L9 Incident Investigation Student Handout PDF

INCIDENT/ACCIDENT INVESTIGATION
AND ROOT CAUSE ANALYSIS
NPC TRAINING PROGRAM
STUDENT HANDOUT
Presented by
Ron Rosser & Mike Breward
Calgary Tel 1-403-221-8077 Fax 1-403-221-8072

E-mail: info@seal.ab.ca Website: www.seal.ab.ca
Table of Contents
COURSE OBJECTIVES.................................................................................................. 1
COURSE OBJECTIVES ....................................................................................................... 1
AGENDA ........................................................................................................................... 2
AGENDA........................................................................................................................... 2
Day 1........................................................................................................................... 2
Day 2........................................................................................................................... 2
INCIDENT INVESTIGATION FLOW PATH ............................................................. 3
WHY INVESTIGATE INCIDENTS?....................................................................................... 4
TEAM EXERCISE............................................................................................................... 4
WHY INVESTIGATE INCIDENTS?....................................................................................... 5
INCIDENT RECURRENCE ........................................................................................... 6
INCIDENT ......................................................................................................................... 6
QUESTIONS THAT NEED TO BE ASKED ............................................................................ 6
RECOMMENDATIONS ........................................................................................................ 6
INCIDENT VIDEO - 'NOBODY'S FAULT' ............................................................................ 8
PRESERVATION OF EVIDENCE .......................................................................................... 9
Segment Objectives:.................................................................................................... 9
There are four types of evidence:................................................................................ 9
POSITION EVIDENCE ...................................................................................................... 10
PHOTOGRAPHS:.............................................................................................................. 11
POSITION MAPS: ............................................................................................................ 11
PEOPLE EVIDENCE ......................................................................................................... 12
Interviewing Techniques ........................................................................................... 12
PARTS EVIDENCE ........................................................................................................... 14
PAPER EVIDENCE ........................................................................................................... 15
INTERVIEWING EXERCISE............................................................................................... 16
INCIDENT REPORTING ............................................................................................. 17
SEGMENT OBJECTIVES: .................................................................................................. 17
INCIDENT INVESTIGATION FLOW PATH............................................................ 18
TEAM EXERCISE : WHY REPORT INCIDENTS?.................................................................. 19
WHY REPORT INCIDENTS ............................................................................................... 20
IMPORTANCE OF QUALITY DATA ................................................................................... 24
CASE STUDY .................................................................................................................. 25
Bhopal ....................................................................................................................... 25
ANALYZING TO ROOT CAUSE......................................................................................... 26
ROOT CAUSE ANALYSIS................................................................................................. 28
CASE STUDY PHYSICAL ROOTS...................................................................................... 32
“NOBODY’S FAULT” LATENT ROOT CAUSE ANALYSIS .................................................. 30
TEAM EXERCISE : ROOT CAUSE ANALYSIS .................................................................... 32
INCIDENT/ACCIDENT INVESTIGATION I
S.E.A.L. International
INCIDENTS TO INVESTIGATE................................................................................. 34
SEGMENT OBJECTIVES: .................................................................................................. 34
INCIDENT INVESTIGATION FLOW PATH .......................................................................... 35
SPORADIC INCIDENT ...................................................................................................... 36
CHRONIC INCIDENT ........................................................................................................ 37
FAILURE MODES AND EFFECTS ANALYSIS (FMEA) ...................................................... 39
USING FMEA IN YOUR COMPANY .................................................................................. 39
FMEA WORKSHEET................................................................................................ 40
REPORTING AND RECOMMENDATIONS ........................................................................... 41
WHY INVESTIGATE INCIDENTS?..................................................................................... 41
MAKING APPROPRIATE RECOMMENDATIONS................................................................. 41
NOBODY’S FAULT LATENT ROOT CAUSE ANALYSIS ..................................................... 42
SMALL GROUP EXERCISE ............................................................................................... 43
CLASS INCIDENT ............................................................................................................ 44
APPENDIX...................................................................................................................... 48
GENERAL REFERENCES........................................................................................... 48
BHOPAL CASE STUDY ............................................................................................... 48
GENERAL REFERENCES:................................................................................................. 49
BHOPAL CASE STUDY .................................................................................................... 50
Introduction............................................................................................................... 50
Methyl Isocyanate (M.I.C.) ....................................................................................... 51
Toxicological Effects — Acute .................................................................................. 51
Immediate Causes ..................................................................................................... 52
Three Questions:....................................................................................................... 54
Basic Causes ............................................................................................................. 54
SCHEMATIC LAYOUT OF COMMON HEADERS OF MIC STORAGE TANKS ........................ 58
INCIDENT/ACCIDENT INVESTIGATION II
COURSE OBJECTIVES
Course Objectives
The objectives for this course are:
• Define the purpose of incident investigation.

• Explain the importance of incident reporting.
• Describe evidence preservation techniques.
• Describe the investigation flow path.
• Define key terms used in incident investigation.
• Correctly complete incident reporting and investigation data.
• Analyze the causes of incidents.
• Make recommendations to prevent incident recurrence.
• Explain the importance of determining root cause.
What are your expectations for the course?
INCIDENT/ACCIDENT INVESTIGATION 1
AGENDA
Agenda
Day 1
• Introductions
• Why Investigate Incidents?
• Preservation of Evidence
• Incident Reporting
• Incidents to Investigate
Day 2
• Case Study - Bhopal
• Analyzing to Root Cause
• Reporting and Recommendations
• Group Exercise
• Course Wrap-Up
This workshop covers a great deal of material. To ensure that the course can be
completed as planned, please stay within the assigned time frames for team exercises
and breaks.
INCIDENT INVESTIGATION FLOW PATH
UNDESIRED
EVENT
FOLLOW DETERMINE
IS THE CAUSE
INCIDENT Yes No CALL OUT
EVIDENT?
GUIDELINES REQUIREMENT
S
FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER.

COMPLETE INCIDENT REPORT
FORWARD TO INCIDENT INVESTIGATION ADMINISTRATOR.
NEAR EXTRA-
MINOR SERIOU MAJOR
MISS ORDINARY
S
INVESTIGATE NOW?
Yes
OTHER DATA ASSIGN INVESTIGATION TEAM
-PMS LEADER
- No
LOGS
-HOT
LINE
DETERMINE:-
TEAM MEMBERSHIP DATA REQUIREMENTS
-PMT REPRESENTATIVES -LCR & QA RECORDS
DATABASE FOR -EXPERTS -EQUIPMENT HISTORY
FUTUR -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS
E
INVESTIGATION & -CRITICS -INTERVIEW REQUIREMENTS
ANALYSIS
PERFORM K.T. PROBLEM

ANALYSIS
OR ALTERNATIVE ANALYTICAL
PERFORM F.M.E.A. TECHNIQUE TO DETERMINE
PHYSICAL CAUSE(S)
MANAGEMENT CAUSE(S)
REVIEW/SELECTION No
FOUND?
Yes
PROCESS &
MAINTENANCE PERFORM ROOT CAUSE ANALYSIS
TEAMS ATS TO IDENTIFY MANAGEMENT
SYSTEM
CAUS INADEQUACIES
No
E
FOUND
COMPLETE REPORT AND GENERATE

Yes
RECOMMENDATIONS TO PMT OR MANAGEMENT
TEAM
Why Investigate Incidents?
Segment Objectives:
• To illustrate the importance of incident investigation.
• To discuss the concept of incident recurrence.
• To introduce the first segment of the case study exercise.
Team Exercise
Working in your teams, brainstorm a list of reasons why we investigate incidents.
•
•
•
•
•
•
•
•
•
•
•
•
• To recognize the unsafe acts and/or conditions that caused the incident.
• To identify the management system that failed to prevent it from happening.
• To recommend remedial actions that will prevent it from happening again.
INCIDENT RECURRENCE
Incident
• A person falls from a ladder.
• Unsafe act - climbing a defective ladder.
• Recommendation - replace the ladder.
Questions That Need To Be Asked

