Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 141
8
Post-Incident Retrospective
Process Assessment
Part 3.5 of this study’s statement of task was to “[c]omment, if possible, on
whether and how inherently safer process assessments can be utilized during
post-incident investigations.” Unlike the preceding chapter, this portion of the
task looks beyond Bayer and requires broad consideration of the application
of inherently safer process (ISP) assessments under these circumstances. The
conclusion from the analysis presented here is that the principles of ISP assess-
ment can be used to good effect in conducting an incident investigation when
the objective is the prevention of potential incidents having similar funda-
mental, underlying (root) causes. Examples are provided to demonstrate how
this might be done and the extent of current practice in this regard. This chapter
also provides information regarding emergency response systems and discusses
how ISP assessments could be used to improve and support effective emergency
planning and response.
INCIDENT INVESTIGATION—AN ESSENTIAL COMPONENT OF A
SAFETY MANAGEMENT SYSTEM
As noted in Chapter 7, incident investigation is not a one-time, stand-alone
event, but instead a necessary element within a functioning process safety man -
agement (PSM) system. Indeed, it is one of the mandatory elements of OSHA’s
PSM standard, which requires, “the investigation of each incident that resulted in,
or could reasonably have resulted in, a catastrophic release of a highly hazardous
chemical in the workplace” (Department of Labor, 2000).
Comprehensive protocols and advice are available for conducting inves-
tigations of chemical process incidents (e.g., CCPS, 2003). Such guidelines
141
OCR for page 142
142 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE
emphasize the need for a PSM system to be simultaneously retrospective and
prospective, with incident investigation providing the vital bridge between the
lessons of the past and safer designs and operation in the future (CCPS, 2003).
This point is expanded upon in the following sections.
Relationship Between A Priori and Post-Facto Assessment
Although advance preparation is essential, incident investigations are con -
ducted after the fact—that is, after a loss-producing event or a near-miss has
occurred. In conducting a post-incident process assessment, it is important
to avoid the problem of hindsight bias. Hindsight bias, known commonly as
“Monday morning quarterbacking” or “20-20 hindsight” is the tendency to view
events as more foreseeable or more inevitable after the fact than they actually
would have appeared at the time actions needed to be taken (Fischhoff, 1975;
Blank et al., 2007; Louie et al., 2007). In particular, anyone who is judging
the safety of a facility after an incident has information that was not available
to those who conducted any pre-incident process assessment. Although most
people recognize it would be unfair to use later information to second-guess
earlier decisions, research on hindsight bias cited above has shown that cognitive
biases can limit our ability to recognize the additional information that we have
acquired after the event. While such new information should never be ignored,
it is important to acknowledge that critical factors may not have been obvious
before an incident, because this can help identify new opportunities for analysis,
monitoring, communication, etc.
The chain of events that produced a chemical release is obvious in retrospect
because it happened, even though it might not have been obvious in prospect
because safety analysts failed to imagine that such an event chain could happen.
In such cases, it is important to judge what the safety analysts could reasonably
have been expected to anticipate by examining the safety analyses conducted in
other facilities. If facilities with similar designs had also failed to anticipate that
chain of events, then those conducting a pos-tincident process assessment should
be wary of the effects of hindsight bias. However, if facilities with similar designs
had anticipated that chain of events, then those conducting a post-incident pro -
cess assessment should be less concerned that their analyses are being affected
by hindsight bias.
