Click for next page ( 142


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 141
8 Post-Incident Retrospective Process Assessment Part 3.5 of this study’s statement of task was to “[c]omment, if possible, on whether and how inherently safer process assessments can be utilized during post-incident investigations.” Unlike the preceding chapter, this portion of the task looks beyond Bayer and requires broad consideration of the application of inherently safer process (ISP) assessments under these circumstances. The conclusion from the analysis presented here is that the principles of ISP assess- ment can be used to good effect in conducting an incident investigation when the objective is the prevention of potential incidents having similar funda- mental, underlying (root) causes. Examples are provided to demonstrate how this might be done and the extent of current practice in this regard. This chapter also provides information regarding emergency response systems and discusses how ISP assessments could be used to improve and support effective emergency planning and response. INCIDENT INVESTIGATION—AN ESSENTIAL COMPONENT OF A SAFETY MANAGEMENT SYSTEM As noted in Chapter 7, incident investigation is not a one-time, stand-alone event, but instead a necessary element within a functioning process safety man - agement (PSM) system. Indeed, it is one of the mandatory elements of OSHA’s PSM standard, which requires, “the investigation of each incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical in the workplace” (Department of Labor, 2000). Comprehensive protocols and advice are available for conducting inves- tigations of chemical process incidents (e.g., CCPS, 2003). Such guidelines 141

OCR for page 141
142 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE emphasize the need for a PSM system to be simultaneously retrospective and prospective, with incident investigation providing the vital bridge between the lessons of the past and safer designs and operation in the future (CCPS, 2003). This point is expanded upon in the following sections. Relationship Between A Priori and Post-Facto Assessment Although advance preparation is essential, incident investigations are con - ducted after the fact—that is, after a loss-producing event or a near-miss has occurred. In conducting a post-incident process assessment, it is important to avoid the problem of hindsight bias. Hindsight bias, known commonly as “Monday morning quarterbacking” or “20-20 hindsight” is the tendency to view events as more foreseeable or more inevitable after the fact than they actually would have appeared at the time actions needed to be taken (Fischhoff, 1975; Blank et al., 2007; Louie et al., 2007). In particular, anyone who is judging the safety of a facility after an incident has information that was not available to those who conducted any pre-incident process assessment. Although most people recognize it would be unfair to use later information to second-guess earlier decisions, research on hindsight bias cited above has shown that cognitive biases can limit our ability to recognize the additional information that we have acquired after the event. While such new information should never be ignored, it is important to acknowledge that critical factors may not have been obvious before an incident, because this can help identify new opportunities for analysis, monitoring, communication, etc. The chain of events that produced a chemical release is obvious in retrospect because it happened, even though it might not have been obvious in prospect because safety analysts failed to imagine that such an event chain could happen. In such cases, it is important to judge what the safety analysts could reasonably have been expected to anticipate by examining the safety analyses conducted in other facilities. If facilities with similar designs had also failed to anticipate that chain of events, then those conducting a pos-tincident process assessment should be wary of the effects of hindsight bias. However, if facilities with similar designs had anticipated that chain of events, then those conducting a post-incident pro - cess assessment should be less concerned that their analyses are being affected by hindsight bias. Alternatively, it might be that the probability (rather than the possibility) of that chain of events might seem more likely in retrospect than in prospect because a pre-incident safety assessment underestimated the probability that such an event chain could happen. In this case, it is important to balance the possibil- ity that the post-incident process assessment is being affected by hindsight bias against the possibility that any pre-incident process assessment was affected by optimistic bias (Weinstein, 1989), also known as comparative optimism (Klar and Ayal, 2004). In other words, the pre-incident process assessment might have

