Bio
The following extract is taken from the IChemE Blog “The wisdom of Trevor Kletz – the ‘founding father’ of inherent safety (Day 353)“
The name, Trevor Kletz, needs little introduction to anyone who has been involved with chemical process safety over the past forty years. Trevor died in 2013 at the age of ninety.
He is greatly missed but his impact on the chemical engineering profession was enormous and his name is rarely uttered along without the words ‘hero’ or ‘guru’ as the same breath.
Trevor spent his entire career at ICI (Imperial Chemical Industries), and by the time of his retirement in 1982 he had created a safety culture within the company with a major positive impact on accident statistics.
This success was attributed to his powerful intellect on one hand, but also to his exceptional communication skills. Trevor’s ability to reduce complicated issues to simple fundamentals was the stuff of legend.
He is also remembered in The Chemical Engineer article “Trevor Kletz – A lifetime spent saving lives” and an obituary in The Guardian.
Wit & Wisdom
Publications
Thoughts
Trevor contributed to the MKOPSC via Trevors’ Corner…
Samuel Coleridge described history as a ‘lantern on the stern’, illuminating the hazards the ship has passed through rather than those that lie ahead. It is better to illuminate the hazards we have passed through than not illuminate them at all, as we may pass the same way again, but we should try to see them before we meet them
The following detailed quotations are extracted from the ICI Newsletters.
In dealing with the question, Need the disaster have happened? it is, of course, necessary to consider the events which preceded it and the extent of the information (recorded in writing or forming part of the fund of common knowledge) avoidable to all who were concerned …
The stark truth is that the tragedy … , flowed from the fact that, notwithstanding the lessons of the recent past, not for one fleeting moment did many otherwise conscientious and able men turn their minds to the problem … These men were not thinking or working in a vacuum. All that was required of them was a sober and intelligent consideration of the established facts.
The incidents preceding the disaster … should have served … to bring home vividly to all having any interest in the subject … ; that it was accordingly necessary to formulate and maintain a system aimed at preventing such a happening; and for that purpose to issue instructions, disseminate information, train personnel, inspect frequently and report regularly. These events were so spread out over the years that there was ample time for their significance to be reflected upon and realised and so to lead to effective action. But the bitter truth is that they were allowed to pass unheeded into the limbo of forgotten things.
Why was there this general neglect? Human nature being what it is, we think the answer to this question lies in the fact that … there is no previous case of loss of life due to incidents of this nature.
There were 30 minor accidents in April in one of the Division’s Works. Over half were recorded by the supervisor as caused by “human failing”. It is an easy way out for the supervisor or manager as then he has to do nothing except tell the man to be more careful.
These accidents were discussed individually with the supervisors and in all but two cases they agreed that there was something they could do to prevent the accident happening again.
If you don’t believe that over 90% of all accidents can be prevented by better management let me know and we can discuss a few examples.
I have often commented on our readiness to write down “human failing” as the cause of fires and accidents. Over half our accidents are given this cause, though there is nearly always something that managers or supervisors could do to make a repetition less likely. If we say that an accident can be prevented by better design, better training, better methods of working, better systems of inspection and so on then we are led on to do something to prevent it happening again, But if we say that an accident is due to “human failing”, then there is nothing we can do to prevent it occurring again, except telling someone to take more care.
A similar point is made in a recent Penguin Book, “Disaster”, by Sheila Tidmarsh. She points out how politicians and newspapers, when commenting on floods, earthquakes, famines and similar disasters, use phrases such as “cruel fate”, thus implying inevitability and discouraging constructive thinking on ways of preventing them or minimising their consequences.
A mathematician was recently asked to calculate the chance of a collision between two ships in the narrow strait of water that separates Denmark from Sweden. He showed that if the traffic doubles the chance of a collision increases eight times and becomes significant. A meeting to discuss his report was held at Elsinor (the scene of Hamlet) overlooking the strait. The mariners present poured scorn on the report. The rules of the sea, they said, and the skill of the mariners would prevent collisions ever happening. While the meeting was in progress a collision actually occurred outside, seen and heard from the meeting room. The author commented that “…. men often wait for the inevitable tragedy, before deciding that it may possibly occur”.
Most of our fires and explosions, like the collision of the two ships, are not accidents in the sense that they are unexpected and unforeseen events; they are events that we know will occur; the only thing uncertain is the time and place.
Regular readers of these Newsletters will be able to forecast that somewhere during the coming year:
- A maintenance worker will break into the wrong pipeline,
- An explosion will occur because the inert gas supply to a piece of equipment, such as a stack or tank, is inadequate and the atmosphere has not been tested,
- An accident will occur because a piece of equipment given to Maintenance was isolated only by closed valves without locking or slip-plating.