• Why was the ladder not inspected?
• Was the employee properly trained?
• Was the employee informed not to use the ladder?
Recommendations
• An improved ladder inspection program.
• Improved training.
• A clearer definition of responsibilities.
INCIDENT TRAJECTORY
MODEL FOR LOSS
Inadequate defenses
(Active and Latent Errors)
Gaps at any level create an
incident inducing environment Incident contact LOSS
(Active Error)
Process & physical work

environment
(Active/ Latent Errors)
HSE Management Systems

(Latent errors -Root Causes)
Trajectory
Incident Corporate commitment

(Latent Errors - Root
causes)
Incident Video - 'Nobody's Fault'
It is important to keep notes of what you observe during the video, as you will need this
information to complete later segments of the case study exercise.
Names of People and Roles (boss, worker, etc.)
Information/Facts:
Notes:
Preservation of Evidence
Effective preservation of evidence is the key building block to a successful investigation.
Segment Objectives:
• To introduce the four P's of evidence preservation.
• To explain the use of evidence preservation techniques and their importance in the
incident investigation process.
• To demonstrate common techniques used for gathering evidence.
There are four types of evidence:

• Position evidence:
• People evidence:
• Parts evidence:
• Paper evidence:
These are known as the Four P's.
PRESERVATION OF
EVIDENCE
F
R
A P
O
G
S
I I P
L T E
O P
I I A
T P
O L R
Y N E T
S PAPER
MINS HRS DAYS WEEKS
Position Evidence
Pilot Plant Number 1
Burnt dust
sheet
Pilot Steam Trap
Plant
Number Packing crate New equipment
2
Overhead
Gallery
Packing material
Broken glass
Electric Stains on floor
Cable Bunsen
burner
Taffy’s work area
Position evidence is the most fragile of all evidence. This form of evidence should be
gathered as soon as possible after an incident has occurred.
There are several easy ways to record position evidence. The two types of position
evidence we will discuss today are:
• photographs
• position maps
Photographs:
Position Maps:
People Evidence
Interviewing Techniques
• Interview one individual at a time (one on one).
• Neutral, private setting.
• Depersonalize.
• Use open-ended questions to gather information.
• Use close-ended questions to confirm information.
• Follow; don’t lead.
• Listen and record; do not comment.
• Encourage follow-up.
People evidence is the second most fragile type of evidence we can gather in an incident
investigation.
The primary method we use for gathering people evidence is personal interviews.
Relevant information is not restricted to the incident itself, but includes the standards and
practices of the work group, the normal operating conditions and any past incidents of a
similar nature. An interviewer should be able to extract useful information of that nature.
People's ability to remember details regarding a situation diminishes quickly. Therefore

it is imperative that witnesses are interviewed as quickly as possible.
In addition, most people are not trained observers. They tend to interpret or rationalize
what they have seen and “fill in” missing gaps with assumptions or pieces of information
they have heard from others associated with the incident.
Notes:
Parts Evidence
Parts must be retrieved, labeled and protected against damage so that analyses can be
conducted. All too often critical parts are thrown away or damaged, resulting in the loss
of valuable evidence.
If a part is moved, it first should be photographed where it was found and then placed in
an appropriate container. Each part should be labeled to identify what it is and where it
was found. This also applies to material or liquid that has been spilled or discharged as a
result of the incident.
It is important to be careful when handling these parts and materials, as fractured surfaces
may be jagged or spilled material may be hazardous.
Notes:
Paper Evidence
Paper evidence is the least fragile of all types of evidence. Most paper evidence will be
available for analysis several days or weeks after the incident.
Some computer evidence, such as process data, will need to be retrieved soon after an
incident has occurred, as these systems often download or dump data every twenty-four
hours.
Notes:
Interviewing Exercise
In this next section, your team will have the opportunity to analyze information from the
“Nobody's Fault” incident.
You will need:
• Observations from the video introduction.
• Position evidence.
• Notes taken when the instructor answers class questions.
In teams, compose two (2) questions to ask the instructor. One question that is not
allowed to be asked is, “What caused the fire?” Your questions should be designed to
enable your team to find out:
• What happened (sequence of events).
• How the fire started.
INCIDENT REPORTING
Segment Objectives:
• To explain the incident reporting process.
• To describe the incident ratio study.
• To explain the importance of quality incident data.
INCIDENT INVESTIGATION FLOW PATH
UNDESIRED
EVENT
FOLLOW DETERMINE
IS THE CAUSE
INCIDENT Yes No CALL OUT
EVIDENT?
GUIDELINES REQUIREMENT
S

COMPLETE INCIDENT REPORT
FORWARD TO INCIDENT INVESTIGATION ADMINISTRATOR.
NEAR EXTRA-
MINOR SERIOU MAJOR
MISS ORDINARY
S
INVESTIGATE NOW?
Yes
-PMS LEADER
- No
LOGS
-HOT
LINE
DETERMINE:-
FUTUR -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS
E
ANALYSIS
PERFORM K.T. PROBLEM

ANALYSIS
PHYSICAL CAUSE(S)
MANAGEMENT CAUSE(S)
REVIEW/SELECTION No
FOUND?
Yes
PROCESS &
SYSTEM
CAUS INADEQUACIES
No
E
FOUND

Yes
RECOMMENDATIONS TO PMT OR MANAGEMENT
TEAM
Team exercise : Why report incidents?
In your teams, brainstorm a list of reasons why it is important to report incidents:
Why are incidents sometimes not reported?
Why Report Incidents
• What you don’t report, you can’t investigate.
• Legal requirements.
• Develop database of incident reporting and investigation history for future
analysis.
• Identify problems in the operation before they lead to major incidents.
INCIDENT RATIO
COMPARISON
Major
Injuries
Minor
Injuries
Property Damage
Incidents
Near- Miss Incidents
Substandard Act & Conditions
• Incidents are reported on:
¾ An Incident Report Form
• Incident Investigations are recorded on:

¾ An Incident Investigation Report Form
Notes:
INCIDENT REPORT
INSTRUCTIONS: This report is to be filled out by the Onsite Management Representative with the individuals involved in
the occurrence and forwarded to the head office. Use additional paper if necessary.
IDENTIFYING INFORMATION
DATE OF OCCURRENCE: TIME OF OCCURRENCE:

DATE REPORTED: WEATHER CONDITIONS:
LOCATION:
Where did it occur? (Facility Location, Office, etc.)
Type of Incident:
__Personal Injury __Equipment Failure __Product Mix __Major Down Time
__Inhalation Exposure __Equipment Damage __T.D.G. Violation __Contamination
__Chemical Exposure __Property Damage __Security / Theft __Spill
__Occupational Illness __Material Loss __Explosion / Fire __Other
__Employee __Contractor __Other __First Aid __Medical Treatment
__Lost Time __Restricted Work
Source of Injury
Nature of Exposure
Medical Outcome
EMPLOYER
EMPLOYEE SURNAME LENGTH OF SERVICE AGE
FIRST NAME(S) JOB CLASSIFICATION
DESCRIPTION
DESCRIBE HOW EVENT OCCURRED (USE ADDITIONAL PAPER IF NECESSARY)
(Do not speculate on cause, state only verifiable facts of the events that led up to the Incident)
FUTURE RISK ASSESSMENT (circle appropriate hazard classification level)
HOW SERIOUS COULD THIS HAVE BEEN? HOW LIKELY IS THIS EVENT TO OCCUR AGAIN?
Major (A) Serious (B) Minor (C) Frequently Occasionally Rarely
INCIDENT ANALYSIS
CAUSE ANALYSIS (State Facts, Please Do Not Speculate)
IMMEDIATE CAUSES: (WHAT BEHAVIOURS / OR CONDITIONS CAUSED

OR COULD CAUSE THIS OCCURRENCE?)
ROOT CAUSES: (WHAT ARE THE REASONS FOR THE ABOVE BEHAVIOURS AND / OR CONDITIONS?)
REMEDIAL ACTION
DESCRIBE THE ACTIONS TAKEN AND FOLLOW-UP THAT WILL BE TAKEN TO

PREVENT RECURRENCE
CORRECTIVE FOLLOW-UP ACTION REQUIRED ACTION BY: LAST NAME, COMPLIANCE DATE
FIRST INITIAL DATE COMPLETED
INCIDENT WAS REPORTED TO:
Company: Agency: Agency:
Name: Name: Name:
Location: Location: Location:
Phone No.: Phone No.: Phone No.:
*List all agencies contacted
ENDORSEMENTS
INVESTIGATE BY (PRINT): SIGNATURE:
DATE:
MANAGEMENT APPROVAL OF ACTION TAKEN: Name: Signature: Date:
Importance of Quality Data
• Incident analysis.
• External reporting requirements (Ministry of Energy)
• Litigation purposes.
• Investigation process.
What is not reported, cannot be investigated.

