Chapter 1.

Introduction

Safety is a common denominator across all aspects of life; hence knowledge should always be
shared. It is not a matter for industry—it is a matter for humanity.

—Doug Bourne

We believe that the traits required to achieve excellence in safety are the same as those required
to achieve outstanding results in all other aspects of our business.

—Ralph Herbert, Vice President of Engineering, ExxonMobil

The learning objectives for this chapter are:

1. Understand the common definitions used for process safety.

2. Explore myths about process safety.
3. Identify components of a safety culture.
4. Discuss individual risk, societal risk, and risk populations.
5. Distinguish between voluntary risk and involuntary risk.
6. Describe safety metrics.
7. Summarize accident and loss statistics.
8. Create a risk tolerance/acceptance and risk matrix.
9. Discuss codes, standards, and regulations related to process safety.
10. Explore safeguards related to chemical process safety.
11. Explain risk-based process safety (RBPS).
12. Describe inherently safer design.
13. Describe the Bhopal, India, tragedy.

The Aluminum Company of America—otherwise known as Alcoa—was founded in 1888 by

Charles Martin, who discovered an affordable way to produce aluminum via electrolysis. The
company is headquartered in Pittsburgh, Pennsylvania. In 1889, Alcoa developed the first
aluminum tea kettle; in 1910, it introduced aluminum foil. Today, Alcoa is the largest supplier of
aluminum in the world.

In 1987, however, Alcoa was faltering. Its revenues and profits had fallen, several product
lines had failed, and the company had large inventories of unsold product. Many investors
considered Alcoa to be a “Rust Belt” company, associating it with the failing steel companies
located in Pittsburgh and elsewhere in the United States. In addition, both the employees and
unions were unhappy with the company.

As is the case with most companies facing this kind of situation, Alcoa’s board of directors
decided to hire a new chief executive officer (CEO). They tapped Paul O’Neill, formerly of
International Paper, to lead the company.

In October 1987, O’Neill held his first press conference in a swanky hotel in Manhattan,
attended by members of the media, investors, and investment managers. All attendees expected
O’Neill to announce a new financial management strategy for the company. Instead, O’Neill
came to the podium and said, “I want to talk to you about worker safety. I intend to make Alcoa
the safest company in America. I intend to go to zero injuries.” At this time, Alcoa already had
an industry leading safety program.

One investment manager ran out of the press conference declaring, “The board put a crazy
hippie in charge and he’s going to kill the company! I called my clients and told them to sell
their stock!”

But six months later, a tragedy occurred. A young employee in an Arizona plant jumped
over a yellow safety wall to repair a piece of equipment and was crushed when the equipment
was unexpectedly activated. O’Neill immediately called an emergency meeting of the plant’s
executives. He stated bluntly: “We killed this man. It’s my failure of leadership. I caused his
death. And it’s the failure of all of you in the chain of command.”

O’Neill sent a note to all workers telling them to call him at home if managers didn’t
follow up on safety suggestions. He received lots of calls about safety, but he also heard a lot of
suggestions for other improvements—many of which would substantially reduce costs.
 What were the results of O’Neill’s safety leadership? In 1986, Alcoa recorded $264
million in net income on sales of $4.6 billion. When O’Neill retired at the end of 2000, Alcoa
boasted record profits of $1.5 billion on sales of $22.9 billion. Alcoa’s lost work days rate per
100 employees dropped from 1.86 to 0.2 by the end of O’Neill’s tenure. In March 2016, that rate
was a mere 0.055.

When asked later about the secret to his success, O’Neill stated, “I knew I had to transform
Alcoa. But you can’t order people to change. So I decided I was going to start by focusing on
one thing. If I could start disrupting the habits around one thing, it would spread throughout the
entire company.” O’Neill’s important realization was that safety performance and economic
performance were, in his words, “glued together”—with outstanding safety performance
resulting in outstanding economic performance. When O’Neill started at Alcoa, he wasn’t sure if
this approach would work perfectly, but it did.

Safety, in general, is defined as “a strategy for accident prevention.” Process safety is

safety applied to processes, including chemical processes. Table 1-1 provides a more complete
definition of process safety, along with several important definitions provided by the American
Institute for Chemical Engineers (AICHE) Center for Chemical Process Safety (CCPS). Another
common term used in the safety realm is loss prevention, which is defined as the prevention of
incidents that cause losses due to death, injury, damage to the environment, or even loss of
production or inventory.

Table 1-1 AICHE Center for Chemical Process Safety Definitions Related to Process Safety

Term Definition Example

Accident An unplanned event or sequence of events that A leak in a

results in an undesirable consequence. The scope pressurized
of the accident description is arbitrary. vessel
containing 500
kg of
 ammonia.

Conditional A fractional probability that a particular event The

modifier occurs. probability of
a flammable
release being
ignited is 0.10.

Consequence A measure of the expected effects of a specific A 10 kg/s

incident outcome case. ammonia leak
results in a
toxic cloud
downwind.

Enabling condition A fractional probability that a particular The

circumstance exists. It accounts for the time-at- probability of
risk. the ambient
temperature
being low
enough to
cause a water
line to freeze is
0.10.

Hazard An inherent chemical or physical characteristic A pressurized

that has the potential for causing damage to tank
people, the environment, or property. containing 500
kg of
ammonia.

Hazard Determination of the mechanisms causing a A Hazard and

evaluation/analysis potential incident and evaluation of the incident Operability
outcomes or consequences. (HAZOP)
study was
completed on
the distillation
column.

Hazard Identification of material, process, and plant The chemicals

identification characteristics that can produce undesirable in the process
consequences through the occurrence of an are toxic and
incident. flammable
hazards.

Impact A measure of the ultimate loss and harm of an A 10 kg/s

incident. ammonia leak
produces a
downwind
toxic vapor
cloud resulting
in local
evacuations,
an emergency
response, plant
downtime, and
loss of
community
support.

Incident The basic description of an event or series of A plant

events,resulting in one or more undesirable incident
 consequences, such as harm to people, damage to involves a leak
the environment, or asset/business losses. In of 10 kg/s of
general, it is caused by loss of containment or ammonia
control of material or energy. For chemicals producing a
plants, this includes fires/explosions and releases toxic vapor
of toxic or harmful substances. Not all events cloud.
propagate to an incident.

Incident outcome The description of the physical manifestation of A leak in an

the incident. This could include toxic release, ammonia
fire, explosion, and so on. pipeline results
in a toxic
release.

Incident outcome An incident with more than one outcome. A chemical

case release results
in both a toxic
release and an
environmental
impact.

Individual risk The risk to a person in the vicinity of a hazard. The likelihood
This includes the nature of the injury to the of operator
individual, the likelihood of the injury occurring, burns due to a
and the time period over which the injury might butane leak is
occur. estimated at
once in 5
years.

Likelihood A measure of the expected probability or The frequency

 frequency of occurrence of an event. For of an operator
chemical plants, the frequency is most commonly error for the
used. process is
estimated at
once per
month.

Process safety A disciplined framework for managing the After the

integrity of operating systems and processes incident, the
handling hazardous substances by applying good company made
design principles, engineering, and operating a considerable
practices. It deals with the prevention and control effort to
of incidents that have the potential to release improve
hazardous materials or energy. Such incidents corporate
can cause toxic effects, fires, or explosions, and process safety.
could ultimately result in serious injuries,
property damage, lost production, and
environmental impact.

Risk A measure of human injury, environmental The major risk

damage, or economic loss in terms of both the in the process
incident likelihood and the magnitude of the loss was a chemical
or injury. spill into the
adjacent river
with
environmental
damage.

Risk analysis Quantitatively combining risk estimates from a A detailed

variety of scenarios using engineering evaluation fault tree and
 and mathematical techniques to arrive at an event tree
overall risk estimate. analysis of the
process
resulted in an
overall risk
estimate.

Risk assessment Applying the results of a risk analysis to make The plant
decisions. added
additional fire
protection after
completion of
the risk
analysis.

Risk tolerance The maximum willingness of a company, and The plant

society as a whole, to live with a risk to secure decided after
the resulting benefits. completion of
the risk
analysis that
the risk is
below their
acceptable risk
criteria.

Safeguard Design features, equipment, procedures, and An additional

other resources in place to decrease the interlock was
probability of an initiating cause or mitigate the added to
severity of a loss impact. prevent
overflow of
 the storage
vessel.

Safety culture The common set of values, behaviors, and norms After the
at all levels in a facility or in the wider incident, the
organization that affect process safety. company
decided to
improve the
corporate
safety culture.

Scenario A detailed description of an unplanned event or A forklift

incident sequence that results in a loss event and impacts an
its associated impacts. The scope of a scenario is ammonia
arbitrary. pipeline,
resulting in an
ammonia leak
that forms a
vapor cloud
downwind.

Societal risk A measure of risk to a group of people. It is most The societal

often expressed in terms of the frequency risk to the
distribution of multiple casualty events. plant’s
adjacent
community is
deemed
unacceptable.

Source: Adapted from AICHE/CCPS online glossary.

[Link] Accessed July 2018; and AICHE/CCPS,
Guidelines for Chemical Process Quantitative Risk Analysis, 2nd ed. (New York, NY: American
Institute for Chemical Engineers, 2000).

A hazard, in general, is anything that can cause an accident. Table 1-1 provides a more
precise definition for a hazard that is more suitable for process safety usage. Hazards can arise
due to materials, energy, physical situations, equipment design, and even procedures. In addition,
hazards may be continuously present or intermittent. For instance, electricity in a room
represents a continuous hazard to the room occupants. An electrical cord run across the floor of a
lecture hall is also a physical tripping hazard that may not be present all the time. Note that
something needs to occur for the hazard to result in an accident.

An accident is, in general, an undesirable consequence that occurs with an activity. A

process safety incident has a more specific definition, being limited to an accident that occurs in
a process or, more specifically, in a chemical plant. It includes undesirable outcomes, such as
harm to people, damage to the environment, or asset/business losses. In general, a chemical plant
incident is caused by loss of containment of chemicals or control of material or energy. An
example of an incident would be a leak of ammonia from the connecting pipeline to a
pressurized ammonia tank.

Typical hazards that occur in chemical plants include chemicals that are toxic, flammable,
or reactive; high and low pressures and temperatures; and hazards due to the process design,
maintenance, operations, control, and many other factors. An example of a hazard would be a
pressurized tank containing 1000 kg of ammonia.

Hazard analysis/evaluation includes the identification of the hazard as well as the

determination of how that hazard could result in a consequence. An example of a hazard analysis
would be the identification of ammonia in a pressurized tank as a hazard and the identification of
a leak in the connecting pipe due to corrosion as a possible incident. Estimation of the downwind
airborne concentrations of ammonia would provide information on the consequences of such an
incident.
 The more information and knowledge one has about a process, the more thorough and
valuable the hazard analysis/evaluation will be. Key process information required for chemical
plant hazard analysis/evaluation includes the following items:

1. Chemical-related properties, including hazardous properties, physical properties, and more

2. Process conditions, including temperature and pressure, flow rates, concentrations, and other
factors
3. Equipment design parameters, including equipment capacity, operating limits for temperature
and pressure, materials of construction, and pipe wall thicknesses, among others
4. Site and plant layout, including equipment spacing, control room location, and other
considerations
5. Procedures and policies, including startup, operating, shutdown, maintenance procedures, and
others
6. Location and nature of adjacent communities and sensitive locations, such as schools

Other information might also be important depending on the particular process. The quality of
any hazard analysis/evaluation is directly related to the quality of the information available to the
analysis team.

Risk is another important definition in the process safety arena. Risk is a function of both
likelihood and consequence, where likelihood considers either probability or frequency. It is
essential to include both likelihood and consequence in the assessment of risk. As an example,
consider the risk assessment for seat belt usage in automobiles. Many people argue against seat
belt usage by noting that the likelihood of an accident is small—many people drive their entire
lifetime without ever having an accident. However, seat belts are worn entirely to reduce the
consequences of an accident and have no effect on the likelihood.

Risk analysis involves a more detailed mathematical analysis to combine the consequences
and likelihood from multiple hazards. By comparison, risk assessment involves the evaluation of
the risk analysis so as to make decisions—for example, decisions about which chemicals to use,
the design of the plant, materials of construction, operating conditions, and so on.
1-1 Engineering Ethics

The AICHE expects all of its members, including student members, to exhibit professional
conduct, as defined in its Code of Ethics for Engineers from the National Society of Professional
Engineers. Every AICHE applicant must attest to knowledge of the Code of Ethics and
willingness to comply with it when signing his or her membership application. As shown in
Table 1-2, the first item in the Code of Ethics states that the “safety, health, and welfare of the
public” must be held “paramount in the performance of their professional duties.” Item 2 is also
related to process safety—chemical engineers have a responsibility to report activities that will
“adversely affect the present and future health or safety of their colleagues and the public.”
Engineers have a responsibility to themselves, fellow workers, family, community, and the
engineering profession.

Table 1-2 American Institute of Chemical Engineers’ Code of Professional Ethics

Members of the American Institute of Chemical Engineers shall uphold and advance the
integrity, honor, and dignity of the engineering profession by: being honest and impartial and
serving with fidelity their employers, their clients, and the public; striving to increase the
competence and prestige of the engineering profession; and using their knowledge and skill
for the enhancement of human welfare. To achieve these goals, members shall:

1. Hold paramount the safety, health, and welfare of the public and protect the environment
in performance of their professional duties.
2. Formally advise their employers or clients (and consider further disclosure, if warranted)
if they perceive that a consequence of their duties will adversely affect the present or
future health or safety of their colleagues or the public.
3. Accept responsibility for their actions, seek and heed critical review of their work, and
offer objective criticism of the work of others.
4. Issue statements or present information only in an objective and truthful manner.
5. Act in professional matters for each employer or client as faithful agents or trustees,
avoiding conflicts of interest and never breaching confidentiality.
 6. Treat all colleagues and coworkers fairly and respectfully, recognizing their unique
contributions and capabilities by fostering an environment of equity, diversity, and
inclusion.
7. Perform professional services only in areas of their competence.
8. Build their professional reputations on the merits of their services.
9. Continue their professional development throughout their careers, and provide
opportunities for the professional development of those under their supervision.
10. Never tolerate harassment.
11. Conduct themselves in a fair, honorable, and respectful manner.