And so on.
To try to convince people that these events are inevitable unless we take certain actions I have tried to do the next best thing to waiting for them to occur, that is, to show people pictures of a previous occurrence, let them discuss what happened and decide for themselves what ought to be done to prevent it happening again.
Conversations with supervisors have shown that the purpose of an accident or incident investigation is not understood. The view was expressed that such investigations are mainly designed to apportion blame and that the person who reports an incident, instead of keeping quiet, is a ‘double-fool’, once for having the incident and once for reporting it.
Personnel who hold such views clearly do not understand the prime reasons for incident investigations, which are:-
(a) The investigation will uncover the underlying cause of the incident and make suitable recommendations for its removal.
(b) By publishing the incident and subsequent recommendations, an educational role is served in the hope that similar incidents will be prevented elsewhere.
Every Works maintains a register of relief valves. It shows the size of each valve, its duty, how often it should be tested, and so on. The registers should include certain special sorts of relief valves, and items which restrict flows and thus affect the size of relief valve required.
Are the following included on your register?
1. The simplest relief valve of all a hole or an open vent pipe The size should be registered. Regular checks should be made to make sure the hole is clear and that its size has not been altered. On some plants an annual check may be sufficient. On other plants, where vent pipes are liable to choke, a daily or shiftly check may be necessary.
2. A vent pipe fitted with a flame trap – The flame trap should be inspected regularly to make sure it is clear. Tanks have been sucked in because the flame traps have not been kept clean.
3. A restriction plate controlling the flow into a vessel or the input of energy to a vessel. If this restriction is taken into account in sizing the relief valve on the vessel, it should be registered and checked regularly. Do not use a slip-plate with a hole drilled in it – it can be removed too easily. Use a length of narrow pipe or weld a restriction plate to a bobbin piece.
4. If a control valve limits the flow into a vessel or the energy input into a vessel and this has been taken into account in sizing the relief valve, then the size of the trim should be included in the relief valve register. Some Works put labels on these control valves. Labels tend to disappear, so in one works, the following is stamped on the instrument data books. “TRIM SIZE AFFECTS RELIEF VALVE SIZES. DO NOT ALTER WITHOUT INSTRUMENT MANAGER’S APPROVAL” – Of course, not all control valves have to be registered in this way. Very often, the size of the control valve by-pass determines the size of the relief valve.
5. Non-return valves used as part of a relief system should be included in the register and inspected at a prescribed interval. Because non-return valves are less reliable than relief valves, before they can be accepted as part of a relief system they have to be duplicated or, better, supplemented by an alternative device such as a reverse rotation lock. (The first fatal accident to occur at Billingham (April, 1924) was the result of a non-return valve failing and allowing gas at high pressure to pass backwards through a pump into a low pressure gas line.)
I am often asked if Petrochemicals Division spends more on safety than other petrochemical companies.
The answer, I think, is yes. We do spend a lot more money on safety features such as steam curtains, gas detectors, remote isolation valves, cable protection and fire-proofing. Most other petrochemical companies do not install all these features, or do not install them to the same extent.
This safety equipment costs us a lot of money, money which some of our competitors do not spend. We think it is money well spent, primarily because it reduces the chance that people will be hurt by a fire or explosion or other dangerous incident. In addition, fires and explosions cost money and in the long run, by reducing the chance that fires or explosions will occur, we get back the money we have spent on safety features.
Remote isolation valves and so on have to be paid for today. The saving is in the future. A shortsighted company, which looks only at this year’s profits, might not install them.
HOW CAN WE KEEP ALIVE THE MEMORY OF INCIDENTS THAT HAVE HAPPENED ON THE PLANT WHEN THE STAFF CHANGE EVERY FEW YEARS?
One method which has been used successfully on at least one plant in the Division is the plant black book. On this plant there is a folder containing reports of every serious incident and near miss that has occurred on the plant, together with reports of incidents in similar plants in other companies. This is compulsory reading for all managers and engineers when they first join the plant, and the old hands dip into it from time to time to refresh their memory.
Why not start a similar folder on your plant? It may look a little thin at first, but nevertheless it may help your successor. I can probably help you fill it.
IS THERE ANY WAY TO GET PEOPLE MORE INTERESTED IN THE PLANT SAFETY BOOK?
Most plants have a ‘safety book’ in which people write jobs that need doing. (Someone actually wrote in one book “Drain cover propped open with piece of wood” and the manager wrote “Noted” alongside!)
Instead of writing a list of faults, a better idea might be to write down every day something that has been done to improve safety.
HOW OFTEN WILL AN OPERATOR ACT CORRECTLY WHEN AN ALARM SOUNDS?