What is not investigated, cannot be changed.
What is not changed, cannot be improved, and therefore . . .
will happen again.
Notes:
Case Study
Bhopal
• To provide participants with an opportunity to see the results of a major incident

and discuss how they would set up a team to investigate it.
• Consider what evidence would need to be gathered and how.
• Further details of the Bhopal Incident can be found in the Appendix.
Analyzing to Root Cause
Segment Objectives:
• To define physical and latent root causes.
• To clarify the terms used in various incident/accident causation models.
• To demonstrate the root cause analysis process.
INCIDENT TRAJECTORY
MODEL FOR LOSS
Inadequate defenses
(Active and Latent Errors)
Gaps at any level create an
incident inducing environment Incident contact LOSS
(Active Error)
Process & physical work

environment
(Active/ Latent Errors)
HSE Management Systems

(Latent errors -Root Causes)
Trajectory
Incident Corporate commitment

(Latent Errors - Root
causes)
ANALYSIS MODELS COMPARISON
ROOT CAUSE MODEL INCIDENT TRAJECTORY MODEL
TOP LOSS
EVENT
RESULT
Innad. Defence
Active/Latent
PHYSICAL WHY IT Errors
ROOTS HAPPENED
EHS
SYSTEM
MANAGEMENT
LATENT SYSTEM ROOT
ROOTS INADEQUACIES CAUSE
Root Cause Analysis
• Describe a top event.

• Determine what events could have caused the top event.
• Analyze each event to determine its respective causes.
• Continue analysis on each root until management system cause is determined.
FLASHLIGHT FAILS TO
TOP EVENT LIGHT
PHYSICAL ROOTS
Switch
Batter Bulb
Failure
y Failure
Failure
Mfg Batter
Defect Mfg Broken
y
D e fe c t Filament
Dead
Battery
Inverted Improper
Mfg Voltage
Defect Corrosion Rating
LATENT ROOTS
“Nobody’s Fault” Latent Root Cause AnalysisSTEAM
LEAK
(Equipment not
isolated)
No pre-work Changes to pipe work Computer

check out system not understood data
not updated
No permit to Inadequate Inadequate
work procedure communication procedure update
Address the
Poor root cause -
Poor change
would this prevent
maintenance the incident from management
standards recurring? procedures
NOBODY’S FAULT
LATENT ROOT CAUSE
ANALYSIS
STEAM LEAK
(Equipment not isolated)
No pre-work Changes to pipework Computer data

check out system not understood not updated

If these two management system

inadequacies were corrected
Poor would it prevent further incidents Poor change
maintenance
of improper isolation? management
standards procedures
Case Study Physical Roots
CASE STUDY
PHYSICAL ROOTS
Serious Fire in
Pilot Plant
Steam Leak Open Flame Large Quantity Flammable

Inadequate
(Equipment (Bunsen of Combustibles Chemical
Response
not isolated) burner) (packaging) (Solvent)
Notes:
Team Exercise : Root Cause Analysis
• Working in your team, conduct a root cause analysis of your assigned root cause.
• Take the root down to latent cause, management system inadequacy.
Notes:
INCIDENTS TO INVESTIGATE
Segment Objectives:
• To introduce the Failure Modes and Effects Analysis (FMEA) process.

• To provide participants with a mechanism for analyzing incidents.
Incident Investigation Flow Path
UNDESIRED
EVENT
FOLLOW LOSS DETERMINE

IS THE CAUSE
CONTROL Yes No CALL OUT
EVIDENT?
GUIDELINES REQUIREMENTS

COMPLETE INITIAL LOSS CONTROL REPORT
FORWARD TO LOSS CONTROL ADMINISTRATOR.
NEAR EXTRA-
MINOR SERIOUS MAJOR
MISS ORDINARY
INVESTIGATE NOW?
Yes
-PMS LEADER
-LOGS No
-HOT LINE
DETERMINE:-
FUTURE -VENDOR REPRESENTATIVES -PROCESS DATA DUMPS
ANALYSIS
PERFORM K.T. PROBLEM ANALYSIS

PHYSICAL CAUSE(S)
MANAGEMENT CAUSE(S)
REVIEW/SELECTION No
FOUND?
Yes
PROCESS &
SYSTEM INADEQUACIES
CAUSE
No
FOUND

Yes
RECOMMENDATIONS TO PMT OR MANAGEMENT TEAM
Sporadic Incident
• Sudden adverse change in the status quo.
• Requires remedy through restoration of the status quo.
• Tends to be dramatic and receive immediate attention.
• Examples:
¾ Major fire, explosion
¾ Fatality
¾ Structural collapse
¾ Major equipment damage
¾ Major loss of production
¾ Typically incidents costing more than $10 million
Notes:
Chronic Incident
• Long-standing, adverse situation.

• Requires remedy through changing the status quo.
• Usually not dramatic because it often has been occurring for a long time.
• Often difficult to solve.
• Sometimes regarded as status quo.
• Examples:
¾ Recurring quality deviation.
¾ Recurring equipment failure.
¾ System corrosion/erosion.
¾ Fugitive emissions.
¾ Slips, trips and falls.
Notes:
Relationship Between Chronic
Notes:
and Sporadic Incidents

Solving a
chronic failure
changes the
status quo
Continual Improvement
Sporadic
Failure
STATUS Chronic Failures

QUO are part of the
Fix Status Quo
Failure Modes and Effects Analysis (FMEA)
• Systematic approach to analyzing failures.
• Highlights high versus low cost failures.
• Indicates need for further analysis.
• Used to prioritize incidents to investigate.
• Focuses on result rather than causes.
Using FMEA in your company

• Obtain incident reporting and investigation data for last six months (incident
report records, log books, etc.)
• Break area down into components, e.g., pumps, valves, etc. Use equipment
identification when possible.
• List actual incidents and cost for each piece of equipment. Estimate production
loss.
• Tabulate incident investigation analysis and determine highest cost items.
• Investigate at least two incidents from the list. Determine the physical and
management system causes for each incident.
• Recommend actions to prevent recurrence.
• Repeat every six months.
FMEA WORKSHEET
AREA: Plant 13-2 FROM: 01/01/02 - 06/30/02
CONDUCTED BY: A.N. Other
Reporting and Recommendations
Segment Objective:
• To identify and explain the steps in developing investigation recommendations
and actions.
• To have teams practice-developing recommendations using the case study
example.

• To recognize the unsafe acts and/or conditions that caused the incident,
• To identify the management system that failed to prevent it from happening, and
• To recommend remedial actions that will prevent it from happening again.
The Investigation Report should satisfy the above criteria.
Notes:
Making Appropriate Recommendations

• Most important part of an investigation report.
• Investigation fails if the report merely states the facts and draws conclusions.
• Corrective actions are needed.
• Specific recommendations should be made to address each root from your
analysis.
• Actions should be assigned for persons accountable for their completion.
• Stewardships and action logs should reflect agreed upon actions.
Nobody’s Fault Latent Root Cause Analysis
STEAM LEAK
(Equipment not isolated)
No pre-work Changes to pipework Computer data

check out system not understood not updated

If these two management system

inadequacies were corrected
Poor would it prevent further incidents Poor change
maintenance
of improper isolation? management
standards procedures
Notes:
Small Group Exercise
In your teams, use the root cause analysis you created in the last exercise to develop
actions that will prevent this incident from recurring.
• Select a team spokesperson.