Approved by the AICHE Board in November 2015.

1-2 Myths about Process Safety

A number of myths about process safety have emerged over the years. It is important to
understand why these myths are false, as they can lead to disregard for key tenets of process
safety.

Myth 1: Process safety costs a lot of money and has a negative impact on the company’s
bottom line.

The story of Alcoa presented earlier in this chapter readily dispels Myth 1. Although safety
programs do cost money and there may be startup costs, the reduction in costly accidents and the
improvements in all business aspects results in even greater cost savings and a net improvement
in profits.

Myth 2: Process safety is the same as personal or even laboratory safety.

Figure 1-1 falsifies Myth 2 by illustrating the difference between personal and process safety.
Personal safety—which includes laboratory safety—applies to accidents involving individuals,
such as slips and falls, cuts, and other injuries. These events tend to have a higher frequency but
 lower consequences. In contrast, process safety applies to events with a lower frequency but
higher consequences. The process safety and personal/lab safety domains are likely to overlap to
some extent, as shown in Figure 1-1.

Figure 1-1 Personal safety versus process safety. Personal safety consists of more frequent, but
lower consequence incidents. (Source: Dow Chemical Faculty Workshop, June 2017, AICHE.)

Myth 3: Process safety is no more than following rules and regulations.

Myth 3 is falsified by Table 1-3, which shows the hierarchy of safety programs. The hierarchy
ranges from level 0 (lowest level) to level 5 (highest level). The safety program must work its
way through the levels from the bottom to the top: No levels can be skipped. Thus, level 5
includes all of the levels below it:

consists of no safety program and maybe even disdain for safety. Such a program is destined to
have continuous accidents, maybe even accidents that are repeated. No improvement is ever
achieved.
is a safety program that reacts to accidents as they occur. Accidents do result in changes, but only
on a reactive basis, rather than the organization taking a proactive stance. Accidents continue to
occur, although specific accidents are not likely to be repeated.

is a safety program that consists of complying with rules and regulations. Rules and regulations
can never be complete, however, and can never handle all situations. Regulations have legal
authority and generally set a minimum standard for industrial operations.

introduces management systems to assess hazards and provide procedures to manage hazards. A
variety of management systems can be used to achieve this level, including job safety assessment
(JSA), lock-out/tag-out (LOTO), management of change (MOC), and other means to control
hazards during operations. Written management systems provide documentation to train
operators and others and to ensure consistency in operating practices.

Table 1-3 Hierarchy of Safety Programs

Highest 5: Adapting: Safety is a core value of the organization and a primary driver for a
successful enterprise.

4: Performance: Monitoring using statistics to drive continuous improvement.

3: Management systems: Based on job safety assessment (JSA), lock-out/tag-out (LOTO),
or another approach.
2: Complying: Focuses on adhering to rules and regulations.
1: Reacting: To accidents as they occur.

Lowest 0: No safety—maybe even disdain for safety.

Note: The hierarchy must be worked from bottom to top without skipping any levels.

uses monitoring to obtain statistics on how well the safety program is performing. The
performance monitoring identifies problems and corrects them. For instance, performance
monitoring might indicate a large number of ladder incidents, which might be resolved by
additional training in ladder safety.

is the highest level, at which the safety program is dynamic and adapting. Safety is a core value
for everything that is done and the primary driving force for a successful enterprise.

The hierarchy of safety programs shown in Table 1-3 addresses Myth 3, since rules and
regulations are only at level 2. Note that the safety program developed at Alcoa was at level 5—
the level that most chemical companies must achieve to have an effective safety program.

Myth 4: Process safety is a soft science—no more than hard hats or safety shoes—not
engineering science.

Myth 4 is easily falsified by examining the contents of this text—notice the large number of
equations. Process safety is based on engineering science and is just as fundamentally rigorous as
any other academic courses in chemical engineering, relying heavily on other core concepts such
as mass and energy balances, thermodynamics, fluid flow, and reaction engineering, among
others.

Myth 5: Process safety applies only to the petrochemical industry.

Myth 5 is falsified by realizing that all companies require process safety, including warehouses,
foundries, food processing, power plants, and so forth. For example, a leading ice cream
manufacturer has a process safety vice president due to the large quantities of ammonia used in
refrigeration.

Myth 6: Industry should train graduates in process safety; this topic should not be a part of
the undergraduate engineering curriculum.

Myth 6, which deals with the training of professionals in safety, was debunked long ago. As
early as 1918, L. DeBlois, Dupont Safety Manager, stated:

[S]safety engineering, with its interests in design, equipment, organization, supervision, and
education … bears as well a very definite and important relation to all other branches of
engineering. This relation is so close, and its need so urgent, that I am convinced that some
instruction in the fundamentals of safety engineering should be given a place in the training of
every young engineer. He should be taught to think in terms of safety as he now thinks in terms of
efficiency. Conservation of life should surely not be rated below the conservation of energy. Yet,
few of our technical schools and universities offer instruction in this subject, and the graduates
go out to their profession with only vague surmises on “what all this talk on safety is about.”

Companies that hire chemical engineering graduates believe that including process safety
in the undergraduate curriculum has enormous added-value, particularly in helping companies
achieve level 5 in the safety hierarchy (see Table 1-3). If a graduate is hired by a smaller
company, it is possible that the undergraduate curriculum is the only place where the individual
will receive instruction in process safety topics. All chemical engineering undergraduates need
process safety knowledge, whether they work for major chemical companies, refineries, small
chemical companies, government labs and institutes, warehouses, ice cream companies, or even
academia.

Myth 7: Process safety does not include product safety.

Myth 7 is falsified by realizing that all companies are responsible for their products, no matter
who purchases the product and how it is used. All companies, including chemical companies,
must ensure that their products are shipped safely and are used safely by whoever purchases the
product.

1-3 Safety Culture

A safety culture is an essential part of any safety program, including process safety, laboratory
safety, personal safety, or any safety program. Table 1-1 provides the CCPS’s definition of
process safety culture. Almost all accidents, whether large or small, can be attributed to a failure
of safety culture, since the safety culture is such an essential and over-reaching part of any safety
program.

Klein and Vaughen1 provide a very extensive discussion of safety culture. They define
safety culture as “the normal way things are done at a facility, company, or organization,
reflecting expected organizational values, beliefs, and behaviors, that set the priority,
commitment and resource levels for safety programs and performance.” The same authors also
provide a list of essential features for safety culture, as derived from the CCPS sources; these
features are shown in Table 1-4.

1James A. Klein and Bruce K. Vaughen. Process Safety: Key Concepts and Practical
Approaches. Boca Raton, FL: CRC Press, Taylor & Francis Group, 2017.

Mannan et al.2 found the following important elements of a best-in-class safety program:
leadership; culture and values; goals, policies, and initiative; organization and structure;
employee engagement and behaviors; resource allocation and performance management;
systems, standards, and processes; metrics and reporting; continuous learning; and verification
and auditing. These elements are similar to those provided in Table 1-4.

2M. S. Mannan, R. A. Mentzer, and J. Zhang. “Framework for Creating a Best-in-Class

Safety Culture,” Journal of Loss Prevention in the Process Industries, 26, no. 6 (2013): 1423–
1432.

Table 1-4 Essential Features of Safety Culture

Establish process safety as a core value.

Core values are deeply held beliefs that are beyond compromise.
Establish process safety as a core value in vision and mission statements, by clear and
constant communication.
Implement cultural activities that reinforce desired beliefs and behaviors, such as
beginning all meetings with a safety moment.
Provide strong leadership.
Strong process safety leadership must be based on:
Understanding and valuing process safety.
Sharing personal commitment with others by displaying desired behaviors.
Providing resources.
Involving and supporting safety personnel.
Consistently considering risk management in day-to-day decision making.
Establish and enforce high standards of performance.
Provide clear and consistent expectations, including in annual individual performance
reviews.
Follow safety systems and operating procedures without tolerating intentional shortcuts or
other violations of requirements.
Document the process safety culture emphasis and approach.
Document safety culture core values, expectations, responsibilities, and accountabilities,
including mechanisms for periodically evaluating and sustaining a strong culture.
Maintain a sense of vulnerability.
Provide systems and training to:
Develop awareness and respect for process hazards and potential process incidents to
prevent complacency.
Ensure appropriate sensitivity to operations, including recognition of possible warning
signs.
Ensure effective incident investigations.
Provide records of historical incidents.
Empower individuals to successfully fulfill their responsibilities.
Ensure personnel are trained in all aspects of their roles.
Provide personnel with appropriate resources so they can complete their work correctly
and safely.
Empower personnel to stop the work if they are concerned about safety.
Defer to expertise.
Create leadership positions where knowledgeable safety personnel have access to and
credible input for decision-making processes.
Involve other safety professionals as appropriate.
 Ensure open and effective communications.
Communicate consistently and clearly on process safety goals, activities, and
accomplishments.
Provide systems for reporting of safety-related issues requiring timely response.
Establish a questioning/learning environment.
Provide risk management systems to:
Identify process hazards and prevent process incidents.
Include mechanisms for learning from experience.
Ensure input from all personnel.
Maintain critical knowledge.
Foster mutual trust.
Create an environment based on consistent management principles where personnel are
comfortable:
Participating in activities.
Communicating with leadership and with each other honestly.
Reporting mistakes.
Making decisions without fear.
Provide timely response to process safety issues and concerns.
Provide systems for:
Reporting process safety concerns.
Following up and completing action items in a timely manner.
Communicating action resolutions to demonstrate consistent application of process safety
principles to avoid credibility problems.
Provide continuous monitoring of performance.
Develop key performance indicators for process safety and safety culture.
Periodically review and evaluate performance indicators to identify continuous
improvement opportunities.
Share results with affected personnel.

Sources: AICHE Center for Chemical Process Safety. Guidelines for Risk Based Process Safety
(New York, NY: Wiley/AICHE, 2007); W. L. Frank. “Process Safety Culture in the CCPS Risk
Based Process Safety Model.” Process Safety Progress, 26 (2007): 203–208; James A. Klein and
Bruce K. Vaughen. Process Safety: Key Concepts and Practical Approaches (Boca Raton, FL:
CRC Press, Taylor & Francis Group, 2017).

In November 2010, Rex Tillerson, Chairman and CEO of ExxonMobil, testified before the
National Commission on the disastrous BP Deepwater oil spill. He stated:

A commitment to safety therefore should not be a priority but a value—a value that shapes
decision making all the time, at every level. Every company desires safe operations—but the
challenge is to translate this desire into action. The answer is not found only in written rules,
standards, and procedures. While these are important and necessary, they alone are not enough.
The answer is ultimately found in a company’s culture—the unwritten standards and norms that
shape mindsets, attitudes, and behaviors. Companies must develop a culture in which the value
of safety is embedded in every level of the workforce, reinforced at every turn, and upheld above
all other considerations. … [A] culture of safety has to be born within the organization. You
cannot buy culture. You have to make it yourself. … [M]ake no mistake: Creating a strong
sustainable culture is a long process.

1-4 Individual Risk, Societal Risk, and Risk Populations

Risk can be addressed from many different angles. With individual risk, one person is exposed to
one or more hazards, as shown in Figure 1-2. Individual risk calculations are normally performed
when considering a plant employee exposed to plant hazards. In contrast, with societal risk, a
group of people is exposed to one or more hazards. Societal risk calculations are normally
performed when considering the risks to a community surrounding a chemical plant and exposed
to multiple plant hazards. Methods to calculate and display individual and societal risk are
discussed in depth in Chapter 12, “Risk Assessment.”
Figure 1-2 Individual versus societal risk.

For every accident, there are potentially many people and different populations at risk—
the so-called risk populations. For an incident in a chemical plant, for example, risk populations
would include the workers in the plant, workers in adjacent plants, and the people living nearby
in the surrounding community since they may be seriously affected by a plant incident. The plant
and community will likely also suffer physical damage, leading to a financial impact. The
company’s stockholders are also at risk since the company’s reputation will be negatively
impacted and its stock value will decline. In addition, the insurance companies for the plant and
the community will suffer losses and are another risk population. The entire chemical industry, in
general, will be at risk as well, since its reputation will be diminished. Other risk populations are
also possible.

The primary risk population can be defined as those who suffer immediate injury or death.

1-5 Voluntary and Involuntary Risk

Chemical plant employees are aware of and trained to handle the risks that are found in their
work environment—this is a legal requirement in the United States and most countries
worldwide. In contrast, people in the surrounding community may not be fully aware of these
risks or may not understand the risks and the associated probabilities and consequences. This
difference in understanding can arise because the plant may not have properly communicated
these risks to the community, new risks may have been introduced in the plant over time, or
people may have moved into the community without any understanding of the risk.

People are more willing to accept risks if these are carefully explained to them—including
the probabilities and potential consequences. Certainly, most car drivers understand the risks of
driving a car. However, people become outraged when an industrial accident occurs that involves
risks of which they were not fully aware or risks with higher actual likelihoods and/or
consequences than perceived.

As an example, suppose you purchase a house for your family. Ten years later, you learn
that the house was built on top of a toxic waste dump. The consequences are the adverse effects
to the health of your family and a dramatic reduction in the value of your house. Certainly, you
would be outraged.