Alternatively, it might be that the probability (rather than the possibility)
of that chain of events might seem more likely in retrospect than in prospect
because a pre-incident safety assessment underestimated the probability that such
an event chain could happen. In this case, it is important to balance the possibil-
ity that the post-incident process assessment is being affected by hindsight bias
against the possibility that any pre-incident process assessment was affected by
optimistic bias (Weinstein, 1989), also known as comparative optimism (Klar
and Ayal, 2004). In other words, the pre-incident process assessment might have
OCR for page 143
143
POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT
assumed that engineered safety features would not fail, that emergency operating
procedures would be implemented effectively, that everyone at risk would receive
warning messages, and so on. Aside from any erroneous assumptions about
the quality of the facility design, there is ample documentation that facilities
“as built” and “as maintained” typically differ—sometimes substantially—from
their original designs (as evidenced by the Bhopal tragedy). Further, operational
and design changes over the life of a facility can introduce new hazards not
anticipated by the original designers; this illustrates the need for an effective
management-of-change protocol within an overall PSM system. Consequently,
preincident process assessments can provide unrealistically optimistic estimates
of incident probabilities.
Issues of hindsight, and hindsight bias, are critical when the focus of an
investigation is solely on a given incident itself, perhaps for reasons relating
to litigation or disciplinary measures. It is precisely this retrospective nature of
incident investigation, however, that gives this PSM element its dominant role
in learning from experience. As noted in CCPS (2007), the process of incident
investigation involves reporting, tracking, and investigating incidents, together
with management of the development and documentation of recommendations
arising from investigations. If the sole purpose is simply to establish guilt and
assign blame to plant personnel, the result will not only be ineffective recommen-
dations but also missed opportunities to prevent repeat occurrences. CCPS (2007)
further comments that a much more effective approach to incident investigation
is to develop recommendations that address systemic causes. In other words,
it is the management system deficiencies (often termed root causes) that need
to be identified in an effort to avoid not just the same or a similar incident from
happening again, but also incidents that could occur because of the existence of
deeper, management-system causation factors. Examples in this latter category
would include shortcomings in any of the elements of a PSM system.
Because PSM involves a suite of considerations that complement one another,
efforts directed at a particular element can have a positive effect on one or more
other elements. For example, commitment to a strong process safety culture
will undoubtedly affect all remaining PSM elements as previously discussed in
Chapter 7. It is difficult to envisage senior managers searching for PSM system
deficiencies during an incident investigation without those same managers being
fully committed to ensuring a sound safety culture; Sutton (2008) has demon -
strated this strong correlation between root-cause analysis through incident inves-
tigation and the development of a company’s safety culture. Similarly, hazard
identification and risk analysis, which by their nature are a priori activities, can
be used to inform the process of incident investigation, a post facto activity as
previously mentioned.
A tool commonly used to identify process hazards is a checklist of rel -
evant concerns. Table 8.1 gives a partial listing of items drawn from the ISP
checklist found in Appendix A of CCPS (2009). The recommended questions in
OCR for page 144
144 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE
TABLE 8.1 Partial ISP Checklist (adapted from CCPS, 2009)
ISP Alternative a b c d e
MINIMIZE
Can hazardous raw materials inventory be reduced?
Can hazardous in-process storage and inventory be reduced?
Can hazardous finished product inventory be reduced?
Can alternative equipment with reduced hazardous material inventory
requirement be used?
SUBSTITUTE
Is this hazardous process/product necessary?
Is it possible to completely eliminate hazardous raw materials, process
intermediates, or by-products by using an alternative process or
chemistry?
Is an alternative process available for this product that eliminates
or substantially reduces the need for hazardous raw materials or
production of hazardous intermediates?
Is it possible to substitute less hazardous raw materials?
MODERATE
Is it possible to limit the supply pressure of hazardous raw materials
to less than the maximum allowable working pressure of the vessels
to which they are delivered?
Can the process be operated at less severe conditions for hazardous
reactants or products by considering improved thermodynamics or
kinetics to reduce operating temperatures or pressures?
Can process units for hazardous materials be designed to limit the
magnitude of process deviations?
SIMPLIFY
Can equipment be designed such that it is difficult or impossible
to create a potential hazardous situation due to an operating or
maintenance error?
Can passive leak-limiting technology be used to limit potential loss of
containment?
Has attention to control system human factors been addressed through
logical arrangement of controls and displays that match operator
expectations?