• List your recommendations on a flip chart.
• Be prepared to present your findings in 10 minutes
Notes:
Class Incident
• Apply what you have learned.
• Take notes on Tank Incident.
• In teams, on flip charts:
¾ Whom would you need on your investigation team?
¾ How would you collect evidence?
¾ Do a root cause analysis.
Workers were filling one of two MIBC
tanks with water from fire hydrant to valve.
One worker had just

checked to see if air was
being forced from pressure
relief valve on top and had
been standing on
permanent structure.
Worker had on foot on
bottom rung of ladder
and one foot on concrete
after descending when a
loud explosion was heard
and felt.
APPENDIX
General References
Bhopal Case Study
General References:
Accident Prevention Manual for Industrial Operations: Administration and Program,
ninth ed. (National Safety Council, Chicago, Illinois, 1988) p.p. 149 – 166 ISBN 0-
87912-135-1
Guidelines for Investigating Chemical Process Incidents (American Institute of Chemical

Engineers, New York, 1992) ISBN 0-8169-0555-X
Bird, Frank Jr. and Germain, George L., Practical Loss Control Leadership (Institute
Publishing, Loganville, Georgia, 1986) p.p. 57 – 95 ISBN 0-88061-054-9
Firenze, Robert J., The Process of Hazard Control (Kendall/Hunt Publishing, Dubuque,
Iowa, 1978) p.p. 171 – 250 ISBN 0-8405-8002-X
Ferry, Ted S., Modern Accident Investigation and Analysis (John Wiley & Sons, New
York, 1988) ISBN 0 471-62481-0
Bhopal Case Study
Introduction
At approximately 12:40 a.m. on December 3, 1984, a control room operator at Union
Carbide’s Pesticide Plant in Bhopal, India noticed very significant changes in plant
operating conditions.
A storage tank containing Methyl Isocyanate (MIC), used for pesticide production,
normally was refrigerated. Yet the temperature, usually at 0ºC (32ºF) had risen to 25ºC
(77ºF). Pressure, normally between 14 Kpa and 172 Kpa (2 psi-25 psi) was rising rapidly
beyond 379 Kpa (55 psi).
The operator, assistant operators, and MIC supervisor rushed to the storage tank. There
was a rumbling sound. A plume of gas was gushing out of the scrubber vent stack. The
flare was out.
They took emergency action:
• They tried switching on the refrigeration that had been shut off.
• They started the scrubber on the stack that had been shut off.
• They attempted to spray water on the escaping gases.
These attempts all failed, gas continued to escape; and some plant personnel panicked
and fled. Approximately 4,000 kg (40 tons) of MIC gas escaped in the form of a “heavy”
cloud over a 45-minute period. The wind was approximately 10 km/hr (6.2 miles/hr).
Two large slum areas were located directly across the street. In the panic of the night,
well over 100,000 people were urged to flee. Morning found death strewn over a stunned
city.
At least 2,500 people were killed initially, but as of August 2002 (nearly 18 years later),
the death toll is estimated to be 20,000.
By most reports, the large majority of deaths were caused by gassing. However, many
people also died from blunt injuries.
The shantytown had few large streets to facilitate a quick evacuation, and no evacuation
plan existed. Residents knew something was wrong. Many felt the burning sensation in
their respiratory system, others heard of the toxic release, and they panicked. The
population attempted to flee and flooded the streets. The few people who owned cars
drove as quickly as possible, often running over the crowds who were running on foot.
Many people tripped, fell and were crushed by the crowd.
Even in 2002, there still are 120,000 – 150,000 people suffering from long term health
problems resulting from the disaster. There are many and varied medical ailments
amongst the survivors, but the most common ones are lung diseases.
Ironically only 1 of the 100 workers in the vicinity of the plant was affected, and even
then the consequences were not fatal.
Methyl Isocyanate (M.I.C.)

• Molecular formula : C2H3NO
• At normal pressure, boils at 39ºC (102ºF).
• Volatile, with a vapour pressure of 348 mm Hg at 20ºC (68ºF).
• As vapour, it is twice as dense as air, and tends to settle out of still air. The gentle
wind on December 3, 1984 moved it slowly along.
• Has a flash point of –18ºC (0ºF).
Toxicological Effects — Acute

• Before Bhopal, not a single death from MIC had been reported anywhere.
• Little toxicological data was available regarding the effect on humans.
• This knowledge increased rapidly after the first autopsy reports from Bhopal were
available.
• MIC causes damage to two systems:
¾ Lungs — much more severe
¾ Eyes — somewhat recoverable
• Most deaths were due to respiratory failure:
¾ Pulmonary edema — swollen tissue, with serious fluid, local dropsy
¾ Bronchitis — inflammation of mucous membranes
• Among the 150,000 others affected, main damage was to lungs — capacity
reduced by 50-60%
• Most common complaints were:
¾ Eye irritation
¾ Breathlessness
¾ Chest pains
¾ Vomiting
¾ Muscular weakness
• Long term studies are being carried out on:
¾ Abnormalities in babies born after the Bhopal accident
¾ Lung function with time
¾ Effect on blood systems
¾ Incidence of cancer
Immediate Causes
• A batch process was used to manufacture MIC.

