1
INTRODUCTION

"Learning is not compulsory... neither is survival."

-W. Edwards Deming, Engineer and Management Consultant

Nearly everything we do today, as we manage process safety to prevent losses of primary containment that result in fires, explosions, and toxic releases, we do because of conditions that led to past incidents. Our engineering forebears began building the modern practice of process safety at the beginning of the industrial revolution. Subsequent generations have steadily advanced process safety.

For example, when E.I. DuPont built a black powder works in Delaware, USA, in 1802, he took note of the explosions that had happened in other black powder works. To protect his workers, family, and property, his process buildings were constructed of thick stone, with blow-out walls aimed away from people and buildings (Klein 2009).

Similarly, Sir Humphrey Davy noted the large number of coal dust explosions in English mines in the early nineteenth century (Gibbs 2020). After talking to miners who survived such explosions, he designed an explosion-proof lamp based on principles still used today in flame arrestors and explosion-proof electrical boxes (Figure 1.1).

Figure 1.1 The Davy Lamp

In 1880, H.R. Worthington, A.L. Holley, and J.E. Sweet founded the American Society of Mechanical Engineers (ASME) to create uniform engineering standards that would ensure safety, reliability, and efficiency (ASME 2020).

Working on behalf of the chemical engineering profession, the American Institute of Chemical Engineers (AIChE) began to share findings and recommendations from process safety incidents via the Ammonia Plant Safety (Williams 2005) and Loss Prevention Symposia in the 1950s and 1960s (Freeman 2016). AIChE's Design Institute for Emergency Relief Systems (DIERS) began publishing guidelines for multiphase relief systems in the 1970s (AIChE 2020a).

Until the mid-1980s, institutional lessons learned came in the form of technology innovations, new or revised standards and codes, or back-up systems. This began to change with the formation of AIChE's Center for Chemical Process Safety (CCPS) in 1985. CCPS began the process of formally leveraging incident findings and successful practices into "Guidelines" and "Concepts" (Berger 2009). In 1988 CCPS codified the first Process Safety Management System (PSMS). The CCPS 12 Elements (CCPS 1989) provided the first organized common framework to comprehensively manage all the standards, technologies, and practices needed to control a company's process safety hazards. The original framework has evolved into today's 20 elements of Risk Based Process Safety (RBPS), which are organized in four pillars: Commit to Process Safety, Understand Hazards and Risk, Manage Risk, and Learn from Experience (CCPS 2007).

Regulations around the world also began to emerge in the 1980s, most notably the Sevesso Directive in the European Union, the Process Safety Management (PSM) regulation in the USA, and the Control of Major Accident Hazards (COMAH) in the UK. Most national and regional process safety regulations are based on one or a combination of these original regulations.

Unfortunately, incidents continue to happen despite 200 years of continuous development of technology, standards, publications, and management systems. They continue to happen despite the great number of recommendations from incident investigations conducted by every operating company in this industry. And nearly every incident that occurs in an industry, a company, or a plant has root causes that resemble the causes of previous incidents.

1.1 The Focus of this Book

CCPS (CCPS 2019a) and others have written guidelines addressing the general process of incident investigations. These books focus heavily on the process of investigation, the determination of root causes and causal factors, and the process of developing findings and recommendations. CCPS and others also have published books that describe past incidents to extract the lessons that could be learned from them (Gil 2008; CCPS 2019b; Kletz 2019; Hopkins 2008; Hopkins 2012). What's more, CCPS provides several publications addressing how to drive a culture of improvement in process safety (CCPS 2018; 2019c).

Just the same, incidents that look the same as previous incidents continue to occur-whether they happen at a site, or within a company, or replicate well publicized external incidents. Section 3.2 will discuss the numerous reasons companies fail to learn, including but not limited to:

• imbalance between production and safety
• corporate culture problems
• employment turnover
• financial or liability concerns
• lack of employee involvement
• lack of leadership ownership of process safety
• lack of sense of vulnerability
• knowledge remaining in silos
• normalization of deviance.

This book seeks to help companies overcome the reasons they fail to learn. It greatly expands on the process for:

• Seeking and obtaining key findings from external incidents.
• Translating findings into lessons learned. And especially
• Converting these lessons learned into institutional knowledge.

While the examples in this book focus on learning from incidents outside the company, the process described in this book can-and should-be applied to transform findings from internal incidents and near-misses into institutional knowledge.

Let's define some key terms for this book. Note that most of these terms can be found in the CCPS glossary, while a handful are specific to this book.

• Causal factor: A major unplanned, unintended contributor to an incident (a negative event or undesirable condition) that, if eliminated, would have either prevented the incident or reduced its severity or frequency.
• Root cause(s): A fundamental, underlying, system-related reason why an incident occurred that identifies a correctable failure(s) in management systems. There is typically more than one root cause for every process safety incident.
• Findings: The root causes and causal factors of the incident, as determined by the investigator.
• Near-miss: An event in which an accident (that is, property damage, environmental impact, or human loss) or an operational interruption could have plausibly resulted if circumstances had been slightly different.
• Lessons learned: The process of applying knowledge gained from past incidents in current practices.
• Institutional knowledge: The translation of the lessons learned by the experts into the company's standards and policies, its PSMS, its culture, and into the rigor and professionalism with which it manages process safety.

The difference between the latter two terms is critical in this book. Specifically, individuals do the primary learning, and then work with others in the organization to translate what they learned into improvements to 1) the corporate PSMS, 2) relevant standards and policies, and 3) designs and practices in company facilities. Only once these improvements are in place, are being followed, and are being managed on a reliable ongoing basis do lessons learned become institutional knowledge.

After making the case for continuous learning from incidents, we will evaluate ways that individuals and companies learn. We will then describe a recommended model for continuous corporate change driven from incidents, the Recalling Experiences and Applied Learning (REAL) Model. Next, we will provide a variety of scenarios that show companies in different industries applying this model to transform findings from incidents into institutional knowledge-and permanently retain that knowledge.

1.2 Why Should We Learn from Incidents?

In 1995 The Dow Chemical Company established a "Generational Goal" of reducing its process safety incidents by 90% between 1996 and 2005. Dow took many proactive steps including:

• implementing a rigorous process safety management system
• establishing centers of excellence
• defining key roles for leaders in driving process safety improvement
• learning from internal and external incidents.

Additional detail may be found in the reference (Champion 2017). Although Dow didn't quite meet its initial goal, the reduction in incidents was still quite significant. Inspired by the progress, Dow set a new goal: to reduce incidents by another 75% by 2015. However, by 2008 Dow realized that, for the past five years, their performance had effectively plateaued. Other members of the American Chemistry Council (ACC) had the same result, as shown by the dotted and dashed lines in Figure 1.2.

Figure 1.2 Incident Reduction Case Study (Champion 2017)

Dow analyzed the bottlenecks preventing further incident reduction and noted that many incidents had the same management system failures and causal factors: asset integrity and work practices related to corrosion under insulation (CUI). Dow sought out findings, recommendations, and best practices related to these factors from many internal and external sources. They translated what they learned into new standards, updated their PSMS, and drove...