NOTES: a = Applicable (Y/N), b = Opportunities/Applications, c = Feasibility, d = Current Status,
e = Recommendation.
SOURCE: Adapted from CCPS (2009).
OCR for page 145
145
POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT
Table 8.1—which provide explicit, structured consideration of the four key ISP
principles (minimization, substitution, moderation, and simplification)—can be
asked at virtually any stage of process design and operation to identify potential
hazards and suggest remedial actions. They can also be asked at the stage of inci -
dent investigation with the aim of root-cause prevention. This point is elaborated
upon in the following paragraph and later in this chapter.
Kletz and Amyotte (2010) have commented that reports of incident investiga-
tions often deal only with the immediate causes of the incident (i.e., the triggering
events), but not with ways of avoiding the hazard. If an investigation protocol is
designed primarily to determine why control of hazards was lost, it is unlikely that
emphasis will be placed on examining why the hazard was tolerated and whether
it could have been avoided in the first place. A primary function of effective inci-
dent investigation must therefore be to challenge company personnel to question
the basic technology underlying the affected materials, equipment, and processes.
Several questions have been posed by Kletz and Amyotte (2010) to motivate
incident investigators and investigation teams to think of less obvious ways of
preventing process incidents. These questions, given below in adapted form, raise
issues similar to the checklist questions listed in Table 8.1:
• What is the purpose of the operation involved in the incident?
Why do we do this?
How else could we do it?
Who else could do it?
When else could we do it?
Where else could we do it?
What could we do instead?
• What equipment failed?
How can we prevent failure or make it less likely?
How can we detect failure or approaching failure?
How can we control failure (i.e., minimize consequences)?
What does this equipment do?
What other equipment could we use instead?
What could we do instead?
• What material leaked (exploded, decomposed, etc.)?
How can we prevent a leak (explosion, decomposition, etc.)?
How can we detect a leak or approaching leak (etc.)?
What does this material do?
What material could we use instead?
What safer form could we use the original material in?
What could we do instead?
• Which people could have performed better? (Consider people who might
supervise, train, inspect, check, or design better than they did, as well as people
who might construct, operate, or maintain better than they did.)
OCR for page 146
146 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE
What could they have done better?
How can we help them to perform better? (Consider training, instructions,
inspections, audits, etc., as well as changes to design.)
What could we do instead?
Kletz and Amyotte (2010) further challenge incident investigators to keep a
more general, overarching set of questions in mind when following their estab -
lished investigation protocol. These questions are as follows:
• Did a lack of application of the principles of ISP play a role in incident
causation?
• Would minimization, substitution, moderation, and simplification have
helped to prevent the incident or mitigate the consequences?
• How effective were the available passive and active engineered safety
devices with respect to prevention and mitigation?
• How effective were the available procedural safety measures with respect
to prevention and mitigation?
• Were recommendations made to avoid the hazards and to permanently
remove them wherever possible?
AN APPROACH TO ISP-BASED INCIDENT INVESTIGATION
The discussion in the preceding section demonstrated that similar questions
can and should be asked during both hazard identification and incident investiga -
tion. A structured use of checklist questions is, however, required for effective
performance of the tasks of identifying hazards and investigating incidents.
Hazard identification/risk analysis and incident investigation are distinct
PSM elements. Because PSM is underpinned by the concept of continuous
improvement, it stands to reason that the use of ISP principles in conducting these
activities will lead to opportunities for refinement of the ISP assessment method -
ologies. Mahnken (2001) has illustrated the general use of case histories arising
from incident investigations to enhance process hazard analysis methodologies
such as the familiar HAZOP (HAZard and OPerability study). Similarly, Khan
(2006) has demonstrated how case histories can assist in identifying the need for
improved hazard identification—particularly with respect to thermal stability of
reactive materials and the potential for runaway chemical reactions. Khan (2006)
further comments that “it is . . . necessary to make full use of all opportunities at
the conceptual stages of process development and design to reduce the frequency
of accidents in the chemical process industries.” This is essentially a call for early
ISP consideration and an examination of the effectiveness of preincident ISP
assessments based on the findings of post-incident investigations.