• The plant was at only 40% capacity due to low demand.
• The last batch before the disaster had been made on October 22, 1984.
• 4,000 kg (40 tons) of MIC was stored in Tank 610
• Maintenance work was planned.
• The plant had several safety features:
¾ Vent gas scrubber with caustic neutralizer — but it was not on.
¾ Flare tower for burning small amount of gases — but it was not on.
¾ Refrigeration system to keep MIC cool, particularly in summer months — but
it was not on.
¾ Water-spray pipes that could be used to control some quantities of escaping
gases — but they were not on.
• With the batch process that manufactured MIC shut down, parts of the plant were
dismantled for maintenance:
¾ ·Flare system was shut down to repair pipe.
¾ ·Refrigeration was shut down with refrigerant drained.
¾ ·Nitrogen pressure system on tanks developed faults.
¾ ·Pipes were flushed with water before repairs.
¾ ·Leaking valves and “open” valves allowed water to flow into MIC Tank 610.
¾ ·Workers should have inserted a “blind”, but the inexperienced mechanical
crew did not.
¾ 500kg (1,100 pounds) of water flowed into Tank 610.
• Water reacted with MIC in presence of metallic impurities (acted as catalyst) and
caused a tremendous exothermic reaction. Temperatures approached 260ºC
(500ºF), probably exceeding tank design criteria.
• Secondary chemical reactions also took place. There was rapid release of vapour
through the relief valve system.
• The scrubber system was designed to deal with gases alone, not gases mixed with
liquid. It failed to operate and therefore had to be started up.
• The flare was down for maintenance.
• The refrigeration system was out of commission.
• Water sprinklers could not throw water high enough to neutralize the escaping
gases.
• Hence, toxic gases were able to bypass all these safety features.
Three Questions:
1. Even if all these systems had been working, could they have handled the large mass
of vapour?
2. How much water is required to set off a catastrophic event, with or without metallic
impurities?
3. They took a risk. Did they know the extent of the risk, and was it an “acceptable
risk”? Did they have their guard down? Were they complacent?
Excerpts from the press and other published sources now will be provided. The reader
will notice some inconsistencies in the information provided by various journalists and
scientists. This is a “real life” example of the conflicting information with which
incident/accident investigators have to cope. After an actual incident or accident, the
investigators encounter numerous pieces of evidence, some of which conflict with each
other. The investigators need to collect all of the position evidence, people evidence,
parts evidence and paper evidence. They then need to compile and analyze the
evidence. After a catastrophic accident that is the consequence of a complex
combination of causes, it takes a considerable amount of time to conduct the analysis.
Basic Causes
Paul Shrivastava, Executive Director
Industrial Crisis Institute, New York
Human Factors
• The plant was losing money, running at 40% capacity.
• Morale was low.
• 1982 Operational Safety Survey indicated safety rules, permits, etc., were not
being effectively enforced by Union Carbide Inc.
• The best employees were leaving; 80% of workers trained in the U.S.A. had left.
• Between 1980 and 1984, staff level was cut by half.
• No maintenance supervisor was on second or third shift. Maintenance supervisors
had been responsible for ensuring proper blanking of lines before water washing.
• It was not a computerized plant; hence human backup was very important.
• Rumors of sabotage delayed bringing systems under control.
Organizational Factors
• Bhopal Plant was an unprofitable plant in an unimportant division of the
corporation.
• Union Carbide India Limited (UCIL) was one of fifty international subsidiaries of
Union Carbide Corporation. It represented 2% of Union Carbide Corporation’s
world sales and 2% of its profits.
• Bhopal Plant was one of 13 Union Carbide India Limited plants. It had been
operating below 40% capacity for several years due to weak markets.
• It was not receiving much attention or support from top management.
• Because of the above-mentioned economic conditions, the plant was up for sale at
time of disaster.
• Top Management Discontinuity. The plant had had 8 managers in 15 years.
Many had come from non-chemical industry backgrounds. The result was that
systems, procedures, emergency response and training all suffered.
• The parent company did an audit in 1982 and identified 10 major areas of
concern. Five of these contributed to the accident: instrumentation, permits,
procedures and maintenance.
• The plant had no contingency plans for dealing with major incidents. The lethal
nature of MIC was not fully understood by the plant workers and members of the
community.
• Management systems were of a poor quality, including Safety and Loss
Management.
Technological Factors
• Large storage of bulk MIC in an operating area using manual non-computerized
control systems.
• Tank 610 had not been under continuous positive nitrogen pressure for 2 months.
This had allowed metallic impurities to enter, and they acted as a catalyst.
• Without these impurities, the reaction would have been much less severe.
• Plant design and piping systems allowed a pathway for large quantities of wash
water to back into tank during flushing operations.
• The scrubber system was designed for vapour only.
• There was no radio communication system for operating staff.
The Environment
• The rapidly developing city of Bhopal sought and obtained sophisticated western
industrialization without investing in industrial infrastructures.
• Bhopal was selected as the capital of the State of Madhya Pradesh in 1956. It
grew rapidly from a fairly small town to a city of approximately 800,000.
(Growth was especially dramatic from 1974 to 1984).
• The plant site originally had little population around it.
• Because of rapid population increase, shantytown areas grew around the plant.
They were densely populated with poor streets, lighting, etc.
• A combination of social factors, local infrastructure, lack of awareness and lack of
community preparedness added severely to the results.
Overall Lessons
• Plants like these must have first class design and technology with built-in reliable
safety features and must be kept up to date over the years by capital investment.
• Management must be totally committed to Safety and Loss Management — both
at the local and corporate levels, independent of the local economy (or threat of
shutdown).
• Location of plant with respect to population areas should be a major
consideration.
• Infrastructure of surrounding areas must be supportive — roads, water, sewers,
access to fire stations, emergency measure organizations, etc.
• Combined knowledge and experience of operating, maintenance, technical and
management personnel must always be maintained at a high level. This may
require some non-local expertise. Today we have retired much of this knowledge.
Does this mean we have increased our level of risk?
• Strength of organization needs continual risk assessment.
• Prime Causes:
¾ lack of management / government attention
¾ not knowing how sloppy the operation had become
¾ failure to ensure known actions were carried out
Schematic Layout of Common Headers of MIC Storage Tanks
Murder charges in Bhopal case dropped
(The Edmonton Journal — Sunday, September 22, 1996)
Almost 12 years after the world's worst industrial accident, India's Supreme Court has
dropped homicide charges against eight former senior officials of chemical maker Union
Carbide.
But, the court cleared the way for the prosecution of the accused for a string of lesser
offenses, including causing death by negligence.
The charges were brought after nearly 4,500 people died in a toxic gas lead in the central
Indian city of Bhopal in December, 1984.
In 1989, the Supreme Court chief justice ordered Union Carbide to pay a settlement of
$425 million US and its Indian subsidiary $45 million.
Bhopal : Learning from Accidents
by Trevor Kletz, D.Sc., FRCS, FIChe
1994
(ISMB 0 7506 1952X)
“The gas leak just can't be from my plant. The plant is shut down. Out technology just
can't go wrong. We just can't have such leaks.”
The first reaction of the Bhopal works manager.
The worst accident in the history of the chemical industry occurred in the Union Carbide
plant at Bhopal, India on 3 December 1984 when a lead of over 25 tonnes of methyl
isocyanate (MIC) from a storage tank spread beyond the plant boundary, killing over
2,000 people. The official figure was 2,1532 but according to some reports the true figure
was nearer 10 0003, 4. In addition about 200 000 people were injured. Most of those
killed and injured were living in a shantytown that had grown up close to the plant.
Before 1984 the worst accidents that had occurred in the chemical industry were the
explosion of a 50/50 mixture of ammonium sulphate and ammonium nitrate at Oppau in
Germany in 1921, which killed 430 people including fifty members of the public, and the
explosion of a cargo of ammonium nitrate in a ship in Texas City Harbour in 1947, which
killed 552 people, mostly members of the public5. If conventional explosives are
classified as chemicals, then we should include the explosion of an ammunition ship in
Halifax, Nova Scotia in 1917, which killed about 1,800 people. Earlier in 1984, on 19
November, 550 people were killed when a fire occurred at a liquefied petroleum gas
processing plant and distribution centre in San Juanico, a suburb of Mexico City6 and on
25 February at least 508 people, most of them children, were killed when a petrol pipe
ruptured in Cubatao, near Sao Paulo, Brazil and the petrol spread across a swamp and
caught fire7. In both cases most of those killed were living in shantytowns. 1984 was
thus a bad year for the chemical industry.
The Bhopal tragedy started when a tank of MIC - an intermediate used in the
manufacture of the insecticide carbaryl - became contaminated with water - probably as
the result of sabotage - and a runaway reaction occurred. The temperature and pressure
rose, the relief valve lifted and MIC vapour was discharged into the atmosphere. The
protective equipment which should have prevented or minimized the discharge was out of
action or not in full working order: the refrigeration system which should have cooled
the storage tank was shut down, the scrubbing system which should have absorbed the
vapour was not immediately available and the flare system, which should have burnt any
vapour which got past the scrubbing system, was out of use.
10.1 "What you don't have, can't leak"

