15478_02

07:11 7/11/00 Ref: 3723 LEES ± Loss Prevention in the Process Industries Chapter 2 Page No. 1

2.1 The Accident Process 2/12.2 Standard Industrial Classification 2/42.3 Injury Statistics 2/42.4 Major Disasters 2/92.5 Major Process Hazards 2/102.6 Fire Loss Statistics 2/132.7 Fire and Explosion 2/172.8 Causes of Loss 2/182.9 Downtime Losses 2/192.10 Trend of Injuries 2/242.11 Trend of Losses 2/242.12 Case Histories 2/25

Hazard, Accident

and Loss2

2 / 2 H A Z A R D , A C C I D E N T A N D L O S S

2.1 The Accident Process

There are certain themes which recur in the investiga-tion of accidents and which reveal much about theaccident process. First, although in some reportingschemes the investigator is required to determine thecause of the accident, it frequently appears meaninglessto assign a single cause as the accident has arisen froma particular combination of circumstances. Second, it is


A rational approach to loss prevention must be based onan understanding of the nature of accidents and of thetypes of loss which actually occur. Therefore, in thischapter, first the nature of the accident process isconsidered and then the accident and loss statistics arereviewed to give an indication of the problem. Selectedreferences on accident and loss experience are given inTable 2.1. In addition, many other tables of data aregiven in other chapters. Cross-references to some ofthese tables are given in Table 2.2.

Table 2.1 Selected references on accident and lossexperience

Natural and man-made hazards, disastersThygerson (1972, 1977); Walker (1973); G.F. White(1974); Bignell et al. (1977); MuÈnchener RuÈck (1978);B.A. Turner (1978); ASCE (1979/9); Ferrara (1979);Whittow (1980); Perry (1981); Rossi et al. (1983); Simkimand Fiske (1983); Perrow (1984); Wijkman andTimberlake (1984); McWhirter (1985); Cairns (1986); SirR. Jackson (1986); E.A. Bryant (1991); GuinnessPublishing Co. (1991); K. Smith (1992); R. Smith (1992);Arnold (1993)

Process hazards, accidentsMatheson (1960); Vervalin (1964a, 1973a); BCISC (1968/7); Fowler and Spiegelman (1968); W.H. Doyle (1969);Spiegelman (1969, 1980); CIA (1970/3); Cornett andJones (1970); Rasbash (1970b); Houston (1971); H.D.Taylor and Redpath (1971, 1972); R.L. Browning (1973);Walker (1973); FPA (1974b, 1976); AEC (1975); N.McWhirter (1976); J.R. Nash (1976); McIntire (1977);AIA (1979); Harvey (1979); Carson and Mumford (1979);Ferrara (1979); R. King and Magid (1979); Kletz andTurner (1979); Lees (1980); Pastorini et al. (1980);Mance (1984); Manuele (1984 LPB 58); Hawkins (1985);D. McWhirter (1985); APCA (1986); Kletz (1986b); V.C.Marshall (1986a, 1988c); Garrison (1988a,b); Instone(1989); Mahoney (1990); Anon. (1991 LPB 99, p. 1);O'Donovan (1991 LPB 99); K.N. Palmer (1991 LPB 99);Guinness Publishing Co. (1991); Marsh and McLennan(1992); Pastorini et al. (1992); Bisio (1993); O'Shima(1993); Crooks (1994 LPB 115)

Accident modelsSurry (1969b); Houston (1971); Macdonald (1972);Haddon (1973a, b); W.G. Johnson (1973a,b, 1980); deJong (1980); Rasmussen (1982b, 1983); Haastrup (1983);Benner (1984); A.R. Hale and Glendon (1987); Wells etal. (1991); Bond (1994 LPB 120)

Accident rankingKeller et al. (1990); Keller and Wilson (1991)

Annual or periodic reports, statistical summariesAGA (Appendix 28 Pipeline Incident Reports); API(Appendix 28 Annual Summaries); BIA (annual report);BRE (annual statistics, Appendix 28 UK Fire and LossStatistics); FPA (annual report); HM Chief Inspector ofExplosives (annual report); HM Chief Inspector ofFactories (annual report, annual analysis of accidents);HM Senior Electrical Inspector of Factories (annualreport); M&M Protection Consultants (periodic); NTSB(Appendix 28); NSC (n.d./1); ABCM (1930±64/2); MCA

(1962±/1±4, 1971±/20, 1975±/23); BCISC (1965±/4);CISHC (1975±/5); CONCAWE (1977 9/77, 1992 4/92);HSC (1977); HSE (1977d, 1986c, 1992b); ILO (1992)

FireBRE (annual statistics); FPA (annual report, 1974, 1976,1991); W.H. Doyle (1969); Spiegelman (1969, 1980); H.D.Taylor and Redpath (1971, 1972); FRS (1972 FireResearch Note 920); P. Nash (1972b) Vervalin (1963a,1972c, 1973a, 1974a, 1975c, 1976b, 1977, 1978a,b, 1986b);Duff (1975); Redpath (1976); Rutstein (1979a, b); Rutsteinand Clarke (1979); Banks and Rardin (1982); Norstrom(1982a); Gebhardt (1984); Uehara and Hasegawa (1986);Mahoney (1990); Home Office (1992)

ExplosionEggleston (1967); Doyle (1969); Spiegelman (1969,1980); Duff (1975); Davenport (1977b, 1981b); Norstrom(1982b); Uehara and Hasegawa (1986); Vervalin (1986b);Mahoney (1990); Lenoir and Davenport (1993)

RefineriesAnon. (1970a); McFatter (1972); W.L. Nelson (1974);McIntire (1977); Mahoney (1990)

Ammonia plantsHolroyd (1967); Axelrod et al. (1968); Sawyer et al.(1972); G.P. Williams and Sawyer (1974); G.P. Williams(1978); G.P. Williams and Hoehing (1983); G.P. Williamset al. (1987)

Educational institutionsBowes (1985)

Table 2.2 Cross-references to other accident and lossdata

Major fires Section 16.38Major condensed phase explosions Table 17.24;

Appendix 1Major vapour cloud explosions (VCEs) Section 17.28;

Table 17.30Major boiling liquid expanding vapour Section 17.29

explosions (BLEVEs) Table 17.37Major missile incidents Section 17.34

Table 17.49Major dust explosions Section 17.43;

Table 17.63Major toxic releases Section 18.27;

Tables 18.30,18.31

Case histories Appendix 1Failure data Appendix 14

H A Z A R D , A C C I D E N T A N D L O S S 2 / 3

often found that the accident has been preceded by otherincidents which have been 'near misses'. These are caseswhere most but not all of the conditions for the accidentwere met. A third characteristic of accidents is that whenthe critical event has occurred there are wide variationsin the consequences. In one case there may be no injuryor damage, whilst in another case which is similar inmost respects there is some key circumstance whichresults in severe loss of life or property. These and otherfeatures of accidents are discussed in Man-MadeDisasters (B.A. Turner, 1978). It is in the nature ofdisasters that they tend to occur only as the result of thecombination of a number of events and to have a longincubation period before such a conjunction occurs.

It is helpful to model the accident process in order tounderstand more clearly the factors which contribute toaccidents and the steps which can be taken to avoidthem. One type of model, discussed by Houston (1971),is the classical one developed by lawyers and insurerswhich focuses attention on the `proximate cause'. It isrecognized that many factors contribute to an accident,but for practical, and particularly for legal, purposes aprincipal cause is identified. This approach has a numberof defects: there is no objective criterion for distinguish-ing the principal cause; the relationships between causesare not explained; and there is no way of knowing if thecause list is complete.

There is need for accident models which bring outwith greater clarity the common pattern in accidents.Some models of the accident process which may behelpful in accident investigation and prevention are givenbelow, with emphasis on the management and engineer-ing aspects. Further accident models are discussed inChapters 26±28.

2.1.1 The Houston modelThe model given by Houston (1971, 1977) is shownschematically in Figure 2.1. Three input factors arenecessary for the accident to occur: (1) target, (2)driving force, and (3) trigger. Principal driving forcesare energy and toxins. The target has a thresholdintensity � below which the driving force has no effect.The trigger also has a threshold level �0 below which itdoes not operate.

The development of the accident is determined by anumber of parameters. The contact probability p is theprobability that all the necessary input factors arepresent. The contact efficiency � defines the fraction ofthe driving force which actually reaches the target, andthe contact effectiveness � is the ratio of damage done tothe target under the actual conditions to that done under

standard conditions. The contact time t is the duration ofthe process.

The model indicates a number of ways in which theprobability or severity of the accident may be reduced.One of the input factors (target, driving force or trigger)may be removed. The contact probability may beminimized by preventive action. The contact efficiencyand contact effectiveness may be reduced by adaptivereaction.

Work by Haddon (1973a,b) emphasizes prevention ofaccidents by control of the energy. His list of energycontrol strategies is given in Table 2.3. Failure of one ormore of these modes of control is a normal feature of anaccident and hence of accident models.

