Chapter 12
Accident Investigations

The investigation of accidents and near misses (that is, close calls) provides opportunities to learn how to prevent similar events in the future. Accident investigations, including detailed descriptions and recommendations, are commonly shared within the chemical industry. Many professionals believe that this sharing of information about accidents has been a major contributor to the steady improvement in safety performance.

In recent years important techniques have been developed for improving the effectiveness of investigations. In this chapter we cover the more important techniques, including

• learning from accidents,

• layered investigations,

• the investigation process,

• investigation summary,

• aids for diagnosis, and

• aids for recommendations.

An important principle in safety states that the causes of accidents are visible the day before the accident. These causes are visible to professionals who “see” deficiencies. This vision (knowledge or awareness) is developed by the study and development of accident and near-miss investigations.

12-1 Learning from Accidents

Every member of an investigation team learns about problems that precipitate accidents. This new knowledge helps every team member avoid similar situations in the future. If the investigation is appropriately reported, many others will also benefit.

This concept is also important for reporting minor accidents or near misses. Minor accidents and near misses are excellent opportunities to obtain “free chances” to prevent larger accidents from occurring in the future. It is much easier to correct minor problems before serious accidents occur than to correct them after they are manifested in major losses.

Accident investigations are designed to enhance learning. The fundamental steps in an investigation include (1) developing a detailed description of the accident, (2) accumulating relevant facts, (3) analyzing the facts and developing potential causes of the accident, (4) studying the system and operating methods relevant to the potential causes of the accident, (5) developing the most likely causes, (6) developing recommendations to eliminate recurrence of this type of accident, and (7) using an investigation style that is fact-finding and not faultfinding; faultfinding creates an environment that is not conducive to learning.

Good investigations help organizations use every accident as an opportunity to learn how to prevent future accidents. Investigation results are used to change hazardous practices and procedures and to develop management systems to use this new knowledge on a long-term and continuous basis.

12-2 Layered Investigations

The important concept of layered investigations is emphasized by T. Kletz.¹ It is a technique that significantly improves the commonly used older methods. Older investigation methods identified only the relatively obvious causes of an accident. Their evidence supported their conclusions, and one or two technical recommendations resulted. According to Kletz, this older method developed recommendations that were relatively superficial. Unfortunately, most accidents are investigated in this style.

¹T. Kletz, “Layered Accident Investigations,” Hydrocarbon Processing (November 1979), pp. 373–382; and T. Kletz, Learning from Accidents in Industry (Boston: Butterworths, 1988).

The newer and better method includes a deeper analysis of the facts and additional levels or layers of recommendations. This recommended deeper analysis identifies underlying causes of the accident that are analyzed to develop a multilayered solution to the problem — layered recommendations.

The number of relevant facts accumulated in an accident investigation is usually limited. Further investigation usually cannot uncover additional facts. A deeper analysis of the facts, however, often leads to new conclusions and recommendations. This deeper analysis is, for example, similar to a brainstorming session to develop new applications for a common house brick. New and interesting applications will continue to surface.

Kletz emphasized an extra effort to generate three levels of recommendations for preventing and mitigating accidents:

First layer: immediate technical recommendations,

Second layer: recommendations to avoid the hazards,

Third layer: recommendations to improve the management system.

To fully utilize this layered technique, the investigation process is conducted with an open mind. Facts about the accident that support conclusions at all three levels are accumulated.

Example 12-1

In this particular example, almost all recommendations can be implemented without difficulty. These technical improvements and new management systems will prevent future drownings and also prevent other types of accidents in this pool environment. This example also illustrates the value of having an open mind during the investigation, which is a requirement for uncovering underlying causes.

Table 12-1 Questions for Layered Accident Investigations¹

¹Trevor Kletz, Learning from Accidents in Industry (Boston: Butterworths, 1988), p. 153.

A set of questions designed to help accident investigators find less obvious ways to prevent accidents is shown in Table 12-1. The team approach of questioning and answering is especially important because the supportive, synergistic, and feedback approach by team members gives results that are always greater than the sum of the parts.

12-3 Investigation Process

Different investigators use different approaches to accident investigations. One approach that can be used for most accidents is described here and shown in Table 12-2; it is an adaptation of a process recommended by A. D. Craven.²

²Howard H. Fawcett and William S. Wood, eds., Safety and Accident Prevention in Chemical Operations (New York: Wiley, 1982), pp. 659–680.