A voluntary risk is “risk that is consciously tolerated by someone seeking to obtain the
benefits of the activity that poses the risk.”3 An example of a voluntary risk is driving or riding
in a car: Most people are aware that automobile accidents occur and accept this risk. An
involuntary risk is “risk that is imposed on someone who does not directly benefit from the
activity that poses the risk.”4 Examples of involuntary risk include riding an airplane, visiting a
mall, and walking down the street. Living near a chemical plant or other manufacturing facility is
also an involuntary risk. Individuals are typically willing to accept more voluntary risk (by a
factor of 10 or more) versus involuntary risk.

3AICHE/CCPS glossary, accessed December 2017.

4AICHE/CCPS glossary, accessed December 2017.

A community outreach program is a very important part of any process safety program for
a company and plant site. The plant officials must carefully explain the risks—including both the
probabilities and the consequences—to any community that may be impacted by these risks. This
effort is part of stakeholder outreach—where the set of stakeholders includes the employees,
contractors, neighboring communities, neighboring companies, suppliers, customers, company
stockholders, and other possible communities. The public considers chemical plants to pose a
higher risk than is actually the case, so chemical plants must make a better effort to communicate
these risks.

1-6 Safety Metrics

A very important part of any safety program is measuring the safety program effectiveness. This
is done using safety metrics. Each company must identify metrics that are effective for its
operations. These metrics are not universal, will change between companies and even plant sites,
and will change with time.

Metrics are usually measured over a period of time and at multiple plant sites to identify
any important changes or trends. Adverse changes in the metrics will trigger a management
review, with resulting recommended changes for improvement.

Figure 1-3 shows the accident pyramid demonstrating the relationship between various
levels of accidents based on severity. The severity level increases toward the top of the pyramid.
Accidents of lower severity occur more frequently. Indeed, for every fatality, there are orders of
magnitude more accidents of lesser magnitude and even more near misses. A near miss is an
accident with no consequences that might have resulted in a catastrophe if conditions had been
slightly different. Accidents of smaller magnitude and higher frequency, in particular near
misses, provide many opportunities to recognize problems and make improvements—and, one
hopes, to prevent more consequential accidents.
Figure 1-3 The accident pyramid showing the relationships between various levels of accidents.
Metrics near the top are more leading; metrics toward the bottom are more lagging.

The problem with the accident pyramid is that the items listed are all lagging indicators.
That is, the accident pyramid is based on incident outcome metrics derived after an accident or
near miss has already occurred. It would be preferable to have leading indicators—that is,
metrics that measure activities prior to the occurrence of an accident. Lagging metrics have
historically been used more often than leading metrics because they are easier to identify and
interpret, and typically must be reported to various regulators. By comparison, leading metrics
are more difficult to identify and interpret.

Table 1-5 lists examples of leading and lagging metrics suitable for a chemical plant. The
metrics at the top of Table 1-5 are leading indicators, while the ones at the bottom are lagging
indicators. Notice that process safety culture—a leading metric—is at the very top of the table,
while serious injuries and fatalities—lagging metrics—are at the bottom.

Table 1-5 Example Leading and Lagging Metrics for a Chemical Plant

Leading metrics - towards top of table

Process safety culture:
Number of monthly process safety suggestions
Response time for process safety suggestions to be addressed
Number of open recommendations
Process safety budget reduction
Number of meetings addressing process safety
Time to complete an incident investigation and issue a report
Attendance at required safety meetings
Signs of worker fatigue

Training:
Percentage of workers who require remedial training
Percentage of near-miss incidents with training root causes
Change in training budget
Number of workers with overdue training
Training sessions canceled or postponed

Operating procedures:
No system to gauge whether procedures have been followed
Number of operating procedures updated per year
Number of incident investigations that recommend changes to procedures
Percentage of procedures that are annotated in the field
Tolerance of failure to follow operating procedures
Fraction of operators who believe that procedures are current and accurate
Number of procedures that are past due for review
Operators appear unfamiliar with procedures or how to use them

Maintenance procedures:
Number of overdue maintenance tasks
Number of unplanned repair work orders each month
Work order backlog
Change in maintenance budget
Number of work orders that apply to equipment that no longer exists at the site
Number of maintenance employees who hold required certification
Number of management of change (MOC) requests
Follow-up time on recommended actions

Inspection frequency

Safety system demands

Inspections with results outside limits

Excursions on safe operating limits

Near misses

Number of incidents

Property damage

Community response actions

Loss of primary containment (LOPC) incidents

First aid incidents

Minor injuries

Serious injuries
 Fatalities

Lagging metrics - towards bottom of table

1-7 Accident and Loss Statistics

Accident statistics are one metric to determine the effectiveness of any safety program.
However, accident statistics are lagging indicators and are usually more indicative of personal
safety rather than process safety.

Several methods may be used to calculate accident and loss statistics. All of these methods
must be used carefully, because each method has strengths and weaknesses and no single method
is capable of measuring all of the required aspects. The methods most commonly used to
measure accident statistics are as follows:

Total number of fatalities or injuries/illnesses.

Fatality rate, or deaths per person per year
Fatal injury rate based on total hours or total workers
Incidence rate

All of these measures are lagging indicators, since they are tabulated after an accident has
occurred.

The U.S. Occupational Safety and Health Administration (OSHA; [Link]) has
legal authority over U.S. workplace safety. OSHA is responsible for ensuring that U.S. workers
are provided with a safe working environment. Many countries have government organizations
similar to OSHA.

All U.S. workplaces are required by law to report to OSHA all occupational deaths,
illnesses, and injuries. An injury includes medical treatment (other than first aid), loss of
consciousness, restriction of work or motion, or injuries causing a transfer to another job. These
accident statistics are tabulated by the U.S. Bureau of Labor Statistics (BLS; [Link]) and
are made available to the public—albeit usually more than a year after the calendar year the data
were collected. Table 1-6 provides sources for accident statistics; please refer to these sources for
more updated statistics than presented here.

Table 1-6 Sources of Accident Statistics

United States

1. U.S. Department of Labor, Bureau of Labor Statistics (BLS), Washington, DC

[Link]/iif/
This is an excellent, free source on occupational accident statistics in the United States.
Data are typically two years behind.
2. National Safety Council (NSC), Itasca, IL [Link]
Injury Facts—an excellent source of information on work and nonwork injuries in the
United States.
The National Safety Council is a nonprofit organization dedicated to preventing accidents
at work and at home.
3. The 100 Largest Losses 1974—2015, 24th ed., Marsh and McLennen Companies, March
2016
This provides an excellent analysis of worldwide accidents in the hydrocarbon industry,
including a brief description and financial loss for each accident.

United Kingdom

Health and Safety Executive (HSE)

[Link]/statistics
This is the equivalent of OSHA in the United Kingdom.

The total number of fatalities is most commonly used as a lagging indicator, but does not
 take into account the number of people working in a particular occupation. For instance, many
more auto-related fatalities occur in a big state like Texas than in a small state like Vermont.

The total number of injuries/illnesses is also dependent on the number of workers.

However, it has an additional problem since it requires a definition of an injury or illness.

The fatality rate, or deaths per person per year, is independent of the number of hours
exposed to the hazard and reports only the fatalities expected per person per year. The exposed
population may be carefully defined to ensure that it includes only those exposed to the hazard.
This approach is useful for performing calculations on the general population. Fatality rate is
calculated as follows:

Number of fatalities per year

Fatality rate = (1-1)
Total number of people in applicable population

The fatal injury rate is defined in two different ways. The first approach is in terms of the
number of fatalities per 100,000 full-time equivalent workers employed. Thus, the worker-based
fatal injury rate is calculated using the following equation:

Total number of fatalites during period

Worker-based fatal injury rate = × 100, 000 workers
Total number of employees

A similar approach can be applied to a general population. This fatal injury rate is defined
in terms of 100,000 people and applied to a general, exposed population. It is calculated using
the following equation:

Total number of deaths during period

Deaths per 100, 000 people = × 100, 000 people (1-3
Total people in exposed population

A work-related fatal injury rate can be defined in terms of the total hours worked by
100,000 full-time equivalent workers. For 100,000 workers working 40 hours per week and 50
weeks per year, this results in (100,000 workers × 40 hours/week × 50 weeks/year) =
200,000,000 hours. Thus, the hours-based fatal injury rate is defined by the following equation:

Total number of fatalities during period

Hours-based fatal injury rate = × 200, 000, 000 hours
Total hours worked by all employees
 Hours-based fatal injury rates (Equation 1-4) are generally considered more applicable
than worker-based fatal injury rates (Equation 1-2). Hours-based rates use the total number of
employees at work and the total hours each employee works. Worker-based rates will be similar
for groups of workers who tend to work full time, but differences will be observed for worker
groups who tend to include a high percentage of part-time workers.

The incidence rate is based on the cases per 100 workers. A worker year is assumed to
contain 2000 hours (50 work weeks/year × 40 hours/week). The incidence rate, therefore, is
based on 200,000 hours of worker exposure to a hazard (100 worker years × 2000 hours/year).
The incidence rate is calculated from the number of incidents and the total number of hours
worked during the applicable period. The following equation is used to calculate the incidence
rate:

Number of incidents during period

Incidence rate = × 200, 000 hours (1-5)
Total hours worked by all employees

The incidence rate is typically used for accidents involving injuries or illnesses, although it
was used for fatalities in the past. The hours-based fatal injury rate is commonly used for
fatalities, whereas the incidence rate is used for injuries since fatalities occur much less
frequently than injuries. Using a different number of hours for these two rates brings both rates
within comparable numerical values.

OSHA also uses the incidence rate for illnesses; days away from work (DAW); and days
away from work, job restriction, or job transfer (DART). Table 1-7 defines these terms in
relation to occupational injuries. There are many other ways to present accident statistics depend-
ing on what you wish to achieve. For instance, for airline transportation, the usual method is to
report fatalities per million miles traveled.

Table 1-7 U. S. OSHA Definitions for Occupational Injuries

Name Definition
Fatality Injuries or illnesses that result in death, regardless of the time between the
injury and death or the length of the illness.

Injury Any injury, such as a cut, fracture, sprain, amputation, and so forth, that
results from a work-related event or from a single instantaneous exposure in
the work environment.

Illness Any abnormal condition or disorder caused by exposure to factors

associated with employment, other than those resulting from an
instantaneous event or exposure. This includes acute and chronic illnesses
or diseases.

Days away Cases that result in days away from work (beyond the day of injury or onset
from work of illness). The number of days away from work for these cases is
(DAW) determined according to the number of calendar days (not workdays) that
an employee was unable to work, even if the employee was not scheduled
to work those days.

Job transfer Any case that results only in job transfer or restricted work activity.
or Workers who continue working after incurring an injury or illness during
restriction their regularly scheduled shift but produce fewer goods or services are not
considered to be in restricted activity status.

Days away Any case involving days away from work (beyond the day of injury or
from work, onset of illness), or days of job restriction or days of job transfer.
job
restriction,
or job
transfer
(DART)
 Lost time The injured worker is unable to perform regular job duties, takes time off
injury (LTI) for recovery, or is assigned modified work duties while recovering.

Recordable Death, days away from work, restricted work or transfer to another job,
injury medical treatment beyond first aid, or loss of consciousness.

Other Injuries or illnesses that do not result in any days away from work, a job
recordable restriction, or restriction. This includes cases involving medical attention.
cases

Source: [Link].

Table 1-8 provides OSHA statistics on the total number of fatalities, the hours-based fatal
injury rates, and the total recordable incidence rates for the United States in 2015, ordered from
the highest number of fatalities to lowest. In 2015, a total of 4836 occupational fatalities
occurred. The peak number of fatalities was 5840 deaths recorded in 2006; the low was 4551
fatalities in 2009, primarily due to the recession of 2008—fewer workers means fewer fatalities.
The total number of fatalities has been increasing slowly over the past few years (4821 in 2014)
due to an increase in the number of workers, but likely at a diminished pace owing to
improvements in occupational safety programs.

Table 1-8 2015 U.S. Occupational Statistics for Selected Industries, Ranked from Highest to
Lowest Number of Fatalities

Total Hours-based fatal Total recordable

Industry
fatalities injury ratea incidence rateb

All Industries 4836 3.4 3.3

Construction (overall) 937 10.1 3.5

Transportation and warehousing 765 13.8 4.5

Agriculture, forestry, fishing, 570 22.8 5.7

and hunting

Truck transportation 546 25.2 4.3

Professional and business 477 3.0 1.4

services

Manufacturing 353 2.3 3.8

Government (state and local) 338 2.2 5.1

Retail trade 269 1.8 3.5

Leisure and hospitality 225 2.0 3.5

Wholesale trade 175 4.7 3.1

Government, federal 118 1.3

Restaurants and other food 100 1.4 3.0

services

Police and sheriff’s patrol 85 11.7 5.8

officers

Financial activities 83 0.9 1.1

Carpenters 83 6.7

Electricians 83 10.7 2.8

Professional, scientific, and 76 0.8 0.9

technical services

Roofers 75 39.7 5.6

Taxi drivers and chauffeurs 54 13.4 2.4

Information 42 1.5 1.3

Fire fighters 29 4.3 9.2

Mining (except oil and gas) 28 12.4 2.6

Chemical manufacturing 28 2.0 2.1

Fishing, hunting, and trapping 23 54.8 4.4

Utilities 22 2.2 2.2

Hospitals 21 0.4 8.1

Colleges, universities, and 17 1.8

professional schools

Plastics and rubber products 17 3.3 4.3

manufacturing
 Oil and gas extraction 6 0.7

Chemical and allied products 3 2.2

merchant wholesalers

Rate per 100,000 full-time equivalent workers based on exposure hours. See Equation 1-4 and
Table 1-7.

Rate per 100 worker years = 200,000 hours. See Equation 1-5 and Table 1-7. This includes all
recordable cases.

Source: U.S. Bureau of Labor Statistics, [Link]/iif/.