2.1.2 The fault tree modelA simple fault tree model of an accident is given inFigure 2.2. An initiating event occurs which constitutes apotential accident, but often only if some enabling eventoccurs, or has already occurred. This part of the tree isthe 'demand' tree, since it puts a demand on theprotective features. The potential accident is realizedonly if prevention by protective equipment and humanaction fails. An accident occurs which develops into amore severe accident only if mitigation fails.

A somewhat similar model has been proposed byWells et al. (1992).

2.1.3 The MORT modelA more complex fault tree model is that used in themanagement oversight and risk tree (MORT) developedby W.G. Johnson (1980) and shown in Figure 2.3. Thistree is the basis of a complete safety system, which isdescribed further in Chapter 28.


Figure 2.1 Houston model of the accident process(after Houston, 1977)

Table 2.3 Some energy control strategies (afterHaddon, 1973a)

1. To prevent the initial marshalling of the form ofenergy

2. To reduce the amount of energy marshalled3. To prevent the release of energy4. To modify the rate or spatial distribution of release of

energy from its source5. To separate in space or time the energy being

released from the susceptible structure6. To separate the energy being released from the

susceptible structure by interposition of a materialbarrier

7. To modify the contact surface, subsurface, or basicstructure which can be impacted

8. To strengthen the living or non-living structure whichmight be damaged by energy transfer

9. To move rapidly in detection and evaluation ofdamage and to counter its continuation and extension

10. All those measures which fall between the emergencyperiod following the damaging energy exchange andthe final stabilization of the process (includingintermediate and long-term reparative rehabilitativemeasures)


2.1.4 The Rasmussen modelAccident models which show the role of human errorhave been developed by Rasmussen (1982a,b). Figure 2.4shows such a model. The role of human error in causingaccidents is considered in more detail in Chapter 14.

2.1.5 The ACSNI modelFigure 2.5 shows a model proposed by the AdvisoryCommittee on the Safety of Nuclear Installations (ACSNI,1991). The model provides a general framework which

can be used to identify latent failures that are likely tolead to critical errors.

2.1.6 The Bellamy and Geyer modelA model which emphasizes the broader, socio-technicalbackground to accidents has been developed by Geyerand Bellamy (1991) as shown in Figure 2.6. Figure 2.6(a)gives the generic model and Figure 2.6(b) shows theapplication of the model to a refinery incident.

2.1.7 The Kletz modelAnother approach is that taken by Kletz (1988h), whohas developed a model oriented to accident investigation.The model is based essentially on the sequence ofdecisions and actions which lead up to an accident, andshows against each step the recommendations arisingfrom the investigation. An example is shown in Figure2.7, which refers to an incident involving a small fire ona pump.

2.2 Standard Industrial Classification

Statistics of injuries and damage in the UK are generallyclassified according to the Standard IndustrialClassification 1980 (SIC 80). In this classification theclasses relevant here are: Class 1 Energy and waterindustries; Class 2 Extraction of minerals and ores otherthan fuels, manufacture of metals, mineral products andchemicals; Class 3 Metal goods, engineering and vehiclesindustries; and Class 4 Other manufacturing industries.The mineral oil processing industry falls into Class 1,Subclass 14, and the chemical industry in Class 2,Subclass 25.

2.3 Injury Statistics

Accident statistics are available in the Annual Report ofHM Chief Inspector of Factories (HMCIF), or its currentequivalent, and the annual Health and Safety Statistics.The former also gives occasional detailed studies forparticular industrial sectors.

The definition of a major injury changed with theintroduction of the Reporting of Injuries, Diseases andDangerous Occurrences Regulations 1985 (RIDDOR).The Health and Safety Statistics 1990-91 (HSE, 1992b)show that in 1990±91 there were 572 fatalities reportedunder RIDDOR, of which 346 were to employees, 87 tothe self-employed and 139 to members of the public. Thefatal injury incidence rate for employees was 1.6 per100 000 workers.

Major injuries to employees in 1990±91 reported underRIDDOR were 19 896 and the incidence rate was 89.9 per100 000 workers.

For the manufacturing industry (SIC 2-4) fatalitieswere 88 in 1990±91 and averaged 100 in the 5-year periodbetween 1986±87 and 1990±91 and the fatal injuryincidence rate was 1.8 per 100 000 workers.

Fatal and major injuries in the oil and chemicalindustries in the period 1981±85, inclusive, are shownin Table 2.4. For 1990±91 the Health and Safety Statistics1990±91 show that in the oil and chemical industries theaccidents to employees were as shown in Table 2.5.


Figure 2.2 Fault tree model of the accident process



Figure 2.3 MORT model of the accident process (W.G. Johnson, 1980). The letters A�H refer to further subtrees.LTA, less than adequate (Courtesy of Marcel Dekker)



Figure 2.4 Rasmussen model of the accident process (Rasmussen, 1982b) (Reproduced by permission from HighRisk Safety Technology by A.E. Green, copyright John Wiley)



Figure 2.5 ACSNI model of the accident process (ACSNI, 1991) (Courtesy of HM Stationery Office)

Table 2.4 Fatal and major accidents in chemical and petroleum factories in the UK 1981�85 (Cox, Lees and Ang,1990) (Courtesy of Institution of Chemical Engineers)

A Period 1981�85: number of fatal (F) and major (M) injuries

1981 1982 1983 1984 1985 Total

F M F M F M F M F M F M

Chemicals 8 321 6 344 10 374 5 370 5 390 34 1799Mineral oil 3 28 3 36 1 29 1 24 1 24 9 141

processingTotal 11 349 9 380 11 403 6 394 6 414 43 1940

B Period 1981�85: incidence rates of fatal and major injuries

Incidence per 105 employees

1981 1982 1983 1984 1985

Chemicals 89.4 100.3 115.2 112.7 117.2Mineral oil processing 108.4 154.2 136.4 130.2 139.7

C 1984

Industry No. Fatalities Major Fatal and majoremployees injuries injuries per 105

persons

Chemicals 360 000 5 349 98.4Other chemical processes 38 200 1 38 102.1Mineral oil processing 18 200 1 14 82.4

Sources: Health and Safety Executive (1986c); HM Chief Inspector of Factories (1986a).



Figure 2.6 Bellamy and Geyer model of the accident process; (a) generic model; (b) model applied to a refineryincident (Geyer and Bellamy, 1991) (Courtesy of the Health and Safety Executive)


Table 2.5 Fatal and major injuries in the oil andchemical industries in the UK 1981�85 (after HSE,1992b)

Industry Type of accident

Fatal Non-fatalmajor

Over 3days

Allreportable

Mineral oilprocessing

0 33 147 180

Chemicals 5 503 3427 3935

The comparative incidence of fatalities in someprincipal industries and jobs in the UK is given inTable 2.6. The table shows that there is a wide variationbetween industries. It also shows a downward trend. Thefatal accident rate of the chemical industry is approxi-mately the same as that for all manufacturing industry.The injury statistics can be dramatically changed,however, by a single major disaster. In the processindustries the worst disaster since 1945 was the vapourcloud explosion at Flixborough in 1974, which killed 28people. Offshore in the British sector of the North Sea,the Piper Alpha disaster resulted in 167 deaths. Thecomparative incidence of fatalities in some leadingindustrial countries, mainly in 1983, is given in Table 2.7.

2.4 Major Disasters

It is appropriate at this point briefly to consider majordisasters. A list of the worst disasters in certain principal

categories, both for the world as a whole and for the UK,is given in Table 2.8.

Those which are of primary concern in the presentcontext are fire, explosion and toxic release. Both of theworst fires listed occurred in theatres. The explosion atHalifax which killed 1963 people was that of a shipcarrying explosives. The Chilwell explosion, in which 134people died, was in an explosives factory. The toxic gasrelease at Bhopal, where the death toll was some 2500,was an escape of methylisocyanate from a storage tank.

There are available a number of accounts of disasters,both natural and man-made, and these are summarizedin Table 2.9. Disasters (Walker, 1973), Darkest Hours (J.R.Nash, 1976), Man-Made Disasters (B.A. Turner, 1978),The Disaster File: The 1970s (Ferrara, 1979), Disasters(Whittow, 1980) and Catastrophes and Disasters (R. Smith,1992) all contain large numbers of disaster case histories,including those from the process industries. Rail acci-dents in the British Isles are described in Red for Danger(Rolt, 1982) and accidents in the process industries are


Figure 2.7 Kletz model of the accident process (Kletz,1988h) (Courtesy of Butterworths)

Table 2.6 Annual risk and fatal accident rate (FAR) indifferent industries and jobs in the UK

1974±78 1987±90

Annual FAR c,d Annual FAR b

Industry or risk a,b risk a,b

activity

Deep sea 280 140 84 42fishing

Offshore 165 82 125 62oil andgas

Coal 21 10.5 14.5 7.3mining

Railways 18 9 9.6 4.8Construction 15 7.5 10 5Agriculture 11 5.5 7.4 3.7Chemical and 8.5 4.3 2.4 1.2

alliedindustries

Premises ± ± 8e 4covered byFactories Act

All ± ± 2.3f 1.2manufacturingindustry

Vehicle 1.5 0.75 1.2 0.6manufacture

Clothing 0.5 0.25 0.09 0.05manufacture

a Annual risk is given as probability of death in 105 years.b Health and Safety Executive, quoted in the RoyalSociety (1992).c Fatal accident rate is defined as probability of death in108 hours of exposure.d Some values from Kletz (1992b), evidently obtainedfrom annual risk; remainder obtained in like manner byauthor.e British Medical Association (1987).f HSE (1988c).