Formalized approaches to ISP-based hazard identification are available in
the process safety literature—for example, the protocol for use of ISP checklist
OCR for page 147
147
POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT
questions in conducting a process hazard analysis (PHA), which is described in
Appendix B of CCPS (2009). In a similar vein, Goraya et al. (2004) have pro -
posed the ISP-based protocol for incident investigation shown in Figure 8.1. Key
features of this approach are as follows (Goraya et al., 2004):
• Incorporation of a basic framework utilizing best practices drawn from
industry;
• Adoption of an integrated approach that considers all potential categories
of loss (people, property, production, and environment; “property” meaning
assets and “production” meaning uninterrupted business operation);
• Classification of evidence collected after the incident into convenient data
categories as appropriate with respect to data fragility (position, people, parts, and
paper);
• Use of a loss causation model for identification of factors which dis-
tinguishes between “immediate causes, basic causes, and lack of management
control factors” (i.e., management system deficiencies);
• Introduction of inherent safety guidewords or “mind triggers”(minimize,
substitute, moderate, and simplify) at both the initiation and completion of the
protocol, in an attempt to encourage ISP considerations during the collection of
data and the development of recommendations, respectively;
• Use of explicit inherent safety checklist questions structured around key
ISP principles (see, for example, Goraya et al., 2004; CCPS, 2009; Kletz and
Amyotte, 2010) during root-cause analysis; and
• Adoption of a layered approach for making recommendations.
It is the last three items in the above list that make the protocol of Goraya et
al. (2004) explicit in its consideration of ISP. The final item in particular, which
was first introduced to the process safety community by Professor Trevor Kletz,
is critical to the integration of ISP within the investigation protocol. As described
previously in this chapter, it should be well-understood that the root causes of
process incidents are typically management system deficiencies; this accounts for
the third layer of recommendations shown in Figure 8.1. It is of course necessary
to take immediate action to remove existing hazards following an incident; hence
the first layer of recommendations in Figure 8.1. ISP, by its very nature, requires
an attempt to avoid hazards and to permanently remove them wherever possible.
It is therefore fundamentally impossible to address the second layer of recom -
mendations in Figure 8.1 without explicit consideration of the principles of ISP. A
positive result of second-layer ISP recommendations is thus the identification of
opportunities for overall design improvements during facility rebuild in the case
of significant asset loss. Such ISP opportunities represent a specific application
of the well-established need to make general process improvements on the basis
of both incident data (Leggett and Singh, 2000) and lessons learned from major
incidents (Balasubramanian and Louvar, 2002).
OCR for page 148
148 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE
FIGURE 8.1 Inherent safety-based incident investigation methodology.
SOURCE: Goraya et al. (2004).
OCR for page 149
149
POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT
However, the implementation of ISP improvements resulting from second-
layer recommendations will not necessarily be seen as a practical approach by
all decision makers. Sociologist Andrew Hopkins has addressed this issue in his
recent book on high-reliability organizations (Hopkins, 2009). He comments that
although a focus on incident investigation recommendations that are deemed
practical to implement will at least increase the likelihood of action being taken,
it will not ensure that more fundamental (and potentially more costly) system
enhancements will be undertaken.
Hopkins (2009) gives the example of additional training being provided to
air traffic controllers who had made procedural errors, as opposed to removing
hazards by making changes to the computer software running the air traffic con-
trol consoles, which had been identified as the root-cause source of error. Such
system-wide improvements to the underlying technology, although resource-
intensive and requiring comprehensive risk assessment, remain the best response
to hazards identified during an incident investigation (Hopkins, 2009).