Several conclusions can be reached from Table 1-8. Construction (overall) has the highest
number of fatalities (937), but fishing, hunting, and trapping has the highest hours-based fatal
injury rate (54.8). The difference depends on the number of workers employed in each area.
Construction has a larger number of workers than fishing, hunting, and trapping, resulting in the
total fatalities for construction being higher and the hours-based fatal injury rate being lower.
Interestingly, hospitals have the second highest total recordable incidence rate (8.1), followed by
agriculture, forestry, fishing, and hunting (5.7). Table 1-8 also shows that the traditional
chemical engineering industries are near the bottom in terms of occu-pational injuries and
fatalities. This group includes chemical manufacturing (28 fatalities), plastics and rubber
products manufacturing (17 fatalities), oil and gas extraction (6 fatalities), and chemical and
allied products merchant wholesalers (3 fatalities). The hours-based fatal injury rates and total
recordable incidence rates for these industries are lower than those of many other occupational
activities that are commonly considered as safer. For example, colleges, universities, and
professional schools had a total of 17 fatalities in 2015. Many specific chemical companies
achieve total recordable incidence rates as low as 0.2, compared to the industry average for
chemical manufacturing of 2.1.

Table 1-9 provides details on the nature of the fatalities. Clearly, transportation accidents
account for the largest number of fatalities in the workplace (2054 fatalities). This is followed by
falls, slips, and trips (800 fatalities). With respect to the nature of the fatal injury, most of the
injuries are due to multiple traumatic injuries and disorders—occupational fatalities usually
involve widespread injury to many areas in the human body. With respect to the worker activity
involved with the fatality, transportation accounts for the largest number of fatalities, followed
by constructing, repairing, and cleaning and using or operating tools or machinery.

Table 1-9 Details on the Nature of Occupational Fatalities in 2015

Total occupational fatalities for 2015: 4836

Event or exposure

Transportation accidents 2054

Falls, slips, and trips 800

Contact with objects and equipment 722

Violence and other injuries by persons or animalsa 703

Exposure to harmful substances or environments 424

Fires and explosions 121

Primary sourceb

Vehicles 2195

Persons, plants, animals, and minerals 900

Structures and surfaces 568

Machinery 358

Chemicals and chemical products 233

Parts and materials 192

Tools, instruments, and equipment 192

Containers, furniture, and fixtures 95

Nature of fatal injury

Multiple traumatic injuries and disorders 1855

Other traumatic injuries and disorders 1293

Intracranial injuries 803

Open wounds 558

Traumatic injuries to bones, nerves, and spinal cord 180

Burns and corrosions 78

Effects of environmental conditions 41

Traumatic injuries to muscles, tendons, ligaments, joints, etc. 18

Surface wounds and bruises 3

 Worker activity

Vehicular and transportation operations 2121

Constructing, repairing, cleaning 968

Using or operating tools or machinery 405

Other activities 374

Physical activities 308

Materials handling operations 215

Protective service operations 110

Includes 417 homicides and 229 suicides.

The primary source is the object, substance, person, bodily motion, or exposure that most directly
led to, produced, or inflicted the injury.

Source: U.S. Bureau of Labor Statistics, [Link]/iif/.

Note under the “Primary Source” heading in Table 1-9 that 233 fatalities occurred due to
exposure to chemicals and chemical products. However, if you look further into the U.S. Bureau
of Labor Statistics data, you find that only 5 of these deaths occurred in the chemical
manufacturing industry and only 1 in operations of chemical and allied products merchant
wholesalers. One can easily conclude that few fatalities in the chemical industry are due to
chemical exposures; instead, most of the chemical fatalities occur in industries that are not
considered chemical in nature.
 Table 1-10 provides more details on fatalities in the chemical industry. Surprisingly, retail
gasoline stations account for the largest number of fatalities (39 fatalities—due mostly to
robberies). Within chemical manufacturing, fertilizer manufacturing (6 fatalities) and basic
chemical manufacturing (5 fatalities) account for the largest number of fatalities. Petroleum
refineries had 4 fatalities in 2015, while crude petroleum and natural gas extraction had 6
fatalities.

Table 1-10 2015 Fatal Occupational Injuries Related to the U.S. Chemical Industry

Chemical industry Fatalities

Gasoline Stations (Retail) 39

Chemical Manufacturing 28

Fertilizer manufacturing 6

Basic chemical manufacturing 5

Soap, cleaning compound, and toilet prep manufacturing 4

Pharmaceutical and medicine manufacturing 3

Paint, coating, and adhesive manufacturing 2

Industrial gas manufacturing 1

All other chemical manufacturing 7

Plastics Manufacturing 13
 Petroleum and Coal Products Manufacturing 12

Asphalt paving mixture and block manufacturing 5

Petroleum refineries 4

Asphalt shingle and coating materials manufacturing 3

Petroleum and Petroleum Products Merchant Wholesalers 9

Crude Petroleum and Natural Gas Extraction 6

Rubber Product Manufacturing 4

Chemical and Allied Products Merchant Wholesalers 3

Source: U.S. Bureau of Labor Statistics, [Link]/iif/.

The Marsh and McLennan companies annually publish a report entitled 100 Largest
Losses in the Hydrocarbon Industry.5 The most recent report tabulates losses from 1974 to 2015
and is based only on the property value losses from the ground up. It does not include the
financial losses due to fatalities/injuries, environmental factors, lawsuits, fines, or business
interruption—these additional losses could easily multiply the losses by many times. Table 1-11
shows the percentage of losses by industry sector and Table 1-12 shows the total property
damage losses by event type. Reviewing these data, the first conclusion is that these losses are
huge—totaling more than $33 billion, an amount that does not include losses to human life and
environmental losses. Second, 87% of the losses occurred in upstream oil and gas production,
refining, and petrochemicals. Finally, $25 billion in losses—75% of the total dollar losses—are
from explosions and fires.

5 100 Largest Losses in the Hydrocarbon Industry (New York, NY: Marsh and McLennan
Companies, 2015).

Table 1-11 Percentage of Property Damage by Industry Sector

Industry sector Percentage of total losses

Upstream production of oil and gas 33%

Refining 29%

Petrochemicals 25%

Gas processing 8%

Terminals and distribution 5%

Source: The 100 Largest Losses 1974–2015, 24th ed. (New York, NY: Marsh and McLennan
Companies, March 2016), p. 10.

Table 1-12 Property Damage Values Based on Event Type

Event type Property damage ($U.S. billions, adjusted to December 2015 $)

Explosion $21.19

Fire $4.36

Blowout $2.54

Storm $2.00
 Collision $1.32

Earthquake $1.23

Sinking $0.61

Release $0.23

Mechanical damage $0.27

Total $33.75

Source: The 100 Largest Losses 1974–2015, 24th ed. (New York, NY: Marsh and McLennan
Companies, March 2016), p. 10.

Table 1-13 is a list of non-occupational fatalities in the United States for the year 2014
ranked from the highest number of fatalities to lowest. Also shown is the deaths per 100,000
people, as defined by Equation 1-3. In 2014, there were 136,053 non-occupational fatalities due
to unintended injuries—compared to 4836 occupational fatalities. Poisoning accounted for the
highest number of fatalities, although this includes 38,718 poisoning deaths by drug overdose.
This alarmingly large number of fatalities is dramatically increasing each year. Motor vehicle
deaths numbered 35,398—a total that has been increasing slowly for the past few years. In 1972,
the number of motor vehicle fatalities reached a peak of 56,278. In 2014, 58 people died from
electrocution by exposure to electric transmission lines, while 25 died from lightning.

Table 1-13 Non-Occupational Fatalities in the United States Due to Unintentional Injuries, 2014

Total Deaths per 100,000

Injury class
fatalities peopleb

All deaths (occupational and non- 136,053a 42.7

 occupational)

Poisoning 42,032a 13.2

Motor vehicle 35,398 11.2

Falls 31,959 10.0

Choking 4816 1.5

Drowning 3406 1.1

Fires, flames, and smoke 2701 0.4

Exposure to excessive natural cold 930

Firearm discharge 270 0.2

Exposure to excessive natural heat 244

Exposure to electric transmission lines 58

Lightning 25

Flood 8

Includes 38,718 fatalities due to drug overdose.

See Equation 1-3.

Source: Injury Facts (Itasca, IL: National Safety Council, Itasca, IL, 2015), [Link].
 Comparing Table 1-13 with Table 1-8 shows that the total number of fatalities in the
workplace is much lower than the non-occupational fatalities in the general population: The
number of workplace fatalities is comparable to the number of deaths by choking. Choking, falls,
motor vehicle deaths, and poisonings all exceed the total number of workplace fatalities by a
large margin. Also note that the general population is much larger than the total number of
workers in the general population. Nevertheless, this comparison does provide an indication of
the magnitude of workplace deaths compared to non-occupational deaths.

In summary, accident statistics show that:

The chemical industry has much lower fatalities and hours-based fatal injury rates than many
other occupational activities that are commonly considered to be safer.
The numbers of transportation and motor vehicle fatalities are high in both occupational and
non-occupational environments.
Chemical industry incidents, although infrequent, can result in huge property losses.

The chemical industry includes chemical plants, refineries, and other industrial sites using
chemicals. Despite the relatively small number of fatalities that occur in the chemical industry,
the potential always exists for a major incident—though such an event remains unlikely. Clearly,
no unintended injury or fatality is acceptable in the workplace or elsewhere. All safety programs
must drive toward zero injuries.

Example 1-1

A company employs 1000 full-time employees. If the company has one fatality over a one-year
time period, calculate (a) the worker-based fatal injury rate and (b) the hours-based fatal injury
[Link] the company has one recordable injury rate in that same year, calculate (c) the total
recordable incidence rate. Compare the answers for parts (b) and (c) to the numbers for chemical
manufacturing in Table 1-8.

Solution
1. From Equation 1-2:
Total number of fatalities during period
Worker-based fatal injury rate = × 100, 000
Total number of employees
1
= × 100, 000 workers
1000 workers
= 100
2. From Equation 1-4:
Total number of fatalities during period
Hours-based fatal injury rate = × 200, 000, 000
Total hours worked by all employees
1 fatality
= × 200
(1000 employees) (50 weeks/yr) (40 hours/wk)
200, 000, 000 hours
=
2, 000, 000 hours
= 100
3. From Equation 1-5:
Number of incidents during period
Recordable incidence rate = × 200, 000 hours
Total hours worked by all employees
1 recordable incident
= × 200, 000 hours
2, 000, 000 hours
= 0.10

The part (b) answer compares to a chemical manufacturing value of 2.0 and the part (c) answer
compares to a chemical manufacturing value of 2.1. The part (b) answer is well above the
chemical industry value while the part (c) answer is well below it.

1-8 Risk Perception

People perceive risks in different ways, though their perceptions might not always be supported
by the actual statistics. The actual risk associated with the chemical industry is generally much
less than that perceived by the public. Thus, the chemical industry is held to a higher safety
standard than other industries. This requires continuous improvement in chemical industry safety
programs to achieve the necessary public trust, credibility, and license to operate.

1-9 Risk Tolerance/Acceptance and Risk Matrix

Risk tolerance or acceptance is defined as “the maximum level of risk of a particular technical
process or activity that an individual or organization accepts to acquire the benefits of the process
or activity.”6 We cannot eliminate risk entirely—all activities inevitably involve risk. Indeed,
people accept risks many times during their daily activities. For instance, simply crossing the
street involves a risk assessment as to where and when to cross. People accept risks based on
their perceived risk—which may or may not be the actual risk. The risk accepted is voluntary
based on the perceived risk, while any additional actual risk not perceived will be involuntary.

6AICHE/CCPS Glossary, accessed September 2017.

Engineers must make every effort to minimize risks within reasonable constraints. No
engineer should ever design a process that he or she knows will result in certain human loss or
injury. For a chemical plant, at some point in the design stage or at every point in the operation
of the plant, the corporation (this decision involves both the workers and management) must
determine whether the risks are acceptable. The risk acceptance must be based on more than just
perceived risks.

Risk tolerance may also change with time as society, regulatory agencies, and individuals
come to expect more from the chemical industry. As a consequence, a risk that was considered
tolerable years ago may now be deemed unacceptable.

A risk matrix is a semi-quantitative method to represent risk and to help companies make
risk acceptance decisions. A typical risk matrix is shown in Table 1-14. The consequence or
severity of the incident is found in columns 1, 2, and 3, and the likelihood of that incident
occurring appears in columns 4 through 7. The incident severity is used to estimate the severity
category and the safety severity level. The likelihood level is selected based on the frequency of
the incident, as shown in columns 4 through 7. The combination of the severity category row and
the likelihood column is used to determine the risk level, A through D.

Table 1-14 Risk Matrix for Semi-Quantitative Classification of Incidents

Risk Matrix

1. Select the severity from the highest box in either of columns 1, 2, or 3. Read the
4
Severity Category and Safety Severity Level from the same row. LIKELY
2. Select the likelihood from columns 4 through 7. Expected
3. Read the Risk Level from the intersection of the severity row and the likelihood to
column. happen
several
TMEF: Target mitigated event frequency (yr–1).
times
TQ: Threshold quantity—see Table 1-15.
over the
life of the
plant

Severity 1 2 3 Severity Safety 0–9 years

Human Fire, Chemical category severity
health explosion impact level
impact direct
cost ($)

Public Greater ≥ 20 × Catastrophic 4 Risk

fatality than TQ TMEF level A
possible, $10 =
employee million 1 × 10–
6
fatalities
likely

Employee $1 9 × to< Very serious 3 Risk

fatality million 20 × TQ TMEF level A
possible, to< $10 =
major million 1 × 10–
5
 injury
likely

Lost time $100,000 3 × to< 9 Serious 2 Risk

injury to< $1 × TQ TMEF level B
(LTI) million =1 ×
likelya 10–4

Recordable $25,000 1 × to< 3 Minor 1 Risk

injuryb to< × TQ TMEF level C
$100,000 =1 ×
10–3

Risk level A: Unacceptable risk; additional safeguards must be implemented immediately.