2 / 1 0 H A Z A R D , A C C I D E N T A N D L O S S

described in Chemical Industry Hazards (V.C. Marshall,1987).

2.5 Major Process Hazards

The major hazards with which the chemical industry isconcerned are fire, explosion and toxic release. Of thesethree, fire is the most common but, as shown later,explosion is particularly significant in terms of fatalitiesand loss. As already mentioned, in the UK the explosionat Flixborough killed 28 people, while offshore 167 mendied in the explosion and fire on the Piper Alpha oilplatform. Toxic release has perhaps the greatest potentialto kill a large number of people. Large toxic releases arevery rare but, as Bhopal indicates, the death toll can bevery high. There have been no major toxic releasedisasters in the UK.

The problem of avoiding major hazards is essentiallythat of avoiding loss of containment. This includes notonly preventing an escape of materials from leaks, etc.,but also avoidance of an explosion inside the plantvessels and pipework. Some factors which determine thescale of the hazard are:

(1) the inventory;(2) the energy factor;(3) the time factor;(4) the intensity±distance relations;(5) the exposure factor; and(6) the intensity±damage and intensity±injury relation-

ships.

These factors are described below.

2.5.1 The inventoryThe most fundamental factor which determines the scaleof the hazard is the inventory of the hazardous material.The larger the inventory of material, the greater thepotential loss. As plants have grown in size and output,so inventory in process and in storage has grown. In theearly days of this growth, there was perhaps insufficientappreciation of the increase in the magnitude of thehazard. There is now, however, much wider recognitionof the importance of inventory. At the same time, it isimportant to emphasize that inventory is not the onlyfactor which determines the scale of the hazard.

2.5.2 The energy factorFor an inventory of hazardous material to explode insidethe plant or to disperse in the form of a flammable ortoxic vapour cloud there must be energy. In most casesthis energy is stored in the material itself as the energyeither of chemical reaction or of material state.

In particular, a material which is held as a liquid aboveits normal boiling point at high pressure and tempera-ture, in other words superheated, contains large quan-tities of physical energy, which cause a large proportionof it to vaporize by instantaneous flash-off and to disperseif there is loss of containment. On the other hand, amaterial which is held as a refrigerated liquid atatmospheric pressure contains much less physicalenergy and does not vaporize to anything like thesame extent if containment is lost. In this case theenergy necessary for vaporization has to be supplied bythe ground and the air, which is a relatively slowprocess. Similarly, the hazard presented by an ultratoxicmaterial depends very largely on whether there is energyavailable for its dispersion. There is a hazard, forexample, if an ultratoxic substance is produced as a by-product in a chemical reactor in which a runawayexothermic reaction may occur. But if there is no suchsource of energy, the hazard is much less.

The energy requirement is thus another fundamentalfeature. Unless it is taken into account in the calculation,the scenarios considered may be not merely unlikely, butliterally physically impossible.

2.5.3 The time factorAnother fundamental factor is the development of thehazard in time. The time factor affects both the rate ofrelease and the warning time.

The nature and scale of the hazard is often determinedby the rate of release rather than by the inventory. Thusit is the rate of release which determines the size of aflammable gas cloud formed from a jet of flashinghydrocarbon liquid, such as occurred at Flixborough.Similarly, the hazard presented by an escape of toxic gasdepends on the rate of release. There is a considerabledifference in the concentrations attained between aninstantaneous and a continuous release of toxic gas.

The warning time available to take emergency counter-measures and reduce the number of people exposed isalso very important. An explosion gives a warning timewhich is usually measured only in seconds and may bezero, whereas a toxic release gives a warning which isoften measured in minutes.


Table 2.7 Fatal accidents in manufacturing industry indifferent countriesa

Fatality rate

Deaths per 1000 Deaths per 100 000man-yearsb,c workers per year d

Argentina 0.020Austria 0.142Belgium 0.140 (1979)Canada 0.080 14 (1971±74)Czechoslovakia 0.061Eire 9 (1971±75)France 0.068 (1982) 11 (1971±74)Germany (FRG) 0.120 (1982) 17 (1971±75)Germany (GDR) 0.030Italy 8 (1971±73)Japan 0.010 5 (1971±75)Netherlands 0.009 4 (1971±73)Norway 0.050Poland 0.066 (1984)Spain 0.109Switzerland 0.080UK 0.020 4 (1971±75)USA 0.022 7 (1971±74)

a The basis of the calculation differs somewhat betweencountries and the original references should be consultedfor further details.b International Labour Office (1985b).c For 1983 unless otherwise stated.d HSE (1977d).

H A Z A R D , A C C I D E N T A N D L O S S 2 / 1 1


Table 2.8 Some of the worst non-industrial and industrial disasters world-wide and in the UK (Material fromGuinness Book of Records, copyright # reproduced by permission of the publishers)

Event Date

A Worst world disastersEarthquake Near East and East Mediterranean 1201 1 100 000Volcanic eruption Tambora Sumbawa, Indonesia 1815 92 000Landslide Kansu Province, China 1920 180 000Avalanche Yungay, Juascaran, Peru 1970 �18 000Circular storm Ganges Delta Islands, Bangladesh 1970 1, 000, 000Tornado Shaturia, Bangladesh 1989 �1 300Flood Hwang-ho river, China 1887 900 000Lightning Hut in Chinamasa Krael nr Umtali,

Zimbabwe (single bolt) 1975 21Smog London fog, UK (excess deaths) 1951 2 850Panic Chungking (Zhong qing),

air raid shelter, China 1941 �4 000Dam burst Manchu River Dam, Morvi, Gujarat, India 1979 �5 000Fire (single building) The Theatre, Canton, China 1845 1 670Explosion Halifax, Nova Scotia, Canada 1917 1 963Mining Hankeiko Colliery, China (coal dust explosion) 1942 1 572Industrial Union Carbide methylisocyanate plant,

Bhopal, India 1984 �2 500Offshore platform Piper Alpha, North Sea 1988 167Nuclear reactor Chernobyl Reactor No. 4 1986 31a

Aircraft KLM-Pan Am, Boeing 747crash, Tenerife 1977 583

Marine (single ship) Wilhelm Gustloff, German liner torpedoedoff Danzig by Soviet submarine S-13 1945 �7 700

Rail Bagmati River, Bihar, India 1981 >800Road Petrol tanker explosion inside Salang

Tunnel, Afghanistan 1982 �1 100Atomic bomb Hiroshima, Japan 1945 141 000Conventional bombing Tokyo, Japan 1945 �140 000

B UKEarthquake London earthquake, Christ's Hospital, 1580 2

NewgateLandslide Pantglas coal tip No. 7, Aberfan,

Mid-Glamorgan 1966 144Avalanche Lewes, East Sussex 1836 8Circular storm `The Channel Storm' 1703 �8 000Tornado Tay Bridge collapsed under impact of two

tornadic vortices 1879 75Flood Severn Estuary 1606 �2 000Smog London fog (excess deaths) 1951 2 850Panic Victoria Hall, Sunderland 1883 183Dam burst Bradfield Reservoir, Dale Dyke, 1864 250

near Sheffield (embankment burst)Fire (single building) Theatre Royal, Exeter 1887 188Explosion Chilwell, Nottinghamshire (explosives

factory) 1918 134Mining Universal Colliery, Senghenydd,

Mid-Glamorgan 1913 439Offshore platform Piper Alpha, North Sea 1988 167Nuclear reactor Windscale (now Sellafield), Cumbria

(cancer deaths) 1957 ±b

Marine (single ship) HMS Royal George, off Spithead 1782 �800Rail Triple collision, Quintinshill, Dumfries 1915 227Road Coach crash, River Dibb, near Grassington,

North Yorkshire 1975 33Conventional bombing London, 10±1 May 1941 1 436

a The Guinness Book of Records states: ` Thirty one was the official Soviet total of immediate deaths. On 25 April 1991Vladimir Shovkoshitny stated in the Ukrainian Parliament that 7000 ``clean-up'' workers had already died fromradiation. The estimate for the eventual death toll has been put as high as 75 000 by Dr Robert Gale, a US bonetransplant specialist.'b The Guinness Book of Records states: ` There were no deaths as a direct result of the fire, but the number of cancerdeaths which might be attributed to it was estimated by the National Radiological Protection Board in 1989 to be 100.'


2.5.4 The intensity�distance relationshipAn important characteristic of the hazard is the distanceover which it may cause injury and/or damage. Ingeneral, fire has the shortest potential range, thenexplosion and then toxic release, but this statementneeds considerable qualification. The range of a fireballis appreciable and the range of a fire or explosion from avapour cloud is much extended if the cloud drifts awayfrom its source.