OCR for page 141
143 POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT assumed that engineered safety features would not fail, that emergency operating procedures would be implemented effectively, that everyone at risk would receive warning messages, and so on. Aside from any erroneous assumptions about the quality of the facility design, there is ample documentation that facilities “as built” and “as maintained” typically differ—sometimes substantially—from their original designs (as evidenced by the Bhopal tragedy). Further, operational and design changes over the life of a facility can introduce new hazards not anticipated by the original designers; this illustrates the need for an effective management-of-change protocol within an overall PSM system. Consequently, preincident process assessments can provide unrealistically optimistic estimates of incident probabilities. Issues of hindsight, and hindsight bias, are critical when the focus of an investigation is solely on a given incident itself, perhaps for reasons relating to litigation or disciplinary measures. It is precisely this retrospective nature of incident investigation, however, that gives this PSM element its dominant role in learning from experience. As noted in CCPS (2007), the process of incident investigation involves reporting, tracking, and investigating incidents, together with management of the development and documentation of recommendations arising from investigations. If the sole purpose is simply to establish guilt and assign blame to plant personnel, the result will not only be ineffective recommen- dations but also missed opportunities to prevent repeat occurrences. CCPS (2007) further comments that a much more effective approach to incident investigation is to develop recommendations that address systemic causes. In other words, it is the management system deficiencies (often termed root causes) that need to be identified in an effort to avoid not just the same or a similar incident from happening again, but also incidents that could occur because of the existence of deeper, management-system causation factors. Examples in this latter category would include shortcomings in any of the elements of a PSM system. Because PSM involves a suite of considerations that complement one another, efforts directed at a particular element can have a positive effect on one or more other elements. For example, commitment to a strong process safety culture will undoubtedly affect all remaining PSM elements as previously discussed in Chapter 7. It is difficult to envisage senior managers searching for PSM system deficiencies during an incident investigation without those same managers being fully committed to ensuring a sound safety culture; Sutton (2008) has demon - strated this strong correlation between root-cause analysis through incident inves- tigation and the development of a company’s safety culture. Similarly, hazard identification and risk analysis, which by their nature are a priori activities, can be used to inform the process of incident investigation, a post facto activity as previously mentioned. A tool commonly used to identify process hazards is a checklist of rel - evant concerns. Table 8.1 gives a partial listing of items drawn from the ISP checklist found in Appendix A of CCPS (2009). The recommended questions in

OCR for page 141
144 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE TABLE 8.1 Partial ISP Checklist (adapted from CCPS, 2009) ISP Alternative a b c d e MINIMIZE Can hazardous raw materials inventory be reduced? Can hazardous in-process storage and inventory be reduced? Can hazardous finished product inventory be reduced? Can alternative equipment with reduced hazardous material inventory requirement be used? SUBSTITUTE Is this hazardous process/product necessary? Is it possible to completely eliminate hazardous raw materials, process intermediates, or by-products by using an alternative process or chemistry? Is an alternative process available for this product that eliminates or substantially reduces the need for hazardous raw materials or production of hazardous intermediates? Is it possible to substitute less hazardous raw materials? MODERATE Is it possible to limit the supply pressure of hazardous raw materials to less than the maximum allowable working pressure of the vessels to which they are delivered? Can the process be operated at less severe conditions for hazardous reactants or products by considering improved thermodynamics or kinetics to reduce operating temperatures or pressures? Can process units for hazardous materials be designed to limit the magnitude of process deviations? SIMPLIFY Can equipment be designed such that it is difficult or impossible to create a potential hazardous situation due to an operating or maintenance error? Can passive leak-limiting technology be used to limit potential loss of containment? Has attention to control system human factors been addressed through logical arrangement of controls and displays that match operator expectations? NOTES: a = Applicable (Y/N), b = Opportunities/Applications, c = Feasibility, d = Current Status, e = Recommendation. SOURCE: Adapted from CCPS (2009).

OCR for page 141
145 POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT Table 8.1—which provide explicit, structured consideration of the four key ISP principles (minimization, substitution, moderation, and simplification)—can be asked at virtually any stage of process design and operation to identify potential hazards and suggest remedial actions. They can also be asked at the stage of inci - dent investigation with the aim of root-cause prevention. This point is elaborated upon in the following paragraph and later in this chapter. Kletz and Amyotte (2010) have commented that reports of incident investiga- tions often deal only with the immediate causes of the incident (i.e., the triggering events), but not with ways of avoiding the hazard. If an investigation protocol is designed primarily to determine why control of hazards was lost, it is unlikely that emphasis will be placed on examining why the hazard was tolerated and whether it could have been avoided in the first place. A primary function of effective inci- dent investigation must therefore be to challenge company personnel to question the basic technology underlying the affected materials, equipment, and processes. Several questions have been posed by Kletz and Amyotte (2010) to motivate incident investigators and investigation teams to think of less obvious ways of preventing process incidents. These questions, given below in adapted form, raise issues similar to the checklist questions listed in Table 8.1: • What is the purpose of the operation involved in the incident? Why do we do this? How else could we do it? Who else could do it? When else could we do it? Where else could we do it? What could we do instead? • What equipment failed? How can we prevent failure or make it less likely? How can we detect failure or approaching failure? How can we control failure (i.e., minimize consequences)? What does this equipment do? What other equipment could we use instead? What could we do instead? • What material leaked (exploded, decomposed, etc.)? How can we prevent a leak (explosion, decomposition, etc.)? How can we detect a leak or approaching leak (etc.)? What does this material do? What material could we use instead? What safer form could we use the original material in? What could we do instead? • Which people could have performed better? (Consider people who might supervise, train, inspect, check, or design better than they did, as well as people who might construct, operate, or maintain better than they did.)