Risk level B: Undesirable risk; additional safeguards must be implemented within 3 months.
Risk level C: Acceptable risk, but only if existing safeguards reduces the risk to as low as reasonably practicab
Risk level D: Acceptable risk, no additional safeguards required.

Lost time injury (LTI): The injured worker is unable to perform regular job duties, takes time off
for recovery, or is assigned modified work duties while recovering.

Recordable injury: Death, days away from work (DAW), restricted work or transfer to another
job, medical treatment beyond first aid, or loss of consciousness.

The severity levels are listed under columns 1, 2, and 3 in Table 1-14. They include human
health impacts; direct costs of fire and explosion in dollars; and chemical impacts. The chemical
impact is based on a chemical release quantity called a threshold quantity (TQ). Table 1-15 lists
TQs for a number of common chemicals.

Table 1-15 Threshold Quantities (TQ) for a Variety of Chemicals

2000 kg = 4400 lbm 1000 kg = 2200 lbm 500 kg = 1100 lbm

Acrylamide Acetic anhydride Acetaldehyde

Ammonium nitrate Acetone Acrylonitrile

fertilizer

Amyl acetate Acetonitrile Calcium cyanide

Amyl nitrate Aldol Carbon disulfide

Bromobenzene Ammonium perchlorate Cyclobutane

Calcium oxide Aniline Diethyl ether or ethyl

ether

Carbon dioxide Arsenic Ethane

Carbon, activated Barium Ethylamine

Chloroform Benzene Ethylene

Copper chloride Benzidine Furan

Kerosene Butyraldehyde Hydrazine, anhydrous

Maleic anhydride Carbon tetrachloride Hydrogen, compressed

n-Decane Copper chlorate Lithium

Nitroethane Copper cyanide Methylamine, anhydrous

Nitrogen, compressed Cycloheptane Potassium

Nitrous oxide Cycloheptene Potassium cyanide

Nonanes Cyclohexene Propylene oxide

Oxygen, compressed Dioxane Silane

Paraldehyde Epichlorohydrin Sodium

Phosphoric acid Ethyl acetate Sodium cyanide

Potassium fluoride Ethyl benzene Sodium peroxide

Potassium nitrate Ethylenediamine Trichlorosilane

Sulfur Formic acid

Tetrachloroethylene Heptane 100 kg = 220 lbm

Undecane Hexane Hydrogen bromide,

anhydrous

Methacrylic acid Hydrogen chloride,

anhydrous

200 kg = 440 lbm Methyl acetate Hydrogen fluoride,

anhydrous

Ammonia, anhydrous n-Heptene Methyl bromide

 Carbon monoxide Nitrobenzene Methyl mercaptan

Nitromethane Sulfur dioxide

5 kg = 11 lbm Octanes

Acrolein Phenol, molten or solid 25 kg = 55 lbm

Arsine Propylamine Chlorine

Diborane Pyridine Cyanogen

Dinitrogen tetroxide Silver nitrate Germane

Methyl isocyanate Sodium permanganate Hydrogen sulfide

Tetrahydrofuran

Nitric oxide, Tetrahydrofuran Nitric acid, red fuming

compressed

Nitrogen trioxide Toluene Sulfuric acid, fuming

Phosgene Triethylamine

Phosphine Vinyl acetate

Stibine Zinc peroxide

Source: AICHE/CCPS. Details on how to compute the TQ are available from AICHE/CCPS
Process Safety Metrics: Guide for Selecting Leading and Lagging Indicators (New York, NY:
American Institute of Chemical Engineers, 2018).

The target mitigated event frequency (TMEF) listed with the safety severity level is the
minimum frequency level desired for this level of severity. It defines the frequency for
acceptable risk.

Some risk matrixes include a severity column based on environmental impacts. However,
the environmental impact is implicitly related to the quantity of chemical released: The greater
the chemical release, the greater the environmental impact. Thus, environmental impact is
implicit in this risk matrix.

The procedure for using the risk matrix of Table 1-14 is as follows:

1. Select the severity levels from columns 1, 2, and 3 and select the highest level from any of
these columns.
2. Read the Risk Category and Safety Severity Level from the highest row.
3. Select the likelihood from columns 4 through 7.
4. Read the risk level from the intersection of the Safety Severity Level row and the Likelihood
column.

The risk levels are identified just below the table and define the risk and the required response.
The Safety Severity Level contains the TMEF. The TMEF will be useful for the layer of
protection analysis (LOPA) method presented in Chapter 11.

Example 1-2

A risk analysis is performed on an incident involving a hole in a storage vessel containing a

specific chemical. The chemical has a TQ of 5 lbm. Calculations for this hole release estimate a
total release of 50 lbm of chemical. An employee fatality is possible with such a release, and the
fire and explosion direct cost is estimated at $150,000. This incident is expected to occur once
over the life of the plant. Use the risk matrix in Table 1-14 to determine the risk category, safety
severity level, TMEF, and risk level.
Solution

Using Table 1-14, the following severity levels are selected under columns 1, 2, and 3:

Human Health Impact: Employee fatality possible

Fire, Explosion Direct Cost: $100,000 to < $1 million.
Chemical Impact: 9× to < 20× TQ

Selecting these three levels under columns 1, 2, and 3, respectively, results in the highest
severity category of “Very serious,” with a safety severity level of 3 and a TMEF of 1 × 10−5.
The likelihood is selected from column 5, since this is expected once over the lifetime of the
plant.

Combining the Severity Category row of “Very serious” with Likelihood column 5 gives a
risk level of B. Risk level B is defined as an “Undesirable risk; additional safeguards must be
implemented within 3 months.”

Note that if we could drop the severity level or decrease the likelihood, we can reduce the
risk level. The LOPA method presented in Chapter 11 is a formalized method to add more
safeguards to reduce the risk level to the TMEF.

The risk matrix provided in Table 1-14 is one specific example; that is, most companies
customize the risk matrix to work for their particular situation. Additional methods for
determining risk are presented in Chapter 12 on risk assessment.

1-10 Codes, Standards, and Regulations

Codes, standards, and regulations are an important part of chemical process safety.

A code is a set of recommendations developed by a team of knowledgeable people, who are

most likely to be associated with an industrial professional organization. Codes do not have
legal authority, but governments might adopt one by turning it into law.
A standard is more elaborate, explaining in a lot more detail how to meet the code. That is,
 codes tell you what you need to do, and standards tell you how to do it. Standards do not carry
the weight of legal authority, but governments might adopt them by turning them into laws.
A regulation is developed by a government and has legal authority. It may be based on a code
or standard. Violations of regulations could result in fines and/or jail time.

Table 1-16 lists a number of regulations, codes, and standards important to process safety in the
United States.

Table 1-16 Selected Regulations, Codes, and Standards That Apply to the Chemical Industry

Regulations
U.S. Occupational Safety and Health Administration (OSHA), [Link]
29 CFRa 1910.119 Process Safety Management of Highly Hazardous Materials
This applies to manufacturing sites when on-site inventories of chemicals exceed the threshold
values provided in the regulation. A prevention program involving 14 elements must be
maintained.
U.S. Environmental Protection Agency (EPA), [Link]
40 CFR 68 Risk Management Programs (RMP)
This applies to releases of toxic or flammable materials that could have off-site impacts. If
chemicals exceed threshold quantities, a consequence analysis must be completed to
estimate off-site impacts.A prevention program involving 11 elements must be maintained.
U.S. Department of Homeland Security (DHS), [Link]
6 CFR 27 Chemical Facility Anti-Terrorism Standards (CFATS)
This establishes risk-based performance standards for the security of chemical facilities. An
online Chemical Security Assessment Tool must be completed to identify the company’s
security tier. Each tier has chemical security requirements.
Codes
National Fire Protection Association (NFPA), [Link]
NFPA 70: National Electrical Code (NEC)
NFPA 101: Life Safety Code
American Society of Mechanical Engineers (ASME), [Link]
 ASME Boiler and Pressure Vessel Code
Standards
National Fire Protection Association (NFPA), [Link]
NFPA 45: Standard on Fire Protection for Laboratories Using Chemicals
NFPA 68: Standard on Explosion Venting by Deflagration Venting
NFPA 69: Standard on Explosion Prevention Systems
NFPA 652: Standard on the Fundamentals of Dust Explosions
American Society for Testing and Materials (ASTM), [Link]
ASTM D93: Standard Test Methods for Flash Point by Pensky-Martens Closed Cup Tester
ASTM E681-09 Standard Test Method for Concentration Limits of Flammability of
Chemicals (Gases and Vapors)
American Petroleum Institute (API), [Link]
API Recommended Practice 521: Selection and Installation of Pressure Relieving Devices in
Refineries
API Recommended Practice 754: Process Safety Performance Indicators for the Refining
and Petrochemical Industries
International Electrochemical Commission (IEC), [Link]
IEC 61511: Safety Instrumented Systems for the Process Industry Sector

Code of Federal Regulations.

Codes, standards, and regulations vary considerably between countries around the world.
This creates challenges for engineers in one country who are designing a plant to operate in
another country, or even for shipping chemicals from one country to another. Codes, standards,
and regulations also change with time.

In the United States, OSHA and EPA use the codes and standards as a basis for
Recognized and Generally Accepted Good Engineering Practices (RAGAGEP). RAGAGEP
means that each plant site must keep its facility up to date with respect to codes and standards
that apply to that plant, even though these codes and standards do not have regulatory authority.
RAGAGEP is a complex regulatory and legal issue, well beyond the scope of this book.
 1-11 Safeguards

Figure 1-4 shows the sequence of events in an incident. The hazard is shown on the left side of
the figure, and the consequences are shown on the right side. The initiating event, or cause, may
be “a device failure, system failure, external event, or improper human inaction that begins a
sequence of events leading to one or more undesirable outcomes.”7 It is usually caused by
internal plant events such as operational problems, equipment failures, human error, and design
deficiencies, to name a few possibilities. The initiating event may also be caused by events
external to the plant, including natural phenomena such as lightning strikes, floods, tornadoes, or
other influences outside the plant boundaries.

7Center for Chemical Process Safety, Guidelines for Initiating Events and Independent
Protection Layers in Layer of Protection Analysis (New York, NY: Wiley, 2015).

Figure 1-4 The sequence of events causing a hazard to result in an incident with consequences.

The enabling conditions are “operating conditions necessary for an initiating cause to
propagate into a hazardous event. Enabling conditions do not independently cause the incident,
but must be present or active for it to proceed.”8 An enabling condition makes the beginning of
the scenario possible. Such conditions are represented as probabilities—for example, the
probability of a unit being in a particular state of operation (e.g., recycle mode, startup), the
probability that a particular raw material or catalyst is in the process, or the probability that the
temperature or pressure is within high or low values.

8Ibid.

Conditional modifiers are conditions that occur after initiation and impact a step in the
sequence either before or after the incident has occurred. They could include weather conditions
(wind direction and speed), presence of people, and probability of ignition, among other factors.

Chemical plants use several types of safeguards to prevent incidents or to reduce the
impact of an incident. Once an initiating event has occurred, safeguards come into play, as
shown in Figure 1-4. A safeguard is a design feature, equipment, procedure, or even software
that is in place to prevent or mitigate the consequences of an initiating event. Two types of
safeguards are distinguished: preventive and mitigative. A preventive safeguard (also called a
protection layer) intervenes after the initiating event to stop the event from developing further
into an incident. A mitigative safeguard is a safeguard that reduces the consequences after an
incident has occurred. Thus, preventive safeguards stop the propagation of the initiating event to
an incident while mitigative safeguards reduce the consequences after an incident has occurred.
Table 1-17 lists a variety of common preventive and mitigative safeguards used in the chemical
industry.

Table 1-17 Common Preventive and Mitigative Safeguards Used in the Chemical Industry

Preventive Safeguards: Prevents an initiating event from proceeding to a defined,

undesirable incident; also called a protection layer.

Basic process control system (BPCS)

Safety instrumented functions (SIF)
Safety instrumented systems (SIS)
Alarm systems
Operator response to an alarm or process conditions
Pressure relief system with containment (may also be considered mitigative)
 Procedures
Maintenance
Interlocks
Emergency shutoff valves
Flame/detonation arresters
Inhibitor addition to reactor
Emergency cooling systems
Vapor inerting and purging to prevent flammable mixtures
Grounding and bonding to prevent static accumulation
Normal testing and inspection

Mitigative Safeguards: Reduce the consequences after an incident has occurred.

Active fire protection, including sprinklers, sprays, foams, and deluges

Emergency fire water system
Passive fire protection including insulation
Flammable vapor detectors
Emergency response, including on-site and off-site
Plant and equipment layout and spacing
Diking around storage areas/processes
Emergency power
Blast walls
Water curtains to disperse vapors
Blast resistant control rooms
Explosion blow-out panels on process vessels

Source: Guidelines for Risk Based Process Safety, AICHE Center for Chemical Process Safety
(Wiley, NY), 2007.

In reality, not all safeguards are 100% effective or are working all the time. Figure 1-5
 shows these safeguards as slices of Swiss cheese, where the holes represent defects in the
safeguards. These kinds of defects in safeguards are dynamic and can come and go—that is, the
“hole” size can change with time and even move around on the Swiss cheese. Only a few Swiss
cheese safeguards are shown in Figure 1-5 to simplify the figure—the actual number of
safeguards depends on the magnitude of the hazard.

Figure 1-5 Swiss cheese model showing defects in the safeguards. If the defects line up, an
incident will occur with resulting consequences.