It is possible to derive from the simpler physicalmodels for different hazards analytical expressions whichgive the variation of the intensity of the physical effect(thermal radiation, overpressure, toxic concentration)with distance. For some models the variation followsapproximately the inverse square law. This aspect isdiscussed in Chapter 9.

With regard to the exposure of the public to processhazards, it is of interest to know the distance at whichthere might be a significant number of fatalities orinjuries and the maximum distance at which any fatalityor injury might occur. Estimates of the distancenecessary to reduce the risk of fire and explosion tomembers of the public to a level which is assumed to benot unacceptable, based on criteria such as thermalradiation from fire and overpressure from explosion, are

generally of the order of 250±500 m for a major planthandling hydrocarbons, but may be less or more.Estimates of the distance necessary to reduce the riskfrom toxic release tend to be somewhat greater.

The maximum distance at which there might conceiv-ably be fatalities or injuries cannot be determined withany great accuracy. The explosion effect which can occurat the greatest distance is the shattering of glass ± thishas happened at distances of up to 20 miles from a verylarge explosion. But in such cases the energy of theglass fragments is low and very rarely causes injury.Similarly, cases of injury from toxic gas at largedistances, say over 10 miles, are rare but are reportedto have occurred.

The effects of fire, explosion and toxic release arediscussed further in Chapters 16±18. Although a potentialeffect of a hazard is often expressed as a function ofdistance, it is the area covered by the effect whichdetermines the number of people at risk.

2.5.5 The exposure factorA factor which can greatly mitigate the potential effectsof an accident is the reduction of exposure of the peoplewho are in the affected area. This reduction of exposuremay be due to features which apply before the hazard


Table 2.9 Coverage of some books on disasters

Bignell, Ferrara R. Smith Thygerson Walker WhittowPeters (1979) (1993) (1977) (1973) (1980)and Pym (1977)

Natural hazardsSubterranean stress:Earthquakes x x x x xVolcanoes x x x xTsunamis x x xSurface instability:Landslides and

avalanches x x x x xGround surfacecollapse xWeather:Wind, storm x x xTornadoes x x xHurricanes x x xFloods (river, sea) x x x x xFires (forest, grass) x x xMan-made hazardsStructures:Buildings x x xDams x xBridges x x xBuilding fires x x x xGas explosions x x xIndustrial:Mines x x xFire x x xExplosion x x xTransport:Air x x x xRail x x x xRoad x x x xSea x x x x


develops, or to emergency measures which are takenafter the hazard is recognized.

The principal mitigating features are shelter andescape. Escape may be by personal initiative or bypreplanned evacuation. It should not be assumed thatemergency measures are synonymous with evacuation.For a toxic release, for example, the emergencyinstructions may be to evacuate the area but are morelikely to be to stay indoors and seal the house.Emergency measures may be of great value in reducingthe toll of casualties from a major accident.

For an explosion which gives no advance warningthere is no time for emergency measures such asevacuation. This does not mean, however, that evacua-tion has no role to play as far as fire and explosion areconcerned. On the contrary, although the initial eventmay be sudden, there are frequently further fire andexplosion hazards. Evacuation may then be applicable.

Measures which can be taken to mitigate exposure arediscussed in Chapter 24.

2.5.6 The intensity�damage and intensity�injuryrelationshipsThe range of the hazard depends also on the relation-ships between the intensity of the physical effect and theproportion of people who suffer injury at that level of theeffect. The annular zone within which injury occurs isdetermined by the spread of the injury distribution. If thespread is small, the injury zone will be relatively narrow,while if it is large the zone may extend much furtherout. Similar considerations apply to damage. This aspectis discussed further in Chapter 9.

2.6 Fire Loss Statistics

The loss statistics of interest are primarily those for fireloss. In the UK, principal sources of statistics on suchlosses are the Home Office, the Fire ProtectionAssociation, the Loss Prevention Council and theinsurance companies. These organizations produceannual statistics for fire losses. Loss due to explosionsis generally included in that for fire loss. There are noregular loss statistics on toxic release, since this is a rareevent and usually causes minimal damage to property.

Fire loss data are given in Fire Statistics UnitedKingdom 1990 (Home Office, 1992), in FPA Large FireAnalysis for 1989 (Fire Protection Association (FPA),1991) and in Insurance Statistics 1987±91 (Association ofBritish Insurers (ABI), 1992).

The Home Office data show that in 1990 fire brigadeswere called to some 467 000 fires, of which 108 000 werein buildings. The FPA defines a large loss fire as oneinvolving a loss of £50 000 or more. In 1990 there were739 such fires, with a total cost of £282 million and anaverage cost of £0.382 million. In the chemical and alliedindustries in 1990 there were eight large loss fires, witha total cost of £5.24 million and an average cost of £0.656million. There were no large loss fires in the coal andpetroleum industries class.

A more detailed analysis of fires in the chemical andpetroleum industries given by the FPA in 1974 is shownin Tables 2.10 and 2.11, the former giving analysis bynumber and cost and the latter by number andoccupancy, by place of origin, by ignition source, bymaterial first ignited and by time of day. There are anumber of significant points in the tables. The chemicalindustry had the largest number of fires, but the oil


Table 2.10 Large fires in the chemical and petroleumindustriesa in Great Britain, 1963�75: number and cost(Fire Protection Association, 1974; Redpath, 1976)

Year No. of Costfires (£m.)

1963 44 2.31964 43 2.91965 40 3.01966 43 2.51967 51 4.41968 53 3.11969 44 3.21970 67 6.21971 65 6.21972 66 3.51973 80 121974 45 431975 46 6.6

a The chemical and petroleum industries are taken asStandard Industrial Classification Order 4 (Coal andpetroleum products) and 5 (Chemical and alliedindustries)

Table 2.11 Large fires in the chemical and petroleum industries in Great Britain, 1971�73 (Fire ProtectionAssociation, 1974b)

A Number and cost by occupancy

Occupancy No. of fires Total Total cost Average cost£10 000± £40 000± £100 000± >£250 000 No.£39 000 £99 000 £249 000 (£m.) (£m.)

Chemicals 1 12 13 7 33 7.215 0.219Oil and tar 0 1 2 6 9 6.225 0.692Paint and varnish 1 2 2 1 6 0.738 0.123Fertilizer 1 1 2 1 5 0.625 0.125Agricultural products 0 0 3 0 3 0.525 0.175Plastics 1 1 0 0 2 0.051 0.025Others 2 7 1 1 11 0.823 0.075

Total 6 24 23 16 69 16.202 0.235

continued


industry the most expensive. The origin of the fires ispredominantly in storage and in leakages. The sources ofignition are fairly evenly spread. There is only one fireattributed to static electricity and two to arson. But in 35cases, i.e. 44%, the ignition source was unknown. Thematerial phase first ignited also shows a balanced spread,with the solid phase actually being predominant. There isno marked trend in the time of day of the fires, althoughthe number is somewhat higher during the day shift.

Further analyses of fire statistics have been given byH.D. Taylor and Redpath (1971), the FPA (1976) andRedpath (1976). In particular, these sources presentadditional data of the type given in Tables 2.10 and2.11. These data are a useful general pointer. Theyconstitute, however, a rather small sample. Moreover,they are not necessarily representative of the type of fireor explosion which constitutes a major disaster.

Work on the occurrence of fires in industrial buildingshas been described by Rutstein and Clarke (1979) andRutstein (1979b). The probability of fire was found toincrease with the size of building according to theequation

P � aB c �2:6:1�where B is the floorspace (m2) and P is the probabilityof fire per year, and a and c are constants. Forproduction buildings in manufacturing industry generally(SIC Classes 3±19) the values of the constants a and cwere 0.0017 and 0.53 and in the chemical and alliedindustries (SIC 4) they were 0.0069 and 0.60, respec-tively. (These SIC numbers refer to the StandardIndustrial Classification at the time). The probability offire in a 1500 m2 production building was thus 0.083 formanufacturing industry and 0.21 for the chemicalindustry.

An analysis of some 2000 large loss claims at CignaInsurance has been given by Instone (1989) and issummarised in Table 2.12.

A study of the contribution of human factors to failuresof pipework and in-line equipment by Bellamy, Geyerand Astley (1989) contains a large amount of informationcharacterising releases, as shown in Table 2.13.