In Safety Newsletter 66/3 I described a method for calculating how often somebody will press the wrong button and I described an accident that had occurred as a result of the wrong button being pressed.
I have often been asked how often we can expect an operator to act correctly when an alarm sounds. Suppose that when an alarm sounds he has to go outside and operate a valve. How often will he operate the wrong valve or fail to operate any valve at all?
There are no definite data available, but my feeling is that on the sort of plants we operate we should not expect the operator to act correctly more than 99 times out of 100; that is, once in 100 times he will either operate the wrong valve or operate no valve at all.
In some cases the operator’s failure rate may be much higher. If he works in a busy control room with lots of alarms sounding, telephones ringing, people demanding clearances and so on, and in addition the layout of the valves is poor and action is required in a hurry, then he may fail to act correctly as often as one occasion in ten.
If these estimates are correct then we have got to take them into account in our designs. It is no use expecting people to do the right thing every time. We must expect an occasional mistake, sometimes it is 1 in 10 times, sometimes 1 in 100 times and sometimes 1 in 1000 times.
Do you think these estimates are too high or too low? If so, I shall be glad to hear from you. I shall be particularly glad to hear from operators and from people who have been operators.
ARE WE EXPECTED TO LEARN THE LESSONS OF ACCIDENTS WHICH HAVE OCCURRED SOMEWHERE ELSE?
Yes, legally and morally we are expected to learn the lessons of accidents that have occurred somewhere else, provided the information is readily available. This is expressed in the old saying, “Every dog is allowed one bite”. Until it has bitten somebody we could plead that we did not know it was liable to bite. As far as industry is concerned we are expected to muzzle our dog if a similar dog has bitten someone.
What is meant by “readily available”? Nobody would expect us to know about an accident described in the Journal of the Outer Mongolian Chemical Society— it does not circulate widely in this country and not many people can read the language it is written in. But information published in well-known British and American journals is certainly “readily available”. If an accident has been described in, shall we say, “Loss Prevention”, published by the American Institute of Chemical Engineers, or the “Loss Prevention Bulletin”, published by the Institution of Chemical Engineers then it is reasonable to expect us to know about it. So far as Petrochemicals Division is concerned I see it as one of my responsibilities to keep readers informed of incidents that have occurred in other companies, on which information is made available to us through publication or in other ways.
We try to do our duty and tell other Companies about incidents which have occurred in ICI, by sending them copies of these Newsletters and by contributing to the “Loss Prevention Bulletin” and other publications
HOW LONG SHOULD A MANAGER SPEND ON THE PLANT?
The explosion at Flixborough in June 1974 stresses the need for managers at all levels, including the most senior, to spend some time walking round the plant with open eyes, looking out for anything unusual or abnormal.
Managers are under great pressures, much office work has to be done, costs and personnel matters clamour for attention and a walk around the plant with no precise objective may get left out. However, a plant cannot be managed from an office and there is no substitute for walking round with open eyes. Bill Simpson, Chairman of the Health and Safety Commission calls it “Shoe-leather management”.
Walking round the site is, of course, not done just to improve the safety record; it has effects on output, efficiency and product quality.
How long should a manager spend on the plant?
It is difficult to lay down a guide, because some plants require more attention than others and there is room for a good deal of variation in management style. Ten years ago, as an assistant works manager, I used to tell new plant managers that if they were spending less than three hours per day on the plant, then they should ask themselves if this was enough. This, of course, includes time spent in the control room and talking to the supervisors.
What should managers look for when walking round the plant?
I suggest anything that looks unusual — what does not look right is usually not right — and anything that has changed since the last visit. Also look at a few things picked at random. Pick a maintenance job and check that the clearance certificate is correctly made out. Try a shower to see if it works. Look in an eyewash bottle cabinet. Above all, try to look where others do not, behind and underneath equipment.
DO YOU PUT FORWARD MINIMUM STANDARDS? CAN WE GO FURTHER THAN YOU SUGGEST SO LONG AS WE DO NOT DO LESS?
Many of my colleagues in other companies call the standards they put forward “minimum standards”. Individual works or design engineers can do more if they wish, but they may not do less.
I have never felt very happy about this arrangement. The resources available to spend on safety are large but they are not unlimited; there is only so much time and money and effort. If we spend too much on one plant or problem, there is less left for others. So I feel we should try to pick out the biggest hazards and deal with these first. If I see an individual putting too much effort into the removal of a small hazard, I try to persuade him not to do so.
Of course, most of my time is spent persuading people to do something which will make the plant safer. But quite often I say, “There is no need to do that; the hazard is slight. Let’s spend our time and effort on dealing with this bigger hazard first”.