CET vol 99 DOI: 10.3303/CET2399034 Paper Received: 10 December 2022; Revised: 18 March 2023; Accepted: 28 April 2023 Please cite this article as: Perelli S., Zanon G., Carluccio L.M., 2023, Achieving Effective Process Safety Through Incident Investigation, Chemical Engineering Transactions, 99, 199-204 DOI:10.3303/CET2399034 CHEMICAL ENGINEERING TRANSACTIONS VOL. 99, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Sauro Pierucci, Flavio Manenti Copyright © 2023, AIDIC Servizi S.r.l. ISBN 978-88-95608-98-3; ISSN 2283-9216 Achieving Effective Process Safety Through Incident Investigation Sara Perelli*, Gianluca Zanon, Leonardo Michele Carluccio DEKRA Italia s.r.l., Process Safety Business Unit, Via Fratelli Gracchi 27, 20122 Cinisello Balsamo (MI) sara.perelli@dekra.com A robust Process Safety system is crucial in reducing the risk of a catastrophic event to tolerable levels. Among the twenty PSM elements identified by CCPS, Incident Investigation provides an opportunity for organizations to learn valuable lessons from minor incidents that then help prevent major disasters. Choosing the right methodology for Incident Investigation facilitates the process and must be tailored to the purpose and available resources in order to be effective. Care should be exercised, however, when searching for the relationship between minor incidents and full-blown catastrophes, in order to fully exploit the potential of Incident Investigations and use their results as drivers for Process Safety risk reduction. While most organizations have Incident Investigation processes in place, statistical evidence shows that the lessons learned during investigations seldom take root, resulting in repeated accidents. This is most likely caused by the lack of implementation of the changes (or root actions) required. A particularly important role in incident investigation is played by near-misses, as they represent valuable sources of information and provide helpful opportunities for learning. A near-miss is much less grievous than a full-blown disaster: evidence is usually easier to find; people are more willing to be frank; and greater frequency means learning can happen more often and more consistently. This article discusses how thorough investigations and appropriate follow-up combined with increased attention on near-miss events can translate into safer operations and fewer tragedies. 1. Introduction In the first 20 days of 2023 alone, a number of Process Safety Incidents were responsible for several fatalities, as summarized in the list below: • Propane distribution factory explosion, Canada, 12th January: 3 fatalities (Hazardexonthenet.net, 2023a); • Hazardous waste facility explosion, Canada, 12th January: 1 fatality (Hazardexonthenet.net, 2023b); • Gas pipeline explosion, Lithuania, 13th January: no casualties (Wikipedia Contributors, 2023); • Petrochemical plant explosion, China, 15th January: 5 fatalities (Reuters, 2023); • Oil tanker explosion, Thailand, 17th January: 1 fatality (Marine Insight, 2023). According to the Center for Chemical Process Safety, a Process Safety Incident is an event that is potentially catastrophic, involving the loss of containment of hazardous materials that can result in large-scale health and environmental consequences (CCPS, 2010). As can be inferred from the list above, reduction of Process Safety Incidents is still today a difficult goal to achieve. If the accidents above were to be systematically analysed, the results would probably point to the same root causes that have contributed to many other Process Safety Incidents in the past. It is widely understood that the only way to nullify the risk (and reduce to zero the occurrence of Process Safety Incidents) is removing the hazard, but as the world cannot make do without pharmaceutical, food, chemical and petrochemical industries, the risk of major incidents needs to be accounted for and properly managed. What can be done is continuing to learn from previous mistakes, improving the analysis techniques in order to progressively reduce this risk and put all possible efforts into analysing and implementing the results that come out from these studies. 199 The efforts made in this direction led to the creation, among other things, of the Process Safety Management (PSM) System: one of the key elements of PSM is incident investigation, meaning the branch that analyses accidents and near-misses that have occurred, so to avoid them in the future. The analysis of accidents (and near-misses) however, must not be an end in itself, but must be included in a continuous improvement cycle, so that it can serve as a basis for future risk analyses. As such, incident investigation should be included in a Management System that allows to keep track of the recommendations that have emerged, supporting the implementation of these recommendations, and facilitating the diffusion of information not only within the company, but also outside. All Management Systems are based on the Deming Cycle: Plan, Do, Check and Act (Figure 1). In a Management System whose objective is to avoid major accidents (and many fatalities), even more importance should be given to this concept of never stopping and using all past experiences to reduce the risks and therefore the future accidents. Only by combining efforts and knowledge of all involved stakeholders will it be possible to achieve satisfactory results in a short time. Figure 1: Representation of PDCA Cycle adapted by SafetyCulture (Reyes, 2022). 