As with fatal injuries so with fire losses, a singleaccident may dominate the process industries loss for a


B Place of origin

No. offires

Storage:Warehouse or open site 21Tank 12

Leakage:from fractured pipe 15from leaking coupling, flange or seal 6from electrical equipment 6unspecified 2

Reactor or mixer 4Steam drier 2Spray booth 1Cooling tower 1Unreported 9Total 79

C Ignition source

No. offires

Hot surfaces 8Burner flames 8Electrical equipment 6Spontaneous ignition 6Friction heat and sparks 6Flame cutting 4Children with matches 3Malicious ignition 2Static electricity 1Unknown 35Total 79

D Material first ignited

No. offires

Classification by phaseGas 10Vapour 16Liquid 20Solid 23Unknown 10Total 79

Classification by materialHydrocarbons:

Gas 3Liquid/vapour 18Solid 2

Other organics, etc.:Liquid/vapour 16Solid 7Cellulosic solids (timber, paper, cardboard,fireboard) 6Hydrogen 7Steel 2Sulphur 1Unknown 17

Total 79

E Time of day

Time of day No. of Time of day No. offires fires

24.00±1.00 h 4 12.00±13.00 h 1(midnight)1.00±2.00 0 13.00±14.00 32.00±3.00 4 14.00±15.00 23.00±4.00 2 15.00±16.00 54.00±5.00 3 16.00±17.00 35.00±6.00 2 17.00±18.00 66.00±7.00 1 18.00±19.00 57.00±8.00 4 19.00±20.00 28.00±9.00 3 20.00±21.00 59.00±10.00 3 21.00±22.00 310.00±11.00 3 22.00±23.00 01.00±12.00 3 23.00±24.00 2

(midnight)



Table 2.12 Large losses in the process industriesinsured by Cigna Insurance (after Instone, 1989)(Courtesy of Cigna Insurance)

Proportion (%)

A Operations typeRefinery complex 48Petrochemicals 20General properties 10Storage terminals 8Onshore production plants 7Jetty installations 3Offshore production plant 2Coal mines 2Total 100

B Plant typeStorage tanks and pipelines 23Refineries 22Oil/gas production 13Offsites 10Monomers and polymers 6Petrochemicals 6Fertilizers 5Coal products 3Gas processing 3Refinery feedstock and products 3Acids, glycols, etc. 3Aromatics 2Alcohols, ketones, etc. 1Paraffins 0Total 100

C Process unit typeFurnace or heater 10Pipework 9Storage tank ± unspecified 7Drilling rig 5Pump 5Compressor 5Boiler 5Heat exchanger 4Cone roof tank 4Distillation column 3Warehouse 3Process vessel 3Floating roof tank 3Electrical substation 3Reactor 3Reformer 2Conveyor belt 2Riser pipe 2Jetty or buoy 2Gas turbine generator <2Control room <2Hopper <2Transformer <2Flare; furnace stack; relief system (2); aircooler; centrifuge; filter; extruder; drier;refrigeration circuit; cooling tower;incinerator; electric motor; meters;instrument analyser; valve; crane; API (AmericanPetroleum Institute) separator (2); hydrogen;loading arm ± vessels; loading arm ± roadvehicles; road tanker; hose; laboratory;office; computer <1

D Plant statusNormal operations 50Plant start-up 15Plant under maintenance 10Filling tanks or vessels 6Well drilling 5Plant in shut-down state 3Process upset 2Emptying tanks or vessels 2Construction <2Well workover <2Plant shutting down <1Ship berthing/sailing <1Plant commissioning <1Blending operation <1Well logging <1

E Loss typeFire 33Explosion 12Explosion and fire 10Wind, storm and flood 10Well blowout 5Mechanical 5Ship impact 5Contamination 4Machinery breakdown 4Product loss 3Electric cable fire 3Construction defect; collapse; subsidence/collapse; earthquake; impact; implosion; floatingroof sunk; pool fire; vapour fire; vapour cloudexplosion; theft <1

F Cause of lossOperator error 17Wind, storm and flood 16Pipe/weld failure 7Tube failure 7Machinery breakdown 7Electrical short-circuit 4Valve leak 4Pipe flange leak 4Instrumentation failure 4Vehicle/digger impact 3Corrosion 3Seal failure 3Lightning <2Anchor/hull damage to jetty <2Power failure <2Storage tank overflow <2Tank vent blocked <2Pressure increase <2Sabotage <2Burst vessel <2Compressor leak <2Runaway reaction <2Lost well circulation fluid <2Modification/design error; erosion; feedstock;process vessel overflow; flare carryover; waterhammer; insufficient air purge; lubricationfailure; instrument air failure; pyrophoric ironsulphide; gauge broken open; corrodedelectrical contacts; flame impingement; firewater leak; malicious damage <1


particular year. In the UK, the Flixborough disasterconstituted a significant proportion of the fire loss in1974, whilst the Piper Alpha disaster dominated that for1988. Fire losses are considered further in Chapter 5.


G Material ignitedRefinery feedstock and products 41Petrochemicals 31Gas processing 13Acids, glycols, additives 6Monomers and polymers 3Alcohols, ketones, ethers; aromatics;paraffins; fertilisers; coal products <1

H Source of ignitionMaterial not ignited 35Furnace 12Hot surface 12Autoignition 7Electrical arcing 3Operator error 3Other electrical apparatus 3Welding 3Friction <3Static electricity <3Pyrophoric matter; spontaneous combustion;matches; spark; electric motor; boiler; flare;explosive device; vehicle; lightning; spreadof fire; hot embers <2

Table 2.13 Characteristics of releases in study offailure of pipework and in-line equipment (Bellamy,Geyer and Astley, 1989) (Courtesy of the Health andSafety Executive)

No. ofincidents

A Location typeChemical plant 278Refinery 96Factory 187Storage depot 47Tank yard 28Fuel station 15Other 38Unknown 232Total 921

B Site statusNormal operations 343Storage 103Loading/unloading 33Maintenance 146Modification 8Contractor work 18Testing 5Unknown 128Other 40Start-up 42Shut-down 18Total 884

C Materials releasedAmmonia 54Hydrocarbons (unspecified) 54

Chlorine 50Hydrogen 37Benzene 33Crude oil 28Steam 25Natural gas 24Propane 20Butane 18Fuel oil 18Hydrochloric acid 16Sulphuric acid 16Ethylene 16Hydrogen sulphide 14Water 13Nitrogen 13Oxygen 13Vinyl chloride 12LPG 12Styrene 11Naphtha petroleum 10Total 507

D Material phaseLiquid 393Gas 260Vapour 13Solid 9Liquid + gas/vapour 120Solid + gas/vapour 3Total 798

E Unignited material dispersionFlammable 127Toxic 123Flammable/toxic 47Corrosive 97Irritant 1Unignited gas 96Vapour cloud 180Liquid 212Spill 186Jet/spurt 8Spray 10Total 1087

F Fire or explosion eventFire 145Flash fire 11Pool fire 4Jet fire 1Fireball 7BLEVE 4Explosion 63Explosion followed by fire 77Explosion followed by flash fire 2Total 314

Note: BLEVE, boiling liquid expanding vapour explosion.


2.7 Fire and Explosion

So far no distinction has been made between fire andexplosion losses. The latter are normally included in theoverall fire statistics. In fact it is explosions which causethe most serious losses. This is illustrated by Table 2.14,which shows losses in the chemical industry insured bythe Factory Insurance Association (FIA) of the USA(W.H. Doyle, 1969). Some two-thirds of the loss isattributable to explosions. The nature of these explosionsis shown in Table 2.15. Over three-quarters of theexplosions involve combustion or explosive materials.


Table 2.14 Large losses in the chemical industry insured by the Factory Insurance Association: fire, explosion andother loss (after W.H. Doyle, 1969) (Courtesy of the American Institute of Chemical Engineers)

Year Fires Explosions Other Total

No. Loss No. Loss No. Loss No. Loss(%) (%) (%) (%)

1964 3 1.6 6 13.4 1 0.4 10 15.41965 4 1.9 8 8.7 0 0 12 10.61966 7 9.2 6 9.9 1 0.6 14 19.71967 8 5.9 12 22.4 2 1.1 22 29.41968 13 11.6 12 13.3 0 0 25 24.9

Total 35 30.2 44 67.7 4 2.1 83 100.0

Table 2.15 Large losses in the chemical industryinsured by the Factory Insurance Association: types ofexplosion (W.H. Doyle, 1969) (Courtesy of the AmericanInstitute of Chemical Engineers)

No. Loss(%)

Combustion:In equipment 13 10.5Outside equipment, in building 8 24.4In open 1 3.3

Subtotal 22 38.2

Reaction:Explosive liquid or solid 12 16.8Runaway reaction 4 6.5

Subtotal 16 23.3

Metal failure:Corrosion 1 1.4Overheating 3 4.1Accidental overpressure 2 1.0

Subtotal 6 6.5

Total 44 68.0

Table 2.16 Large fires in the chemical and alliedindustries insured by Industrial Risk Insurers (Norstrom,1982a) (Courtesy of the American Institute of ChemicalEngineers)

Proportion(%)

A CauseFlammable liquid or gas

(release, overflow) 17.8Overheating, hot surfaces, etc. 15.6Pipe or fitting failure 11.1Electrical breakdown 11.1Cutting and welding 11.1Arson 4.4Others 28.7

B LocationEnclosed process or

manufacturing buildings 42.2Outdoor structures 33.3Warehouses 6.7Others 17.8

C OccupancyMixing/blending 8.9Storage 8.9Distillation 6.7Control/computer rooms 6.7Chemical reaction, batch 4.4Chemical reaction, continuous 4.4Heating 4.4Drying 4.4Others 51.2

D Contributing factorsSprinkler or water spray lacking 35.6Human element 15.6Presence of flammable liquids 11.1Rupture of vessel or equipment 8.9Excessive residue 8.9Production bottleneck 6.7Sprinkler or water spray inadequate or

impaired 6.7

E Area protectionProtected building or structure 26.7Unprotected building or structure 62.2Outside building or structure 11.1


Further analyses of fires and explosions, treated sepa-rately, have been made by Norstrom (1982a), as shownin Tables 2.16 and 2.17.