Preventive maintenance of equipment at specified frequencies is designed to ensure that

safeguards work properly, even as equipment ages. Only one preventive safeguard must work
successfully for the incident to be stopped. Since multiple safeguards are present, if one
safeguard has a defect, the initiating event will propagate through the defective safeguard but
will be stopped by another safeguard. If the defects or “holes” in all the preventive safeguards
line up, however, then the initiating event will propagate to an incident. Many well-known
catastrophic incidents have occurred with many safeguards in place.

Once an incident has occurred, consequences are expected, although they might be
minimal at this point. If mitigative safeguards are lacking, it is possible that the incident could
expand in scope. For instance, the incident might be the leak of a flammable liquid from the
process to the surroundings. If the flammable liquid ignites, then a fire or explosion might occur,
greatly expanding the consequences. Thus, the mitigative safeguards, in this case, are intended to
prevent the ignition of the released flammable liquid and the expansion of the consequences. In
this example, the mitigative safeguards might be foam, water sprays, or other fire protection
methods to prevent ignition.

It is possible that the mitigative safeguards could completely contain the incident and
prevent it from increasing in scope and consequences. However, if some of the mitigative
safeguards are not working or not effective, then additional consequences are expected.

Mitigative safeguards may be effective for only a specific incident outcome. For instance,
safeguards designed to reduce the probability of ignition of a flammable material may not be
effective in reducing the toxicity of the vapor if it does not ignite.

To see how preventive and mitigative safeguards work together, consider the following
example: A chemical reactor vessel can be damaged by the effects of high pressure, maybe even
resulting in the destructive bursting of the reactor vessel. The basic process control system
(BPCS) controls the operation of the reactor to prevent high pressure. However, high pressure
can arise from many sources—almost too numerous to completely prevent using the BPCS.
Thus, reactor vessels are also equipped with relief devices in the form of spring-operated valves
that open with high pressure, discharging the reactor contents to reduce the pressure. The BPCS
is a preventive safeguard since it prevents the buildup of pressure in the reactor—but it cannot be
expected to work all the time or to handle all possible situations. The relief device is a mitigative
safeguard since it operates after the high-pressure incident has occurred and reduces the
consequences of the incident. As a result of the relief device’s actions, the consequences of the
high pressure incident are loss of product from the reactor and a clean-up of the relief discharge.
Without the relief device, the consequences of the high-pressure incident might be permanent
pressure damage to the reactor vessel or maybe even destructive bursting of the vessel, leading to
substantial damage to the surrounding equipment and workers. Since there are many ways for
high pressure to build up in a reactor vessel, many preventive and mitigative safeguards are
usually present.

1-12 The CCPS 20 Elements of Risk-Based Process Safety

In 2007, the AICHE Center for Chemical Process Safety published Guidelines for Risk Based
Process Safety.9 The risk-based process safety (RBPS) approach

9Center for Chemical Process Safety, Guidelines for Risk Based Process Safety (New York,
NY: Wiley, 2007).

recognizes that all hazards and risks in an operation or facility are not equal; consequently,
apportioning resources in a manner that focuses effort on greater hazards and higher hazards is
appropriate. … The RBPS system may encompass all process safety issues for all operations
involving the manufacture, use, storage, or handling of hazardous substances or energy.
However, each organization must determine which physical areas and phases of the process life
cycle should be included in its formal management systems, based on its own risk tolerance
considerations, available resources, and process safety culture. … The RBPS elements are meant
to apply for the entire process life cycle.

The 20 elements of RBPS are listed in Table 1-18. These elements are organized in four
major foundational blocks: (1) commit to process safety, (2) understand hazards and risks,(3)
manage risk, and (4) learn from experience.

Table 1-18 The 20 Elements of Risk-Based Process Safety

Foundational Block: Commit to Process Safety

1. 1. Process safety culture

2. 2. Compliance with standards
3. 3. Process safety competency
 4. 4. Workforce involvement
5. 5. Stakeholder outreach

Foundational Block: Understand Hazards and Risks

1. 6. Process knowledge management

2. 7. Hazard identification and risk analysis (HIRA)

Foundational Block: Manage Risk

1. 8. Operating procedures
2. 9. Safe work practices
3. 10. Asset integrity and reliability
4. 11. Contractor management
5. 12. Training and performance assurance
6. 13. Management of change
7. 14. Operational readiness
8. 15. Conduct of operations
9. 16. Emergency management

Foundational Block: Learn from Experience

1. 17. Incident investigation

2. 18. Measurements and metrics
3. 19. Auditing
4. 20. Management review and continuous improvement

Source: AICHE Center for Chemical Process Safety, Guidelines for Risk Based Process Safety
(Hoboken, NJ: Wiley Interscience, 2007).

OSHA has a similar set of 14 elements that are included as part of 29 CFR 1910.119 on
process safety management.10 The OSHA elements of this regulation are (1) employee
 participation, (2) process safety information, (3) process hazards analysis, (4) operating
procedures,(5) training, (6) contractors, (7) pre-startup safety review, (8) mechanical integrity,
(9) hot work permits, (10) management of change, (11) incident investigation, (12) emergency
planning and response, (13) audits, and (14) trade secrets. While these 14 elements are contained
within the CCPS 20 elements, the OSHA regulation has legal authority.

10OSHA 1919.119, Process Safety Management (1992). [Link].

The 20 CCPS RBPS elements are described here:11

11AICHE/CCPS online glossary, [Link], accessed October 27, 2017.

Element 1—Process Safety Culture: A positive environment in which employees at all levels are
committed to process safety. This starts at the highest levels of the organization and is shared by
all. Process safety leaders nurture this process. (See Section 1-3, “Safety Culture.”)

Element 2—Compliance with Standards: Applicable regulations, standards, codes, and other
requirements issued by national, state/provincial, and local governments; consensus standards
organizations; and the company itself. Interpretation and implementation of these requirements.
Includes development activities for corporate, consensus, and governmental standards. (See
Section 1-10, “Codes, Standards, and Regulations.”)

Element 3—Process Safety Competency: Skills and resources that the company needs to have in the right
places to manage its process hazards. Verification that the company collectively has these skills
and resources. Application of this information in succession planning and management of
organizational change.

Element 4—Workforce Involvement: Broad involvement of operating and maintenance personnel in

process safety activities, to make sure that lessons learned by the people closest to the process
are considered and addressed.
Element 5—Stakeholder Outreach: A process for identifying, engaging, and maintaining good
relationships with appropriate external stakeholder groups. This would include the surrounding
community, suppliers of raw materials, customers, government agencies and regulators,
professional societies, contractors, and more.

Element 6—Process Knowledge Management: The assembly and management of all information needed
to perform process safety activities. Verification of the accuracy of this information.
Confirmation that this information is correct and up-to-date. This information must be readily
available to those who need it to safely perform their jobs.

Element 7—Hazard Identification and Risk Analysis: Identification of process safety hazards and their
potential consequences. Definition of the risks posed by these hazard scenarios.
Recommendations to reduce or eliminate hazards, reduce potential consequences, and reduce
frequency of occurrence. Analysis may be qualitative or quantitative, depending on the level of
risk.

Element 8—Operating Procedures: Written instructions for a manufacturing operation that describes how
the operation is to be carried out safely, explaining the consequences of deviation from
procedures, describing key safeguards, and addressing special situations and emergencies.

Element 9—Safe Work Practices: Procedures to safely maintain and repair equipment, such as permits to
work, line breaking, and hot work permits. This applies to nonroutine operations.

Element 10—Asset Integrity and Reliability: Activities to ensure that important equipment remains
suitable for its intended purpose throughout its service. Includes proper selection of materials of
construction; inspection, testing, and preventive maintenance; and design for maintainability.

Element 11—Contractor Management: Practices to ensure that contract workers can perform their jobs
safely, and that contracted services do not add to or increase facility operational risks.

Element 12—Training and Performance Assurance: Practical instruction in job and task requirements and
methods for operation and maintenance workers, supervisors, engineers, leaders, and process
safety professionals. Verification that the trained skills are being practiced proficiently.
Element 13—Management of Change: Process of reviewing and authorizing proposed changes to facility
design, operations, organization, or activities prior to implementing them, and ensuring that the
process safety information is updated accordingly.

Element 14—Operational Readiness: Evaluation of the process before startup or restart to ensure the
process can be safely started. Applies to restart of facilities after being shut down or idled as well
as after process changes and maintenance. Also applies to startup of new facilities.

Element 15—Conduct of Operations: Means by which the management and operational tasks required for
process safety are carried out in a deliberate, faithful, and structured manner. Managers ensure
workers carry out the required tasks and prevent deviations from expected performance.

Element 16—Emergency Management: Plans for possible emergencies that define actions in an
emergency; resources to execute those actions; practice drills; continuous improvement; training
or informing employees, contractors, neighbors, and local authorities; and communications with
stakeholders in the event that an incident does occur.

Element 17—Incident Investigation: Process of reporting, tracking, and investigating incidents and near
misses to identify root causes; taking corrective actions; evaluating incident trends; and
communicating lessons learned.

Element 18—Measurement and Metrics: Leading and lagging indicators of process safety performance,
including incident and near-miss rates as well as metrics that show how well key process safety
elements are being performed. This information is used to drive improvement in process safety.
(See Section 1-6, “Safety Metrics.”)

Element 19—Auditing: Periodic critical review of process safety management system performance by
auditors not assigned to the site to identify gaps in performance and identify improvement
opportunities, and track closure of these gaps to completion.

Element 20—Management Review and Continuous Improvement: The practice of managers at all levels
of setting process safety expectations and goals with their staff and reviewing performance and
progress toward those goals. May take place in a staff or “leadership team” meeting or on a one-
on-one basis. May be facilitated by process safety leader but is owned by the line manager.

Table 1-19 presents common chemical plant activities associated with each of the 20
elements. When a chemical plant incident occurs, the incident investigation usually finds
deficiencies in many of the elements. The 20 elements provide a comprehensive management
system to handle risks|in chemical plants and other facilities. All of the elements are important,
and all must be given adequate consideration. Chemical engineers are involved in all aspects of
the 20 elements.

Table 1-19 Typical Activities Associated with the 20 Risk Based Process Safety (RBPS)
Elements

1. Process safety culture

Develop or deploy corporate process safety culture programs.
Identify process safety culture issues and influence corporate changes.
Maintain a strong process safety culture among team members.
Conduct formal assessments to identify gaps and recommend improvements in the
process safety culture.
2. Compliance with standards
Interpret or apply standards for internal use.
Participate in standards development.
Develop a system to identify standards and uniformly administer and maintain the
information.
3. Process safety competency
Develop a training program to increase workers’ level of competency.
Develop competency profiles for critical process safety positions.
Evaluate a unit to determine gaps in competency.
4. Workforce involvement
Develop, lead, or participate in organizing workforce involvement efforts at the corporate,
business, plant, or unit level.
 As a supervisor, regularly lead discussions around process safety concerns or issues with
operating personnel.
As a worker, provide constructive feedback aimed at improving process safety and track
feedback to resolution.
5. Stakeholder outreach
Lead community action panel (CAP) meetings.
Work with the local community to create an area CAP and facilitate meetings.
Develop site or corporate practices or standards to coordinate and manage major off-site
accident risks, to include communications with stakeholders.
Coordinate an emergency response simulation or drill in the community.
6. Process knowledge management
Validate existing Process and Instrument Diagrams (P&IDs) with actual plant
configuration.
Develop safe operating limits and consequences of deviations for a process unit.
Update process safety knowledge following management of change (MOC).
Write internal standards for the company.
Develop a database of relief devices.
7. Hazard identification and risk analysis
Develop and/or implement corporate methods and procedures for hazards analysis and
risk assessment.
Develop consequence assessment simulations.
Lead or participate in process hazards analysis (PHA).
8. Operating procedures
Write or revise operating procedures to make them clearer and more usable.
Review and update operational procedures for a site.
Identify safe operating limits for a process.
9. Safe work practices
Participate in confined-space operations.
Certify confined-space operations attendants.
Participate in or develop and audit line breaking and/or lock-out/tag-out (LOTO)
 procedures.
Develop a corporate work permit policy.
Audit and/or improve safe work practices.
10. Asset integrity and reliability
Review and assess data from inspections; draw conclusions and make recommendations.
Develop or implement practices, procedures, and strategies to manage the integrity in a
facility, site, or company.
Research published corrosion rates to provide general guidance for developing
specifications.
11. Contractor management
Audit contractors for safety.
Develop recommendations and actions to improve contractor performance.
Develop process safety requirements for hiring new site contractors.
12. Training and performance assurance
Develop process safety training programs.
Provide oversight of corporate or site process safety training program.
Give or receive process safety training.
13. Management of change (MOC)
Develop corporate procedures for change management.
Participate in management of change reviews.
Author MOC documentation.
Identify a site MOC coordinator.
14. Operational readiness
Lead and/or participate in pre-startup safety reviews (PSSR).
Develop commissioning and startup plans.
Identify critical process safety information (PSI) required to operate safely.
Start up a process that is ready to operate.
15. Conduct of operations
Implement practices intended to maintain the operational discipline at a facility.
As a front-line worker, cooperate with peers to ensure that performed tasks are done
 exactly as prescribed over a long period of time.
Actively monitor and make corrective action plans related to the performance of process
safety operating tasks.
16. Emergency management
Set up or participate in emergency response drills with community responders.
Work with corporate officials to perform emergency drills or table-top drills.
Participate in planning and addressing potential plant emergencies.
17. Incident investigation
Participate in an accident investigation.
Manage accident investigation action items.
Develop and implement corporate procedures for incident investigation.
18. Measurements and metrics
Act as the site lead for or participate in collecting and reporting metrics.
Prepare reports on process safety metrics.
Develop and implement site or company metrics.
19. Auditing
Participate in process safety audits, either as an auditor or an audited party.
Develop process safety audit methods.
Manage audit recommendations to ensure they are implemented.
20. Management review and continuous improvement
Participate in management reviews.
Evaluate results from management reviews and proposed/reviewed recommendations for
improvement.
Engage management to follow up and close out actions derived from management
reviews.