2. Process Safety Management System The Center for Chemical Process Safety (CCPS) was established back in the 1980s by the American Institute of Chemical Engineers (AIChE), as an active response to the catastrophic incidents of Bhopal and San Juan Ixhuatepec. Its goal was to develop the tools required to comprehensively identify, assess and manage Process Safety risks, and resulted in the creation of a Process Safety Management System (PSM). Such system focuses on prevention of, preparedness for, mitigation of, response to, and restoration from catastrophic releases of chemicals or energy from a process associated with a facility (CCPS, 2010). One of the many outcomes of PSM has been the Risk-Based approach, which highlights how all hazards (and related risks) are different. In a Risk- Based methodology it is possible to provide a ranking for all the assessed risks (from the highest to the lowest), which helps define an effective strategy in which the most dangerous situations are addressed first. As a result, companies can efficiently invest in Process Safety matters their often-limited resources. CCPS identified twenty Risk-Based Process Safety Elements, as shown in Table 1, divided into four Accident Prevention Pillars. This structure should guide organizations in their investments and efforts, furthering the development of a more effective Process Safety system, reducing the number of incidents and improving environmental and business performance. The present paper focuses on the last pillar, the so-called “Learn from Experience”. There is widespread agreement in the hazardous industries that lessons learned are critical to reducing accident risk (Wood et al., 2022). The idea is far older than chemical Process Safety. Biblical reference to history repeating itself is as early as Ecclesiastes 1:9: ‘There is nothing new under the sun’, and it has been taken for granted since the beginning of the industrial age that we need to learn from technological disasters to prevent similar tragedies. 200 Table 1: Risk-Based Process Safety (RBPS) Elements Accident Prevention Pillars RBPS Element Commit to Process Safety Process Safety Culture Compliance with Standards Process Safety Competency Workforce Involvement Stakeholder Outreach Understand Hazards and Risk Process Knowledge Management Hazard Identification and Risk Analysis Manage Risk Operating Procedures Safe Work Practices Asset Integrity and Reliability Contractor Management Training and Performance Assurance Management of Change Operational Readiness Conduct of Operations Emergency Management Learn from Experience Incident Investigation Measurement and Metrics Auditing Management Review and Continuous Improvement One of the most famous quotations attributed to Confucius says “By three methods we may learn wisdom: first, by reflection, which is noblest; second, by imitation, which is easiest; and third by experience, which is the bitterest”. Considering this framework in light of Confucius’ assessment, “Hazard Identification and Risk Analysis” would clearly best represent “learning by reflection”; “Learning by imitation” can be metaphorically compared to “Compliance with Standards”. Designing a process based on standards and regulations is like imitating practices carried out in the past. Last but not least, “Learning by experience” can be identified with the “Incident Investigation”. Moreover, experience is something everyone uses from an early age in order to learn how the world works. So, it is possible to conclude that experience is something that man has always used to improve his way of life and there is no reason it cannot be used to reduce Process Safety Incidents. But Incident Investigation needs to be carried out in the correct way to be effective. The purpose of the Incident Investigation element is not only to describe how an incident should be analysed in order to understand its causes, but also how a company should track the information and implement the lessons learned. A good Incident Investigation process should not stop after finding the root causes of an event, that should be only the starting point. Most people are confused on the scope of the Incident Investigation. In fact, they can think that Incident Investigation is used to assign blame to personnel involved in an incident, but this approach results in ineffective recommendations being implemented (CCPS, 2010). Indeed, removing the culprit is certainly not the solution in order to avoid future accidents. If the accident occurred, it is because there was the "ideal" context for it to occur. Therefore, the root causes that led to the event will have to be investigated. A much better approach is identifying the causes of an event to develop valuable recommendations that could help the company (or even better, in a visionary world, all the companies that share the same process / substance / type of plant) to avoid future accidents with the same underlying, system-related causes. 