There are many lessons to be learned from Bhopal, but the most important is that the
material that leaked need not have been there at all. It was an intermediate, not a product
or raw material, and while it was convenient to store it, it was not essential to do so.
Originally MIC was imported and had to be stored but later it was manufactured on site.
Nevertheless over 100 tonnes were in store, some of it in drums. After the tragedy it was
reported that DuPont intended to eliminate intermediate storage from a similar plant that
they operated. Instead they use the MIC as soon as it is produced, so that instead of 40
tonnes in a tank there will be only 5-10 kg in a pipeline. Mitsubishi were said to do this
already8,9. During the next few years other companies described plans for reducing their
stocks of other hazardous intermediates10. At the end of 1985 Union Carbide claimed
that the inventories of thirty-six toxic chemicals had been reduced by 74%11.
The main lesson of Bhopal is thus the same as that of Flixborough: “What you don't have,
can't leak.” Whenever possible, we should reduce or eliminate inventories of hazardous
materials, in process or storage. It is unfortunate, to say the least, that more notice was
not taken of the papers written after Flixborough, which stressed the desirability of
inherently safer designs, as they are called12-14. It seems that most companies felt so
confident of their ability to keep hazardous materials under control that they did not look
for ways of reducing inventories. Yet to keep lions under control we need expensive
added-on protective equipment that may fail or may be neglected. It is better to keep
lambs instead.
Plant managers usually want intermediate storage, as it makes operation easier. One
section of the plant can continue on line when another is shut down. Computer studies on
equipment availability always show that intermediate storage is needed. However, they
do not allow for the fact that if intermediate storage is available it will always be used,
and maintenance will be carried out at leisure, but if it is not available people do
everything possible to keep the plant on line, carrying out maintenance as soon as
possible. The need for intermediate storage is thus a self-fulfilling prophecy.
Another alternative to intermediate storage is to build a slightly larger plant and accept
fewer running hours per year. Intermediate storage, including working capital, is
expensive as well as hazardous, but the alternative is rarely considered.
If reducing inventories, or intensification as it is called, is not practicable, an alternative

is substitution, that is, using a safer material or route. At Bhopal the product (carbaryl)
was made from phosgene, methylamine and alpha-naphthol. The first two were reacted
together to make MIC, which was then reacted with alpha-naphthol. In an alternative
process used by the Israeli company, Makhteshim, alpha-napthol and phosgene are
reacted together to make a chloroformate ester, which is then reacted with alpha-naphthol
and phosgene are reacted together to make a chloroformate ester which is then reacted
with methylamine to make carbaryl. The same raw materials are used, but MIC is not
formed at all.
Of course, phosgene is also a hazardous material and its inventory should be kept as low
as possible, or avoided altogether. If carbaryl can only be made via phosgene, perhaps
another insecticide should be manufactured instead.
Or instead of manufacturing pesticides perhaps we should achieve our objective -

preventing the harm done by pests - in other ways, for example, by breeding pest-
resistant plants or by introducing natural predators. I am not saying we should -- both of
these suggestions have disadvantages -- merely saying that the questions should be asked.
10.2 Plant location

If materials that are not there cannot leak, people who are not there cannot be killed. The
death toll at Bhopal would have been much smaller if a shantytown had not been allowed
to grow up near the plant. In many countries, planning controls prevent such
developments, but not apparently in India. Of course, it is much more difficult to prevent
the growth of shantytowns than of permanent dwellings, but nevertheless it is essential to
stop them springing up close to hazardous plants. If the government or local authorities
cannot control their growth, then industry should be prepared, if necessary, to buy up the
land and fence it off. As already mentioned, the high death tolls at Mexico City and
Cubatao earlier in 1984 occurred in shantytowns.
It is generally agreed that if a lead of toxic gas occurs people living in the path of the
plume should stay indoors with their windows closed. Only if the lead is likely to
continue for a long time, say, more than half-an-hour, should evacuation be considered.
However, this hardly applies to shanties that are usually so well ventilated that the gas
will enter them at once. It may be more difficult to prevent the growth of shantytowns
than of permanent buildings, but it is also more important to do so.
The need to keep hazardous plants and concentrations of people apart has been known for
a long time. In the 19th century a series of explosions in fireworks and explosives
factories in the United Kingdom led ultimately to regulations on location and an
inspectorate to enforce them. In 1915, however, the government insisted that TNT
should be manufactured in a factory at Silvertown, a heavily built-up area near London.
The owners of the factory, Brunner Mond, objected but were overruled, as explosives
were urgently needed to support the war effort. In 1917, 54 tons of TNT exploded,
devastating the site and the surrounding area. Seventy-three people were killed,
including everyone working in the factory, and a hundred were seriously injured. Eighty-
three houses were flattened or so badly damaged that they had to be demolished and 765
were seriously damaged and needed new interiors. After the explosion the officials who
had insisted that production of TNT at Silvertown was essential now said that the loss of
the factory would make no practical difference to the output of munitions16.
The immediate cause of the explosion is unknown, but the underlying cause was the
erroneous belief that TNT was not very dangerous. It was not covered by the Explosives
Act, although another TNT factory had blown up in 1915. Compare the quotation at the
head of this chapter.
10.3 Why did a runway reaction occur?

The MIC storage tank became contaminated by substantial quantities of water and
chloroform, up to a tonne of water and 1½ tonnes of chloroform, and this led to a
complex series of runaway reactions, a rise in temperature and pressure and discharge of
MIC vapour from the storage tank relief valves17. The precise route by which the water
entered the tank is not known, though several theories have been put forward18,19. One
theory is that it came from a section of vent line some distance away that was being
washed out. This vent line should have been isolated by a slip-plate (spade) but it had not
been fitted. However, the water would have had to pass through six valves in series and
it seems unlikely that a tonne could have entered the tank in this way. Another theory is
that the water entered via the nitrogen supply line. Kalelkar has argued convincingly that
there was a deliberate act of sabotage by someone who did not realize what the results of
his actions would be20. This theory has been criticised by many people who sympathised
with the victims and thought an attempt was being made to whitewash [exonerate] Union
Carbide. This was not the case. The company is still responsible for stocking more MIC
than is necessary, for allowing a shantytown to grow alongside the plant, for not keeping
protective equipment in working order (see next section) and for all the other deficiencies
discussed later in this chapter.
When we are looking for the underlying causes of the accident, rather than the immediate
cause, the route by which the water entered the MIC tank hardly matters. Since it is well
known that water reacts violently with MIC, no water should have been allowed
anywhere near the equipment, for washing outlines or for any other purpose. If water is
not there, it cannot lead in or be added deliberately. If any of the suggested routes were
possible, then they should have been closed before the disaster occurred. So far as is
known, no hazard and operability study (HAZOP)21, 22 was carried out on the design
though HAZOP is a powerful tool, used by many companies for many years, for
identifying routes by which contamination (and other unwanted deviations) can occur.
10.4 Keep protective equipment in working order - and size it correctly

The storage tank was fitted with a refrigeration system which should have absorbed the
MIC discharged through the relief valve was not in full working order. The flare system
that should have burned any MIC that got past the scrubbing system was disconnected
from the plant for repair. The high temperature and pressure on the MIC tank were at
first ignored, as the instruments were poorly maintained and known to be unreliable23.
The high temperature alarm did not operate as the set point had been altered and was too
high24. One of the main lessons from Bhopal is thus the need to keep all protective
equipment in full working order.
It is easy to buy safety equipment; all we need is money and if we make enough fuss we
get it in the end. It is much more difficult to make sure that the equipment is kept in full
working order, especially when the initial enthusiasm has worn off. Procedures,
including testing and maintenance procedures, are subject to a form of corrosion more
rapid than that which affects the steelwork and can vanish without trace in a few months
once managers lose interest. A continual auditing effort is needed by managers at all
levels to make sure that procedures are maintained (see Chapter 6).
Sometimes procedures lapse because managers lose interest. Unknown to them,