Example 1-3

A valve in a chemical plant is replaced by a valve from the warehouse. Unfortunately, the
warehouse valve was not constructed of the same material as the original and within a few
months corrosion caused the valve to leak, causing a release of toxic material. Which element of
RBPS applies to this scenario?

Solution

The element most directly impacted is Element 13, management of change. Whenever
equipment is replaced, steps must be taken to ensure that the replacement part has the identical
function as the original part. Other elements that might also be involved are Element 1, process
safety culture; Element 3, process safety competency; Element 6, process knowledge
management; Element 9, safe work practices; Element 10, asset integrity and reliability; Element
12, training and performance assurance; and Element 15, conduct of operations. Can you identify
how all of these other elements are involved? This type of incident would likely invoke a
management review(Element 20) to identify the cause and take corrective action to prevent this
type of incident from occurring again.

1-13 Inherently Safer Design

Section 1-11, “Protecting Against Hazards: Safeguards,” described how hazards are protected
with safeguards to prevent initiating events from propagating into more serious incidents with
consequences. These safeguards add considerable cost to the process and also require testing and
maintenance—and even with these actions, the safeguards can still fail.

If we could design a process with fewer hazards, then the process would be simplified, and
the safeguards reduced. This is the essence of inherently safer design—to eliminate hazards
rather than to provide complex safeguard hierarchies around the hazards. An inherently safer
plant uses the elimination of hazards to prevent accidents rather than depending on control
systems, interlocks, redundancy, special management systems, complex operating instructions,
or elaborate procedures. Inherently safer plants are tolerant of errors; are generally cost-effective;
and are simpler, easier to operate, and more reliable.

Table 1-20 provides examples of the four inherently safer design strategies: minimize,

12
substitute, moderate, and simplify. Other references12 provide more detailed strategies, but many
of these additional strategies can be included in the four shown in the table. The four strategies
listed in Table 1-20 are the traditional strategies, though they might go by other names (shown in
parentheses in the table).

12Trevor Kletz and Paul Amyotte. Process Plants: A Handbook for Inherently Safer
Design, 2nd ed. (Boca Raton, FL: CRC Press, 2010).

Table 1-20 Inherently Safer Design Strategies

Type Example applications

Minimize (intensification) Replace a large batch reactor with a smaller continuous

reactor.
Reduce storage inventory of raw materials.
Improve management and control to reduce inventory of
hazardous intermediate chemicals.
Reduce process hold-up.

Substitute (substitution) Use mechanical pump seals instead of packing.

Use a welded pipe rather than a flanged pipe.
Use solvents that are less hazardous.
Use chemicals with higher flash point temperatures, boiling
points, and other less hazardous properties.
Use water as a heat transfer fluid instead of hot oil.

Moderate (attenuation and Reduce process temperatures and pressure.

limitation of effects) Use a vacuum to reduce the boiling-point temperature.
Refrigerate storage vessels to reduce the vapor pressure of
liquids.
 Dissolve hazardous material in a nonhazardous solvent.
Operate at conditions where reactor runaway is not possible.
Locate control rooms remotely from the process to reduce
impacts of accidents.
Provide adequate separation distance from process units to
reduce impacts of accidents.
Provide barriers to reduce impacts of explosions.
Provide water curtains to reduce downwind concentrations.

Simplify (simplification Reduce piping lengths, valves, and fittings.

and error tolerance) Simplify piping systems and improve ability to follow the
pipes within them.
Design equipment layout for easy and safe operation and
maintenance.
Select equipment that requires less maintenance.
Select equipment with higher reliability.
Label process equipment—including pipelines—for easy
identification and understanding.
Design control panels and displays that are easy to
comprehend.
Design alarm systems to provide the operators with critical
information.

The minimize strategy entails reducing the hazards by using smaller quantities of
hazardous materials in the process. When possible, hazardous materials should be produced and
consumed on site—this minimizes the storage and transportation of hazardous raw materials and
intermediates.

The substitute strategy entails replacing hazardous materials with less hazardous materials.
For example, a nonflammable solvent could replace a flammable solvent.
 The moderate strategy entails using hazardous materials under less hazardous conditions.
This includes using these materials at lower temperatures and pressures. Other approaches
include (1) refrigeration to lower vapor pressures, (2) diluting solutions to a lower concentration,
and (3) using larger particle-sized solids to reduce dust explosions, to name a few.

The simplify strategy is based on the fact that simpler plants are friendlier than complex
plants, because they provide fewer opportunities for error and because they contain less
equipment that can cause problems. Often, the complexity in a process is driven by the need to
add equipment and automation to control the hazards. Simplification reduces the opportunities
for errors and mis-operation.

In the strictest sense, inherently safer design applies only to the elimination of hazards.
Some of the inherently safer design strategies shown in Table 1-20 treat hazards by making the
hazard less intense or less likely to occur. For instance, simplifying a complex piping system
reduces the frequency of leaks and operator error, but does not completely eliminate the hazard
—the remaining pipes and valves can still leak. The inherently safer design strategies that
eliminate the hazard are called first-order strategies, whereas strategies that make the hazard less
intense or less likely to occur are called second-order strategies.

Although inherently safer design should be applied at every point in a process life cycle,
the potential for major improvements is the greatest at the earliest stages of process development.
At these early stages, process engineers and chemists have the maximum degree of freedom in
the selection of the reaction, chemicals, process technology, and plant design and process
specifications.

Inherently safer design can significantly reduce the hazards in a process, but it can go only
so far. Many chemicals and products are used precisely because of their hazardous properties.
For instance, if gasoline is the product, then flammability is the necessary hazardous property for
this product—this hazard cannot be eliminated.

After we have applied inherently safer design as much as possible, we can use a hierarchy
of management systems to control the remaining hazards, as shown in Table 1-21. Inherently
safer design appears at the top of the hierarchy and should be the first approach, followed by
passive, active, and procedural strategies. The strategies closer to the top of Table 1-21 are more
robust than the lower strategies and should be preferred.

Table 1-21 Hierarchy of Process Risk Management Strategies. The strategies at the top of the
table are more robust

Strategy Emphasis Examples

Inherent See Table 1-20. Minimize (intensification).

Substitute (substitution).
Moderate (attenuation and
limitation of effects).
Simplify (simplification and
error tolerance).

Passive Minimizes the hazard through process Using equipment with a higher
and equipment design features that pressure rating than the
reduce either the frequency or the maximum possible pressure.
consequence without the active Blast walls around process
functioning of any device. equipment to reduce blast
overpressures.
Dikes around storage vessels
to contain spills.
Separation of equipment from
occupied buildings and other
locations where personnel may
be present.

Active Requires an active response. These Alarms, with operator

systems are commonly referred to as response.
 engineering controls, although human Process control system,
intervention is also included. including basic process control
systems, safety instrumented
systems, and safety
instrumented functions.
Sprinklers and water deluge
systems.
Pressure relief devices.
Inerting and purging systems.
Water curtains to knock down
gas releases.
Flares.

Procedural Based on an established or official way Policies.

of doing something. These are Operating procedures.
commonly referred to as administrative Safe work practices, such as
controls. lock-out/tag-out, vessel entry,
and hot work.
Emergency response
procedures.
Training.

Active safeguards require the physical motion or activity in the performance of the
equipment’s function; a valve opening or closing is an example. A passive safeguard is hardware
that is not physically actuated to perform its function; dikes around storage vessels are an
example. Procedural safeguards, often called administrative safeguards, are administrative or
management safeguards that do not directly involve hardware; an operating procedure is an
example.

One potential problem with inherently safer design is risk shifting. That is, application of
inherently safer design strategies might shift the risk from one population to another. For
example, one company used a highly toxic chemical as a catalyst in a process. The chemical was
highly effective and was recycled with little make-up. The company decided to replace the
highly toxic catalyst with one that was considerably less toxic—an inherently safer approach by
substitution. The less toxic catalyst required a substantial amount of make-up, necessitating
regular and substantial truck shipments. While the risk to the company’s employees was reduced,
the risk to the community was increased due to the truck shipments along municipal roads.

Environmental impacts should also be considered in inherently safer designs. A classic

example of this is refrigeration systems. In the very early days of refrigeration, ammonia was
used as a refrigerant. Ammonia is toxic, and leaks of this gas can affect both employees and the
surrounding communities. Later, chlorofluorocarbons (CFCs) were developed to replace
ammonia. Since these refrigerants are not toxic, CFCs were inherently safer than ammonia.
However, in the 1970s, CFCs were found to deplete the ozone layer. Hydrochlorofluorocarbons
(HCFCs) were used for a short period since these had less impact on the environment. More
recently, many refrigeration systems have returned to ammonia as a preferred refrigerant
primarily to reduce environmental impacts.

Example 1-4

Carbon tetrachloride was originally used as a dry-cleaning fluid and was very effective. In the
1950s, carbon tetrachloride was phased out and replaced by perchloroethylene (PERC). Today,
other alternatives, such as carbon dioxide, are being considered. Why?

Solution

Carbon tetrachloride worked very well as a dry-cleaning fluid. However, it has high toxicity and
can damage the liver, kidneys, and central nervous system. It is a possible carcinogen, and
repeated exposure to the vapors by the dry-cleaning workers and customers resulted in adverse
health effects.

PERC is also a possible carcinogen and can affect the liver and kidneys. It can result in
adverse health effects, albeit not as severe as the effects associated with carbon tetrachloride.
 Other dry-cleaning alternatives, such as carbon dioxide, silicones, and propylene glycol
ethers, are possible replacements, but they have higher costs. Their use demonstrates inherently
safer design by substitution of a hazardous material with one less hazardous.

1-14 The Worst Chemical Plant Tragedy: Bhopal, India, 198413

13John F. Murphy, Dennis Hendershot, Scott Berger, Angela E. Summers, and Ronald J.
Willey. “Bhopal Revisited.” Process Safety Progress, 33, no. 4 (2014): 310–313.

The Bhopal, India, tragedy occurred on December 3, 1984, in a pesticide plant jointly owned by
Union Carbide (USA) and its affiliate Union Carbide India Limited (UCIL). More than 2500
lives were lost due to inhalation and exposure to methyl isocyanate (MIC) vapor released from
the plant. Another 200,000 people suffered various levels of exposure, with the adverse effects
ranging from blindness to nausea. Many people who survived the incident suffered from severe
health effects for the rest of their lives.

MIC was used as an intermediate chemical in pesticide production and was stored on-site.
This compound is reactive, toxic, volatile, and flammable. The maximum exposure concentration
of MIC for workers over an 8-hour period is 0.02 ppm (parts per million). Individuals exposed to
concentrations greater than 21 ppm experience severe irritation of the nose and throat. Death at
larger concentrations of MIC vapor is due to respiratory distress.

MIC demonstrates a number of other hazardous physical properties. Its boiling point at
atmospheric conditions is 39.1°C, and its vapor pressure is 348 mm Hg at 20°C. The vapor is
about twice as heavy as air, meaning that the vapors stay close to the ground once released. In
addition, MIC reacts exothermically with water. Although the reaction rate is slow, with
inadequate cooling the temperature will increase and the MIC will begin to boil. MIC storage
tanks are typically refrigerated to prevent this.

At the time of the MIC release, the Bhopal plant was under extreme financial pressure. It
was able to sell only about one-third of its design capacity on the Indian market. In June 1984,
the plant’s managers decided to turn off the refrigeration system on the 15,000-gallon liquid MIC
storage tank in an effort to reduce costs. A flare system was also present to burn any MIC vapors
from the storage tank, but the flare was taken out of service several weeks prior to the incident
due to a corroded pipeline. A sodium hydroxide (NaOH) scrubber system was also present to
handle small releases, but it had been taken out of service for cost savings. With the shutdown of
the refrigeration system, flare, and scrubber, no mitigative safeguards remained between the MIC
storage tank and the external environment.

The area around the plant was zoned for industrial use. However, the siting of a major
chemical manufacturing plant at the city’s edge created a large opportunity for employment.
Several shanty towns were built immediately adjacent to the plant and were inhabited by more
than 30,000 people. Zoning laws were in place to prevent the establishment of such shanty
towns, but local politicians looked the other way regarding the enforcement of the zoning laws.

The incident was initiated by water contamination of the 15,000-gallon liquid MIC storage
tank. Many theories have been proposed to explain how this happened, but there is no publicly
available evidence confirming any of these theories. The water caused the MIC to heat up and
boil. The pressure in the storage tank increased until the relief system opened, discharging the
MIC vapors directly into the air. The temperature of the MIC in the vessel was reported to reach
100°C—well above its boiling point. An estimated 25 tons of toxic MIC vapor was released. The
incident occurred during the night when most residents in the adjacent shanty towns were asleep.
The toxic cloud dispersed into the shanty town areas, with tragic consequences: The residents of
the shanty towns suffered many of the deaths and the severest of injuries during the MIC release.

Prior to the incident, Union Carbide was viewed as a large, well-respected, high-tech
American company. In 1980, its annual sales totaled $9 billion. The company had 116,000
employees at 500 sites. It had successfully operated the Oak Ridge National Lab for 40 years—a
very important facility for the U.S. nuclear program. Union Carbide produced many well-
recognized consumer products, including Eveready batteries, Prestone antifreeze, and Linde
gases. Graduating chemical engineers considered Union Carbide a “must interview” company
and a very desirable employer.

Before the incident, Union Carbide stock traded for a price between $50 and $58. In early
1985, after the Bhopal incident, the stock price dropped to $32 to $40. Union Carbide also
became the target of a hostile takeover by GAF Corporation. To repel this takeover, Union
Carbide was forced to sell its consumer products division—its most profitable division. In 1986,
the company sold assets worth $3.3 billion to repurchase 38.3 million shares of stock in an effort
to protect the company from further takeovers. It was able to retain its commodity chemicals
division.