3. Process Safety Incident and Near-Miss It is important to understand how the Incident Investigation can be efficiently applied to Process Safety. Nearly a century ago, Herbert William Heinrich, an assistant superintendent at an insurance company, analysed thousands of incident reports to formulate an early scientific theory of incidents. He summarized his findings in a seminal book and in what is nowadays commonly known as the Heinrich triangle (or pyramid), shown in Figure 2. Heinrich’s main thesis was fairly simple: there is a constant numeric ratio between the different incident severity categories, i.e., for every 600 near-misses there will be, on average, one fatal incident. One would be tempted to conclude, along with Heinrich, that reducing the number of near-misses (or minor incidents) would automatically mean a reduction in fatalities and, even, in catastrophic events. Unfortunately, experience has taught us otherwise. The problem here is one well known to statisticians and logicians: one cannot infer 201 causation from correlation. In other words, and contrary to Heinrich’s thesis, we cannot expect that by reducing the number of minor incidents we will achieve a commensurate reduction in fatalities. Figure 2: DEKRA interpretation of the Heinrich's pyramid. This is mainly due to two contributing factors: first, low severity injuries do not have the same potential of occurrence as serious ones; second, injuries of differing severity do not have the same underlying (root) causes. Consequently, it would seem that Incident Investigation is applicable only in case of major accidents. This would mean being able to act only after major consequences have occurred. Also, there are very few major accidents compared to the number of near-misses or minor accidents (as the Heinrich’s pyramid reminds us). Finally, in case of a new process, no historical data would be available to be investigated until the first major event. Actually, Process Safety Incident Investigation can be really useful not only after a major incident, but also in case of near-misses, and that is because there are the numerous minor incidents that have: • the potential to escalate into a major incident, or • common causes with major incidents. These minor incidents are of the utmost importance ad they have the potential to escalate into a Process Safety event and cause serious injuries or fatalities (often referred to as SIF). In this context, Incident Investigation of minor events provides a fantastic opportunity to learn major incident prevention lessons “for free”, meaning that it can provides results without having to experience the harm first. Moreover, it is not rare that a major accident in the chemical and in process industry was caused by “atypical scenario”, that may be defined as unexpected scenarios which were not identified by conventional hazard identification processes. Common HAZID techniques are often unable to capture low probability or little-known accidents. The HAZID process also has a large potential for human error with little or no feedback pertaining to those errors (Paltrinieri et al., 2011). It is clear that hazard identification cannot be the only tool to prevent or at least reduce the frequency of Process Safety events, but Incident Investigation is required too. Accident investigation and risk analysis are intricately part of the same process of increasing the resilience and coping capacity of systems in the face of potential hazards. Experience has shown that there is a natural relationship between Accident Investigation and risk assessment, and there are several advantages for having an active cooperation between them (ESReDA, 2009). The two approaches can be seen as complementary to each other. And near-miss can be one of the links between them. Carrying out a HAZOP or a HAZID based on a list of near- misses that the plant encountered in the previous years, it could help to unearth future causes of incidents. Of course, it is required a good PSM system in place to track all the near-misses that happen inside of the company. Near-misses have another advantage that is directly connected to the previous point: They can be studied from a statistical perspective. In case of a major incident the main analysis that is carried out is always a Root Cause Analysis (or similar). RCA is resource-consuming, in terms of time, people and money. In case of near-misses it is always possible to carry out an RCA, but it is also possible to develop a statistical analysis, which is easier and requires less resources. 