operators discontinue safety measures. At Bhopal it went further than this.
Disconnecting the flare system and shutting down the refrigeration system are hardly
decisions that operators are likely to take on their own. The managers themselves must
have taken these decisions and thus shown a lack of understanding and/or commitment.
It is possible that the protective equipment was out of use because the plant that produced
the MIC was shut down and everyone assumed that the equipment had been installed to
protect the plant rather than the storage. Runaway reactions, leaks and discharges from
relief valves are more common on plants than on storage systems but they are by no
means unknown on storage systems. Twenty-four of the hundred largest insurance losses
in a thirty-year period occurred in storage areas and their value was higher than
average25. Furthermore, since a relief valve was installed on the storage tank, it was
liable to lift and the protective equipment should have been available to handle the
discharge. As stated in Chapter 9, if the designers were sure that a relief valve would
never lift there would have been no need to install it.
It has been argued that the refrigeration, scrubbing and flare systems were not designed to
cope with a runaway reaction of the size that occurred and that there would have been a
substantial discharge of MIC to atmosphere even if they had all been in full working
order. This may be so, but they would certainly have reduced the size of the discharge
and delayed its start.
The relief valve was too small for the discharge from a runaway reaction. The pressure
in the storage vessel, designed for a gauge pressure of 40 psi (2.7 bar), reached 200-250
psi (14-17 bar). The vessel was distorted and nearly burst. If it had burst the loss of life
might have been lower as there would have been less dispersion of the vapour. The relief
valve was designed to handle vapour only but the actual flow was a two-phase mixture of
vapour and liquid26.
If the protective equipment was not designed to handle a runaway, or two-phase flow, we
are entitled to ask why. Were the possibilities of a runaway or two-phase flow not
foreseen or were they considered so unlikely that it was not necessary to guard against
them? What formal procedures were used during design to answer these questions?
Although the managers (and also the operators, but they take their cue from the
managers) showed less competence and commitment to safety than might reasonably
have been expected, we should not assume that Indian managers (and operators) are in
general less competent than those in the west. There are poor managers in every country
and there is no reason to believe than the standard in India is any lower than elsewhere.
In one respect the managing director of Union Carbide India Limited showed more
awareness than his American colleagues: He queried the need for so much more storage
but was overruled.
Bhopal illustrates the limitations of hazard assessment techniques both before the
accident and after it happens - by fault tree or similar techniques. Most analysts would
have estimated the failure rates of the refrigeration, scrubbing and flare systems but
would not have considered the possibility that they might all be switched off. Hazard
assessments become garbage if the assumptions on which they are based are no longer
true.
Similarly, estimates of human error are usually estimates of the probability that a man
will forget to carry out a task, such as closing a valve, or carry it out wrongly. We cannot
estimate the probability that he will make a conscious decision not to close it, either
because he considers it unnecessary to do so or because he wishes to sabotage
operations27.
Some reports on Bhopal suggested that the instrumentation there was less sophisticated
than on similar plants in the United States and that this may have led to the accident.
This is a red herring [distraction]. If conventional instrumentation was not adequately
maintained and its warnings were ignored, then there is no reason to believe that
computerised instrumentation would have been treated any differently. In fact the
reverse may be the case. If people are unable to unwilling to maintain basic equipment,
they are less likely to maintain sophisticated equipment. Nevertheless, during the
investigation of accidents that have occurred because the safety equipment provided was
not used, people often suggest that more equipment is installed (see Chapter 6).
Another protective device was a water spray system that was designed to absorb small
leaks at or near ground level. It was not intended to absorb relief valve discharges at a
high level and failed to do so.
10.5 Joint ventures

The Bhopal plant was half-owned by a US company, Union Carbide Corporation, and
half-owned locally. Although Union Carbide Corporation had designed the plant and had
been involved in the start up, by the time of the accident the Indian company had become
responsible for operations, as required by Indian law.
In the case of such joint ventures it is important to be clear as to who is responsible for
safety in design and operation. The technically more sophisticated partner has a special
responsibility if it is not directly responsible. It should make sure that the operating
partner has the knowledge, skill, commitment and resources necessary for safe operation.
If not, it should not go ahead with the venture. It cannot shrug off responsibility by
saying that it is no longer in full control. Soon after Bhopal one commentator wrote,
“…… multinational companies and their host countries have got themselves into a
situation in which neither feels fully responsible.”28
People who sell or give dangerous articles to children are responsible if the children
injure themselves or others. Similarly, if we give dangerous plant or material to people
who have not demonstrated their competence to handle it, we are responsible for the
injuries they cause.
For Union Carbide Corporation the Bhopal plant was a backwater, making little
contribution to profits, in fact often losing money, and may have received less than its
fair share of management resources29. At Flixborough (Chapter 8) the partner with
knowledge of the technology (Dutch State Mines) was in control.
10.6 Training in loss prevention
Bhopal makes us ask if the people in charge of the plant, and those who designed it,
received sufficient training in loss prevention30. If they do not they are not able to join
the Institution of Chemical Engineers as full or corporate members. In most other
countries, including the United States, most undergraduate chemical engineers receive no
such training, although the American Institute of Chemical Engineers is now encouraging
universities to introduce it.
There are several reasons why loss prevention should be included in the training of
chemical engineers31:
1. Loss [accident] prevention should not be something added on to a plant after

design like a coat of paint but an integral part of design. Hazards should,
whenever possible, be removed by a change in design, such as reduction in
inventory, rather than by adding on protective equipment. The designer should
not ask the safety adviser to add on the safety features for him; he should be
taught to design a plant that does not require added-on safety features.
2. Most engineers never use much of the knowledge they acquire as students but
almost all have at some time to take decisions on loss prevention. Universities
that give no training in loss prevention are not preparing their students for the
tasks they will have to undertake.
3. Loss prevention can be used to illustrate many of the principles of chemical

engineering and to show that many problems that at first sight do not seem to
lend themselves to numerical treatment can in fact be treated quantitatively.
Since in many countries universities are not providing training in chemical engineering,
companies should make up the deficiency by internal training. Many try to but often do
so in a rather haphazard way - an occasional course or lecture. Few companies put all
new recruits through a planned program.
At Bhopal the original managers had left and had been replaced by others whose
experience had been mainly in the manufacture of batteries. There had been eight
different managers in charge of the plant in 15 years32. Many of the original operators
had also left and one wonders how well their successors were trained33.
However, while these facts, and reductions in manning, may be evidence of poor
management and a lack of commitment to safety I do not think that they contributed
directly to the accident. The errors that were made, such as disconnection of safety
equipment and resetting trips at too high a level, were basic ones that cannot be blamed
on inexperience of the particular plant. No manager who knew and accepted the first
principles of loss prevention would have allowed them to occur.
10.7 Handling emergencies

More than any other accident described in this book Bhopal showed up deficiencies in the
procedures for handling emergencies, both by the company and by the local authorities. It
showed clearly the need for companies to collaborate with the emergency services in
identifying incidents that might occur and their consequences, drawing up plans to cope
with them and exercising these plans. In the United Kingdom this is now required by
law34. This aspect is discussed in reference 35.
10.8 Public response