As discussed in Chapter 7, the principles of inherent safety have broad appli-
cation to all elements of a PSM system. This point is repeated here as a reminder
that ISP enhancements can be beneficial to all PSM aspects—not only those
involving hazard identification, risk analysis, and incident investigation (Amyotte
et al., 2007; CCPS, 2009; Kletz and Amyotte, 2010).
LONG-TERM TRENDS IN INVESTIGATION RESULTS
The documentation resulting from investigations by the U.S. Chemical
Safety and Hazard Investigation Board (CSB) represents some of the most acces -
sible process incident information available in the public domain. As noted on its
Web site (www.csb.gov), CSB is an independent, nonregulatory federal agency
charged with investigating industrial chemical incidents. Such incidents are inves-
tigated by a team of CSB employees, and from the evidence collected, root and
contributing causation factors are identified. With this information, the CSB
creates sets of recommendations for various bodies such as facility managers,
regulatory agencies, and technical associations. Following a completed investiga -
tion, documentation in the form of a full investigation report, case study, safety
bulletin, or urgent recommendations are made available on the CSB Web site.
These documents often have accompanying video support and are widely recog -
nized as valuable learning tools for improving safety in the process industries.
An analysis of these publicly available CSB reports has recently been under-
taken by Amyotte et al. (2011), primarily from the perspective of the actual
and potential use of ISP principles in incident investigations. Approximately 60
reports covering the period 1998-2010 were reviewed; this resulted in the identifi -
cation of numerous ISP examples related to incident prevention and consequence
mitigation. These findings were often implicitly referenced in the documentation
(i.e., not named as inherent safety per se), with a growing trend in recent years
OCR for page 150
150 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE
toward explicit use of ISP terminology when identifying causation factors and
making recommendations. Particularly noteworthy in this latter regard are the BP
Texas City (CSB, 2007), Valero McKee (CSB, 2008), and Xcel Energy (CSB,
2010a) investigation reports, as well as the urgent recommendations resulting
from the Kleen Energy (CSB, 2010c) and ConAgra (CSB, 2010b) investigations.
In accordance with the concept that ISP is not a stand-alone approach to risk
reduction, the review of CSB reports by Amyotte et al. (2011) also identified a sig-
nificant number of actual and potential measures related to the other categories in
the overall hierarchy of controls. The majority of the non-ISP safety features were
related to procedural safety, followed by active engineered devices and, to a lesser
extent, passive engineered devices. These results were determined to be generally
consistent with the work of Kidam et al. (2010), who reviewed 364 chemical pro-
cess industry incident descriptions in the Failure Knowledge Database maintained
on the Japan Science and Technology Web site. The analysis by Amyotte et al.
(2011) identified investigation lessons similar to those given by Kaszniak (2010) in
his independent review of CSB reports, and by Yang et al. (2009) in their analysis
of case histories (including a small subset of CSB investigations).
It is not known whether other organizations that conduct process incident
investigations have adopted ISP as an integral component of their investiga-
tion protocols. It does appear, however, that at least one such organization—the
CSB—has made a conscious attempt to explicitly utilize the concept and prin-
ciples of ISP during post-incident investigations. As noted by Amyotte et al.
(2011), this is a welcome trend that should be encouraged and widely adopted in
the process industries. Expanded use of ISP considerations during process inci -
dent investigations is predicated on widespread knowledge and understanding of
the inherent safety concept itself. Continued educational (e.g., Hendershot, 2006;
Hendershot and Murphy, 2008) and training (e.g., IChemE, 2005) efforts in this
regard are therefore imperative.
CONCLUSIONS
This chapter has provided a review of incident investigation from both a
general perspective as a key element of a PSM system and with specific ISP
considerations in mind. Incident investigations are most useful in the process
industries when they are conducted with the objective of determining root causes.
Such causes typically reside at the level of management system deficiencies and
are often related to shortcomings in hazard identification and risk assessment
protocols. Explicit incorporation of the principles of ISP can play an important
role in the efficacy of an incident investigation protocol.