The problem of large fires or explosions in vapourclouds is considered in Chapter 17. The data given inTable 17.33 by V.C. Marshall (1976a), in which the

incidents are ranked in terms of the amount of vapourreleased, suggest that the large releases often result inexplosions rather than fires.

2.8 Causes of Loss

There are almost as many analyses of the causes of lossas there are investigators. Unfortunately, there is noaccepted taxonomy, so that it is often difficult toreconcile different analyses. Two typical breakdowns ofthe causes of loss are given in Table 2.18 (W.H. Doyle,1969) and in Table 2.19 (American Insurance Association(AIA), 1979), the latter being an up-date of an earliertable (Spiegelman, 1969). Doyle emphasizes the impor-tance of poor maintenance, followed by poor design andlayout of equipment and inadequate knowledge of theproperties of chemicals. Spiegelman (1969) gives, inaddition to the table referred to, a fairly detailedbreakdown of the factors considered under each head-ing. His category of equipment failures evidently has alarge element of poor maintenance.


Table 2.17 Large explosions in the chemical and alliedindustries insured by Industrial Risk Insurers (Norstrom,1982a) (Courtesy of the American Institute of ChemicalEngineers)

Proportion (%)

A CauseChemical reaction uncontrolled 20.0Chemical reaction accidental 15.0Combustion explosion in equipment 13.3Unconfined vapour cloud 10.0Overpressure 8.3Decomposition 5.0Combustion sparks 5.0Pressure vessel failure 3.3Improper operation 3.3Others 16.8

B LocationEnclosed process or manufacturing

buildings 46.7Outdoor structures 31.7Yard 6.7Tank farm 3.3Boiler house 3.3Others 8.3

C OccupancyChemical reaction process, batch 26.7Storage tank 10.0Boiler 8.3Chemical reaction process, continuous 6.7Compressor 5.0Evaporation 3.3Recovery 3.3Transfer 3.3Liquefaction 3.3Others 25.1

D Contributing factorsRupture of equipment 26.7Human element 18.3Improper procedures 18.3Faulty design 11.7Vapour-laden atmosphere 11.7Congestion 11.7Flammable liquids 8.3Long replacement time 6.7Inadequate venting 6.7Inadequate combustion controls 5.0Inadequate explosion relief 5.0

E Area protectionProtected building or structure 43.3Unprotected building or structure 36.7Outside building or structure 20.0

Table 2.18 Large losses in the chemical industryinsured by the Factory Insurance Association: causes ofloss (W.H. Doyle, 1969) (Courtesy of the AmericanInstitute of Chemical Engineers)

No. Loss(%)

Incomplete knowledge of the propertiesof a specific chemical 6 11.2

Incomplete knowledge of the chemicalsystem or process 6 3.5

Poor design or layout of equipment 13 20.5Maintenance failure 14 31.0Operator error 5 6.9

Total 44 73.1

Table 2.19 Hazard factors for 465 fires and explosionsin the chemical industry 1960�77 (American InsuranceAssociation, 1979)

No. of times Proportionassigned (%)

Equipment failure 223 29.2Operational failure 160 20.9Inadequate material

evaluation 120 15.7Chemical process

problems 83 10.9Material movement

problems 69 9.0Ineffective loss prevention

programme 47 6.2Plant site problems 27 3.5Inadequate plant layout 18 2.4Structures not in

conformity with userequirements 17 2.2

Total 764 100.0


Further information on causes of loss is provided bythe data of Norstrom (1982a) given in Tables 2.16 and2.17.

2.9 Downtime Losses

The losses considered so far are insured losses arisingfrom fire and explosion. Another important, but oftenuninsured, loss arises from plant shut-down and down-time. Once again there are many different analyses ofshut-down and downtime, and its causes on differenttypes of plant. Three sets of statistics on shut-down anddowntime are given in Tables 2.20±2.22 for a refinery

(McFatter, 1972), in Tables 2.23 and 2.24 for anotherrefinery (Anon, 1970b), and in Tables 2.25±2.28 (G.P.Williams, Hoehing and Byington 1987). In addition, dataon down-time causes in ammonia plants were givenearlier in Table 1.5.

McFatter's data in Tables 2.20±2.22 are for a singlerefinery consisting of seven units over a 10-year period.During this time the overall availability of all the unitswas 96.4%. In other words the units were down forscheduled or unscheduled shut-down 3.6% of the time.But in addition there were some 122 failures which weresignificant in that they resulted in 1313 equivalent daysof lost production, although they did not cause shut-down. The large number of unscheduled shut-downs in1967 was due to a major hydrocarbon line leak and fire,which resulted in complete shut-down of the refinery.

The importance of compressors, furnaces and heatexchangers is clear from Table 2.22. Other data given byMcFatter show a rising trend of equivalent days lost dueto failures. He comments that this is due to largeincreases in throughput, reduction in sparage of criticalitems, e.g. compressors and pumps, and lack ofopportunity to take items, e.g. furnaces, off for main-tenance. The data for another refinery given in Tables2.23 and 2.24 show an essentially similar picture; as dothe data given by McIntire (1977a,b).

Surveys of ammonia plant shut-downs have beenpublished by Sawyer, Williams and Clegg (1972), G.P.Williams and Sawyer (1974), G.P. Williams (1978), G.P.Williams and Hoehing (1983) and G.P. Williams,Hoehing and Byington (1987). The 1987 survey covers136 plants, divided into three groups: (1) large-tonnage,single-stream, centrifugal compressor type plants, world-wide in North America, Europe and the rest of the


Table 2.20 Shut-downs in a refinery a (after McFatter,1972) (Courtesy of the American Institute of ChemicalEngineers)

Year Scheduled Unscheduled

1961 1 11962 4 11963 3 11964 3 11965 4 11966 1 01967 3 101968 2 31969 4 11970 2 5

a There are seven units in the refinery.

Table 2.21 Causes of non-scheduled shut-downs in arefinery (after McFatter, 1972) (Courtesy of the AmericanInstitute of Chemical Engineers)

%

Line leaks and fires 28Line leaks 28Process 12Utilities 20Miscellaneous 12

Total 100

Table 2.22 Causes of significant non-shut-down failuresin a refinery (after McFatter, 1972) (Courtesy of theAmerican Institute of Chemical Engineers)

%

Compressors 30Furnaces 18Exchangers 17Towers 5Process 18Process integration 7Miscellaneous 5

Total 100

Table 2.23 Causes of downtime in a refinery (afterAnon., 1970b)

%

Scheduled maintenance 71.6Process problems 15.6Problems in other linked plants 7.6Utility problems 5.2

Total 100

Table 2.24 Significant equipment failures in a refinery(after Anon., 1970b)

All failures

(No.) (%)

Pumps and compressors 35 33.9Furnaces 14 13.6Piping 11 10.7Towers and reactors 9 8.8Exchangers 7 6.8Utilities 23 22.3Other 4 3.9

Total 103 100


world; (2) small plants, usually with multiple parallelstreams of reciprocating compressors; and (3) partialoxidation plants. The general nature of the shut-downsand downtime is shown in Table 2.25. Part of thedowntime is due to non-plant problems (gas curtailmentand market problems) and part is due to plant problems.

The service factor is the availability net of non-plantproblems. The contributions to shut-downs and downtimeare given in Table 2.26 in terms of plant area and type ofequipment and in Table 2.27 in terms of individualitems of equipment. Table 2.28 gives data on fires in theplants.