In the United States Bhopal produced a public reaction similar to that produced in the
United Kingdom by Flixborough (Chapter 8) and in the rest of Europe by Seveso
(Chapter 9). Many companies spent a great deal of money and effort making sure that a
similar accident could not occur on their plants. Even so, Bhopal seems to have produced
less “regulatory fallout” than Flixborough or Seveso. The U.S. chemical industry has
tried to convince the authorities that it can put its own house in order. In particular the
American Institute of Chemical Engineers set up a Center for Chemical Process Safety,
generously funded by the chemical industry, to provide advice on loss prevention. One
of its objectives is to have loss prevention included in the training of undergraduates.
The Chemical Manufacturers Association has launched a Community Awareness and
Response 9CAER) program to encourage companies to improve their emergency plans
and a National Chemical Response Information Center to provide the public and
emergency services with advice and assistance before and during emergencies.
Nevertheless in a paper called "A field day for the legislators" Stover36 lists thirty-two
U.S. Government proposals or activities and thirty-five international activities that had
been initiated by the end of 1985. In addition there have been state and local responses in
the U.S. These have been reviewed by Horner37.
In India there were, of course, extensive social effects. They are reviewed in reference
38.
After Bhopal many international companies reviewed the extent to which they controlled
and audited the subsidiaries. Chapters 4 and 5 also showed what can happen when they
are left to do as they wish. Jim Whiston has described the changes made by ICI in the
years after Bhopal.
Terrible though Bhopal was, we should beware of over-reaction and of suggestions that
insecticides, or even the whole chemical industry, are unnecessary. Insecticides, by
increasing food production, have saved far more people than Bhopal has killed. But
Bhopal was not an inevitable result of insecticide manufacture. By better design or by
better operation, by just one of the recommendations summarised in Figure 10.2, Bhopal
could have been prevented. The most effective methods of prevention are those near the
bottom of the diagram, such as reduction in inventory or change in the process. The
safety measures at Bhopal, such as the scrubber and the flare stack, were too near the top
of the chain, too near the top event. If they failed there was nothing to fall back on. To
prevent the next Bhopal we need to start at the bottom of the chain.
References:
1. Bidwai, P., quoted by Bogard, W., The Bhopal Tragedy, Westview Press, Boulder,
Colorado, 1989, p.14.
2. Tachakra, S.W., Journal of Loss Prevention in the Process Industries. Vol.1, No.1,
January 1988, p..3.
3. Free Labour World, International Federation of Free Trade Unions, Brussels,
Belgium. No. 1/86, 18 January 1986, p.1.
4. Shrivastava, P., Bhopal - Anatomy of a Crisis, Ballinger, Cambridge,
Massachusetts, 1987. p.64.
5. Lees, F.P., Loss Prevention in the Process Industries. Vol.2, Butterworths, London
1980. Appendix 3.
6. BLEVE - The Tradegy of San Juanico, Skandia International, Stockholm, 1985.
7. Hazardous Cargo Bulletin, June 1984, p.34.
8. Chemical Week. 23 January 1985, p.8.
9. Chemistry in Britain. Vol.21, No.2, Feb.1985, p.123.
10. Wade, D.E., Proceedings of the International Symposium on Preventing Major
Chemical Accidents. American Institute of Chemical Engineers, Washington, DC,
3-5 February 1987, Paper 2.1.
11. Chemical Insight. Late Nov.1985, p.1.
12. Kletz, T.A., Chemical Engineering, Vol.83, No.8, 12 April 1976, p.124.
13. Kletz, T.A., Chemistry and Industry, 6 May 1978, p.37.
14. Kletz, T.A., Hydrocarbon Processing, Vol.59, No.8, Aug. 1980, p.137.
15. Reuben, B.M., Private Communication.
16. Neal, W., With Disastrous Consequences, Hisarlik Press, London, 1992, Chapters 3
and 7.
17. Bhopal Methyl Isocyanate Incident: Investigation Team Report, Union Carbide
Corporation, Charleston, South Carolina, March 1985.
18. The Trade Union Report on Bhopal, International Federation of Free Trade Unions
and International Federation of Chemical, Energy and General Workers' Unions,
Geneva, Switzerland, 1985.
19. Varadarajan, S. et al., Report on Scientific Studies on the Factors related to Bhopal
Toxic Gas Leakage, Indian Planning Commission, Delhi, India, Dec. 1985.
20. Kalelkar, A.S., Investigations of large magnitude incidents - Bhopal as a case
study. Preventing Major Chemical and Related Process Accidents, Symposium,
Series No.110, Institution of Chemical Engineers, Rugby, UK, 1988, p.553.
21. Kletz, T.A., Hazop and Hazan - Identifying and Assessing Process Industry
Hazards, 3rd edition, Institution of Chemical Engineers, Rugby, UK, 1992.
22. Knowlton, R.E., A Manual of Hazard and Operability Studies, Chemetics
International, Vancouver, Canada, 1992.
23. New York Times. 28 Jan-3 Feb 1985.
24. Shrivastava, P., The Accident at Union Carbide Plant in Bhopal - A case Study. Air
Pollution Control Association Conference on Avoiding and Managing
Environmental Damage from Major Industrial Accidents, Vancouver, Canada, 3-6
Nov. 1985.
25. One Hundred Largest Losses, Marsh and McLennan, Chicago, Illinois, 8th edition.
1985.
26. Swift, I.. In The Chemical Industry after Bhopal, Proceedings of a Symposium,
London, 7/8 November 1985, IBC Technical Services.
27. Kletz, T.A., An Engineer's View of Human Error, 2nd edition, Institution of
Chemical Engineers, Rugby, UK, 1991, Chapter 5.
28. Smith, A.W., The Daily Telegraph, 15 Dec. 1984, p.15.
29. As ref.4 p.51.
30. First Degree Course including Guidelines on Accrediting of Degree Course,
Institution of Chemical Engineers, Rugby, UK, 1989.
31. Kletz, T.A., Plant/Operations Progress. Vol.7, No.2, April 1988, p.95.
32. As ref. 4. p.52.
33. The Bhopal Papers. Transnationals Information Centre, London, 1986, p.4.
34. Control of Industrial Major Accident Hazard Regulations, Statutory Instrument
No.1902. Her Majesty's Stationery Office, London, 1984.
35. As ref.4 Chapter 6.
36. Stover, W., In The Chemical Industry after Bhopal, Proceedings of a Symposium,
London, 7/8 November 1985, IBC Technical Services.
37. Horner, R.A., Journal of Loss Prevention in the Process Industries, Vol.2, No.3,
July 1989. p.123.
38. As ref.4. Chapters 4 and 5.

L9 Incident Investigation Student Handout PDF

Transféré par

Informations du document

Description originale:

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

L9 Incident Investigation Student Handout PDF

Transféré par

Droits d'auteur :

Formats disponibles

INCIDENT/ACCIDENT INVESTIGATION

AND ROOT CAUSE ANALYSIS

NPC TRAINING PROGRAM

Calgary Tel 1-403-221-8077 Fax 1-403-221-8072

• Define the purpose of incident investigation.

What are your expectations for the course?

FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER.

PERFORM K.T. PROBLEM

COMPLETE REPORT AND GENERATE

Questions That Need To Be Asked

Process & physical work

HSE Management Systems

Incident Corporate commitment

Names of People and Roles (boss, worker, etc.)

There are four types of evidence:

MINS HRS DAYS WEEKS

Pilot Plant Number 1

Taffy’s work area

People's ability to remember details regarding a situation diminishes quickly. Therefore

You will need:

• Observations from the video introduction.

• Notes taken when the instructor answers class questions.

• To explain the incident reporting process.

• To describe the incident ratio study.

• To explain the importance of quality incident data.

FREEZE THE EVIDENCE, PEOPLE, POSITION, PARTS, PAPER.

PERFORM K.T. PROBLEM

COMPLETE REPORT AND GENERATE

In your teams, brainstorm a list of reasons why it is important to report incidents:

Why are incidents sometimes not reported?

Near- Miss Incidents

Substandard Act & Conditions

• Incident Investigations are recorded on:

DATE OF OCCURRENCE: TIME OF OCCURRENCE:

EMPLOYEE SURNAME LENGTH OF SERVICE AGE

FIRST NAME(S) JOB CLASSIFICATION

DESCRIBE HOW EVENT OCCURRED (USE ADDITIONAL PAPER IF NECESSARY)

FUTURE RISK ASSESSMENT (circle appropriate hazard classification level)

Major (A) Serious (B) Minor (C) Frequently Occasionally Rarely

CAUSE ANALYSIS (State Facts, Please Do Not Speculate)

IMMEDIATE CAUSES: (WHAT BEHAVIOURS / OR CONDITIONS CAUSED

DESCRIBE THE ACTIONS TAKEN AND FOLLOW-UP THAT WILL BE TAKEN TO

INCIDENT WAS REPORTED TO:

Company: Agency: Agency:

Name: Name: Name:

Location: Location: Location:

Phone No.: Phone No.: Phone No.:

*List all agencies contacted

INVESTIGATE BY (PRINT): SIGNATURE:

MANAGEMENT APPROVAL OF ACTION TAKEN: Name: Signature: Date:

What is not reported, cannot be investigated.

• To provide participants with an opportunity to see the results of a major incident

Process & physical work

HSE Management Systems

Incident Corporate commitment

• Describe a top event.

No pre-work Changes to pipe work Computer

No pre-work Changes to pipework Computer data

No permit to Inadequate Inadequate

If these two management system

Steam Leak Open Flame Large Quantity Flammable

• To introduce the Failure Modes and Effects Analysis (FMEA) process.