Prevention Bulletin, No. 188, April 2006, p. 10–13.

Anon. (15 Sep. 2008). Bosses prepare to enter a new world. (UK). Daily TelegraphBusiness B5.

Appleton, B. (2001). In T. A. Kletz (Ed.), Learning from accidents (3rd ed.). Oxford, UK:Butterworth-Heinemann.

Ayres, I. (2007). Super crunchers. New York: Bantam Books.Buncefield Major Accident Investigation Panel. (2008)The Buncefield incident, Vol. 1.

London, UK: Health and Safety Executive. (Volume 2 contains reprints of theinterim reports.).

Corigan, T. (August 8 2008). (UK). Daily Telegraph Business News B5.Cullen, W. D. (1990). The public inquiry into the piper alpha disaster: Report of the

court of inquiry. London: Her Majesty’s Stationery Office.For other examples of explosions of cold gasoline in the open air search Google for

‘‘Gasoline spills resulting in vapor cloud explosions’’.Henry, M. F. (1985). NFPA’s consensus standards at work. Chemical Engineering

Progress, 81(8), 20–24.Hodgson, P. (2008). Switch design. Modern Railways, 65(712), 26–27.Kletz, T. A. (June 1986). Can cold petrol explode in the open air? The Chemical

Engineer63, (Reprinted in Loss Prevention Bulletin, No. 188, April 2006, p. 9).Kletz, T. A. (1993). Lessons from disaster – How organisations have no memory and

accidents recur. Rugby, UK: Institution of Chemical Engineers.Kletz, T. A. (2001). Learning from accidents (3rd ed.). Oxford, UK: Butterworth-

Heinemann.Kletz, T. A. (2009). What went wrong? Case histories of process plant disasters

(5th ed.). Boston, MA: Elsevier. Section 5.1.Knott, T. (April 2008). Subsea king. Frontiers: The BP Magazine of Technology and

Innovation 34–38.Lechaudet, J. F. (1995). Assessment of an accidental vapour cloud explosion. Loss

Prevention and Safety Promotion in the Process Industries, 314, 377–378.Parker, R. J. (1975). The Flixborough disaster: Report of the court of inquiry. London:

Her Majesty’s Stationery Office.Pilkey, O. H., & Pilkey-Jarvis, L. (2006). Useless arithmetic: Why environmental

scientists can’t predict the future. New York: Columbia University Press. p. 136.Russo, G., Maremonti, M., Salzano, E., Tufano, V., & Ditali, S. (1999). Vapour cloud

explosion in a fuel storage area; a case study. Process Safety and EnvironmentalProtection, 77(B6), 310–365.

Urben, P. G. (Ed.). (1999) (6th ed.).Bretherick’s handbook of reactive chemical hazards,Vol. 2 (pp. 245–247) Oxford, UK: Butterworth-Heinemann.