OCR for page 141
146 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE What could they have done better? How can we help them to perform better? (Consider training, instructions, inspections, audits, etc., as well as changes to design.) What could we do instead? Kletz and Amyotte (2010) further challenge incident investigators to keep a more general, overarching set of questions in mind when following their estab - lished investigation protocol. These questions are as follows: • Did a lack of application of the principles of ISP play a role in incident causation? • Would minimization, substitution, moderation, and simplification have helped to prevent the incident or mitigate the consequences? • How effective were the available passive and active engineered safety devices with respect to prevention and mitigation? • How effective were the available procedural safety measures with respect to prevention and mitigation? • Were recommendations made to avoid the hazards and to permanently remove them wherever possible? AN APPROACH TO ISP-BASED INCIDENT INVESTIGATION The discussion in the preceding section demonstrated that similar questions can and should be asked during both hazard identification and incident investiga - tion. A structured use of checklist questions is, however, required for effective performance of the tasks of identifying hazards and investigating incidents. Hazard identification/risk analysis and incident investigation are distinct PSM elements. Because PSM is underpinned by the concept of continuous improvement, it stands to reason that the use of ISP principles in conducting these activities will lead to opportunities for refinement of the ISP assessment method - ologies. Mahnken (2001) has illustrated the general use of case histories arising from incident investigations to enhance process hazard analysis methodologies such as the familiar HAZOP (HAZard and OPerability study). Similarly, Khan (2006) has demonstrated how case histories can assist in identifying the need for improved hazard identification—particularly with respect to thermal stability of reactive materials and the potential for runaway chemical reactions. Khan (2006) further comments that “it is . . . necessary to make full use of all opportunities at the conceptual stages of process development and design to reduce the frequency of accidents in the chemical process industries.” This is essentially a call for early ISP consideration and an examination of the effectiveness of preincident ISP assessments based on the findings of post-incident investigations. Formalized approaches to ISP-based hazard identification are available in the process safety literature—for example, the protocol for use of ISP checklist

OCR for page 141
147 POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT questions in conducting a process hazard analysis (PHA), which is described in Appendix B of CCPS (2009). In a similar vein, Goraya et al. (2004) have pro - posed the ISP-based protocol for incident investigation shown in Figure 8.1. Key features of this approach are as follows (Goraya et al., 2004): • Incorporation of a basic framework utilizing best practices drawn from industry; • Adoption of an integrated approach that considers all potential categories of loss (people, property, production, and environment; “property” meaning assets and “production” meaning uninterrupted business operation); • Classification of evidence collected after the incident into convenient data categories as appropriate with respect to data fragility (position, people, parts, and paper); • Use of a loss causation model for identification of factors which dis- tinguishes between “immediate causes, basic causes, and lack of management control factors” (i.e., management system deficiencies); • Introduction of inherent safety guidewords or “mind triggers”(minimize, substitute, moderate, and simplify) at both the initiation and completion of the protocol, in an attempt to encourage ISP considerations during the collection of data and the development of recommendations, respectively; • Use of explicit inherent safety checklist questions structured around key ISP principles (see, for example, Goraya et al., 2004; CCPS, 2009; Kletz and Amyotte, 2010) during root-cause analysis; and • Adoption of a layered approach for making recommendations. It is the last three items in the above list that make the protocol of Goraya et al. (2004) explicit in its consideration of ISP. The final item in particular, which was first introduced to the process safety community by Professor Trevor Kletz, is critical to the integration of ISP within the investigation protocol. As described previously in this chapter, it should be well-understood that the root causes of process incidents are typically management system deficiencies; this accounts for the third layer of recommendations shown in Figure 8.1. It is of course necessary to take immediate action to remove existing hazards following an incident; hence the first layer of recommendations in Figure 8.1. ISP, by its very nature, requires an attempt to avoid hazards and to permanently remove them wherever possible. It is therefore fundamentally impossible to address the second layer of recom - mendations in Figure 8.1 without explicit consideration of the principles of ISP. A positive result of second-layer ISP recommendations is thus the identification of opportunities for overall design improvements during facility rebuild in the case of significant asset loss. Such ISP opportunities represent a specific application of the well-established need to make general process improvements on the basis of both incident data (Leggett and Singh, 2000) and lessons learned from major incidents (Balasubramanian and Louvar, 2002).