Lessons learned from incident investigations—both general and those spe -
cific to ISP—can also have a beneficial impact on PSM overall. Such lessons can
be used to make systemic improvements involving all categories in the hierarchy
of controls and to help identify previously unforeseen hazards in a given process
OCR for page 151
151
POST-INCIDENT RETROSPECTIVE PROCESS ASSESSMENT
or industry sector. Because incident investigation acts within a management
system based on continuous improvement, it is to be expected that investigation
results will provide valuable input to the methodologies being used to predict
hazards and prevent their occurrence.
REFERENCES
Amyotte, P. R., A. U. Goraya, D. C. Hendershot, and F. I. Khan. 2007. Incorporation of inherent safety
principles in process safety management. Process Saf. Prog. 26(4):333-346.
Amyotte, P. R., D. K. MacDonald, and F. I. Khan. 2011. An analysis of CSB investigation reports
for inherent safety learnings. Paper No. 44a in Proceedings of 13th Process Plant Safety Sym-
posium, 2011 Spring Meeting & 7th Global Congress on Process Safety, March 13-16, 2011,
Chicago, IL. New York: American Institute of Chemical Engineers.
Balasubramanian, S. G., and J. F. Louvar. 2002. Study of major accidents and lessons learned. Process
Saf. Prog. 21(3):237-244.
Blank, H., J. Musch, and R. F. Pohl. 2007. Hindsight bias: On being wise after the event. Soc. Cogni-
tion 25(1):1-9.
CCPS (Center for Chemical Process Safety). 1989. Guidelines for Technical Management of Chemical
Process Safety. New York: American Institute of Chemical Engineers.
CCPS. 2003. Guidelines for Investigating Chemical Process Incidents. 2nd Ed. New York: American
Institute of Chemical Engineers.
CCPS. 2007. Guidelines for Risk Based Process Safety. Hoboken, NJ: John Wiley & Sons.
CCPS. 2009. Inherently Safer Chemical Processes: A Life Cycle Approach. 2nd Ed. Hoboken, NJ:
John Wiley & Sons.
CSB (Chemical Safety Board). 2007. Investigation Report: Refinery Explosion and Fire—BP, Texas
City, TX. Report No. 2005-04-I-TX. Washington, DC: CSB [online]. Available: http://www.csb.
gov/assets/document/CSBFinalReportBP.pdf. Accessed: Sept. 28, 2011.
CSB. 2008. Investigation Report: LPG Fire at Valero-McKee Refinery—Valero Energy Corporation,
Sunray, TX. Report No. 2007-05-I-TX. Washington, DC: CSB [online]. Available: http://www.
csb.gov/assets/document/CSBFinalReportValeroSunray.pdf. Accessed: Sept. 28, 2011.
CSB. 2010a. Investigation Report: Xcel Energy Hydroelectric Plant Penstock Fire—Cabin Creek,
Georgetown, CO. Report No. 2008-01-I-CO. Washington, DC: CSB [online]. Available: http://
www.csb.gov/assets/document/Xcel_Energy_Report_Final.pdf. Accessed: Sept. 28, 2011.
CSB. 2010b. Urgent Recommendations from ConAgra Investigation. Washington, DC: CSB [online].
Available: http://www.csb.gov/assets/document/CSB_Gas_Purging_Urgent_Recommendations.
(2).pdf. Accessed Sept. 28, 2011.
CSB. 2010c. Urgent Recommendations from Kleen Energy Investigation Washington, DC: CSB
[online]. Available: http://www.csb.gov/assets/document/KleenUrgentRec.pdf. Accessed: Sept.
28, 2011.
CSChE (Canadian Society for Chemical Engineering). 2002. Process Safety Management, 3rd Ed.
Ottawa, ON: CSChE.
Department of Labor. 2000. Process Safety Management. OSHA 3132. Washington, DC: OSHA
Publications Office.