In February 1989, the Supreme Court of India mediated payment of $470 million from
Union Carbide and Union Carbide India. Union Carbide paid the settlement within 10 days of the
order.

The downward spiral of Union Carbide continued until the remaining assets were
purchased by Dow Chemical in 1999. The Bhopal incident was the beginning of the end for
Union Carbide.

In March 1985, the AICHE, responding to industry concerns about the Bhopal incident
and chemical plant safety, established the Center for Chemical Process Safety. According to the
Center, CCPS is “dedicated to improving the ability of engineers to deal with process hazards.”
Today, CCPS is a world leader in chemical process safety.

The Bhopal incident also resulted in a considerable number of industry initiatives and
government regulations related to process safety. Clearly, incidents have a lasting impact on the
reputation of the chemical industry and can change the practice of chemical engineering forever.

Root causes are defined as “failures … that lead to an unsafe act or condition resulting in
[an] accident.”14 For any accident, there are typically multiple root causes. If any of those root
causes did not occur, then the accident would not have occurred. For the Bhopal incident, the
immediate root cause of the incident was the presence of water in the MIC storage [Link]
other root causes occurred, including turning off the refrigeration system, the flare, and the
NaOH scrubber system. If a detailed incident report were publicly available, other root causes
would likely be identified. Although no official, publicly available, and detailed report of the
Bhopal incident was ever published, publicly available information suggests almost all of the 20
elements of RBPS, as shown in Table 1-18, were involved.

14AICHE/CCPS glossary, accessed November 27, 2017.

Example 1-5

For the Bhopal incident, identify the hazard(s), the initiating event, enabling conditions,
conditional modifiers, and safeguards. Also determine whether the safeguards were preventive or
mitigative.

Solution

The hazard of the Bhopal incident was the large quantity of toxic MIC present in the storage
vessel. The initiating event for the incident was the introduction of water into the MIC storage
tank, which caused the temperature of the MIC to increase to its boiling point. The enabling
condition was the large quantity of MIC in the storage vessel.

There were many conditional modifiers, including the presence of the shanty town around
the plant and its large population. Also, the incident occurred at night when everyone was asleep,
and the weather conditions were such that there was little wind to rapidly transport and disperse
the vapors. Emergency response was nonexistent, including emergency response in the
community. These conditional modifiers did not directly cause the incident, but they resulted in
increased consequences of the incident.

The safeguards were the refrigeration unit, flare, and scrubber. None of these were
functioning at the time of the incident. The refrigeration unit was designed to keep the MIC cool
and below its normal boiling point under normal storage conditions. It is not known if it had
adequate capacity to handle the exothermic reaction due to the presence of water. Under normal
circumstances, the refrigeration unit was preventive. The flare was designed to handle the vapors
from the storage vessel; it was mitigative. It is not clear if it could handle the full vapors from the
boiling MIC. The NaOH scrubber was designed only for routine releases from the storage vessel
—most likely due to filling of the vessel and thermal expansion of the liquid. It was probably
mitigative.

1-15 Overview of Chemical Process Safety

Process safety includes hazard identification and evaluation, as well as risk analysis. It can be
simplified to the following questions:

1. What are the hazards?

2. What can go wrong and how?
3. How bad can it be?
4. How often can it happen?
5. What is the risk?
6. How do we control and manage this?

Question 1 is discussed in Chapter 2, Toxicology; Chapter 3, Industrial Hygiene; Chapter 6,

Fires and Explosions; Chapter 8, Chemical Reactivity; and Chapter 11, Hazards Identification.
Questions 2 and 3 are discussed in Chapter 4, Source Models; Chapter 5, Toxic Release and
Dispersion Models; Chapter 6, Fires and Explosions; and Chapter 12, Risk Assessment.
Questions 4, 5, 6, and 7 are discussed in Chapter 12, Risk Assessment.

Chapters 7, 9, 10, and 13 focus on systems designed to prevent specific types of incidents.
Chapter 7, Concepts to Prevent Fires and Explosions, discusses common fire and explosion
prevention methods. Chapter 9, Introduction to Reliefs, and Chapter 10, Relief Sizing, discuss
the primary method to protect process systems from the damaging effects of high pressure.
Chapter 13, Safety Procedures and Designs, presents incident prevention systems in general.

Suggested Reading

General Aspects of Chemical Process Safety

S. Mannan, ed. Lees’ Loss Prevention in the Process Industries, 4th ed. (London, UK: Butterworth-
Heinemann, 2012).

S. Mannan, ed. Lees’ Process Safety Essentials (London, UK: Butterworth-Heinemann, 2013).

D. W. Green and M. Z. Southard, eds. Perry’s Chemical Engineers Handbook, 8th and 9th eds.,
Section 23: Process Safety (New York, NY: McGraw-Hill, 2008 and 2019).

J. A. Klein and B. K. Vaughen. Process Safety: Key Concepts and Practical Approaches (Boca
Raton, FL: CRC Press, 2017).

Accident Statistics

U.S. Bureau of Labor Statistics, [Link]

Marsh and McLennan Companies, The 100 Largest Losses, Large Property Damage Losses in the
Hydrocarbon Industry. Search the web for “100 largest losses.”

AICHE/CCPS 20 Elements of Risk-Based Process Safety

Center for Chemical Process Safety. Guidelines for Risk Based Process Safety (New York, NY:
American Institute of Chemical Engineers, 2007).

Center for Chemical Process Safety. Introduction to Process Safety for Undergraduates and
Engineers (Hoboken, NJ: Wiley, 2016).

Inherently Safer Design

Center for Chemical Process Safety. Inherently Safer Chemical Processes: A Life Cycle Approach,
2nd ed. (Hoboken, NJ: Wiley, 2009).

T. Kletz and P. Amyotte. Process Plants: A Handbook for Inherently Safer Design, 2nd ed. (Boca
Raton, FL: CRC Press, 2010).
 Bhopal Incident

Chemical and Engineering News (February 11, 1985), p. 14.

John F. Murphy, Dennis Hendershot, Scott Berger, Angela E. Summers, and Ronald J. Willey.
“Bhopal Revisited.” Process Safety Progress, 33, no. 4 (2014): 310–313.

Case Histories

U.S. Chemical Safety and Hazard Investigation Board, [Link].

CCPS Process Safety Beacon, electronically published monthly by email subscription and available
at no charge in many languages. [Link]

Problems

Engineering ethics: Write an essay on why you think safety (and process safety) is an important
part of any engineering ethics statement.

Classify the following from 0 to 5 based on the hierarchy of safety programs provided in Table 1-
3. Explain why.

1. The company and plant executive teams are very receptive to any safety suggestions and the
suggestions are reviewed and implemented on a timely basis.
2. A change is made in a laboratory apparatus after a valve has leaked.
3. A change is made in a laboratory apparatus after a JSA review is completed.
4. The faculty member in charge of a laboratory has very little knowledge about safety.
5. The faculty member in charge of a laboratory states that “Safety is very important!” but does
nothing after a small accident.
6. The company uses several leading safety metrics to assess its safety program.
7. The laboratory meets all the rules in the safety manual.
8. The faculty member in charge of a laboratory states that the safety program is interfering with
the research efforts.
 9. The laboratory is a mess.

Safety culture: Classify the following activities as either strengthening or weakening process
safety culture. Explain why.

1. The plant manager schedules an important safety meeting that everyone must attend. At the
meeting, the plant manager introduces a person from corporate safety and then excuses
himself, stating that he has a more important meeting to attend elsewhere.
2. The faculty member in charge of a research lab states that not everyone in the laboratory
needs to wear safety glasses—only people who are doing hazardous operations. Visitors also
do not need to wear safety glasses.
3. The faculty member in charge of a research laboratory states that “No work is ever done in a
clean lab!”
4. The faculty member in charge of a research laboratory states that his students—not him—are
in charge of the safety program and does little else.
5. The plant manager institutes a suggestion box for safety ideas, and these ideas are discussed
and resolved at the required safety meeting.
6. A suggestion box for safety ideas is implemented, but it takes the plant management many
months to respond to the suggestions.
7. A research laboratory requires safety glasses, but the workers in the lab must purchase their
own safety glasses.
8. A research laboratory requires safety glasses. The safety glasses are provided but are available
only in a room down the hallway.
9. The laboratory safety manual has not been reviewed or updated in many years.
10. The faculty member in charge of a teaching lab tells the students that they have primary
responsibility for safety, and the faculty member provides the training, resources,
management and continuous auditing to ensure that the students are successful.

Individual and societal risk: For the following cases, identify the primary risk population, classify
the case as involving individual risk and/or societal risk, and identify the risk as voluntary or
involuntary.
1. A worker does not wear the required personal protective equipment for the chemicals being
used.
2. A large butane storage facility is built next to a congested neighborhood.
3. A person drives a car from New York to Los Angeles.
4. A person drives a car without wearing the seat belt.
5. A person drives a car while intoxicated.
6. An airplane is produced with a manufacturing defect.
7. A tank truck containing gasoline is driven from the refinery to the gas station for unloading.
8. An underground pipeline is routed through a residential area.
9. A person climbs a cliff face solo.

Safety metrics: Classify the following as either leading or lagging safety metrics. Explain why.

1. Number of reports of unsafe activities in a plant

2. Number of near-miss incidents
3. Money spent on insurance claims
4. Number of visits to the plant first aid facility
5. Number of process alarms that were managed without incident
6. Time duration to complete maintenance

Accident and loss statistics: Return to Example 1-1. For parts (b) and (c), the length of time for
both the hours-based fatal injury rate and the recordable incidence rate was 1 year. What time
period is required for the hours-based fatal injury rate and the recordable incidence rate to be
equal to the chemical manufacturing rates?

Accident and loss statistics: If the U.S. population in 2014 was 325 million people, calculate the
deaths per 100,000 people from lightning strikes using the total fatalities from lightning in Table
1-13. Also calculate the fatality rate.

Use the risk matrix in Table 1-14 to determine the risk level for the Bhopal incident. Estimate the
severity category, the safety severity level, the likelihood, and the risk level.
 Codes, standards, and regulations: Go to the [Link] web site and look up the OSHA
regulation CFR 1910.119: Process Safety Management of Highly Hazardous Chemicals. Use
Appendix A to determine the threshold quantities for the following chemicals. If your plant site
exceeds this threshold quantity, then this standard applies.

1. Ammonia, anhydrous
2. Chlorine
3. Hydrogen fluoride
4. Propylene oxide

Safeguards: Classify the following safeguards as either preventive or mitigative.

1. A safety instrumented system to shut down a process if an unsafe operating condition occurs.
2. A foam system to reduce evaporation from a pool of leaked hydrocarbon.
3. A dike around a storage vessel.
4. A flow limiter is installed on a feed line to a chemical reactor to ensure that the reaction rate
does not exceed a maximum value.
5. Covers are placed over pipe flanges to prevent liquid spraying.
6. A containment pond is built to collect any liquid runoff from a plant.
7. A relief device is installed on a chemical reactor to protect the reactor vessel from the
damaging effects of high pressure.
8. A containment system is installed to collect the effluent from a relief device.
9. The basic process control system.
10. An emergency alarm system.
11. An alarm system to notify the operator of out-of-limits process conditions.
12. A gas chromatograph is installed to confirm chemical concentrations in a process.
13. All plant operations personnel are given yearly emergency response training.

CCPS elements: Classify the following activities as being most directly related to one of the 20
elements of RBPS. Although many elements may be involved, list only the single most
applicable element. An element may be used more than once.
 1. The plant has an open house for the local community.
2. A plant-wide emergency response drill is completed once each quarter.
3. A wide selection of courses on process safety are made available to the employees, and they
are given the time and the motivation to enroll and complete the courses.
4. The plant manager demonstrates a shared responsibility for the plant safety.
5. All contractors on site are required to watch a video with an overview of the plant process
safety and may be required to complete additional safety training depending on the type of
work.
6. Participation in monthly safety meetings is required of all workers.
7. A small incident is investigated by the safety committee, with a final report being issued with
recommendations and follow-through.
8. A permit system is developed to ensure that no welding or open flames are present when
flammable liquids are handled.
9. Critical safety instrumentation is calibrated on a regular basis by the instrumentation
personnel.
10. The plant site is audited on a regular basis by the corporate safety personnel.
11. Plant operating procedures are reviewed and updated to ensure that they conform to actual
practice.
12. A management system is developed to ensure that all replacement equipment is identical in
function to the original equipment.
13. When the electrical code changes, the plant staff reviews the changes to ensure that the plant
meets the revised codes.
14. A hazard identification procedure is implemented for all existing processes.
15. Technical documents, engineering drawings and calculations, and equipment specifications
are placed online for all workers to use.
16. A shutdown process is verified to be in a safe condition for restart.
17. A documented operations program is established to maintain reliable worker performance.
18. Leading and lagging metrics are established to gauge process safety performance.
19. An annual evaluation is developed to determine if management systems are performing as
intended.
20. Appropriate information is made available to people who need it.

Inherently safer design: Which inherently safer design strategy applies to each of the following?

1. A flammable solvent is used to control the temperature in a reactor. The solvent is replaced by
a nonflammable solvent.
2. A valve that requires 10 turns to close is replaced by a quarter-turn valve.
3. The equipment in a process can withstand 10 bar gauge (barg) of pressure even though the
actual process operates normally at 5 barg. The pressure relief valve opening pressure is
reduced from 10 barg to 8 barg.
4. A plant stores a large quantity of a hazardous intermediate chemical to keep the plant
operating during upsets in the upstream process. The intermediate storage is eliminated and
the process reliability is improved to prevent upsets and downtime.
5. An alternative reaction pathway is used that involves less hazardous raw materials.
6. The trays on a distillation column are replaced by structured packing, which operates over a
wider range of operating conditions.

Additional homework problems are available in the Pearson Instructor Resource Center.