OCR for page 141
148 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE FIGURE 8.1 Inherent safety-based incident investigation methodology. SOURCE: Goraya et al. (2004).

OCR for page 141
149 POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT However, the implementation of ISP improvements resulting from second- layer recommendations will not necessarily be seen as a practical approach by all decision makers. Sociologist Andrew Hopkins has addressed this issue in his recent book on high-reliability organizations (Hopkins, 2009). He comments that although a focus on incident investigation recommendations that are deemed practical to implement will at least increase the likelihood of action being taken, it will not ensure that more fundamental (and potentially more costly) system enhancements will be undertaken. Hopkins (2009) gives the example of additional training being provided to air traffic controllers who had made procedural errors, as opposed to removing hazards by making changes to the computer software running the air traffic con- trol consoles, which had been identified as the root-cause source of error. Such system-wide improvements to the underlying technology, although resource- intensive and requiring comprehensive risk assessment, remain the best response to hazards identified during an incident investigation (Hopkins, 2009). As discussed in Chapter 7, the principles of inherent safety have broad appli- cation to all elements of a PSM system. This point is repeated here as a reminder that ISP enhancements can be beneficial to all PSM aspects—not only those involving hazard identification, risk analysis, and incident investigation (Amyotte et al., 2007; CCPS, 2009; Kletz and Amyotte, 2010). LONG-TERM TRENDS IN INVESTIGATION RESULTS The documentation resulting from investigations by the U.S. Chemical Safety and Hazard Investigation Board (CSB) represents some of the most acces - sible process incident information available in the public domain. As noted on its Web site (www.csb.gov), CSB is an independent, nonregulatory federal agency charged with investigating industrial chemical incidents. Such incidents are inves- tigated by a team of CSB employees, and from the evidence collected, root and contributing causation factors are identified. With this information, the CSB creates sets of recommendations for various bodies such as facility managers, regulatory agencies, and technical associations. Following a completed investiga - tion, documentation in the form of a full investigation report, case study, safety bulletin, or urgent recommendations are made available on the CSB Web site. These documents often have accompanying video support and are widely recog - nized as valuable learning tools for improving safety in the process industries. An analysis of these publicly available CSB reports has recently been under- taken by Amyotte et al. (2011), primarily from the perspective of the actual and potential use of ISP principles in incident investigations. Approximately 60 reports covering the period 1998-2010 were reviewed; this resulted in the identifi - cation of numerous ISP examples related to incident prevention and consequence mitigation. These findings were often implicitly referenced in the documentation (i.e., not named as inherent safety per se), with a growing trend in recent years