Table 12-2 Accident Investigation Process

The accident investigation report is the major result of the investigation. In general, the format should be flexible and designed specifically to best explain the accident. The format may include the following sections: (1) introduction, (2) process description (equipment and chemistry), (3) incident description, (4) investigation results, (5) discussion, (6) conclusions, and (7) layered recommendations.

The accident investigation report is written using the principles of technical documentation. Items 1–4 are objective and should not include the authors’ opinions. Items 5–7 appropriately contain the opinions of the authors (investigation team). This technical style allows readers to develop their own independent conclusions and recommendations. As a result of these criteria, the accident investigation report is a learning tool, which is the major purpose of the investigation.

12-4 Investigation Summary

The previously described accident investigation report is a logical and necessary result of an investigation. It includes comprehensive details that are of particular interest to specialists. These details, however, are too focused for an average inquirer.

Figure 12-1 Accident report summary.

Kletz³ used a report format that summarizes the events and recommendations in a diagram. This type of summary is shown in Figure 12-1. It emphasizes underlying causes and layered recommendations. These concepts are described in Example 12-2. The illustrated format is similar to the one used by Kletz.

³T. Kletz, Learning from Accidents in Industry, p. 22.

The third-layer recommendations shown in Figure 12-1 emphasize the importance of management systems for preventing accidents. Management systems are designed to continuously, and on a long-term basis, either prevent the accident or eliminate the hazardous conditions, that is, to break the link in the chain of events that led to the accident. Examples may be (1) a quarterly audit program to ensure that recommendations are understood and used, (2) a semiannual orientation program to review and study accident reports, or (3) a checklist that is initiated by management and checked by operations on a daily basis.

Layered events and recommendations are developed primarily by experienced personnel. For this reason some experienced personnel are always assigned to investigation teams. Inexperienced team members learn from the experienced personnel, and often they also make significant contributions through an open and probing discussion.

12-5 Aids for Diagnosis⁴

⁴Fawcett and Wood, eds., Safety and Accident Prevention, p. 668.

The data collected during an investigation are studied and analyzed to establish the causes of the accident and to develop recommendations to prevent a recurrence. In most cases the evidence clearly supports one or more causes. Sometimes, however, the evidence needs added analysis to uncover explanations. This phase of the investigation may require special techniques or aids to diagnosis to relate the evidence to specific causes.

Fires

The identification of the primary source of ignition is one of the major objectives of investigations. In this regard observations around the charred remains are helpful. For example, the depth of wood charring is proportional to the duration of burning, and most woods burn at a rate of 1.5 in/hr. Therefore, if the time of extinguishment is known and if the depth of char at various locations is known, then the region of the origin can be approximated.

Further searching in this region may reveal possible causes of the fire, as shown in the following discussion.

The fire temperature for various materials, such as wood, plastic, and solvents, is approximately 1000°C. Because pure copper melts at 1080°C, copper wire usually survives fires. If copper beads are found around electrical equipment, it may indicate that electrical arcs created temperatures greater than those observed in fires. Sometimes pits at the ends of conductors indicate high temperatures and vaporization of copper while arcing. Although this type of evidence indicates a source of ignition, it may not be the primary source of the fire.

The integrity of steelwork is not very useful evidence. Iron and steel have high melting points (1300–1500°C) compared to fire temperatures. However, steel weakens at approximately 575°C; therefore steelwork may be completely distorted.

Aluminum and alloys of aluminum have very low melting points (660°C). All aluminum products will therefore melt during fires. This evidence together with steelwork distortions is not useful, and deeper analysis in this regard should be avoided.

Explosions

The classification of the explosion as either a deflagration or a detonation and the magnitude of the explosion may be useful for developing causes and recommendations during accident investigations.

Deflagrations

Breaks in pipes or vessels resulting from deflagrations or simple overpressurizations are usually tears with lengths no longer than a few pipe diameters.

The pressure increases during deflagrations are approximately⁵

⁵Frank P. Lees, Loss Prevention in the Process Industries (Boston: Butterworths, 1983), p. 567.