202 A good example could be a company that has two very similar plants. The statistical analysis could enable the detection of some design issue: let’s take for example one plant (Plant A) that needs to be stopped every month for extraordinary maintenance, while a similar plant (Plant B) is regularly shut-down only for planned maintenance. Looking at the statistical analysis, it would be clear that Plant A is not working properly, and a deeper look could reveal that the there is some basic issue with the design of the plant. This could give the opportunity to prevent a certain number of accidents with a relatively small economic impact. In addition, a near-miss is much less fraught than a full-blown disaster: evidence is usually easier to find; people are more willing to be frank; and greater frequency means learning can happen more often and more consistently. 4. Process Safety Incident Investigation and follow-up Root Cause is defined as “causal factor with no predecessor that is relevant for the purpose of the analysis” (IEC 62740, 2015): applying this definition within the framework of a Process Safety Management System, a Root Cause can be identified as a deficiency of the Management System that allowed the onset of a causal factor. Such deficiency is usually a performance gap, meaning the difference between the expected performance of an item (a piece of equipment, a person, a barrier, a procedure, etc.) and its real operation. Root Causes can be eliminated by implementing appropriate Root Actions, which are corrective measures aimed at fixing the performance gaps identified within the PSM. Those measures, taken together, break the causal network and prevent the focus event occurring again. In this sense, Root Actions are meant to address the underlying cause of a problem, rather than just the “symptom”. Root Actions need to be practical, effective and realistic, and care should be taken that the identified actions do not introduce new hazards or risk within the system. Additionally, adequate Process Safety improvement can only be achieved if the Root Actions are implemented in a timely manner: the longer a gap in PSM is left unresolved, the more likely it is for an accident to occur again. For this reason, a Root Cause Analysis should not be considered finished until each action is assigned an owner and a deadline for its implementation. At the end of an Incident Investigation, it is fundamental to communicate findings externally. Auditors and the company itself should always share findings and lessons learned with industry peer group, respecting business confidentiality (CCPS, 2010). Lessons learned can be discussed during conferences or can be added to specific tool developed by many authorities and institutions all around the world. For example, in the Netherlands, the “Safety First” programme (Veiligheid Voorop, 2020) published a paper on the value of sharing information at sector level. In this way other companies and sectors can learn from specific and particular incidents or near- misses (Manuel et al., 2022). The often-mentioned CSB (U.S. Chemical Safety and Hazard Investigation Board), an independent federal agency based in the United States, publishes outcomes of investigations of incidents for all to benefit. In Europe, as specified in Annex VI of the Seveso III Directive, major accidents must be reported into the Major Accident Reporting System (MARS). Like any element of a Management System, Incident Investigation should be part of a continuous improvement cycle, enabling companies to intervene proactively, based on previous experiences. In a Process Safety Management System, this translates into capitalizing on the lessons learned from accidents and near-misses, using this newly acquired knowledge as additional input information for the other Pillars of the RBPS. All the corrective measures that emerge from an Incident Investigation are functional to reducing the probability of Process Safety Incidents in the future: there is value in the statistical significance of a near-miss analysis, as there is equal value in using the results of an RCA to identify possible process deviations otherwise not considered in any HIRA (Hazard Identification and Risk Analysis) study. Based on the outcome of an Incident Investigation, companies should prompt the review a study (even a recent one) that did not include specific causes, or that wrongly considered them as non-credible. This way, an exercise in Incident Investigation provides added value for everyone involved in the safety of the plant, shedding light on causes that would otherwise have gone unnoticed. Many severe events in the process industry were caused by “atypical scenarios”, that may be defined as unexpected scenarios which were not addressed by standard hazard identification analyses (Paltrinieri et al., 2011). This derives from the fact that often some chains of events had never occurred all together, but most likely they occurred individually several times without leading to serious consequences. Therefore, by implementing the results of Incident Investigations conducted on near misses, it allows to intervene in this chain of events by working not on the entire chain, but on a single chain link. 5. Conclusions A sound organizational Process Safety System is key in reducing the risk of a catastrophic event to tolerable levels. Among the twenty elements identified by CCPS as essential for Process Safety performance in its Risk- 203 Based Process Safety framework, Incident