OCR for page 141
150 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE toward explicit use of ISP terminology when identifying causation factors and making recommendations. Particularly noteworthy in this latter regard are the BP Texas City (CSB, 2007), Valero McKee (CSB, 2008), and Xcel Energy (CSB, 2010a) investigation reports, as well as the urgent recommendations resulting from the Kleen Energy (CSB, 2010c) and ConAgra (CSB, 2010b) investigations. In accordance with the concept that ISP is not a stand-alone approach to risk reduction, the review of CSB reports by Amyotte et al. (2011) also identified a sig- nificant number of actual and potential measures related to the other categories in the overall hierarchy of controls. The majority of the non-ISP safety features were related to procedural safety, followed by active engineered devices and, to a lesser extent, passive engineered devices. These results were determined to be generally consistent with the work of Kidam et al. (2010), who reviewed 364 chemical pro- cess industry incident descriptions in the Failure Knowledge Database maintained on the Japan Science and Technology Web site. The analysis by Amyotte et al. (2011) identified investigation lessons similar to those given by Kaszniak (2010) in his independent review of CSB reports, and by Yang et al. (2009) in their analysis of case histories (including a small subset of CSB investigations). It is not known whether other organizations that conduct process incident investigations have adopted ISP as an integral component of their investiga- tion protocols. It does appear, however, that at least one such organization—the CSB—has made a conscious attempt to explicitly utilize the concept and prin- ciples of ISP during post-incident investigations. As noted by Amyotte et al. (2011), this is a welcome trend that should be encouraged and widely adopted in the process industries. Expanded use of ISP considerations during process inci - dent investigations is predicated on widespread knowledge and understanding of the inherent safety concept itself. Continued educational (e.g., Hendershot, 2006; Hendershot and Murphy, 2008) and training (e.g., IChemE, 2005) efforts in this regard are therefore imperative. CONCLUSIONS This chapter has provided a review of incident investigation from both a general perspective as a key element of a PSM system and with specific ISP considerations in mind. Incident investigations are most useful in the process industries when they are conducted with the objective of determining root causes. Such causes typically reside at the level of management system deficiencies and are often related to shortcomings in hazard identification and risk assessment protocols. Explicit incorporation of the principles of ISP can play an important role in the efficacy of an incident investigation protocol. Lessons learned from incident investigations—both general and those spe - cific to ISP—can also have a beneficial impact on PSM overall. Such lessons can be used to make systemic improvements involving all categories in the hierarchy of controls and to help identify previously unforeseen hazards in a given process

OCR for page 141
151 POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT or industry sector. Because incident investigation acts within a management system based on continuous improvement, it is to be expected that investigation results will provide valuable input to the methodologies being used to predict hazards and prevent their occurrence. REFERENCES Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2007. Incorporation of inherent safety principles in process safety management. Process Saf. Prog. 26(4):333-346. Amyotte, P. R., D. K. MacDonald, and F. I. Khan. 2011. An analysis of CSB investigation reports for inherent safety learnings. Paper No. 44a in Proceedings of 13th Process Plant Safety Sym- posium, 2011 Spring Meeting & 7th Global Congress on Process Safety, March 13-16, 2011, Chicago, IL. New York: American Institute of Chemical Engineers. Balasubramanian, S. G., and J. F. Louvar. 2002. Study of major accidents and lessons learned. Process Saf. Prog. 21(3):237-244. Blank, H., J. Musch, and R. F. Pohl. 2007. Hindsight bias: On being wise after the event. Soc. Cogni- tion 25(1):1-9. CCPS (Center for Chemical Process Safety). 1989. Guidelines for Technical Management of Chemical Process Safety. New York: American Institute of Chemical Engineers. CCPS. 2003. Guidelines for Investigating Chemical Process Incidents. 2nd Ed. New York: American Institute of Chemical Engineers. CCPS. 2007. Guidelines for Risk Based Process Safety. Hoboken, NJ: John Wiley & Sons. CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd Ed. Hoboken, NJ: John Wiley & Sons. CSB (Chemical Safety Board). 2007. Investigation Report: Refinery Explosion and Fire—BP, Texas City, TX. Report No. 2005-04-I-TX. Washington, DC: CSB [online]. Available: http://www.csb. gov/assets/document/CSBFinalReportBP.pdf. Accessed: Sept. 28, 2011. CSB. 2008. Investigation Report: LPG Fire at Valero-McKee Refinery—Valero Energy Corporation, Sunray, TX. Report No. 2007-05-I-TX. Washington, DC: CSB [online]. Available: http://www. csb.gov/assets/document/CSBFinalReportValeroSunray.pdf. Accessed: Sept. 28, 2011. CSB. 2010a. Investigation Report: Xcel Energy Hydroelectric Plant Penstock Fire—Cabin Creek, Georgetown, CO. Report No. 2008-01-I-CO. Washington, DC: CSB [online]. Available: http:// www.csb.gov/assets/document/Xcel_Energy_Report_Final.pdf. Accessed: Sept. 28, 2011. CSB. 2010b. Urgent Recommendations from ConAgra Investigation. Washington, DC: CSB [online]. Available: http://www.csb.gov/assets/document/CSB_Gas_Purging_Urgent_Recommendations. (2).pdf. Accessed Sept. 28, 2011. CSB. 2010c. Urgent Recommendations from Kleen Energy Investigation Washington, DC: CSB [online]. Available: http://www.csb.gov/assets/document/KleenUrgentRec.pdf. Accessed: Sept. 28, 2011. CSChE (Canadian Society for Chemical Engineering). 2002. Process Safety Management, 3rd Ed. Ottawa, ON: CSChE. Department of Labor. 2000. Process Safety Management. OSHA 3132. Washington, DC: OSHA Publications Office. Fischhoff, B. 1975. Hindsight ≠ foresight: The effect of outcome knowledge on judgment under uncertainty. J. Exp. Psychol. Human 1(3):288-299. Goraya, A., P. R. Amyotte, and F. I. Khan. 2004. An inherent safety-based incident investigation methodology. Process Saf. Prog. 23(3):197-205. Hendershot, D. C. 2006. Inherently Safer Design. SAChE (Safety and Chemical Engineering Educa- tion) [online]. Available: http://sache.org/index.asp. Accessed: Sept. 28, 2011.