(12-1)

(12-2)

For pipe networks the pressure will increase in front of the flame front as the flame travels through the network. The downstream pressure may be 8 to 16 times greater than the original upstream pressure. This concept is called pressure piling. With pressure piling, therefore, p₂ = p₁ × 8 × 8 and p₂ = p₁ × 16 × 16 for Equations 12-1 and 12-2, respectively.

During deflagrations in vessels, the pressure is uniform throughout the vessel; therefore the failure occurs at the vessel’s weakest point. The damage is manifested as tears (detonations give shearing failures), and the point of ignition has no relationship to the ultimate point of failure.

Hydraulic and Pneumatic Failures

Hydraulic high-pressure failures also give relatively small tears compared to pneumatic failures, which are destructive. Rapidly expanding gases give large tears and can propel missiles, drums, and vessels great distances.

Detonations

As described in chapter 6, detonations have a rapidly moving flame and/or pressure front. Detonation failures usually occur in pipelines or vessels with large length-to-diameter ratios.

In a single vessel detonations increase pressures significantly⁶:

⁶Lees, Loss Prevention, p. 569.

(12-3)

When a pipe network is involved, the downstream p₁ increases because of pressure piling; therefore p₂ may increase by as much as another factor of 20.

Detonation failures in pipe networks are always downstream from the ignition source. They usually occur at pipe elbows or other pipe constrictions, such as valves. Blast pressures can shatter an elbow into many small fragments. A detonation in light-gauge ductwork can tear the duct along seams and can also produce a large amount of structural distortion in the torn ducts.

In pipe systems explosions can initiate as deflagrations and the flame front may accelerate to detonation speeds.

Sources of Ignition in Vessels

When a vessel ruptures because of a deflagration, the source of ignition is usually coincident with the point of maximum vessel thinning resulting from expansion. Therefore, if the vessel parts are reconstructed, the source of ignition is at the point with the thinnest walls.

Pressure Effects

When pipe or vessel ruptures are investigated, it is important to know the pressures required to create the damage and ultimately to determine the magnitude and source of energy.

The pressure necessary to produce a specific stress in a vessel depends on the thickness of the vessel, the vessel diameter, and the mechanical properties of the vessel wall.⁷ For cylindrical vessels with the pressure p not exceeding 0.385 times the mechanical strength of the material S_M

⁷Samuel Strelzoff and L. C. Pan, “Designing Pressure Vessels,” Chemical Engineering (Nov. 4, 1968), p. 191.

(12-4)

where

p is the internal gauge pressure,
S_M is the strength of the material,
t_v is the wall thickness of the vessel, and
r is the inside radius of the vessel.

For cylindrical vessels and pressures exceeding 0.385S_M, the following equation applies:

(12-5)

For spherical vessels with pressures not exceeding 0.665S_M the equation is

(12-6)

For spherical vessels and pressures exceeding 0.665S_M the equation is

(12-7)

These formulas are also used to determine the pressure required to produce elastic deformations by using yield strengths for S_M. They are also used to determine the pressures required to produce failures by using tensile strengths for S_M. Strength of material data are provided in Table 12-3.

Table 12-3 Strength of Materials¹

¹Robert H. Perry and Cecil H. Chilton, eds., Chemical Engineers’ Handbook (New York: McGraw-Hill, 1973), pp. 6-96 and 6-97.

High-pressure failures are as likely to occur in a pipe or pipe system as they are in vessels. The maximum internal pressure for pipes is calculated using Equations 12-4 and 12-5.

After the maximum internal pressure is computed, the explosive energy is computed, using Equation 6-29. The ultimate source of this explosion energy is found by developing various reaction or mechanical hypotheses and comparing the reaction energy to the explosion energy until the most likely hypothesis is identified. After the energy and ignition sources are identified, attention is placed on developing conditions to prevent the source of failure.

Medical Evidence

Medical examinations of the accident victims result in evidence that may be useful for identifying the source of the accident or for identifying some circumstances that may help to uncover underlying causes.

The types of medical data that help accident investigations include (1) type and level of toxic or abusive substances in the blood, (2) location and magnitude of injuries, (3) type of poisoning (carbon monoxide, toluene, etc.), (4) signs of suffocation, (5) signs of heat exposure or heat exhaustion, and (6) signs of eye irritation.