Table 2.25 Shut-down and downtime in ammonia plants (after G.P. Williams, Hoehing and Byington, 1987)(Courtesy of the American Institute of Chemical Engineers)

Large tonnage plantsPartial

North Europe Rest of Total Reciprocating oxidationAmerica world plants plants

A Downtime and availabilityTotal downtime (days/plant-year) 71.1 48.6 84.5 70.1 60.2 71.3Unavoidable downtime (days/plant-year):

Feedstock curtailment 0.8 0.6 20.0 7.6 11.2 0.5Inventory control 45.4 8.7 15.2 25.2 20.8 9.7Other 0.9 2.0 4.2 2.3 3.4 19.1

Total 47.1 11.2 39.4 35.1 35.4 29.3Net avoidable (days/plant-year) 24.1 37.4 45.2 35.0 24.7 41.9Service factor (%) 92.4 89.4 87.7 89.4 92.5 87.5

B TurnaroundsTime between turnarounds (days) 21.7 33.2 33.7 30 30.8 21.2Actual frequency (months) 24 20.5 13.5 18 17 16Desired frequency (months) 23.5 25 14.4 20.6 16 12

C Classification of shut-downsAvoidable shut-downs (shut-downs/plant-year):

Instrument failure 1.2 1.4 1.9 1.5 0.8 1.9Equipment failure 3.2 3.5 5.5 4.1 10.7 8.0Turnarounds 0.5 0.4 0.7 0.5 0.5 0.7Other 0.7 0.4 1.0 0.8 1.1 1.8

Total 5.6 5.8 9.1 6.9 13.1 12.3Unavoidable shut-downs (shut-downs/plant-year):

Feedstock curtailment 0.14 0.08 0.74 0.34 0.31 0.41Inventory control 0.34 0.07 0.23 0.23 0.29 0.48Electrical failure 0.36 0.17 1.37 0.67 2.31 2.45Other 0.27 0.11 0.19 0.20 0.46 3.14

Total 1.11 0.43 2.53 1.44 3.37 6.48Total shut-downs 6.7 6.3 11.6 8.3 16.5 18.8

(shut-downs/plant-year)

D Classification of downtimeAvoidable shut-downs (days/plant-year):

Instrument failure 1.1 1.4 1.1 1.2 0.4 2.0Equipment failure 11.4 20.8 20.3 16.7 9.1 20.0Turnarounds 10.5 14.6 20.8 15.2 14.0 16.0Other 1.0 0.7 2.9 1.6 1.4 4.0

Total 24.1 37.4 45.2 35.0 24.7 41.9Unavoidable shut-downs (days/plant-year):

Feedstock curtailment 0.8 0.6 20.0 7.6 11.2 0.5Inventory control 45.4 8.7 15.2 25.2 20.8 9.7Electrical failure 0.2 0.5 1.7 0.8 2.1 3.1Other 0.7 1.4 2.5 1.5 1.4 16.0

Total 47.1 11.2 39.4 35.1 35.4 29.3

Total downtime (days/plant-year) 71.1 48.6 84.5 70.1 60.2 71.3



Table 2.26 Major equipment failures causing shut-down and downtime in ammonia plants a (after G.P. Williams,Hoehing and Byington, 1987) (Courtesy of the American Institute of Chemical Engineers)

Large tonnage plantsReciprocating Partial

North Europe Rest of Total plants oxidationAmerica world plants

A Equipment failures causing shut-downs by plant areaPrimary reforming 3.0 (0.70) 3.0 (0.52) 4.8 (0.68) 3.7 (0.65) 1.1 (0.50) ±Secondary reforming 1.3 (0.14) 5.4 (0.24) 1.3 (0.13) 2.3 (0.16) 0.8 (0.10) ±(including waste heat boilers)Purification 1.1 (0.44) 1.9 (0.39) 1.9 (0.68) 1.6 (0.51) 1.6 (0.59) 4.3 (1.74)Synloop 1.3 (0.48) 2.2 (0.34) 1.1 (0.36) 1.5 (0.40) 0.8 (0.52) 3.7 (0.60)Compression 3.5 (1.20) 3.1 (0.91) 6.1 (2.32) 4.3 (1.52) 1.7 (7.71) 3.3 (1.45)Miscellaneous 1.3 (0.24) 5.2 (1.10) 5.2 (1.36) 3.7 (0.86) 3.1 (1.23) 8.7 (4.21)Total 11.4 (3.21) 20.8 (3.51) 20.3 (5.53) 17.0 (4.10) 9.1 (10.65) 19.9 (8.00)

B Equipment failures by type of equipmentReformer piping 2.3 (0.48) 1.5 (0.27) 4.1 (0.45) 2.8 (0.42) 0.8 (0.32) ±Other piping 0.6 (0.22) 2.0 (0.48) 1.1 (0.43) 1.1 (0.36) 0.8 (0.49) 3.3 (0.81)Valves 0.4 (0.22) 0.2 (0.33) 0.7 (0.53) 0.4 (0.36) 0.4 (0.35) 0.9 (0.57)Compression:

Centrifugal 2.6 (1.02) 2.8 (0.60) 5.1 (1.20) 3.5 (0.98) 0.1 (0.17) 1.1 (0.38)Reciprocating ± ± ± ± 1.7 (7.65) 1.0 (0.02)

Pumps and drives 0.1 (0.10) 0.4 (0.10) 0.3 (0.19) 0.3 (0.13) 0.1 (0.10) 0.3 (0.33)Exchangers 3.3 (0.66) 5.8 (0.91) 6.1 (1.17) 4.9 (0.91) 2.9 (1.13) 4.0 (1.19)Vessels 0.7 (0.10) 6.1 (0.24) 1.3 (0.13) 2.3 (0.15) 1.7 (0.23) 5.2 (2.93)Miscellaneous 1.5 (0.31) 1.8 (0.58) 1.8 (1.40) 1.7 (0.79) 0.6 (0.21) 4.2 (1.8)Total 11.4 (3.21) 20.8 (3.51) 20.3 (5.50) 17.0 (4.10) 9.1 (10.65) 19.9 (8.00)

a Shut-down in shut-downs/plant-year; downtime in days/plant-year, in parentheses.

Table 2.27 Equipment and other failures in ammonia plants a (after G.P. Williams, Hoehing and Byington, 1987)(Courtesy of the American Institute of Chemical Engineers)

North Rest ofAmerica Europe world Total

DT SD DT SD DT SD DT SD

A Equipment failuresPrimary reforming:Tube±riser±pig 1.99 0.44 1.25 0.24 2.82 0.35 2.10 0.36Transfer header 0.32 0.04 0.45 0.04 1.25 0.10 0.68 0.06Convection section 0.40 0.07 0.38 0.05 0.12 0.03 0.30 0.05ID±FD fan 0.18 0.12 0.75 0.15 0.45 0.14 0.42 0.13Miscellaneous 0.12 0.03 0.21 0.04 0.20 0.06 0.17 0.04Total 3.01 0.70 3.04 0.52 4.84 0.68 3.67 0.65

Secondary reforming:Primary waste heat boiler 0.74 0.06 1.76 0.12 0.17 0.01 0.80 0.06Secondary waste heat boiler 0.35 0.06 0.41 0.05 0.16 0.05 0.30 0.05Secondary reformer 0.20 0.01 3.05 0.06 0.88 0.13 1.17 0.07Miscellaneous 0.00 0.01 0.14 0.01 0.04 0.08 0.05 0.03Total 1.29 0.14 5.36 0.24 1.25 0.27 2.32 0.21

Purification:Exchangers 0.41 0.18 0.28 0.07 1.04 0.26 0.60 0.18Pumps and drives 0.06 0.07 0.25 0.05 0.05 0.05 0.11 0.06Piping and valves 0.27 0.14 0.08 0.12 0.59 0.29 0.34 0.19Vessels 0.36 0.04 1.24 0.13 0.18 0.05 0.52 0.07Miscellaneous 0.01 0.01 0.05 0.02 0.04 0.03 0.03 0.02Total 1.11 0.44 1.90 0.39 1.90 0.68 1.59 0.51

continued



Feed compressor:Driver 0.03 0.02 0.00 0.00 0.00 0.00 0.01 0.01Compressor 0.03 0.01 0.01 0.01 0.02 0.03 0.02 0.02Miscellaneous 0.00 0.01 0.16 0.02 0.02 0.01 0.05 0.01Total 0.06 0.04 0.17 0.03 0.04 0.04 0.08 0.04

Air compressor:Driver 0.25 0.09 0.14 0.05 0.61 0.02 0.35 0.05Compressor 0.44 0.15 0.14 0.07 0.69 0.13 0.45 0.12Miscellaneous 0.11 0.07 0.04 0.09 0.37 0.24 0.18 0.14Total 0.80 0.31 0.32 0.21 1.67 0.39 0.99 0.31

Syngas compressor:Driver 0.50 0.21 0.33 0.07 0.76 0.16 0.55 0.16Compressor 0.73 0.25 1.38 0.22 2.01 0.58 1.35 0.36Miscellaneous 0.26 0.19 0.62 0.28 0.93 0.83 0.59 0.44Total 1.49 0.65 2.33 0.57 3.70 1.57 2.49 0.96

Syngas circulator:Driver 0.01 0.01 0.00 0.00 0.00 0.00 0.00 0.00Compressor 0.00 0.01 0.00 0.00 0.01 0.02 0.00 0.01Miscellaneous 0.00 0.00 0.00 0.00 0.01 0.01 0.00 0.00Total 0.01 0.02 0.00 0.00 0.02 0.03 0.01 0.02

Refrigeration compressor:Driver 0.14 0.05 0.01 0.02 0.37 0.09 0.19 0.06Compressor 0.33 0.09 0.07 0.01 0.17 0.04 0.21 0.05Miscellaneous 0.66 0.04 0.17 0.07 0.09 0.16 0.33 0.09Total 1.13 0.18 0.25 0.10 0.63 0.29 0.73 0.20

Synloop and refrigeration:Exchangers 0.72 0.24 0.26 0.09 0.81 0.15 0.63 0.17Piping and valves 0.39 0.20 1.51 0.24 0.30 0.19 0.65 0.21Vessels 0.07 0.03 0.40 0.01 0.01 0.02 0.13 0.02Miscellaneous 0.10 0.01 0.00 0.00 0.00 0.00 0.04 0.00Total 1.28 0.48 2.17 0.34 1.12 0.36 1.45 0.40