OCR for page 141
152 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE Hendershot, D. C., and J. Murphy. 2008. Inherently Safer Design Conflicts and Decisions. SAChE (Safety and Chemical Engineering Education) [online]. Available: http://sache.org/index.asp. Accessed Sept. 28, 2011. Hopkins, A, ed. 2009. Learning from High Reliability Organisations. Sydney, Australia: CCH Aus- tralia Limited. IChemE (Institution of Chemical Engineers). 2005. Inherently Safer Process Design, Training Re- source STP001. Rugby, UK: IChemE. Kaszniak, M. 2010. Oversights and omissions in process hazard analyses: Lessons learned from CSB investigations. Process Saf. Prog. 29(3):264–269. Khan, A. A. 2006. Case histories and recent developments to improve safety assessments during process development. Process Saf. Prog. 25(3):245-249. Khan, F. I., and P. R. Amyotte. 2003. How to make inherent safety practice a reality. Can. J. Chem. Eng. 81(1):2-16. Kidam, K., M. Hurme, and M. H. Hassim. 2010. Inherent safety based corrective actions in accident prevention. Pp. 447-450 in Proceedings of 13th International Symposium on Loss Prevention and Safety Promotion in the Process Industries, June 6-9, 2010, Bruges, Belgium, Vol. 2. Rugby, UK: Institution of Chemical Engineers. Klar, Y., and S. Ayal. 2004. Event frequency and comparative optimism: Another look at the indirect elicitation method of self-others risk. J. Exp. Soc. Psychol. 40(6):805-814. Kletz, T., and P. R. Amyotte. 2010. Process Plants: A Handbook for Inherently Safer Design. Boca Raton, FL: CRC Press. Leggett, D., and J. Singh. 2000. Process improvements from incident data. Process Saf. Prog. 19(1):13-18. Louie, T. A., M. N. Rajan, and R. E. Sibley. 2007. Tackling the Monday-morning quarterback: Ap - plications of hindsight bias in decision-making settings. Soc. Cognition 25(1):32-47. Mahnken, G. E. 2001. Use case histories to energize your HAZOP. Chem. Eng. Prog. 97(Mar.):73-78. OSHA (Occupational Safety and Health Administration). 2000. Process Safety Management. OSHA 3132. U.S. Department of Labor, Occupational Safety and Health Administration, Washington, DC [online]. Available: http://www.osha.gov/Publications/osha3132.html. Accessed: Feb. 14, 2012. Sutton, I. S. 2008. Use root cause analysis to understand and improve process safety culture. Process Saf. Prog. 27(4):274-279. Weinstein, N.D. 1989. Optimistic biases about personal risks. Science 246(4935):1232-1233. Yang, X., L. Dinh, D. Castellanos, C. Osorio, D. Ng, and M.S. Mannan. 2009. Common lessons learned from an analysis of multiple case histories. Pp. 43-50 in Hazards XXI: Process Safety and Environmental Protection in Changing World, November 10-12, 2009, Manchester, UK. IChemE Symposium Series No. 155. Rugby, UK: Institution of Chemical Engineers.