Miscellaneous Aids to Diagnosis

Other aids for identifying underlying causes of accidents are found throughout this text. During an accident investigation, the investigation team must watch for visible evidence, and they must also make supporting calculations to evaluate various hypotheses. A brief review of safety fundamentals before the investigation is helpful. This includes, for example, (1) toxicity of chemicals or combinations of chemicals, (2) explosion limits, (3) magnitude of leaks depending on the source, (4) dispersion of vapors outside or inside plants, (5) principles of grounding and bonding, (6) principles of static electricity, (7) design concepts for handling flammable materials, and (8) methods for performing accident investigations. This knowledge and information will be useful during an investigation.

12-6 Aids for Recommendations

Recommendations are the most important result of an accident investigation. They are made to prevent a recurrence of the specific accident, but they are also made to prevent similar accidents within the company and within the industry. The ultimate result of accident investigations is the elimination of the underlying causes of entire families of accidents. One good accident investigation can prevent hundreds of accidents.

There are four overriding principles that are used to influence accident investigation recommendations:

1. Make safety investments on a basis of cost and performance. Evaluate each investment (money and time) to ensure that there is a true safety improvement proportional to the investment. If the designer is not careful, changes to the system or new procedures may add complexities that result in a more hazardous situation rather than in an improvement.

2. Develop recommendations to improve the management system to prevent the existence of safety hazards, including training, checklists, inspections, safety reviews, and audits,

3. Develop recommendations to improve the management and staff support of safety with the same enthusiasm, attention, quality, plans, and organization as used in production programs.

4. Develop layered recommendations with an appropriate emphasis on recommendations to eliminate underlying causes of accidents.

All the fundamentals described in this text are commonly used to develop recommendations. Some aids to recommendations are covered in the following sections.

Control Plant Modifications

Modifications to plants are often not given the same attention and concern as a new plant design. In addition, they are sometimes the result of mechanical problems that shut the plant down, and in these situations all efforts are directed toward a quick restart. Many accidents are the result of plant modifications.

Recommendations are especially designed to prevent this kind of problem:

1. Authorization: All modifications must be authorized by several levels of management.

2. Design: The modification designs must be mechanically constructed with the same quality of equipment and pipes as the original design. Original designs should be studied so that the consequences of any change are understood. The designers must appreciate that for every problem there are many interesting, economically sound, plausible, and wrong solutions.

3. Safety reviews: A safety review (HAZOP study or equivalent study for hazardous operations) must be conducted by engineers, operators, and design specialists while the modification project is in the design phase. This allows (and encourages) safety changes to be made with minimum effort. Once the system is constructed, changes are difficult and costly to make.

4. Training: Engineers and operators need sufficient training to understand and appreciate the modified operation.

5. Audit: Every plant modification needs periodic audits to be sure that the modifications are made and maintained as designed.

These five requirements are all part of the OSHA Process Safety Management regulation discussed in chapter 3.

User-Friendly Designs⁸

⁸Kletz, Learning from Accidents in Industry, p. 148.

New plants or modifications to existing plants must be designed to be friendly—to tolerate departures from the norm without creating hazardous conditions. Examples of friendly designs include using nontoxic and nonflammable solvents when possible, keeping temperatures below the flash point and below the boiling point at atmospheric conditions, keeping inventories low, and designing for safe shutdowns during emergency situations (expect the unexpected).

Block Valves

Block valves are installed throughout plants to return a process to a safe condition under unusual circumstances. For example, the process shown in Figure 12-2 detects a hose leak by comparing flow rates at both ends of the hose. If the hose breaks, the leak is detected and the block valves on the reactor and sewer are immediately closed.

Block valves are often controlled on the basis of analyzer results, such as area monitors for detecting solvent leaks, reactor analyzers for detecting runaway reactions (a block valve can be opened to add a reaction inhibitor or to turn on a deluge system), sewer analyzers for detecting high concentrations of contaminants, and vent analyzers to detect high levels of contaminants.

Figure 12-2 A block valve arrangement used to prevent leakage from the connecting hose. If the flow at both ends of the hose is not identical, the block valves are closed.

Double Block and Bleed

A special double block and bleed system, shown in Figure 12-3, is added to every feed line to a reactor. During normal operating conditions, the block valves are open and the bleed line is closed. When the feed pump is shut off, the block valves are closed and the bleed line is open.

This system prevents the reactor contents from siphoning back into the monomer storage vessel, even if the block valves leak. This prevents an unexpected chemical reaction in the storage tank.