Miscellaneous equipment:Auxiliary boiler 0.48 0.02 0.31 0.03 0.45 0.07 0.43 0.04Piping and valves 0.27 0.10 0.63 0.44 0.90 0.49 0.59 0.33Exchangers 0.17 0.02 2.59 0.51 3.31 0.59 1.91 0.35Vessels 0.06 0.01 1.40 0.04 0.19 0.04 0.45 0.03Pumps and drives 0.08 0.04 0.17 0.05 0.23 0.14 0.16 0.08Miscellaneous 0.20 0.05 0.12 0.03 0.08 0.03 0.14 0.04Total 1.26 0.24 5.22 1.10 5.16 1.36 3.66 0.86

Grand total 11.44 3.20 20.76 3.50 20.33 5.67 16.99 4.16

B Electrical, instrument and other shut-down causesElectrical:External 0.18 0.36 0.53 0.17 1.70 1.37 0.81 0.67Internal 0.49 0.22 0.19 0.20 1.70 0.35 0.84 0.26Total 0.67 0.58 0.72 0.37 3.40 1.72 1.65 0.93

Instruments:Feed compressor 0.03 0.04 0.00 0.00 0.02 0.02 0.02 0.02Air compressor 0.14 0.19 0.08 0.15 0.06 0.20 0.10 0.18Syngas compressor 0.17 0.33 0.76 0.47 0.37 0.68 0.39 0.49Refrigerationcompressor 0.07 0.09 0.10 0.10 0.06 0.18 0.07 0.12Miscellaneous 0.64 0.51 0.47 0.70 0.60 0.79 0.58 0.66Total 1.05 1.16 1.41 1.42 1.11 1.87 1.16 1.48

continued



Other:Strikes 0.00 0.00 1.35 0.05 0.10 0.01 0.38 0.02Weather 0.66 0.18 0.04 0.03 1.19 0.05 0.69 0.10Operator error 0.01 0.18 0.12 0.21 0.08 0.13 0.10 0.17Catalyst 0.12 0.12 0.23 0.02 0.42 0.08 0.25 0.08Miscellaneous avoidable 0.24 0.03 0.16 0.09 0.40 0.38 0.28 0.17Miscellaneous unavoidable 0.05 0.34 0.03 0.01 1.24 0.13 0.47 0.18Total 1.17 0.85 1.93 0.41 3.43 0.78 2.17 0.71

Feedstock/market curtailment:Feedstock curtailment 0.80 0.14 0.55 0.08 19.97 0.74 7.56 0.34Inventory control 45.37 0.34 8.69 0.07 15.16 0.23 25.21 0.23Total 46.17 0.48 9.24 0.15 35.13 0.97 32.77 0.57

Grand total 49.06 3.07 13.30 2.35 43.07 5.34 37.75 3.69

a DT, downtime (days/plant-year); ID±FD, induced draft-forced draft; SD, shut-downs (shut-downs/plant-year).

Table 2.28 Fires in ammonia plants (after G.P. Williams, Hoehing and Byington, 1987) (Courtesy of the AmericanInstitute of Chemical Engineers)

1973±76 1977±81 1981±85

A No. of plant firesNo. of plants having no fires 2 22 41No. of plants having fires 27 74 95No. of fires 125 257 520Frequency of fires (fires/month) 11.1 14.6 12.2

B Classification of fires (%)Flange 36 32 31Valve packing 8 4 8Oil leaks 20 29 19Transfer header 7 ± 1Piping 10 9 11Electrical 2 3 3Miscellaneous 17 23 27

Table 2.29 Trend in the number of major accidents in UK, Europe and world-wide (after Keller and Wilson, 1991)

1970±79 1980±87 1970±87No. offatalities Europe World-wide Europe World-wide UK Europe World-wide

A Number of accidents5-10 12 53 6 40 3 18 9310-100 10 45 5 30 2 15 75100-102 2 3 0 2 0 2 5102-103 0 0 0 1 0 0 1

B Frequency of accidents (accidents/year)

5-10 1.2 5.3 0.75 5.010-100 1.0 4.5 0.63 3.8100-102 0.2 0.3 0 0.25102-103 0 0 0 0.13


2.10 Trend of injuries

The long-term trend of injury rates in the processindustry is downwards. The trend in the UK may beseen in Table 2.6, which shows that between 1970±74and 1987±90 the fatal accident rate for the chemical andallied industries fell from 4.3 to 1.2. However, as Table2.4 shows, the actual number of fatalities in this industryis small. Consequently, one large accident would have asignificant effect on the figures, even if its effect wereabsorbed over quite a long period such as 10 years.

Evidence is available that the efforts devoted to safetyand loss prevention by some companies have borne fruit.Figure 2.8 Hawksley (1984), shows the trend of the fatalaccident rate in ICI over the period 1960±82. The data

represent the 5-year moving average. They show thatparticular success was achieved in reducing the fatalaccidents associated with the process risks, the reductionfactor being about 15. The success achieved by certainUS companies in reducing the lost time injury rate(LTIR) is illustrated in Figure 2.9 (Brian, 1988). TheLTIR is the percentage of workers in the organizationwho, in a given year, suffer an injury so severe that itcauses the worker to lose some work days. In one casethe reduction factor is 280.

The trend in multiple fatality accidents has beenstudied by Keller and Wilson (1991), who obtained theresults given in Table 2.29. The table shows a broadlystable situation.

2.11 Trend of Losses

There have been a number of studies addressing thequestion of whether the number of major accidents inthe chemical and oil industries is increasing. Early workon these lines was done by V.C. Marshall (1975c) andKletz and Turner (1979). The insurers Marsh andMcLennan (M&M) publish periodically a list of the 100largest losses in the chemical and oil industries world-wide over a running 30-year period, (e.g. Garrison,1988b; Mahoney, 1990; Marsh and McLennan, 1992).The 1987 edition contains the analysis shown in Table2.30. This indicates a trend which is rising up to 1986.

A further review of loss trends is that given by Crook(1994, LPB 115). He comments that the M&M datasuggests that until 1989 losses were doubling eachdecade. He gives further data from a study drawing onthe Lloyds Weekly Casualty Reports (LWCRs). Thefrequency for the incidents which he considers, hasrisen from some 28/year in 1971 to some 103/year in1991.

A particular type of incident which has receivedindividual attention is the vapour cloud explosion


Figure 2.8 Trend of the fatal accident rate in ICI,1960�82 (Hawksley, 1984). The number of fatalaccidents is given as the number in 108 working hoursor the number in 1000 men in a working lifetimeexpressed as a 5-year moving average

Figure 2.9 Trend of lost-time injury rate in some US companies, Chemical Manufacturers Association 1974�85(Brian, 1988) (Courtesy of the Institution of Chemical Engineers)


(VCE), formerly generally referred to as unconfinedvapour cloud explosion (UVCE). In the UK the VCE atFlixborough resulted in a heightened awareness. A study

at that time by V.C. Marshall (1975c) showed that thenumber of VCEs world-wide was indeed on an apparentlyincreasing trend. Similarly, in his book on VCEs, Gugan(1979) stated: `The trends in frequency, proportion ofincidents producing blast and fatalities in UVCEs are allupwards.' This trend appears now to have been arrested.Industrial Risk Insurers (IRI) publish a periodic surveyof VCE incidents. The number of VCEs obtained from thissurvey is given in Table 2.31.

2.12 Case Histories

The generalized statistics may be supplemented byindividual case histories. These are treated in Appendix1, which describes the various sources and gives specificcase histories. The sources include: the accident reportsof the Health and Safety Executive (HSE) and theNational Transportation Safety Board (NTSB); the collec-tions of the Manufacturing Chemists Association (MCA)and the American Petroleum Institute (API); the periodicreviews of insurers, such as the 100 Large Losses (Marshand McLennan); the NFPA Quarterly of the National FireProtection Association (NFPA), the Chemical SafetySummary of the Chemical Industry Safety and HealthCouncil (CISHC) and its successor, the ChemicalIndustries Association (CIA), and the Loss PreventionBulletin of the Institution of Chemical Engineers(IChemE), all of which publish case histories.

Accounts of major accidents are given in: Appendices 2-6on Flixborough, Seveso, Mexico City, Bhopal andPasadena, respectively; Appendix 16 on San Carlos;Appendix 19 on Piper Alpha; and Appendices 21 and 22on Three Mile Island and Chernobyl.


Table 2.30 The 100 largest losses in the chemical andoil industries world-wide (after Marsh and MacLennan,1987)

Period No. of losses Average loss(US$m.)

1957±66 15 28.51967±76 29 38.21977±86 56 36.6

Table 2.31 Trend in number of vapour cloudexplosions world-wide (after Lenoir and Davenport,1992)

Period No. of VCEs

1930±34 01935±39 11940±44 11945±49 21950±54 51955±59 81960±64 111965±69 121970±74 201975±79 221980±84 81985±89 151990±July 1991 7

15478_02

Documents