Investigation is crucial in that it provides an opportunity for organizations to learn valuable lessons from minor incidents that then help prevent major disasters. Choosing the right methodology for Incident Investigation facilitates the process and must be tailored to the purpose and available resources in order to be effective. Major accidents, fortunately, do not happen every day; moreover, it is often difficult to be able to analyse a catastrophic event, due to the complexity of the event itself and due to lack of information. It would therefore seem that the Incident Investigation is limited by a rather limited database of events and information. However, these limits can easily be overcome if near misses are also included in the Incident Investigation. As Heinrich's pyramid shows us, these occur in a much higher number than major accidents. In case of a near miss, it is also easier to trace the root causes with respect to a major event. On the one hand there are usually fewer linked events (which otherwise could have led to a tragic accident), on the other hand the stakeholders are more inclined to share all the information as no deaths and huge economic damages are involved. Once a Root Cause has been identified, it is necessary to move on to the next step, that is to make improvements or even technical or organizational changes to the process. For this reason, whenever the Root Cause of an event has been defined, it is necessary to associate it with a Root Action. In fact, having understood what is at the root of the problem, action must be taken to prevent it from generating future accidents. Sharing the information should be the following step and should always be at the basis of the Incident Investigation. In fact, sharing the results of the analyses with all the stakeholders not only facilitates the dissemination of vital information that can also be absorbed and re-processed by different realities all over the world, but it also allows people to focus on different problems, increasing the number of events and causes investigated. In this way, even (but not only) a recent plant with little experience behind it will be able to increase the effectiveness of the risk analyses conducted. In fact, starting from results shared by plants with similar processes and by carrying out historical research on Incident Investigations conducted on them, it will be possible to generate a database of deviations and causes that otherwise would have remained undetected. References Center for Chemical Process Safety (CCPS). Guidelines for risk-based Process Safety. John Wiley & Sons, 2010. European Safety Reliability and Data Association (ESReDA). Guidelines for Safety Investigations of Accidents, 2009. Hazardexonthenet.net. (2023). Three people killed in propane factory explosion. [online] Available at: https://www.hazardexonthenet.net/article/195434/Three-people-killed-in-propane-factory-explosion.aspx [Accessed 14 Apr. 2023]. Hazardexonthenet.net. (2023). Explosion at Hazardous Waste Facility Kills Worker. [online] Available at: https://www.hazardexonthenet.net/article/195442/Explosion-at-hazardous-waste-facility-kills-worker.aspx [Accessed 14 Apr. 2023]. International Electrotechnical Commission (2015) IEC 62740 Root Cause Analysis (RCA), Geneva, Switzerland. Manuel H.J., Kooi E., Wolting B., 2022, Learning from incidents at Seveso sites: a focus on the safeguarding of containments prior to start of operations, Chemical Engineering Transactions, 90, 637-642. Marine Insight. (2023). Oil Tanker Explodes in Thai Waters. [online] Available at: https://www.marineinsight.com/videos/video-oil-tanker-explodes-in-thai-waters-blows-up-workers-leg-500- m-away/ [Accessed 14 Apr. 2023]. Paltrinieri N., Tugnoli A., Bonvicini S., Cozzani V., 2011, Atypical Scenarios Identification by the Dypasi Procedure: Application to Lng, Chemical Engineering Transactions, 24, 1171-1176. Reuters (2023). China Petrochemical Plant Shut after Deadly Explosion. Reuters. [online] 16 Jan. Available at: https://www.reuters.com/world/china/china-petrochemical-plant-shut-after-deadly-explosion-sources-2023- 01-16/ [Accessed 14 Apr. 2023]. Reyes, J. (2022). PDCA: Meaning, Stages, & Importance. [online] SafetyCulture. Available at: https://safetyculture.com/topics/pdca/. Veiligheid voorop (‘Safety first’) (2020). Handbook for better learning from incidents in the (petro)chemical industry (Dutch) [online] https://crisislab.nl/. Veiligheid Voorop, de VNCI en de zes Regionale Veiligheidsnetwerken. Available at: https://crisislab.nl/wordpress/wp-content/uploads/Handreiking-leren- van-incidenten.pdf [Accessed 14 Apr. 2023]. Wikipedia Contributors (2023). 2023 Lithuania–Latvia Pipeline Explosion. [online] Wikipedia. Available at: https://en.wikipedia.org/wiki/2023_Lithuania%E2%80%93Latvia_pipeline_explosion [Accessed 14 Apr. 2023]. Wood M.H., Koutelos K., Hailwood M., Cowley C., 2022, Learning lessons from chemical incidents – What’s stopping us and how we can make it happen, Chemical Engineering Transactions, 90, 685-690. 204 111perelli.pdf Achieving Effective Process Safety Through Incident Investigation