Figure 12-3 is a relatively simple example of a particularly important application of double block and bleed systems. These systems are also commonly used for reactive intermediates and analyzer systems—anywhere a positive break in a line is desired.

Preventive Maintenance

Most engineers are aware of the importance of preventive maintenance programs, especially those owning automobiles or homes. A little neglect can cause serious property damage and may be the genesis of serious accidents; for example, poorly maintained brake systems have inevitable consequences.

Figure 12-3 A double block and bleed arrangement used to prevent reactant from entering reactor vessel.

In plants one major cause of accidents is the failure of emergency protection equipment such as cooling water pumps, instruments, and deluge systems. Many times, when evaluating underlying causes of accidents, it is found that protective equipment failed because it was neglected; there was no preventive maintenance program. In this case new procedures or new equipment is not needed; adding more protective equipment or procedures might increase the likelihood of accidents. The only improvement needed is upgrading the existing maintenance program.

Preventive maintenance programs must be organized, managed, and fully supported by management. Good results may not be immediately apparent, but bad results are apparent when plants are not appropriately maintained.

Good maintenance programs include scheduled maintenance and a system to keep an inventory of critical maintenance parts. Every maintenance job requires a feedback mechanism based on the inspection of parts while conducting the maintenance. The maintenance schedule is subsequently changed if more frequent maintenance is required.

Analyzers

Chemical analysis of reactor contents and of the surrounding environment is an important way to understand the status of a plant and to identify problems at the incipient state of development. When problems are identified at an early stage, action can be taken to return the system to safe operating regions with no adverse consequences.

In recent years new and better analyzers have been developed. Design engineers should always search for new opportunities to use process analyzers to improve operations and safety within plants. As the reliability and applicability of analyzers are improved, they will become the key control elements in chemical plants, particularly in regard to safety, quality, and yield improvements.

Suggested Reading

CCPS, Chemical Process Safety: Learning from Case Histories, 2d ed. (New York: American Institute of Chemical Engineers, 1996).

CCPS, Guidelines for Investigating Chemical Process Accidents (New York: American Institute of Chemical Engineers, 1992).

CCPS, Inherently Safer Chemical Processes (New York: American Institute of Chemical Engineers, 1996).

CCPS, Plant Guidelines for Technical Management of Chemical Process Safety (New York: American Institute of Chemical Engineers, 1992).

Trevor A. Kletz, “Layered Accident Investigations,” Hydrocarbon Processing (November 1979), pp. 373–382.

Trevor A. Kletz, Learning from Accidents in Industry, 2d ed. (Boston: Butterworth-Heinemann, 1994).

Trevor A. Kletz, What Went Wrong? Case Histories of Process Plant Disasters (Houston: Gulf Publishing, 1985).

Large Property Damage Losses in the Hydrocarbon-Chemical Industries: A Thirty-Year Review, 18th ed. (Chicago: J&H Marsh & McLennan Inc., 1998).

Roy E. Sanders, Chemical Process Safety: Learning from Case Histories (Boston: Butterworth-Heinemann, 1999).

A Thirty Year Review of One Hundred of the Largest Property Damage Losses in the Hydrocarbon-Chemical Industry, 11th ed. (Chicago: Marsh and McLennan Protection Consultants, 1988).

Problems

12-1. Use the Flixborough Works accident described in chapter 1 to develop an investigation similar to Example 12-1.

12-2. Use the Flixborough Works accident and the investigation developed in Problem 12-1 to develop an investigation summary similar to Example 12-2. Include layered recommendations to cover the accident causes and underlying causes.

12-3. Use the Bhopal, India, accident described in chapter 1 to develop an investigation similar to Example 12-1.

12-4. Use the Bhopal accident and the investigation developed in Problem 12-3 to develop an investigation summary similar to Example 12-2. Include layered recommendations.

12-5. Use the Seveso, Italy, accident described in chapter 1 to develop an investigation similar to Example 12-1.

12-6. Use the Seveso, Italy, accident and the investigation developed in Problem 12-5 to develop an investigation summary similar to Example 12-2. Include layered recommendations.

12-7. Develop an investigation similar to Example 12-1 and an investigation summary for an automobile accident that occurred as a result of a brake failure. Create your own brief accident scenario for this problem.