Fischhoff, B. 1975. Hindsight ≠ foresight: The effect of outcome knowledge on judgment under
uncertainty. J. Exp. Psychol. Human 1(3):288-299.
Goraya, A., P. R. Amyotte, and F. I. Khan. 2004. An inherent safety-based incident investigation
methodology. Process Saf. Prog. 23(3):197-205.
Hendershot, D. C. 2006. Inherently Safer Design. SAChE (Safety and Chemical Engineering Educa-
tion) [online]. Available: http://sache.org/index.asp. Accessed: Sept. 28, 2011.
OCR for page 152
152 USE AND STORAGE OF METHYL ISOCYANATE (MIC) AT BAYER CROPSCIENCE
Hendershot, D. C., and J. Murphy. 2008. Inherently Safer Design Conflicts and Decisions. SAChE
(Safety and Chemical Engineering Education) [online]. Available: http://sache.org/index.asp.
Accessed Sept. 28, 2011.
Hopkins, A, ed. 2009. Learning from High Reliability Organisations. Sydney, Australia: CCH Aus-
tralia Limited.
IChemE (Institution of Chemical Engineers). 2005. Inherently Safer Process Design, Training Re-
source STP001. Rugby, UK: IChemE.
Kaszniak, M. 2010. Oversights and omissions in process hazard analyses: Lessons learned from CSB
investigations. Process Saf. Prog. 29(3):264–269.
Khan, A. A. 2006. Case histories and recent developments to improve safety assessments during
process development. Process Saf. Prog. 25(3):245-249.
Khan, F. I., and P. R. Amyotte. 2003. How to make inherent safety practice a reality. Can. J. Chem.
Eng. 81(1):2-16.
Kidam, K., M. Hurme, and M. H. Hassim. 2010. Inherent safety based corrective actions in accident
prevention. Pp. 447-450 in Proceedings of 13th International Symposium on Loss Prevention
and Safety Promotion in the Process Industries, June 6-9, 2010, Bruges, Belgium, Vol. 2. Rugby,
UK: Institution of Chemical Engineers.
Klar, Y., and S. Ayal. 2004. Event frequency and comparative optimism: Another look at the indirect
elicitation method of self-others risk. J. Exp. Soc. Psychol. 40(6):805-814.
Kletz, T., and P. R. Amyotte. 2010. Process Plants: A Handbook for Inherently Safer Design. Boca
Raton, FL: CRC Press.
Leggett, D., and J. Singh. 2000. Process improvements from incident data. Process Saf. Prog.
19(1):13-18.
Louie, T. A., M. N. Rajan, and R. E. Sibley. 2007. Tackling the Monday-morning quarterback: Ap -
plications of hindsight bias in decision-making settings. Soc. Cognition 25(1):32-47.
Mahnken, G. E. 2001. Use case histories to energize your HAZOP. Chem. Eng. Prog. 97(Mar.):73-78.
OSHA (Occupational Safety and Health Administration). 2000. Process Safety Management. OSHA
3132. U.S. Department of Labor, Occupational Safety and Health Administration, Washington,
DC [online]. Available: http://www.osha.gov/Publications/osha3132.html. Accessed: Feb. 14,
2012.
Sutton, I. S. 2008. Use root cause analysis to understand and improve process safety culture. Process
Saf. Prog. 27(4):274-279.
Weinstein, N.D. 1989. Optimistic biases about personal risks. Science 246(4935):1232-1233.
Yang, X., L. Dinh, D. Castellanos, C. Osorio, D. Ng, and M.S. Mannan. 2009. Common lessons
learned from an analysis of multiple case histories. Pp. 43-50 in Hazards XXI: Process Safety
and Environmental Protection in Changing World, November 10-12, 2009, Manchester, UK.
IChemE Symposium Series No. 155. Rugby, UK: Institution of Chemical Engineers.