12-8. Determine the pressure required for a pipe to swell and the pressure required for a pipe failure. The pipe is 3-in stainless 316 schedule 40 pipeline for transporting a gas mixture that is sometimes within the explosive composition range.

12-9. Determine the required thickness of a reactor with cylindrical walls that must be designed to safely contain a deflagration (hydrocarbon plus air). The vessel has a diameter of 4 ft and is constructed with stainless steel 304. The normal operating pressure is 2 atm.

12-10. An accident occurs that ruptures a high-pressure spherical vessel. The vessel is 1.5 ft in diameter, is made of stainless 304, and the walls are 0.25 in thick. Determine the pressure required to cause this failure. Develop some hypotheses regarding the causes of this accident.

12-11. Compute the theoretical maximum pressure obtained after igniting a stoichiometric quantity of methane and oxygen in a spherical vessel that is 1.5 ft in diameter. Assume an initial pressure of 1 atm.

12-12. Compute the theoretical maximum pressure obtained after igniting a stoichiometric quantity of methane and air in a spherical vessel that is 1.5 ft in diameter. Assume that the initial pressure is 1 atm.

12-13. Using the results of Problem 12-11, determine the required vessel wall thickness to contain this explosion if the vessel is made of stainless 316.

12-14. Using the results of Problem 12-13, determine the vessel wall thickness required to contain an explosion in another vessel that is physically connected to the first vessel with a 1-in pipe. Describe why the second vessel requires a greater wall thickness.

12-15. Describe why accident investigation recommendations must include recommendations to improve the management system.

12-16. Describe a preventive maintenance program that is designed to prevent automobile accidents.

12-17. Describe the concept of using block valves to prevent detonation accidents in a system handling flammable gases. The system has two vessels that are connected with a 4-in vapor line.

12-18. Using the data and results of Example 12-6, determine the wall thickness required to eliminate future failures. Assume that the vessel’s cylindrical wall height is equal to the vessel’s diameter.

12-19. Determine the vessel wall thickness required to contain an explosion of 2 lb of TNT. The spherical vessel is 1.5 ft in diameter and is constructed with stainless steel 316.

12-20. In the 1930s there were many accidents in homes because of the explosion of hot water heaters. Describe what features are added to water heaters to eliminate accidents.

12-21. A cloud of hydrogen gas is released and subsequently explodes. Glass is shattered 500 ft away. Estimate the quantity of hydrogen gas initially released, assuming that stoichio-metric quantities of hydrogen and air explode.

12-22. Develop a definition for a major incident, and compare it to CCPS’s definition. See CCPS, Plant Guidelines for Technical Management of Chemical Process Safety (1992), p. 236.

12-23. As stated in section 12-4, the three layers of recommendations for accident investigations include management systems to prevent similar accidents or to eliminate the hazardous conditions. This management system includes the delegation of responsibilities and followup. What are the benefits of followup? Compare your answer to the benefits described in the CCPS (1992) reference on p. 238.

12-24. A management system for accident investigations includes good communications. What are the tangible benefits of a good communications system? Compare your answer to CCPS’s (1992, p. 238).

12-25. Near-miss (close-call) accident investigation reports are also important. Define near-miss accidents. Compare your answer to CCPS’s (1992, p. 239).

12-26. What facts should a near-miss accident report include? Compare your answer to CCPS’s (1992, p. 240).

12-27. The US Chemical Safety and Hazard Investigation Board investigated an accident at the Morton Specialty Chemical Company in 1998. Evaluate the board’s recommendations, and break them down into three layers of recommendations. See http://www.chemsafety.gov/.

12-28. An accident investigation at the Tosco Refinery Company emphasized the importance of a management system. Describe the accident, and develop three layers of recommendations. See http://www.chemsafety.gov/.

12-29. An EPA-OSHA accident investigation at Napp Technologies Inc. in Lodi, New Jersey, developed the root causes and recommendations to address the root causes. Describe the accident, and develop layered recommendations for this specific accident. See http://www.epa.gov/ceppo/pubs/lodiintr.htm.

12-30. The accident investigation at Lodi, New Jersey, included previous industrial accidents with sodium hydrosulfite and aluminum. Summarize the findings of these accidents and develop a few management system recommendations for these industries. See http://www.epa.gov/ceppo/pubs/lodirecc.htm.